www.cmis.csiro.au
ModellingModelling Operational RiskOperational Risk
CSIRO Division of Mathematical and Information Sciences, SydneyCSIRO Division of Mathematical and Information Sciences, SydneyQuantitative Risk Management groupQuantitative Risk Management group
Sydney, AustraliaSydney, AustraliaEE--mail: mail: [email protected]@csiro.au
18 October 200618 October 2006
Pavel ShevchenkoPavel Shevchenko
www.cmis.csiro.au
� Basel II recognises the importance of the potential impact of losses due to Operational Risk and requires that banks hold adequate capital to protect against these losses.
� In Australia, the national regulator (APRA) is now applying the same detailed scrutiny to Operational Risk as previously to credit risk and market risk.
� The BCBS (Basel Committee on Banking Supervision) defined Operational Risk as:
the risk of loss resulting from inadequate or failed internal processes, peopleand systems, or from external events includes legal, excludes strategic and reputationalrisks
www.cmis.csiro.au
Under the Basel II framework, banks canestimate operational risk using one of three approaches:
� The Basic Indicator Approach (15% of Gross income averaged over three year)
� The Standardised Approach(12-18% on the business line level)
� The Advanced Measurement Approaches (AMA)Internal model for 56 risk cells (7 event types x 8 business line)
www.cmis.csiro.au
BCBS has identified the following 7 risk event types:� Internal fraud: e.g. intentional misreporting, employee theft, insider trading
� External fraud: e.g. robbery, cheque forgery, damage from computer hacking
� Employment practices and workplace safety:e.g. workers’compensation claims, violation of employee OH&S rules, union activities, discrimination claims
� Clients, products and business practices:e.g. misuse of confidential customer information, improper trading activities, money laundering, sale of unauthorisedproducts.
� Damage to physical assets:e.g. terrorism, vandalism, earthquakes, fires, floods.
� Business disruption and system failures:e.g. hardware and software failures, telecommunication problems, utility outages, computer viruses.
� Execution, delivery and process management:e.g. data entry errors, management failures, incomplete legal documentation, unapproved access to client accounts
� Corporate finance(18%)� Payment&Settlement(18%)� Trading&Sales(18%)� Agency Services(15%)
� Retail banking(12%)� Asset management(12%)� Commercial banking(15%)� Retail brokerage(12%)
8 Business Lines
www.cmis.csiro.au
Business line
Event type
Bank, top level
www.cmis.csiro.au
Internal Loss Data
(scaling, bias)
External Loss Data
(scaling, bias)
Expert Opinions
(business judgments on
#losses and $ranges)
Risk Frequency and Severity distributions
Total annual loss distribution (over all risks)
Annual Capital Charge (Expected and Unexpected losses)
Capital Allocation, what if scenarios
Control/Risk IndicatorInsurance Dependence Factors
Risk annual loss distributions
Advanced Measurement Approach: bottom-up Loss Distribution Approach
Monte Carlo simulations
www.cmis.csiro.au
Annual Capital Chargeunexpected loss=VaR0.999-Expected Loss; Pr [Loss≤VaR0.999]=0.999
loss distribution
0
0.01
0.02
0.03
0.04
0$ loss
Expected Loss
Unexpected Loss
www.cmis.csiro.au
Challenges/Tools
� Definition, identification, measurement, monitoring, indicators/controls
� Data Truncation: known threshold, stochastic threshold, unknown threshold
� Limited Data: mixing internal, external data and expert opinions via credibility theory, Bayesian techniques
� Data sufficiency: capital charge accuracy� Correlation between risks and its estimation: copula, common
shock processes� Control indicators: regression/factorial analysis� OR insurance: point processes� Non-Gaussian distributions, Fat tails: EVT, mixed distributions,
splices� VaR pitfalls: coherent risk measures, expected shortfall� Capital allocation
www.cmis.csiro.au
severity distribution, pdf
0
0.1
0.2
0.3
0.4
0 3 6 9 X
frequency distribution
0
0.03
0.06
0.09
0.12
0.15
0 5 10 15 20 N
aggregate distribution, pdf
0
0.01
0.02
0.03
0.04
0 30 60 Z
Xeventtheofloss ,
Neventsofnumberannual ,
∑=
=N
kkXZlossannual
1
,
Loss Distribution Approach: single risk cell (business line/event type)
)|(.~,...,
),|(.~
1 ξ
θ
fiidareXX
PN
N
tindependenareXXandN N,...,1
e.g. Poisson
e.g. LogNormal
Monte Carlo, semi-analytic
www.cmis.csiro.au
Insurance for Operational Risks� Insurance: probability of coverage, insurer default,
cover limit, excess, regulatory cap� Modelling of loss event times is required instead of
event frequency to address OR insurance.� point process:
e.g. homogeneous Poisson process
non-homogeneous Poisson: doubly stochastic Poisson:
2t time
1 yeartodayNt
...1...0 11 <<≤<<< +NN ttt
)Poisson(~,)l(Exponentia~1 λλδ Nttt ii −= +
1t
)(tλ(.)nomialNegativeBi(.)Gamma~ =>=> Nλ
www.cmis.csiro.au
Data Truncation modelsData Truncation models
,....2,1, => iLX ii
,....2,1, => iLX i
(.)~ gL
Known constant truncation levelKnown constant truncation level
Known variable truncation levelKnown variable truncation level
Unknown truncation level Unknown truncation level
Stochastic truncation levelStochastic truncation level
www.cmis.csiro.au
Known thresholdKnown threshold
0),( ≥XXf
,....2,1, =≥ iLX i� Known constant truncated level, i.e. loss data
Untruncated severity distribution
Truncated severity distribution
� Severity pdf fit via e.g. Maximum Likelihood Method
∫∞
=>≥>
=>L
dXXfLXLXLX
XfLXXf )(]Pr[;;
]Pr[
)()|(
∏= >
=ΨK
i
iN LX
Xf
11 ]Pr[
)(),...,( αα
� Frequency adjustment ]Pr[/)( LXNN obstrue >≈
www.cmis.csiro.au
Unknown truncation levelUnknown truncation level
� L is an extra parameter in likelihood function
� L is unknown:
mu vs level, L
6
6.5
7
7.5
8
8.5
9
9.5
10
1000 4000 7000 10000 13000
sigma vs level, L
1.31.41.51.61.71.81.9
22.12.2
1000 5000 9000 13000
≥+×<+×
=γβγαγβα
µL
LLL
;
;)( ∑ −
iii
obs LL 2,, )]()([min µµγβα
Example: X~LogNormal(mu=8, sigma=2), L=4000estimates: mu≈8.05, sigma≈2.01, L≈4001
www.cmis.csiro.au
Stochastic truncation levelStochastic truncation level
(.)~ gL
0),( ≥XXfKiLX i ,...,1, =>reported lossesreported losses wherewhere
Severity distribution of lossesSeverity distribution of losses
∫∞
> =>≥>
==a
aX dyyfaXaXaX
XfaLXf )(]Pr[;;
]Pr[
)(1)|(
marginal distribution of reported lossesmarginal distribution of reported losses
∫∫ >===
∞ X
daaX
agXfdaagaLXfXf
00]Pr[
)()()()|()(
~
∫ ∫∞ ∞
=>>=0
)()(]Pr[];Pr[/L
obstrue dXXfdLLgLXLXNN
∏=Ψi
iXf )(~
conditional conditional pdfpdf
www.cmis.csiro.au
Dependence between risks
� Diversification: C(Z=R1+…+Rn)<C(R1)+…+C(Rn)
� VaR:
� Conditional VaR (CVaR):
� Dependence between frequencies
� Dependence between event point processes
� Dependence between severities
� Dependence between annual losses
� Dependence between risk profiles (parameters)
})(,min{)()( 1 ααα ≥== − zFzFZVaR ZZ
)](|[)( ZVaRZZEZCVaR αα >=
∑∑∑∑====
+++==KN
i
Ki
N
ii
N
ii
K
kk XXXZZlossannualtotal
1
)(2
1
)2(1
1
)1(
1
...:
www.cmis.csiro.au
Basel Committee statement:“Risk measures for different operational risk estimates must be added for purposes of calculating the regulatory minimum capital requirement. However, the bank may be permitted to use internally determined correlations in operational risk losses across individual operational riskestimates, provided it can demonstrate to a high degree of confidence and to the satisfaction of the national supervisor that its systems for determining correlations are sound, implemented with integrity, and take into account the uncertainty surrounding any such correlation estimates(particularly in periods of stress). The bank must validate its correlation assumptions.”
Adding capitals=>perfect dependence between risks (too conservative)
∑∑∑∑====
+++==KN
i
Ki
N
ii
N
ii
K
kk XXXZZlossannualtotal
1
)(2
1
)2(1
1
)1(
1
...:
www.cmis.csiro.au
Dependence between frequencies via copula)1,0(~)),,...,,( 21 UniformUUUUC iK
e.g. Gaussian copula
][],....,[ 11
111 KKK UFNUFN −− ==
-1
-0.5
0
0.5
1
-1 -0.5 0 0.5 11,5.0 21 == λλ
))(),...,((),...,( 11
1)(1 KNNNd
Ga uFuFFuuC −−= ρρ
00),( ≠≠ ρifNNcorr ji
10,5 21 == λλ
ρ≠),( 21 NNcorr
)(~
)(~
22
11
λλ
PoissonN
PoissonN
Copula correlation ρ
ρvs),( 21 NNcorr
Example
www.cmis.csiro.au
-1
-0.5
0
0.5
1
-1 -0.5 0 0.5 1
∑=
=1
1
)1(1
N
iiXZ ∑
==
2
1
)2(2
N
iiXZ
Dependence between frequencies=>Dependence between annual losses
Example
),(vs),( 2121 NNZZS ρρ
][],[ 21
211
1 UFNUFN PoissonPoisson−− == ),(),( 2121 UUCUUC Ga
ρ=
)2()1()2()1( ind,1,2)LogNormal(~,1,2)LogNormal(~ XXXX
Copula correlation ρ
10,5 21 == λλ)(~
)(~
22
11
λλ
PoissonN
PoissonN
www.cmis.csiro.au
Dependence via common Poisson process(Johnson, Kotz and Balakrishnan)
1 yeartoday
t
1st risk events
2nd risk events
))((/),();(~)();(~)(
)(~)();(~)(ˆ);(~)(ˆ
)()(ˆ~)(
)()(ˆ~)(
21212211
2211
22
11
CCCCC
CC
C
C
NNcorrPoissontNPoissontN
PoissontNPoissontNPoissontN
tNtNtN
tNtNtN
λλλλλλλλλ
λλλ
++=++
+
+
positive dependence; constant covariance
−+=
ii
iCii
ptN
ptNtNtN
1probwith)(ˆprobwith)()(ˆ
)(extensionkiCki ppNN λ=),cov(
www.cmis.csiro.au
-4
-3
-2
-1
0
1
2
3
4
-4 -3 -2 -1 0 1 2 3 4
X
Y
-4
-3
-2
-1
0
1
2
3
4
-4 -3 -2 -1 0 1 2 3 4
X
Y
-4
-3
-2
-1
0
1
2
3
4
-4 -3 -2 -1 0 1 2 3 4
X
Y
7.0),(
)1,0(~);1,0(~
=YXcorr
NormalYNormalX
t2 Copula
Gumbel Copula
Gaussian Copula
Dependence via copula
www.cmis.csiro.au
Gaussiancopula
))(1),...,2(1),1(1()(),...,2,1( duNFuNFuNFNFduuuGaC −−−= ρρ
t-copula
))(1),...,2(1),1(1()(),...,2,1( dutututtFduuutC −−−Σ=Σ ννννν
Gumblecopula
10,/1)ln(.../1)1ln(exp),...,1( ≤<−++−−=
ββββ
β duuduuGuC
Upper tail dependence
αααα
αααΡ
αλ −
+−−→
=−>−>−→
=1
),(211
lim)](11|)(1
2[1
lim CFXFY
βλ 22−=
0=λ
0≥λ
www.cmis.csiro.au
0.00
0.10
0.20
0 4 8 12
Severity Distribution Tail: Extreme value Theory and splicing
=−−≠+−=
−
0];/exp[1
0;)/1(1)(
/1
ξβξβξ ξ
x
xxH
∞<≤++= XXifXKfKwXfwXf 0),(),(...)(11
)(
EVT Generalized Pareto Distribution (GPD)
aX
0
f1(X)=Truncated LogNormal
f2(X)=GPD
f(x)=qf1(X)+(1-q) f2(X)
Mixture distributions:
www.cmis.csiro.au
Structural Structural ModellingModelling of of OperatinalOperatinalRisk via Bayesian Inference: Risk via Bayesian Inference:
combining loss data with expert opinionscombining loss data with expert opinions
Pavel Shevchenko (CSIRO) and Mario Wüthrich (ETH) Structural Modelling of Operational Risk using Bayesian Inference: combining loss data with expert opinions.June 2006. Submitted to The Journal of Operational Risk
www.cmis.csiro.au
Bayesian inference to combine expert opinions with loss data
� Expert opinions for prior distribution
� Loss data
� Posterior distribution
)(απ r
)()|(ˆ)()|(),( XhXXhXhrrrrrrrr
απαπαα ==
)(/)()|()|(ˆ XhXhXrrrrr
απααπ =
)|(};,...,{ 1 αrrrXhXXX n=
www.cmis.csiro.au
),...,( 1 nNN=N 0,!
)|( ≥= − λλλ λ
NeNf
N
PoissonPoisson--GammaGamma
0,0,0),/exp()(
)/(),|(
1
>>>−Γ
=−
βαλβλβα
βλβαλπα
)ˆ/exp(!
)/exp()(
)/()|(ˆ 1ˆ
1
1
βλλλβλβα
βλλπ αλα
−∝−Γ
∝ −
=
−−
∏n
i i
iN
NeN
).1/(ˆ
,ˆ1
n
Nn
ii
×+=→
+=→ ∑=
ββββ
ααα
are conditionally iid from
www.cmis.csiro.au
estimate of the arrival rate vs year
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
0 3 6 9 12 15year
arriv
al rat
e j
Bayesian estimatemaximum likelihood estimate
15.0,41.3 ≈≈ βα
6.0=λ
the Bayesian estimator with Gamma prior
Annual counts N=(0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 2, 1, 1, 2, 0) from Poisson
kkk βαλ ˆˆˆ ×=
∑ == k
i ikk N1
1~λ the Maximum Likelihood estimator
expert opinions 15.0,41.33/2]75.025.0Pr[,5.0][ ≈≈→=≤≤= βαλλE
Example
www.cmis.csiro.au
““ ToyToy”” Model for Operational Risk Model for Operational Risk using Credibility Theoryusing Credibility Theory
Hans Bühlmann (ETH), Pavel Shevchenko (CSIRO) and Mario Wüthrich (ETH)A “Toy” Model for Operational Risk Quantification using Credibility Theory. June 2006. Submitted to Risk Magazine
www.cmis.csiro.au
0.00
0.10
0.20
0 4 8 12
Low Frequency High Impact Losses: PoissonLow Frequency High Impact Losses: Poisson--ParetoPareto
0,...,1,0,!
)|(;0,,1
)|( ≥=−=>≥−−
=
θθθθξξξξ ne
n
nnPLx
L
x
Lxf
LX
Pareto(ξ)
Severity distribution
www.cmis.csiro.au
∑∑
∑∑
==
==
==+
=
==−+=Θ
=Θ=ΘΘ=
ΘΘΘΘ
Θ=ΘΘ=Θ
=
Θ
=
jK
kkjj
J
jj
j
jj
jK
kkj
j
kjj
J
jj
jjjjj
jjj
J
JJ
kjjjkjjjkj
jkj
jj
kjjkj
www
w
Yw
wYYY
EE
iidarec
b
wYYE
KkYa
j
wKkY
J
1,
1022
1,
,
1 000
2220
1
11
,2
,,
,
,,
~,,/~
~
,~,ˆ,ˆ)1()(ˆ
isestimator y credibilit shomogeneouThen
)](var[,)]([)],([:Define
,...,)
tindependenare),(),...,,()
/)(]|var[),(]|[
withtindependenllyconditionaare,...,1:)
andrisk th - theof profilerisk a is ) rv ofon (realizati
, htsknown weigfor that Assume .,...,1:nsobservatio
with risks of portfolio aconsider :
αατσ
α
αα
µµααµ
τµσσµµ
σµ
θ
YY
model Straub-Bühlmann
www.cmis.csiro.au
Maximum Likelihood Estimator for tail parameter:Maximum Likelihood Estimator for tail parameter:
jjj
j
jjjjjj
jK
k
kj
j
jj
jjkj
jkj
a
KVarE
L
X
K
a
aX
KkLXJj
ϑξ
ϑϑϑϑϑϑ
ϑ
ϑξ
ˆˆ
,2
]|ˆ[,]|ˆ[
,ln1
ˆ
estimator" likelihood maximum" Then the
)Pareto( from iid ally)(condition are
,...,1,losseswith ,...,1 cellsrisk Consider
2
1
1
,
j,
,
=
−==
−=
=
=≥=
−
=∑
www.cmis.csiro.au
Improved credibility estimator (using all data in the bank):Improved credibility estimator (using all data in the bank):
www.cmis.csiro.au
Jja
WW
J
K
K
VarJj
jjj
J
jj
J
jjj
J
jjj
j
jjjjjj
j
,...,1,ˆ̂ˆ̂
,ˆ1ˆ
,)ˆˆ(1
1ˆ
)/(1
2where,)1(ˆˆ̂
Then bank. theof profilerisk a is
][,]E[with iidare,...,1,Assume
)1(
110
1
20
20
200
0
0
20j0j
==
==
−−
=
+−−
=−+=
===
∑∑
∑
==
=
ϑξ
αϑαϑ
ϑϑατ
τϑαϑαϑαϑ
ϑτϑϑϑϑ
Improved credibility estimator (using all data in the bank):Improved credibility estimator (using all data in the bank):
www.cmis.csiro.au
Improved credibility estimator (using industry data):Improved credibility estimator (using industry data):
www.cmis.csiro.au
Improved credibility estimator (using industry data):Improved credibility estimator (using industry data):
∑∑
∑∑
∑
==
==
−
=
==
==
+
==
==
+−
−=
−=
===
=
M
m
mmJ
j
mmAcoll
mJ
j
mj
m
coll
mm
mm
mJ
j
mj
mjmW
m
m
m
mm
j
mjm
j
mjK
km
mkj
mj
mjm
j
collmmm
m
A
MmW
W
W
Mm
Jj
K
K
L
X
K
a
VarMm
MmM
1
)()(
1
)(0
)(1
)(
1
)()(2)(
0)(
)()(
)(
1
)()()(
1)(0
)(
2
)(0
)(0)(
)()(
1)(
1)(
)(,
)(
)()(
coll
2)(0coll
)(0
)(0
)(0
,ˆˆ
,...,1,,,ˆˆ
,...,1
,...,1,
1
2,ln
1ˆ
Then industry. theof profilerisk a is
][,]E[with iidare,...,1, that Assume
1,...,, profilesrisk with banks Consider
βϑβϑ
α
ττ
βϑαϑ
τϑ
αϑ
ϑτϑϑϑϑ
ϑ
www.cmis.csiro.au
1
1 0
)(
0
)(
1
)(0
)(0
1
)(0
1
2)(0
2
0
2
1
2)(0
)(0
0
)(2
)1()1()1()()1(0
)1()1()1()1(
)1()1(0
)1()1(0
11
,ˆ1ˆ,,)ˆ(1
ˆ
0,ˆ
)ˆˆ(1
maxˆ
parameters structuralIndustry
ˆ̂ˆ̂,...,1,
ˆ̂)1(ˆˆ̂
,ˆ)1(ˆˆ̂
down- topestimatorsy credibilit Corrected
−
=
===
=
−−=
===
−−−
×=
=⇒=−+=
−+=
∑
∑∑∑
∑
M
m
mm
M
m
mmM
m
mM
m
m
M
m
mmm
coll
jjjm
jjjj
coll
W
W
W
W
M
Mc
MWW
M
W
M
W
W
M
Mc
aJj
ϑϑττ
τϑϑτ
ϑξϑαϑαϑ
ϑβϑβϑ
www.cmis.csiro.au
Maximum Likelihood Estimator for arrival rate:Maximum Likelihood Estimator for arrival rate:
,~/]|ˆ[Var,]|ˆ[
~,~1ˆ
estimator likelihood maximum Then the
profilesrisk are and constantsknown are
)Poisson( from iid ally)(condition are
,...,1,sfrequencie losswith ,...,1 cellsrisk Consider
1,
,
,
jjjjjjj
jjj
jK
kkj
jj
jj
jjjkj
jkj
E
KN
N
KkNJj
νλλλλλλ
ννν
λ
λνλνθ
==
==
=
==
∑=
www.cmis.csiro.au
Improved credibility estimator for arrival rate (us ing bank dataImproved credibility estimator for arrival rate (us ing bank data))
.~
1~
1;ˆ1
;~;)ˆ(~
1;~
~,ˆ~1ˆ;0,
ˆmaxˆ
ˆ̂ˆ̂
/~
~where,)1(ˆˆ̂
then/][Var,][,/Consider
bank. theof profilerisk a is
][,]E[with iidare,...,1,Assume
1
1 001
1
2
010
00
020
200
0
,,,,
0
20j0jj
−
==
==
−
−==
=−−
==
==
−×=
=⇒+
=−+=
===
===
∑∑
∑∑∑
∑
J
j
jjJ
jj
jj
J
jj
jJ
jj
jjjj
jj
jjjj
jjjjjj
jjkjjkjjkjkj
J
Jc
JF
FJ
JT
KJ
Tc
FFENF
VarJj
νν
νν
λ
γγλνν
νν
ννλγγ
λν
λω
λνθωλν
νγλγλγλ
νλλν
λωλλλλ
www.cmis.csiro.au
Improved credibility estimator of arrival rate (usi ng industry dImproved credibility estimator of arrival rate (usi ng industry data)ata)
∑∑
∑∑
∑
==
==
=
==
==
+
==
==+
==
===
=
M
m
mmJ
j
mmcoll
mJ
j
mj
m
coll
mm
mm
mJ
j
mj
mjm
m
mmmm
j
mjm
j
mjK
k
mkjm
j
mj
collmmm
m
AA
MmW
W
W
W
MmJjN
VarMm
MmM
1
)()(
1
)(0
)(
)(
1
)()(2)(
0)(
)()(
)(
1
)()()(
)(0
)(2)(
0)(
0)(
)()(
)(
1
)(,)(
)(
coll
2)(0coll
)(0
)(0
)(0
,ˆ1ˆ
,...,1,,,ˆ1ˆ
,...,1,,...,1,)/(~
~,~
1ˆ
Then industry. theof profilerisk a is
][,]E[with iidare,...,1, that Assume
1,...,, profilesrisk with banks Consider
ρλρλ
γ
ωω
ρλγλ
ωλνν
γν
λ
λωλλλλ
λ
www.cmis.csiro.au
)1()1()1(
)()1(0
)1()1()1()1(
)1()1(0
)1()1(0
ˆ̂ˆ̂
,...,1,ˆ̂
)1(ˆˆ̂
,ˆ)1(ˆˆ̂
down- top:rate arrivalfor estimatorsy credibilit Corrected
jjj
mjjjj
coll
Jj
λνθ
λγλγλ
λρλρλ
=
⇓
=−+=
−+=
www.cmis.csiro.au
)ˆ̂ˆ̂
(Poisson~),ˆ̂ˆ̂
Pareto(~ j,1
, jjjjjjnj
jN
nnjj NaXXZ λνθϑξ ==⇐=∑
=
www.cmis.csiro.au
Topics for further research
� Evolutionary models (stochastic risk profiles)� Dependence between risks via dependence
between risk profiles� Full Bayesian approach to get not just credibility
estimates for risk profiles but their posterior distributions
� Modelling high frequency low impact losses (with lower threshold)
� Allocation of capital into Business Units� Combining expert opinions and external data