a presentation delivered to the 1st National Conference of the

1. 1o Εκνικό Συνζδριο Επιςτθμονικισ Εταιρείασ
Χρθματοοικονομικισ Μθχανικισ και Τραπεηικισ (Ε.Ε.Χ.Μ.Τ.)
operational risk:
management Vs measurement
a practitioner’s view
03/12/2010
kdkarydias
Group OpRisk Officer
Eurobank EFG

2. introduction
operational risk is as old as the banking industry
itself
institutions had been reactive and responsive to
OpRisk as it arose rather than managing it in a
proactive manner
the confluence of the collapse of Barings and
the derivatives blow-ups in the mid-1990s was
one among several factors that led to Basel II
banks must compute an explicit capital charge for
operational risk
©2010 kdkarydias 2

3. the human factor
OpRisk is defined as the risk of loss resulting from
inadequate or failed:
internal processes designed, drafted, performed by
people
people are people
systems designed, implemented, operated by people
or from external events due to people or act of God
OpRisk is heavily related to people and to
human behaviour
©2010 kdkarydias 3

4. OpRisk characteristics
mainly endogenous
Unwanted by-product of the business activity
Not willingly incurred
Positively related to the complexity of the operations
permeates the entire enterprise, involving virtually
every employee, every business process and every
system
highly idiosyncratic
Tend to be less correlated to each other and to other risk
types
Less directly linked to business cycles
in principle (partially) controllable ex ante
©2010 kdkarydias 4

5. OpRisk characteristics cont’d
a trade off between risk and cost of avoidance
more qualitative rather than quantitative
potential OpRisk losses can be practically
unbounded
Observed losses are not related to bank size
Losses are not capped
Often significant time lags between cause and effect
Usually recognised “after the fact”
Loss severity distributions are fat-tailed
is sizeable compared to other risk types
©2010 kdkarydias 5

6. why measure OpRisk?
“What can’t be measured, can’t be managed…”
Joe Sabatini, Head of OpRisk, JP MorganChase & Co
to enable an effective risk mgt process
to measure progress
to quantify exposure in a forward looking manner
as a minimum you need “measures” with some
directional and relative reliability
is risk going up or down?
is risk higher here or there?
©2010 kdkarydias 6

7. objective of measuring OpRisk
provide an accurate view of the OpRisk profile of
the business over the next 12 months
what are the expected losses from OpRisk
what is the worst case loss from OpRisk
support the analysis of OpRisk
what are the top OpRisks
what is the worst case loss under stress conditions
how will changes to business strategy or control
environment affect the potential losses
how does the potential hit compare with other banks
©2010 kdkarydias 7

8. OpRisk capital (Basel II)
as per AMA, banks should put an OpRisk capital
aside in line with the 99.9% or even higher
confidence level over a one-year holding period
Basel II requires that a bank directly or indirectly
uses information from all four elements of
operational loss data, namely:
internal loss data
external loss data
scenario/workshop data
business environment & internal controls data
©2010 kdkarydias 8

9. measurement
quantification can be a powerful tool for
enhancing transparency, as long as it is credible.
financial industry managers and regulators have an
increasing interest in quantifying OpRisk
numerous conferences convened on quantifying
OpRisk and involving the top specialists - little
substantive has emerged
critiques, however, have been raised about the
limitations and less desirable consequences of
blind quantification
©2010 kdkarydias 9

10. critiques
“As far as the laws of mathematics refer to reality,
they are not certain; and as far as they are certain,
they do not refer to reality”
Albert Einstein, German Physicist, 1922
“But there are also unknown unknowns; there are
things we don't know we don't know”
Donald Rumsfeld, American Politician, 2002
“… a message to banks that have placed too much
emphasis on modeling operational risk to the
detriment of operational risk management”
House of Lords, Banking Supervision & Regulation Report, 2009
©2010 kdkarydias 10

11. modelling for OpRisk
 many banks have focussed on meeting the capital
modelling requirements of Basel II and have lost
sight of the need to manage the business
most of the models currently in use to
quantify OpRisk are based on historical
loss data
considering the constant change of
technology and organizational
structures these data prove not
sufficient to quantify the OpRisk of
today
©2010 kdkarydias 11

12. using historical loss data
 sparse existing data
 employment of third-party loss data is impractical and partly
impossible
 past loss data may no longer reflect current state and structure
of risks
 risk prevention strategy “interferes” with loss history
 due to non-transparent risk drivers, VaR (Value at Risk) levels are
of little informational value to management (too aggregated,
too abstract)
 current structure / non-materialised risks can only be integrated
by direct estimation of a new loss distribution, which is complex
and difficult to reason
 present knowledge about risk correlation cannot be formalised
©2010 kdkarydias 12

13. limitations of models
 a model is always a strong reduction/ approximation of a more
complex reality
 models are as good as the underlying assumptions: "garbage in–
garbage out effect"
 not all risks are relevant and/or quantifiable: also here, use
20/80 approach
 new external parameters and continuous restructurings can
make models questionable, as there is no reliable base material
 comparisons of absolute model figures with those of third
parties are questionable: The prime internal value added of a
good model – including the stress test – is its trend over time
 theoretical rigidity may not prevail over practical relevance and
credibility
 models are always only part of an overall risk management
approach and must include common sense
©2010 kdkarydias 13

14. goal of OpRisk management ...
... is to reduce the frequency and severity of large, rare events
Minor Events
Generally not bank threatening
Experience makes easy to
High understand problems, measure Not relevant
frequency issues, take action [already out of business]
“cost of doing business”
Generates efficiency savings than
reduce material risks
Major Events
Can put banks out of business or
Low
Does not really matter harm reputation
frequency
Difficult to understand & prioritise
in advance
Small losses Large losses
©2010 kdkarydias 14

15. OpRisk management
 OpRisk has, until now, baffled experts due
its lack of meaningful mathematical models
 complex data requirements
 the broad range of areas in which it occurs
 most serious OpRisk losses can not be judged as
mere accidents
 the only way to gain control over operational risk
is to improve the quality of control over the
possible sources of huge operational losses
©2010 kdkarydias 15

16. epilogue
“We need to overcome the tendency to believe
that a single number can summarise a
distribution of possibilities ... We need to be
creative in managing the unexpected”
John Trundle
“We believe that quantification should not be
exaggerated. Equally important is the need for
creativity in operational risk management”
Stefan Look
The PRiM Risk Newsletter, issue No 23, 10/2010
©2010 kdkarydias 16

17. The views expressed in this presentation have
not been subjected to peer review, and should be
interpreted accordingly
We thank our colleagues and partners for the
many fruitful interactions that have contributed
to this work
The views expressed in this presentation do not
necessarily reflect the views of Eurobank EFG
©2010 kdkarydias 17