6. What is
Risk Management?
¡ A structured approach to manage uncertainty
¡ Management strategies:
Risk Avoidance Risk Transfer Risk Mitigation
7. Risk Management - Defense
Insurance Approach
Reward
Do Nothing
Probability of Success
8. Risk Management - Offense
Opportunistic Approach
Reward
Carpe Diem
Do Nothing
Probability of Success
9. What is ERM?
¡ Risk-based approach to managing an enterprise
¡ Risk-aware: every major tangible and intangible
factor contributing toward failure in every process at
every level of the enterprise
¡ Enterprise value maximized with optimal balance
between profitability/growth and related risks
¡ Management better prepared to seize opportunities
for growth and value creation
10. ERM
Components
Identify
Quantify
Respond
Monitor & Report
Effectiveness
Monitor
Comprehensive
Approach To
Managing
Uncertainty
Identify/Assess Internal
and External Risks
Risk Scoring
& Modeling
Respond and Control
11. ERM
Goals
¡ Provide holistic view across an organization
leveraging firm experience and knowledge
¡ Provide greater transparency to factors that can
impair value preservation and business profitability
¡ Understand & test assumptions & interpretations in
business decision-making
15. ERM
Framework
Enterprise Structure, Risks Objectives & Components
Compliance
Financial
Compliance
Reporting
Hazard
Strategic
Entity Wide
Division
Business Unit
Comprehensive
Approach
Leverage Data &
Analytic Resources
Predictive Modeling
16. Common
Challenges
¡ Data warehousing & sharing across entity
¡ Prioritization methodology
¡ Consolidated reporting
¡ Timeliness
¡ Data security
¡ The risk management process itself!
17. Role of
Data Science
¡ Data science methods provide:
¡ Enterprise Data Management
¡ Comprehensive warehousing
¡ Data quality and abundance
¡ Risk Analytics
¡ Predictive Modeling
¡ Loss Distributions
¡ Reporting
¡ Real-time visualization, dashboards
¡ Regulatory requirements
Reporting
19. Data Management
¡ Comprehensive data warehouse
¡ Coherent data collection (maybe)
¡ Facilitate data sharing across entity
¡ No useful analytics without abundant, high quality data
Data Big Data
Excel BigTable
PostgreSQL Cassandra, HIVE, HBase
MongoDB Vertica, KDB
20. Risk
Analytics
¡ Benefits beyond Business Intelligence
Descriptive
Analytics
Predictive
Analytics
Prescriptive
Analytics
What happened? What’s likely to occur? Why would it occur?
Hindsight Foresight Insight
Summary Statistics Data mining Heuristic Optimization
web analytics, BI,
credit scoring, trend
operations planning,
inventory reporting
analysis, sentiment
stochastic methods
¡ Newest: cognitive analytics = What is the best answer?
21. Rich Set of Visualization &
Reporting Tools
Aggregate Risk
Dashboards
Continuous &
Comprehensive
Risk Monitors
Source: IBM Cognos
24. Definition of
Risk
¡ Risk = Frequency of Loss x Severity of Loss
¡ Loss Distribution
Unexpected Loss
25. Traditional ERM
¡ Analytic Methods
¡ Closed-form solutions (…just like most things in life)
¡ Historical
¡ Estimate risk using internal and external loss data
¡ Monte Carlo
¡ Estimate distribution parameters from real data
¡ Monte-Carlo sample distribution
¡ Calculate ensemble measures to estimate overall risk
¡ Simple to implement, aggregate across entity, but make
complex assumptions, not robust to outliers
26. Modern ERM
¡ Data analytics driven
¡ Inference based methods
¡ KRI scoring
¡ Parallelization
¡ Natural applications
¡ credit risk scoring
¡ Anti-money laundering
¡ Fraud
28. Outliers, Inliers,
and Just Plain Liars
¡ Prediction problems fall in two classes:
Inliers Outliers
Inherently different problems with different quirks
29. Main Problems with
Inlier Prediction
¡ Parametric model choice
¡ Estimation error for lower moments (mean, s.d.)
¡ Incorrectly conjugating priors
¡ Normal/Gaussian distributions don’t really occur in
real life
¡ I.I.D.? Really?
30. Main Problem with
Outlier Prediction
¡ Data Quality and Abundance
¡ To estimate low probability events, big data may not be big
enough
Data: 150 years of daily data
Predictor: 100 year flood severity
Relevant Data: 1 or 2 data points
31. Value-at-Risk (VaR)
¡ Loss severity measure for a given probability and time
horizon
• Estimate potential losses (or
historical losses)
• Rank losses based on severity
• 95% Value-at-Risk is equal to
the 95th percentile loss
• Interpretation = Losses won’t
exceed 65.2m 95% of time
• Underestimates losses during
the other 5% of time
Rank
Loss
1
-‐0.1
2
-‐0.1
3
-‐0.3
4
-‐0.6
5
-‐0.7
6
-‐0.9
7
-‐1.1
…
…
91
-‐59.5
92
-‐63.2
93
-‐64.9
94
-‐65.0
95
-‐65.2
96
-‐66.5
97
-‐67.8
98
-‐93.9
99
-‐110.0
100
-‐273.1
VaR
32. Value-at-Risk
¡ Loss severity measure for a given probability and time
horizon
1-day 95% VaR of $1m
Expect to lose no more than
$1m in 95 out of every 100 days
Says nothing about the other 5
days out of 100. Not very
reassuring, is it?
33. Tail Value-at-Risk (TVaR)
¡ Loss severity measure for a given probability and time
horizon
• Estimate potential losses (or
historical losses)
• Rank losses based on severity
• 95% Tail Value-at-Risk is equal
to average of all losses
beyond 95th percentile loss
• Expect to lose on average
$122m if losses exceed the
95th percentile
Rank
Loss
1
-‐0.1
2
-‐0.1
3
-‐0.3
4
-‐0.6
5
-‐0.7
6
-‐0.9
7
-‐1.1
…
…
91
-‐59.5
92
-‐63.2
93
-‐64.9
94
-‐65.0
95
-‐65.2
96
-‐66.5
97
-‐67.8
98
-‐93.9
99
-‐110.0
100
-‐273.1
TVaR
34. Tail Value-at-Risk (TVaR)
¡ Loss severity measure for a given probability and time
horizon
1-day 95% TVaR of $122m
Better Measure of Risk
Also known as Expected
Shortfall, CVaR
35. Application: Operational
Risk Management
¡ Definition: The risk of direct and indirect loss resulting
from inadequate or failed:
¡ Internal processes
¡ People
¡ IT systems
¡ External events
Source: NYFed
Operational
Risk
External Criminal
Activity
Information
security failure
Internal
Criminal
Unauthorized Activity
Activity
Processing
Failure
System Failure
Control Failure
Business
Disruption
Workplace Safety
Malpractice
36. Managing OpRisk
¡ One Approach
Source: NYFed
Assess Scorecard
Internal
Loss Data
Identify
Weakness
Risk
Scenarios
Risk Model
OpVar
Risk
Capital
37. Methods
¡ Scorecard
3
5
9
¡ KRI scoring models
2
3
5
¡ Useful where no severity data exists
1
2
3
Loss Distribution
Impact
¡ ¡ Estimation of severity distribution parameters
¡ MLE Not robust – data not i.i.d., biased upwards, subject to
Probability
data paucity & sparsity
¡ Leads to biased loss exposures and correlation assumptions
¡ Huge opportunity for inference-based analytics
41. Promise of Data Analytics
¡ EDW remains a huge issue for most corporations
¡ Legacy zombie systems
¡ IT reporting lines
¡ Increased understanding by senior managers and
C-suite
¡ Analytics as a Service: growing competition within
consulting industry
¡ Talent Gap – same for anything Data Science