1

TK 6413 / TK 5413

ISLAMIC RISKMANAGEMENT

TOPIC 5 :

THE MEASUREMENT OF OPERATIONAL RISK

2

(1) INTRODUCTION

Operational risk is defined in BASEL II as “ the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events …. (including) legal risk……. But (excluding) strategic and reputational risk” .

Cases of operational failures in the financial services industry during the 1990s brought operational risk to attention as an important area of regulation. The operational failures manifested themselves in different activities of these institutions, including failure in risk oversight by senior management, and poor accounting and auditing processes.

The followings are some of the reported losses due to operational risk:

3

Year Description of Loss

1991 BCCI : Reported loss of USD 10 Billion. Wide range of illegal activities that included fraudulent loans, fictitious deposits.

1995 Barings: Concealed huge (USD 1.4 Billion) losses on options and future trading.

1996 Sumitomo Copper Scandal : Concealed huge losses (USD 2.6 Billion) losses on forwards and futures trading.Daiwa Securities : Concealed USD 1.4 Billion losses on bond trading

1997 Nat West Capital Markets : £90 Million losses concealed on mispricing swaps.

2001 World Trade Center attack : The largest ever single operational loss with estimates of total losses to the insurance industry up to USD 70 Billion.

2001 Lehman Brothers, London : A dealer traded £300 Million lot instead of an intended £ 3 Million.

Allied Irish Bank reported a fraud that had gone on undetected since 1997 had cost the bank USD 691 Million.

4

Policies/Transactions

The different sources of operational risks and where they affect Islamic Financial contracts :

Operational Risk

People Systems & Technology

Process & Delivery failures

Internal & External Events

Ijarah

Murabaha

MusharakahIstisna

Salam Shariah Law

Musharakah

Mudrabah

Istisna

Musharakah

Mudarabah

Ijarah

5

Categorization of Operational risks :

The Basel Committee on Bank Supervision has identified seven categories of operational risk :

i. Internal fraud;ii. External fraud;iii. Employment practices and workplace safety;iv. Clients, products and business practices;v. Damage to physical assets;vi. Business disruption and system failure;vii. Execution, delivery and process management

Banks must assess their exposure to each type of risk for each of the eight business lines namely:

6

Business Line Beta Factor

Corporate finance 18%Trading and Sales 18%Retail Banking 12%Commercial Banking 15%Payment and Settlement 18%Agency Services 15%Asset Management 12%Retail Brokerage 12%

Ideally this will lead to a result where VaR is estimated for each of 7 x 8 = 56risk type / business-line combinations.

(II) VaR for Operational Risk

Operational risk is notoriously difficult to measure. But, in principle at least, the classic distribution approach to measure risk as seen below can be deployed

Cont’d…

7Graph 1.0

Like

hood

of L

oss

Severity of Loss

Expected Unexpected

Severe Catastrophic

1st Percentile

Cont’d…

8

From the graph 1.0

i. Severe but not catastrophic losses : Unexpected severe operational failuresshould be covered by an appropriate allocation of operational risk capital.whose losses are covered by measurement processes described later.

ii. Catastrophic losses : These are the most extreme but also the rarestoperational risk events – the kind that can destroy the financial institutionor bank entirely. VaR and RAROC models are not meant to capture catastrophicrisk, since they consider potential losses only up to a certain confidence level(say 1%), and catastrophic risks are by their very nature extremely rare. Banksfor instance, may tighten procedures to protect themselves against catastrophicevents, or use insurance to hedge catastrophic risk. But the risk capital cannotprotect a bank/financial institution against these risks.

9

Capital requirement (Op Va R) = Σ EI

N

i = 1 ί * βί

Where, EI = Exposure Indicator β = Beta factor of the 8 business line set according by the Basel Committee

The loss distribution approach is analogous to the VaR techniques developed to measure market risk in banking, and therefore we will call it operational value-at-risk(OpVaR). Our aim is to determine the expected loss from operational failures, the worse case loss at a desired confidence level, the required economic capital for operational risk, And the concentration of operational risk.

The firms’ activities should be divided into lines of business (LOB), with each businessbeing assigned an exposure indicator (EI). The primary foundation for this analysisis the historical experience of operation losses. Where no loss data, inputs have to to be based on judgment and scenario analysis.

10

For example, a measure of EI for legal liability related to client exposure could be the number of clients multiplied by the average balance per client. The associated probability of an operational risk event (PE) would then be equal to the number oflawsuits divided by the number of clients. The loss given an event (LGE) would equalaverage loss divided by the average balance per client.

A measure of EI for employee liability could be the number of employees multiplied by the average compensation. The PE of the employee liability would then be thenumber of lawsuits divided by the number of employees, and the LGE would be theaverage loss divided by the average employee compensation.

A measure of EI for regulatory, compliance and taxation penalties could be the numberof accounts multiplied by the balance per account. The PE would then be the number of penalties (including cost to comply) divided by the number of accounts, and the LGEwould be the average balance per account.

11

A measure of EI loss of or damage to assets could be the number of physical assets multiplied by their average value. The associated PE would be the number of damageincidents divided by the number of physical assets; the LGE would be the averageloss divided by the average value of physical assets.

The measure of EI for client restitution could be the number of accounts multipliedby the average balance per account. The PE would then be the number of restitutionsdivided by the number of accounts, and the LGE would be the average restitutiondivided by the average balance per account.

A measure of EI for theft, fraud and unauthorized activities could be the numberof accounts multiplied by the balance per account (of the number of transactions multiplied by the average value per transaction). The corresponding measure forPE would be the number of frauds divided by the number of transactions. The respective LGEs would be the average loss divided by the average balance per account or the average loss divided by the average value per transaction.

12

A measure of EI for transaction-processing risk could be the number of transactionsmultiplied by the average value per transaction. The PE would then be the numberof errors divided by the number of transactions. The LGE would be the average loss divided by the average value per transaction.

13

Exposure Base (EI)

Internal Loss History

Industry Loss History

Scenario Analysis

Key Risk Drivers (KRD)

From Tools for Risk Analysis to OpVaR

Calculation of Actual PEs & LGEs

Calculation ofActual PEs & LGs Reporting

Calculation ofActual PEs & LGs

Actual Loss Rates

Projected Loss Rates OP VaR

RAROC

OPVaR Report

Stress Scenerio

14

(III) THE ROLE OF KEY RISK DRIVERS

The OpVaR number for a line of business or bank activity can be provide animportant indication of that business line or activity’s riskiness. But becausequantifying operational risk is still in its infancy, and therefore is a very inexact science, most banks make use of the number of techniques to try to understand their level of exposure.

In any bank activity, they are likely to be the number of identifiable factors thattend to drive operational risk exposure and that are also relatively easy to track. For example, in the case of system risk, these key risk drivers (KRDs) might include the age of computer systems, the percentage of downtime as a result of system Failure. Ideally, KRDs would be entirely objective measures of some risk-related factor in a bank activity.

Although KRDs are not a direct measure of operational risk, they are a kind ofproxy for it. KRDs can be used to monitor changes in operational risk for eachbusiness and for each loss type, providing red flags that alert management of a rise In the likelihood of an operational risk event. Unwelcome changes in KRDs can be used to prompt remedial management action.

15

KRDs are an important management information tool in themselves. Butonce they have been established, the bank is likely to want to map changes in a driver to the corresponding changes in OpVaR so that the KRD and OpVaRapproaches offer consistent feedback to the bank’s business line.

(IV) LOSS SEVERITY AND LOSS FREQUENCY

There are two distributions that are important in estimating potentialOperational risk losses. One is the loss frequency distribution and the otherIs the severity distribution. The loss frequency distribution is the distribution of The number of losses observed during the time horizon (usually a year). TheLoss severity distribution is the distribution of the size of the loss given that a loss Occurs. It is usually assumed that loss severity and loss frequency are independent.

For loss frequency, the natural probability distribution to use is a PoissonDistribution where,

Probability of losses in time T is e - λ T(λ T)П !

п

16

For the loss severity probability distribution, a lognormal probability distributionis often used.

The loss frequency distribution must be combined to the loss severity distributionfor each loss type and business line to determine a total loss distribution. MonteCarlo simulation can be used for this purpose.