1. finance
2. bank

How to Implement AMA for the
Calculation of Capital Requirement for
Operational Risk
GABRIELLA GREPE
IVAN THOMSON
Master of Science Thesis
Stockholm, Sweden 2008
2
Master of Science Thesis
How to Implement AMA for the
Calculation of Capital Requirement for
Operational Risk
Gabriella Grepe & Ivan Thomson
INDEK 2008:102
KTH Industrial Engineering and Management
Industrial Management
SE-100 44 STOCKHOLM
3
Master of Science Thesis INDEK 2008:102
How to Implement AMA for the Calculation of
Capital Requirement for Operational Risk
Gabriella Grepe
Ivan Thomson
Approved
Examiner
Supervisor
2008-12-11
Thomas Westin
Birger Ljung
Abstract
This report presents a case study of the development of an AMA 1 model for the calculation of
capital requirement for operational risk. The case study was based on an assignment commissioned
by one of Sweden’s largest banks. We were given full scope regarding the choice of the model and
the assumptions, and began the process with a literature study of previously research in the area of
operational risk. We ultimately chose a loss distribution approach for the base; the frequencies of the
losses were assumed to be Poisson distributed, whereas the severities were assumed to follow a
lognormal distribution. Instead of the correlation approach suggested in the loss distribution
approach, we used a bottom-up approach where some losses were assumed to be jointly Poisson
distributed. We also presented a way of scaling data in order to better fit external data to the internal
ones. Please not that the model is only a suggestion since the lack of data made it impossible to test
the ultimate results.
What came to our attention during the development of the model is the lack of univocal guidelines
for how the model has to be designed. Our opinion is that operational risk does not differ that
much between banks. Hence, it might be a good idea to have uniform rules for the model
development and only leave the assumptions about scaling and correlation to the bank.
AMA = Advanced Measurement Approaches. The most advanced model for calculating the capital requirement for
operational risk. A more thorough explanation will be presented in 4.1.3.
1
4
Acknowledgements
We would especially like to thank three people for their significant contribution throughout the
process of writing this thesis. Birger Ljung, our supervisor at INDEK, for his traditional finance
view as well as his insightful comments about the structure of the report. Filip Lindskog, our
supervisor at Mathematical Statistics, for his suggestions to the mathematical parts of the thesis. And
last but not least Carl Larsson, our supervisor at the bank, for his servings as a sounding board and
his valuable help with the implementation of the model.
Stockholm, December 1, 2008
Gabriella Grepe
Ivan Thomson
5
Table of Contents
1 Introduction.................................................................................................................................................... 8
1.1 Background ............................................................................................................................................. 8
1.2 Problem Statement................................................................................................................................. 9
1.3 Commissioner & Assignment............................................................................................................... 9
1.4 Aim of Thesis.......................................................................................................................................... 9
1.5 Delimitations......................................................................................................................................... 10
1.6 Disposition ............................................................................................................................................ 10
1.7 Terms & Definitions............................................................................................................................ 12
2 Methodology................................................................................................................................................. 13
2.1 Research Approach .............................................................................................................................. 13
2.2 Work Procedure ................................................................................................................................... 13
2.3 Choices of Path..................................................................................................................................... 14
3 Theoretical Framework ...............................................................................................................................15
3.1 Risk Types ............................................................................................................................................. 15
3.1.1 Credit Risk ..................................................................................................................................... 15
3.1.2 Market Risk.................................................................................................................................... 15
3.1.3 Operational Risk ........................................................................................................................... 15
3.2 Risk Measures and Methods ............................................................................................................... 16
3.2.1 Value-at-Risk ................................................................................................................................. 16
3.2.2. Expected Shortfall ....................................................................................................................... 17
3.2.3 Extreme Value Theory................................................................................................................. 18
3.3 Distribution Functions ........................................................................................................................ 21
3.3.1 Poisson Distribution .................................................................................................................... 22
3.3.2 Lognormal Distribution............................................................................................................... 23
3.4 Copula .................................................................................................................................................... 24
3.5 Simulation Methods for Computing VaR/ES ................................................................................. 26
3.5.1 Historical Simulation.................................................................................................................... 26
3.5.2 Monte Carlo Simulation............................................................................................................... 26
4 Basel Rules & Previous Research .............................................................................................................. 28
4.1 Three Types of Models........................................................................................................................ 28
4.1.1 Basic Indicator Approach (BIA)................................................................................................. 28
4.1.2 Standard Approach (SA).............................................................................................................. 29
4.1.3 Advanced Measurement Approaches (AMA) .......................................................................... 30
4.2 Three Types of AMA Models ............................................................................................................ 30
4.2.1 Internal Measurement Approach (IMA) ................................................................................... 31
4.2.2 Loss Distribution Approach (LDA) .......................................................................................... 31
4.2.3 Scorecard Approach (SCA) ......................................................................................................... 32
4.3 Previous Research – AMA.................................................................................................................. 32
5 Model Choice & Assumptions................................................................................................................... 34
5.1 What is a Good Model?....................................................................................................................... 34
5.2 Overall Approach Choice ................................................................................................................... 35
5.3 Distribution Assumptions................................................................................................................... 35
5.4 Correlation Assumptions .................................................................................................................... 37
5.5 Assumptions regarding Scaling, Inflation & Truncation Bias ....................................................... 39
5.6 Risk & Simulation Method.................................................................................................................. 39
6 Description of Our Model.......................................................................................................................... 41
6
6.1 Model Overview ................................................................................................................................... 41
6.2 Data Import .......................................................................................................................................... 41
6.3 Data Processing .................................................................................................................................... 43
6.4 Simulation.............................................................................................................................................. 52
7 Model Testing............................................................................................................................................... 53
8 Concluding Chapter..................................................................................................................................... 54
8.1 Insights................................................................................................................................................... 54
8.2 Future Required Updates .................................................................................................................... 54
8.3 Validity & Critique ...............................................................................................................................56
8.4 Further Research .................................................................................................................................. 58
9. References .................................................................................................................................................... 60
9.1 Written Sources .................................................................................................................................... 60
9.2 Interviews .............................................................................................................................................. 63
7
1 Introduction
1.1 Background
This master thesis has been written during a time of financial turbulence. The acquisitions and/or
bankruptcies of the five largest American investment banks have been an indirect result of the burst
of the real estate bubble in 2006. The disturbance has spread with falling stock markets and
concerns about the survival of other banks as a result. The media has speculated about the risk
exposure of European banks and the public has expressed their worries about their saved capital.
During such time, the attention has focused on the risk management of the banks. Can the banks
stand up against the turbulence, and do they have capital to cover for the unexpected losses?
The cooperation of international central banks entered the history books with the formation of the
Bank for International Settlements (BIS) in 1930 (Bank of International Settlements. BIS History
Overview, 2008). The institution, which initially was formed within the context of World War I
reparation payments, came over time to focus on fostering monetary policy cooperation. The
regulatory supervision of internationally active banks commenced as an important issue following
the oil- and international debt crisis of the 70’s. As a result, The Basel Capital Accord was published
in 1988 with the purpose of imposing a minimum capital standard in the banking industry (Basel
Committee of Banking Supervision, 1988). Since then, banks need to reserve a specific amount of
equity that reflects the risk they are exposed to. This Capital Accord was 13 years later replaced by
Basel II, which contains more risk sensitive rules and requirements on the management and board
of directors (Finansförbundet. Finansvärlden, 2005). One of the news with Basel II was the
inclusion of operational risk as a separate category in the capital requirement framework (KPMG
International, 2003). The risk is thus divided into three different categories; credit risk, market risk
and operational risk.
Operational risk is a fairly new modelling phenomenon and there are several complications in the
process. The difficulty of predicting the events combined with the limit of historical data do not
form a solid statistic platform on which to build the model. The internal fraud that caused the
collapse of Barings Bank in the 90’s (BBC News, 1999) is one example of this. How is it possible to
cover for a loss exceeding £ 800 million when it has not happened before? There is not a
straightforward approach for how the model has to be designed. The Basel Committee proposes
8
three different types of methods with increasing degree of sophistication; banks are encouraged to
move on to the more sophisticated ones in order to more precisely measure their operational risk.
1.2 Problem Statement
How can a model for the calculation of capital requirement for operational risk be designed? The
problem of aiming for an advanced method causes issues to the modelling process. There are several
approaches suggested in the literature and some appear more common than others. Neither does
however enclose all modelling issues and possible solutions to these.
1.3 Commissioner & Assignment
The assignment has been commissioned by one of Sweden’s largest banks. The bank is active mainly
in the Nordic region with considerable exposure in the Baltic area. The development process has
been accomplished with guidance from the department Group Operational Risk Control, liable for
the operational risks and the security in the bank. The Basel Committee on Banking Supervision
(2006) has presented three different types of operational risk models with an increasing degree of
sophistication. Since the bank used one of the less sophisticated methods for the capital requirement
calculation for operational risk (the Standard Approach), a more advanced method was desirable.
The assignment has thus concerned the development of the most advanced method called
Advanced Measurement Approaches (AMA).
1.4 Aim of Thesis
The aim of this study has been to make a suggestion of how AMA can be implemented. The
development has been illustrated with the help of a case. The aim of the case study has been to map
out the possibilities, the mathematical difficulties and highlight how the model may be designed in
order to give a good measure for the capital requirement for operational risk.
The aim is also to give an instruction of how to implement the model at a level that can be
conducted at any bank or financial institution. The usage of this report is thus not limited to “our”
bank; it can in theory be applied at any financial institution with internal loss data captured over a
substantial time period. The way in which this report may be used is either directly as a
9
programming template or as discussion material for how to manage operational risk in the
organization. By looking at the model development as a case study, we believe that our report may
contribute to the research regarding how operational risk may be measured.
1.5 Delimitations
The AMA model includes more than just the programming product. In order to get the model
approved by Finansinspektionen (FI), the Swedish Financial Supervisory Authority, the model has
to fulfil not only quantitative but also qualitative requirements. These include (among others)
information about how the model is to be implemented, how the capital is distributed across the
operational risks and how the time plan is designed (FI, 2007). Since our aim has been to map out
the mathematical difficulties in the development of the model, the qualitative requirements have
been considered to be out of scope. The focus has instead been limited to the quantitative
requirements that have to be fulfilled in order to get the model approved. What needs to be
acknowledged is that due to issues of confidentiality, the Matlab 2 code will not be included in this
report.
1.6 Disposition
This thesis is divided into nine chapters as follows:
Introduction. This part of the thesis explains the background and the nature of the problem. The
aim of the thesis, the assignor and the assignment are described as well as necessary delimitations to
the problem statement.
Methodology. The research approach and the work procedure are presented in this chapter. These
include descriptions of how the assignment is related to the problem statement as well as a
description of how the work has developed in the process of time.
Theoretical Framework. The basics of Risk Management, as presented in traditional finance
literature, are described in this chapter. The aim is to provide a basic understanding of what kind of
2
Matlab is a high-level programming language. See http://www.mathworks.com/products/pfo/ for more information.
10
risks banks are exposed to and how these can be measured. An overview of the distributions and
simulations used in the model are presented as well.
Basel Rules & Previous Research. This chapter focuses on the base for the capital requirement
calculations – the rules of the Basel Committee. It presents the regulatory requirement for the AMAmodel as well as a description of the alternatives. The different approaches for how to construct the
AMA and previous research about the model are presented as well.
Model Choice & Assumptions. Considering the many different approaches that are presented,
this chapter focuses on the method chosen in our case. Critical assumptions about loss distributions,
correlations and scaling factors are described and argued for in this chapter. The question of what
characterizes a good model is also discussed.
Model Description. This part describes the features of our developed model. It explains how the
data is imported and processed. It also provides a detailed description of how the correlation and
scaling is handled and how the simulation is conducted.
Model Testing. This chapter focuses on the tests the model has undergone.
Concluding Chapter. The thesis is finished by a chapter that concludes the insights and the
updates that has to be made. It also discusses the validity of the model and presents
recommendations for further research in the area of operational risk.
References. This part contains a list of references as well as a list of the interviewees. The figures
that have been used in the report have either been collected from literature (and the sources are thus
in the reference list) or made by us. In the case of the latter, the source is solely left out in the figure
text.
11
1.7 Terms & Definitions
This section provides a list of the abbreviations and some of the technical terms used in this report.
AMA (Advanced Measurement Approaches). AMA is a summation name for the approaches that
fall into the category of being the most sophisticated kind of model for the calculation of the capital
requirement of operational risk.
BIA (Basic Indicator Approach). The simplest approach for the calculation of the capital
requirement of operational risk.
Copula. A dependence measure that defines a correlation structure between two correlated
variables.
EVT (Extreme Value Theory). A theory of how to estimate the tail (in this case; the high severity
losses) of a distribution.
IMA (Internal Measurement Approach). An approach for how to build the AMA; an alternative
approach to the LDA and SCA approaches.
LDA (Loss Distribution Approach). An approach for how to build the AMA; an alternative to the
IMA and SCA approaches.
Monte Carlo simulation. A simulation technique where one assumes a distribution for how the
losses are distributed and then simulates new losses according to it.
SA (Standard Approach). An approach calculating the capital requirement of operational risk. It is
less sophisticated than AMA, but more sophisticated than BIA.
SCA (Scorecard approach). An approach for building the AMA; an alternative approach to the LDA
and IMA approaches.
Truncation bias. The bias that appears due to the fact that the internal dataset is truncated (i.e. that
only losses that exceed a specific threshold are reported)
VaR (Value-at-Risk). A risk measure answering the question of how much it is possible to loose
within a specified amount of days with a certain certainty.
12
2 Methodology
This chapter aims to provide an overview of how the work was conducted; what kind of research
approaches that was used and how the work procedure was designed. The important choices of
path, including the required mathematical and regulation knowledge, are also explained here.
2.1 Research Approach
The research approach of this thesis has been conducted with the aid of a case study. Since the
assignment came prior to the idea of research, we had to go backwards and find a way in which this
assignment could be scientifically contributing. The case itself is interesting since it touches upon
one of the new areas of modelling within risk analysis. There are numerous reports regarding
different parts of the AMA-model, but we considered there to be a research gap in the overall view;
the model issues, how they may be handled and how the model itself may be criticized.
It must however be emphasized that this is only a suggestion of how such a model may be designed.
We have tested the programming, but because of the lack of data, we have not been able to test its
numerical results. Thus, we have not been able to test the sensitivity of the assumptions made, and
this report should be read with this concern in mind.
2.2 Work Procedure
The process was initiated with a literature review covering working papers from the Basel
Committee as well as academic reports of the area. Most of the material was collected from the
Internet, with Social Science Research Network (SSRN) as the main source. Material concerning the
theoretical framework was read in order to map out applicable risk measurement techniques and
simulation methods that could be used in the model. The next step in the process was to make a
choice about the necessary assumptions. These regarded the distributions of the losses (how often
they occur, and how much that was lost when they occurred), the correlation (is there any reason to
believe that the loss in a may influence a loss in b?) and the potential influence of business line
income on operational risk. In order to thoroughly revise these assumptions, a number of semi
structured interviews were made both with mathematicians at KTH and with employees within the
bank. The interviews with mathematicians at KTH regarded mathematical and modelling issues that
13
were approached in the development process. The interviews within the bank regarded different
areas dependent on who was interviewed. The discussions with the risk analysts regarded the
mathematical aspects and the discussions with employees earlier employed by FI, regarded FI’s work
process and point of view. The interviews with experienced employees within the bank concerned
the potential correlation of losses that was important to the development of the model. The
programming of the model was conducted continuously throughout the development process.
2.3 Choices of Path
In writing this thesis, several important standpoints had to be taken. One regards our theoretical
base. The choice of several theoretical sources is made because of an ambition to make the report as
pedagogical as possible. We have chosen the, in our view, best description of the phenomenon from
different books in order to ease the understanding of the measures and methods used. What needs
to be emphasized is that the different authors do not contradict each other regarding the theoretical
framework. Another standpoint regards to whom this report is directed to. Our aim is to write this
report so that someone with at least some knowledge of probability theory and traditional risk
analysis may find it possible to understand. The reader does not have to have any awareness of the
Basel Committee and its work; the necessary parts will be thoroughly described in chapter 4.
The last, but probably the most important, choice of path is the one regarding our underlying
assumptions about risk analysis. We have chosen to accede to the traditional finance theory and its
interpretation of how risk ought to be measured. We have thus chosen not to criticize the traditional
view of analysing risk, where the history is seen as representative for the future. The discussion of
alternatives is considered to be out of scope.
14
3 Theoretical Framework
In order to simplify for the reader, this part presents an overview of the risk types, risk measures and
mathematical phenomena encountered and involved in the modelling process. The discussion of the
methods is saved for chapter 5; the aim of this part is only to provide a background for the methods
mentioned further on. It is thus recommended to skip this chapter when reading the report for the
first time, and instead use it as a book of reference when reading chapters 5-8.
3.1 Risk Types
Hult and Lindskog (2007) present a general definition of risk for an organization as “any event or
action that may adversely affect an organization to achieve its obligations and execute its strategies”.
When it comes to capital requirement, the risk is divided into three categories; market, credit and
operational risk.
3.1.1 Credit Risk
The Bank of International Settlement (BIS) defines, according to Gallati (2003, p. 130), credit risk as
“the risk that a counterparty will not settle an obligation for full value, either when due or at any
time thereafter. In exchange-for-value systems, the risk is generally defined to include replacement
risk and principal risk”.
3.1.2 Market Risk
The Bank for International Settlement (BIS) defines market risk as “the risk of losses in on- and offbalance-sheet positions arising from movements in market prices”, according to (Gallati, 2003, p.
34). He describes the main factors that contribute to market risk as equity, interest rate, foreign
exchange and commodity risk. The aggregation of all risk factors is the total market risk.
3.1.3 Operational Risk
There is no established way of how to define operational risk. On the one side of the spectrum is
the broad definition of operational risk as “anything in the bank that is not market risk or credit
risk” (Hull, 2007). On the other side of the spectrum is the narrow definition of operational risk as
15
any risk arising from operations. The definition that is widely used in banking terms is that of the
Basel Committee (Basel Committee on Banking Supervision, 2006, p. 144): “The risk of loss
resulting from inadequate or failed internal processes, people and systems or from external events.
This definition includes legal risk, but excludes strategic and reputational risk.”
Examples of operational risks include among others internal and external fraud, IT-breakdowns and
natural disasters. The exposure to operational risk is less predictable than the other risks that the
bank faces. While some of the operational risks are measurable, some may thoroughly escape
detection (Jobst, 2007). The operational risks do mainly occur as rare high severity events or
frequent low severity events. The rare high severity events are for example uncontrolled gambling
and natural disasters, whereas frequent low severity events may be exemplified by stolen credit card
payments. When it comes to the expected loss in the bank, it is easier to quantify the expected loss
for frequent low severity events than it is for rare high severity events (Jobst, 2007). The
incorporation of the latter is thus the most complicated, and probably also the most important, part
of the risk model.
3.2 Risk Measures and Methods
The relevant measures and methods to use regarding the calculation of capital requirement are
introduced in this section. These are presented in order to give the reader an understanding of how
they are used in the model developed.
3.2.1 Value-at-Risk
The Value-at-Risk (VaR) measure is by Hult and Lindskog (2007, p. 14) defined as: “Given a loss L
and a confidence level α ∈ (0,1), VaRα(L) is given by the smallest number l such that the probability
that the loss L exceeds l is no larger than 1- α, i.e.:”
VaRα ( L ) = inf {l ∈ R : P ( L > l ) ≤ 1 − α }
= inf {l ∈ R : 1 − FL (l ) ≤ 1 − α }
= inf {l ∈ R : FL (l ) ≥ α }.
16
The VaR measure thus presents the value V in the following statement: “We are X percent certain
that we will not loose more than V dollars in the next N days. “ (Hull, 2007). X is here the
confidence level, whereas N is the time horizon of the statement. One example will illustrate this
statement. Imagine a portfolio of assets, whose total risk we want to measure with VaR. Then VaR
is the loss over the next N days corresponding to the (100-X)th percentile of the distribution of
changes in the value of the portfolio (Hull, 2007). With 98 % confidence level, the VaR-value is the
second percentile of the distribution. By simulating from this distribution 100 times, there should on
average be two values exceeding this value.
Even though Value-at-Risk gives an easily understandable answer, there is a drawback. The VaRmeasure only provides a value for the maximum loss with a certain probability; it does not say
anything about the loss if that value is exceeded. Hull (2007) demonstrates that this may have a
practical drawback in terms of a trader’s risk limits. If the trader is being told that the one-day 99 %
VaR has to be kept at a maximum of 10 million, the trader can construct a portfolio where there is a
99 % chance of losing less than 10 million, but a 1 % chance of losing much more.
3.2.2. Expected Shortfall
The previously mentioned weakness may be eased by the use of Expected Shortfall (ES). This
measure is presented by Hult and Lindskog (2007) as:
“For a loss L with continuous loss distribution function FL the expected shortfall at confidence level
α ∈ (0,1), is given by”
ESα ( L ) = E ( L L ≥ VaRα ( L ))
Instead of asking how bad things can get, ES measures what the expected loss is if things do get bad
(Hull, 2007). ES is thus the average amount that is lost over the N day-period, if the loss has
exceeded the (100-X)th percentile of the distribution (i.e. the VaR-value). The following figure
illustrates the difference between Value-at-Risk and Expected Shortfall.
17
Figure 1. Illustration of Value-at-Risk and Expected Shortfall.
See Hull (2007, p. 198) for a similar version.
3.2.3 Extreme Value Theory
Extreme Value Theory (EVT) is the science of estimating the tails of a distribution (Hull, 2007). The
tail does here refer to the ultimate end of the distribution that, in terms of a loss distribution,
consists of very high losses. If the tail is heavy, it means that there is a considerable amount of high
losses at the end of the tail. Hult and Lindskog (2007, p. 28) point out that even though there is no
definition of what is meant by a heavy tail, it is “common to consider the right tail F ( x ) = 1 − F ( x ) , x
large, of the distribution function F heavy if: ”
lim
x →∞
F (x )
= ∞ , for every λ > 0
e − λx
Hult and Lindskog (2007) further present the quantile-quantile plot (qq-plot) as a method to achieve
an indication of the heaviness of the tail. It is a useful tool for assessing the distribution of identically
and independently distributed variables. By using a reference distribution F, it is possible to plot the
sample against the reference distribution and thereby get an understanding of how our sample
behaves in reference to F. If Xk,n is our sample, the qq-plot consists of the points (Hult & Lindskog,
2007, p. 29):
⎧⎛
⎫
←⎛ n − k +1⎞⎞
⎟ ⎟⎟ : K = 1,..., n⎬
⎨⎜⎜ X k ,n , F ⎜
⎝ n +1 ⎠⎠
⎩⎝
⎭
18
If the plot achieved is linear, it means that the sample has a distribution similar to the reference
distribution (Hult & Lindskog, 2007). If the sample has heavier tails than the reference distribution,
the plot will curve up at the left and/or down at the right. If the sample has lighter tails than the
reference distribution, the plot will curve down at the left and/or up at the right (Hult & Lindskog,
2007). The figure below is a qq-plot that compares the sample of historical losses to a simulation of
lognormal ones. Since the plot achieved is linear, it is fair to assume the losses to be approximately
lognormally distributed.
Figure 2. QQ-plot.
Hull (2007) mentions that EVT can be used to improve VaR estimates, since it smoothes and
extrapolates the tails of the empirical distribution. This means that EVT may be useful where
extreme historical data is relatively scarce. EVT may also be used to estimate VaR when the VaR
confidence level is very high, and thus provide a closer estimate (Hull, 2007).
One major result within EVT, concerning the right tail of the probability distribution, was proved by
Gnedenko in 1943 (Hull, 2007). He found that the right tail of the probability distribution behaves
according to the generalized Pareto distribution as the threshold u is increased. Hult and Lindskog
(2007, p. 38) present the generalized Pareto distribution (GPD) function as:
⎛ γ x⎞
⎟
Gγ , β ( x ) = 1 − ⎜⎜1 +
β ⎟⎠
⎝
19
−
1
λ
for x ≥ 0
The estimator of the tail (i.e. of the part of the distribution that exceeds u), is presented by Hult and
Lindskog (2007, p. 39) as:
N
Fˆ (u + x ) = u
n
⎛
x⎞
⎜1 + γˆ ⎟
⎜
βˆ ⎟⎠
⎝
−
1
γˆ
(1)
The estimator of the quantile is presented by Hult and Lindskog (2007, p. 39) as: 3
−γˆ
⎞
⎞
βˆ ⎛ ⎛ n
qˆ p (F ) = u + ⎜ ⎜⎜ (1 − p )⎟⎟ − 1⎟
⎟
γˆ ⎜ ⎝ Nu
⎠
⎝
(2)
⎠
In order to use the Peaks Over Threshold (POT) method for the estimation of tail probabilities and
quantiles, one first have to choose the high threshold u and count the number Nu that exceed that
value. See figure below.
Figure 3. Illustration of the POT-method.
Given this sample of exceedances (the parts of the losses that exceed u), the next step is to estimate
the parameters γ and β. These are found by using a maximum likelihood estimation of the
parameters, assuming the losses exceeding u are generalized Pareto distributed. 4 The values of u, Nu,,
γ and β may then be inserted into (1) and (2). Simulation from (1) now gives a smoother tail than the
original sample.
3
4
For proof, see Hult & Lindskog (2007. p. 39).
For a more detailed description, see Hult & Lindskog (2007, p. 41).
20
By using the POT-method, the VaR and ES 5 may be calculated directly as well. Hult and Lindskog
(2007, p. 44) present the following formulas, based on the above estimated parameters:
−γˆ
⎞
⎞
βˆ ⎛⎜ ⎛ n
ˆ
⎜
⎟
(
)
(
)
VaRp, POT X = u + ⎜
1 − p ⎟ −1⎟
⎜
⎟
γˆ ⎝ Nu
⎠
⎝
⎠
βˆ + γˆ (qˆ p − u )
Eˆ S p , POT ( X ) = qˆ p +
1 − γˆ
3.3 Distribution Functions
This report concerns two types of distributions; the discrete distribution (for example binomial,
geometric and Poisson distributions) and the continuous distribution (for example exponential, gamma
and normal distributions). Why these two are of current interest is explained in more detail in
chapter 5.3.
The definition of a distribution function FX, of the random variable X, is defined as (Gut, 1995, p.
7):
FX ( x ) = P ( X = x ),−∞ < x < ∞
For discrete distributions we introduce the probability function pX, defined as:
p X ( x ) =P ( X = x ), for all x
For the discrete probability function, the following is true (Gut, 1995, p. 7):
FX ( x ) = ∑ p X ( y ) , − ∞ < x < ∞
y≤ x
For continuous distributions we introduce the density function fX, for which (Gut, 1995, p. 7):
5
For proof, see Hult & Lindskog (2007, p. 41).
21
FX ( x ) =
x
∫ f ( y ) dy , − ∞ < x < ∞
X
−∞
What is described above is how one random variable, X, may be distributed. There may also be the
case that several variables are distributed together. If we introduce another random variable, Y, the
description of how the pair (X,Y) is distributed is given by the joint distribution function, FX,Y (Gut,
1995, p. 9):
p X ,Y (x, y ) = P ( X = x, Y = y ) , − ∞ < x, y < ∞
There exists a joint probability function in the discrete case, given by (Gut, 1995, p. 9):
FX ,Y ( x, y ) = P ( X ≤ x , Y ≤ y ) , − ∞ < x, y < ∞
There exists a joint density function in the continuous case, given by (Gut, 1995, p. 9)
f X ,Y ( x, y ) =
∂ 2 FX ,Y (x, y )
∂x∂y
, − ∞ < x, y < ∞
3.3.1 Poisson Distribution
The Poisson distribution is commonly referred to as Po(m), where m > 0. It belongs to the discrete
distribution functions and its probability function is defined as (Gut, 1995, p. 259):
p(k ) = e −m
mk
, k = 0,1,2,...
k!
Blom (2005) describes the Poisson distribution as a distribution that appears in the study of
randomly occurrences in time or room. Example of this is for example the occurrence of a traffic
accident or that someone is calling SOS. These may occur at any given time point and are
independent of each other (Blom, 2005). k in the formula above is thus the number of events that
appear in a given interval of time length t; causing k to be Po(m)-distributed, where m is the
expected value of occurrences in that interval.
22
By simulating 1000 times from a Po(5)-distribution, the following plot is achieved. It should be read
as the number of occurrences per outcome. I.e. the outcome 0 occurs approximately 48 times, the outcome 1
approximately 92 times etc.
Figure 4. Illustration of the Poisson distribution with µ=5.
If the variables themselves are Poisson-distributed, they occur in time according to a Poissonprocess. Gut (1995) describes the Poisson process as a discrete stochastic process in continuous
time that is commonly used to describe phenomena as the above (the SOS-call and the traffic
accident). The Poisson process is by Gut (1995, p. 196) defined as “a stochastic process, {X(t), t ≥
0}, with independent, stationary, Poisson-distributed increments. Also, X(0) = 0.” X(t) in the
definition is the number of occurrences in the time interval between 0 and t.
3.3.2 Lognormal Distribution
The lognormal distribution is commonly referred to as LN(μ,σ2), where -∞ < μ < ∞, σ > 0. It
belongs to the continuous distribution functions and its density function is defined as (Gut, 1995, p.
261):
f (x ) =
1
σ x 2π
e
1
− (log x − μ ) 2 / σ 2
2
23
,x>0
In the lognormal distribution, the log of the random variable is normally distributed. This is easier to
grasp by comparing the above formula for the lognormal distribution with the below one for the
more common normal distribution.
f (x ) =
1
− ( x − μ )2 / σ
1
e 2
, −∞ < x < ∞
σ 2π
By simulating 1000 times from a LN(12,2)-distribution and sorting the severity in increasing order,
the following plot is achieved:
Figure 5. Illustration of the lognormal distribution with µ=12 and
σ=2.
3.4 Copula
Copula is a well-known concept within Risk Management theory because of its usefulness for
building multivariate models with non-standard dependence structures (Hult & Lindskog, 2007).
The copula is a function that defines a correlation structure between two correlated variables, each
with its own marginal distribution. If the marginal distribution for example is a normal distribution,
it is convenient to assume that the variables together are bivariate normally distributed (Hull, 2007).
The problem however is that there exists no natural way of defining a correlation structure between
the two marginal distributions; the bivariate normally distribution is not the only way the two
24
variables could be jointly distributed. Hull (2007) explains that this is where the use of copulas
comes in. This section presents two different ways of explaining what a copula is; the first one is a
mathematical explanation by Hult and Lindskog (2007), the second one a descriptive explanation by
Hull (2007).
Hult and Lindskog (2007, p. 63) present two complementing definitions of the copula (where the
second one includes Sklar’s theorem):
“A d-dimensional copula is a distribution function on [0,1]d with standard uniform marginal distributions. […]
This means that a copula is the distribution function P(U1 ≤ u1, …, Ud ≤ ud) of a random vector (U1, …, Ud) with
the property that for all k it holds that
P(Uk ≤ u) = u for u ∈ [0,1].”
“Let F be a joint distribution function with marginal distribution functions F1, …, Fd. Then there exists a copula C
such that for all
x1, …, xd ℜ ∈ [- ∞ , ∞ ],
F ( x1 ,..., xd ) = C (F1 ( x1 ),..., Fd ( xd ))
(10.1)
If F1, …, Fd are continuous, then C is unique. Conversely, if C is a copula and F1, …, Fd are distribution functions,
then F defined by (10.1) is a joint distribution function with marginal distribution functions F1, …, Fd. […] Let F
be a joint distribution function with continuous marginal distribution functions F1, …, Fd. Then the copula C in
(10.1) is called the copula of F. If X is a random vector with distribution function F, then we also call C the copula of
X. “
Hull (2007) explains the copula phenomenon by taking two variables with triangular probability
distributions as an example, he calls them V1 and V2. In order to find out the correlation structure
between these two variables, the author uses the Gaussian copula. In order to do so, the variables
are each mapped into two new variables (call them U1 and U2) that are standard normally
distributed. This is done by looking at V1’s value in each percentile of the distribution and
calculating what that is according to the standard normal distribution. By assuming that the variables
U1 and U2 are jointly bivariate normal, it implies a joint distribution and correlation structure
between V1 and V2 (Hull, 2007). What is done here is what the copula does in practice. Instead of
25
determining the correlation directly out of the original variables (V1 and V2 in this case), these are
mapped into other variables (U1 and U2) with well-behaved distributions for which a correlation
structure is easily defined.
The key property of the copula model here is that the marginal
distributions are preserved at the same time as the correlation structure between them is defined
(Hull, 2007).
3.5 Simulation Methods for Computing VaR/ES
3.5.1 Historical Simulation
In this simulation approach, it is supposed that the historical risk factor changes are representative
for the future. I.e. it is supposed that the same changes will occur over the next period (Hult &
Lindskog, 2007). With the aid of the risk factor changes we achieve the loss vector l. The losses are
then sorted in increasing size, in order to compute the empirical VaR and ES using the formulas
below (Hult & Lindskog, 2007, p. 25). n represents the number of losses in the loss vector.
( )
VˆaRα (L ) = qˆ FLn = l[n (1−α )]+1,n
[n (1−α )]+1
Eˆ Sα (L ) =
∑l
i =1
i ,n
[n(1 − α )] + 1
Hult and Lindskog (2007) however mention the disadvantages of the worst case never being worse
than what has already happened in the past. “We need a very large sample of relevant historical data
to get reliable estimates of Value-at-Risk and expected shortfall” (Hult & Lindskog, 2007, p. 25).
3.5.2 Monte Carlo Simulation
The use of the Monte Carlo simulation method requires an assumption of the distribution of the
previous mentioned risk factor changes. The real loss distribution is thus approximated by the
empirical distribution FLN. Instead of using historical observations, the risk factor changes are in this
method simulated according to the distribution chosen. The empirical VaR and ES are then
computed the same way as shown above.
26
The authors consider the simulation method to be flexible, since it is possible to choose any model
from which it is possible to simulate. It is however computationally intensive as a large amount of
simulations have to be done in order to give a statistically correct value of the confidence level
chosen (Hult & Lindskog, 2007).
27
4 Basel Rules & Previous Research
This chapter aims to give an overview of the Basel Committee’s regulation regarding the calculation
of the capital requirement. It provides a description of the three types of models that may be used in
this process, where AMA is one. Three different approach of how to build the AMA is also
presented in order to give an overview of the alternatives available. The chapter also aims to give an
overview of the previous research regarding AMA and its implementation.
4.1 Three Types of Models
The Basel Committee on Banking Supervision (2006) has identified three types of models for the
calculation of the capital requirement for operational risk. These are, in order of increased
sophistication; the Basic Indicator Approach (BIA), the Standard Approach (SA) and the Advanced
Measurement Approaches (AMA).
4.1.1 Basic Indicator Approach (BIA)
BIA is the simplest approach of the ones available. The Basel Committee on Banking Supervision
(2006, p. 144) explains it as follows: “Internationally active banks and banks with significant
operational risk exposures (for example, specialized processing banks) are expected to use an
approach that is more sophisticated than the Basic Indicator Approach and that is appropriate for
the risk profile of the institution”. The bank must thus hold capital for operational risk equal to the
average over the previous three years of a fixed percentage (15 %) of positive annual gross income 6 .
It is expressed as follows (Basel Committee on Banking Supervision, 2006, p. 144):
K BIA =
α
N
N
∑ GI
i
1
Where KBIA= the capital requirement under the Basic Indicator Approach, α = 15 % (which is set by
the committee), N = number of the three previous years for which the gross income is positive, GIi
= annual gross income (if positive).
Gross Income = Net Interest Income + Net Non-Interest Income (Basel Committee on Banking Supervision, 2001, p.
7).
6
28
4.1.2 Standard Approach (SA)
“In the Standardised Approach, banks’ activities are divided into eight business lines: corporate
finance, trading & sales, retail banking, commercial banking, payment & settlement, agency services,
asset management, and retail brokerage” (Basel Committee on Banking Supervision, 2006, p. 147).
Just like in the Basic Indicator Approach (BIA), you look at an average over the three last years. But
instead of using only one fixed percentage for the entire bank, there are different percentages for all
of the eight business lines. Similarly to the BIA, if the aggregate gross income for all business lines
any given year is negative, it counts as zero. In detail, this is done as follows:
⎛
⎡ 8
⎤⎞
⎜
max
,
0
GI
β
⎢∑ i , j j ⎥ ⎟⎟
∑
⎜
i =1 ⎝
⎣ j =1
⎦⎠
=
3
3
K SA
Where, KSA = the capital requirement under the Standardized Approach, GIi,j= annual gross income
in a given year for each of the eight business lines, βj= a fixed percentage, set by the committee, for
each of the eight business lines. The β-values are detailed below:
Business Lines
Beta Factors
Corporate Finance (β1)
18 %
Trading & Sales (β2)
18 %
Retail Banking (β3)
12 %
Commercial Banking (β4)
15 %
Payment & Settlement (β5)
18 %
Agency Services (β6)
15 %
Asset Management (β7)
12 %
Retail Brokerage (β8)
12 %
Figure 6. List of the β-values in the SA (Basel Committee on
Banking Supervision, 2006, p. 147).
29
4.1.3 Advanced Measurement Approaches (AMA)
The focus of this study is the development of an Advanced Measurement Approach (AMA). This
approach implies that the bank should by itself model the operational risk; there is no direct formula
available as above. The measurement system must, according to the Basel Committee on Banking
Supervision (2006, p. 144), “reasonably estimate unexpected losses based on the combined use of
internal and relevant external loss data, scenario analysis and bank-specific business environment
and internal control factors”.
Figure 7. The requirements for the AMA-model.
The internal data contains the losses that the bank has experienced and reported into its own
system. N.B. that all of the reported losses exceed a specific amount, the reporting threshold. That
means that all losses that are not as severe as to reach that threshold are not reported into the
system. One can thus say that the internal dataset is “truncated” below a specific value. The external
data are for example losses from several banks that have been pooled in order for member banks to
collect supplementary information. ORX is one of these pools where members are expected to
report their full loss data history on a quarterly basis (ORX Association, 2007). The threshold for
these data is € 20000. Scenario analysis implies the use of expert opinion in form of risk
management experts and experienced managers in order to evaluate exposure to high-severity
events. The analysis should also cover how deviations of correlation assumptions may impact the
outcome (Basel Committee of Banking Supervision, 2006). Business environment and internal
control factors are drivers of risk that should be translatable to quantitative measures. Changes of
risk control in the bank should thus be captured by the model.
4.2 Three Types of AMA Models
Since there is no specific regulations of how to develop the AMA model, except that it has to fulfil
the above requirements, there have been different approaches at different banks. The Basel
committee (Basel Committee on Banking Supervision, 2001) has acknowledged three broad types of
30
approaches that are currently under development; the internal measurement approach (IMA), the
loss distribution approach (LDA) and the scorecard approach (SCA).
4.2.1 Internal Measurement Approach (IMA)
In this type of approach the bank’s losses is generally divided into business lines and event types.
For each of these combinations, the expected loss is calculated by the combination of frequency and
severity estimates. The capital charge for each of the combinations Ki,j is (Basel Committee of
Banking Supervision, 2001):
K i , j = γ i , j * EI i , j * PDi , j * LGDi , j = γ i , j * ELi , j
Where γi,j= a parameter whose value depends on the combination of business line / event type, EIi,j
= the Exposure indicator. The higher EIi,j the larger exposure in that particular business line, PDi,j=
Probability of default, LGDi,j= the loss given default.
IMA thus assumes the relationship between expected and unexpected loss to be fixed, regardless of
the level of expected losses and how the frequency and severity are combined (Basel Committee of
Banking Supervision, 2001).
4.2.2 Loss Distribution Approach (LDA)
The loss distribution approach has over the recent years emerged as the most common of the three
approaches (Jobst, 2007). As in the case of IMA, the bank’s losses are divided into business lines and
event types. The approach is founded on certain assumptions about the distributions for the severity
and frequency of events (Basel Committee on Banking Supervision, 2001). These are commonly
simulated using the Monte Carlo simulation technique (ITWG, 2003). The aggregated loss
distribution is the combination of these two distributions. By using the Value-At-Risk of the loss
distribution one finds the total risk exposure (EL and UL) for 1 year at 99.9 % statistical confidence
level (Jobst, 2007). In other words, this amount should cover all expected and unexpected losses the
bank faces during a year with 99.9 % probability. I.e. if the model is correct, the bank’s equity should
not be sufficient one year out of 1000. What distinguishes this approach is that it assesses unexpected
losses directly. It does not, as in the case of IMA, make an assumption about the relationship
31
between EL and UL (Basel Committee of Banking Supervision, 2001). Haas and Kaiser (Cruz, 2004)
present an overview of the Loss Distribution Approach, illustrated as follows:
Figure 8. Overview of the Loss Distribution Approach. (Cruz, 2004, p. 18)
4.2.3 Scorecard Approach (SCA)
This approach is based on the idea that banks determine an initial level of operational risk capital,
which they modify over time as the risk profile changes. The scorecards that are used to reflect
improvements of risk control may be based on either actual measures of risks (for example LDA or
IMA) or indicators as proxies for particular risk types (Basel Committee on Banking Supervision,
2001). Even though the model has to incorporate both internal and external data in order to be
qualified as an AMA, this approach is quite different from LDA and IMA regarding the use of
historical information. According to the Basel Committee on Banking Supervision (2001), once the
initial amount is set the modification can be made solely on qualitative information.
4.3 Previous Research – AMA
The research regarding AMA and its implementation regards everything from qualitative
requirements to detailed mathematical derivations. Since we have limited our thesis to the
quantitative requirements, we have only searched for reports concerning these. A selection of the
empirical research that was found is presented below.
Frachot and Roncalli (2002) propose a way of how to mix internal and external data in the AMA;
both the frequencies and the severities.
32
Baud, Frachot and Roncalli (2002) present a way to avoid the overestimation of the capital charge in
the mix of truncated internal and external data. With the argument that the truncation gives falsely
high parameter values, they propose a way to adjust for the unreasonably high capital charge that is
calculated.
Shevchenko (2004) mentions important aspects in the quantification of the operational risk. These
are among others the dependence between risks, the scaling of the internal data and the modelling
of the tail.
Embrechts, Furrer and Kaufmann (2003) provide a thoroughly explanation of how extreme value
theory can be applied in the model. They also propose 200 exceedances above u in the POT-method
to be ideal for reliable estimation of the tail.
Frachot, Georges and Roncalli (2001) explore the LDA approach. They calculate the capital charge,
compare the approach with the IMA and relate it to the economic capital allocation in the bank.
Frachot, Roncalli and Salomon (2004) examine the correlation problem in the modelling of
operational risk. They present a simplified formula for the total capital charge where the correlation
parameter is incorporated. The correlation parameter is, according to their calculations, not higher
than 5-10 %.
Jobst (2007, p. 32) focuses on the extreme value theory and found that a bank with “distinct lowfrequency, high-severity loss profile” only loses approximately 1.75 % of gross income over five
years. This can be compared with the SA where the capital charge approximates 15 % of gross
income. Thus, Jobst (2007) argues that business volume may not be a good measure of the drivers
behind operational risk.
33
5 Model Choice & Assumptions
The literature concerning operational risk, and the AMA in particular, presents a wide range of
model approaches as shown. The Basel Committee’s list of approaches (IMA, SCA and LDA) is an
attempt to categorize the different models suggested. Since the model choice as well as the
assumptions made is critical for the model design, this section concerns these issues.
5.1 What is a Good Model?
Since our case study is the development of a model, one may ask what a good model is in this
respect. And if there is a difference in the answer depending on who is asked. The reason for
turning from simpler to more advanced methods from Finansinspektionen’s point of view is to
achieve a more precise calculation of the operational risk that the bank is exposed to. For the bank
to have an incentive to run the development from simple to advanced model (more than to get a
model that more precisely estimates the risk) the more simple methods have overestimated the risk
taken. By developing an AMA-model, the bank has a chance to lower the capital requirement, and
thus the equity that has to be held. The question of how to design a good model is thus two folded.
Both the bank and Finansinspektionen wants a model that estimates the risk as precisely as possible.
From the bank’s perspective, the capital requirement calculated however also has to be lower than
with the Standard approach in order to be implemented in the bank. We have tried to rid ourselves
off the fact that we work for the bank and have aimed to make the model as precise and
“academically correct” as possible. Since we lack the data necessary, it is not possible to figure out if
the capital requirement actually turns out to be lower than with the model currently used.
A good model according to us is further a model that gives good incentives to improve the risk
exposure of the bank. One may argue that the main role for the model itself is not to measure, but to
have a driving power on how the risk is managed within the bank. Key employees should further on
be able to comment and influence some parameters of the model so as to make it as bank-specific as
possible. It should also be flexible to business changes over time; if the risk or size increases, it
should be possible to adjust some parameter so that it affects the result.
34
5.2 Overall Approach Choice
Our overall approach choice, based on the Basel Committee’s list of approaches, is the Loss
Distribution Approach (LDA). The main reason for the choice is the fact that it appears to be more
of a “best practice” among academics than the others. Frachot, Roncalli and Salomon (2004, p. 1)
emphasize that “we firmly believe that LDA models should be at the root of the AMA method”.
Shevchenko (2004, p. 1) mentions that ”Emerging best practices share a common view that AMA
based on the Loss Distribution Approach (LDA) is the soundest method”.
There are however drawbacks to the “basic” LDA approach presented in chapter 4.2.2. Nyström
and Skoglund point out, in the collection by Cruz (2004), that the operational risk event in the basic
version is completely exogenous, leaving the risk manager with no control over the risks and the
capital charge. It also implies perfect positive dependence between the cells (BL/ET), something
that is both unrealistic and gives too high of a capital requirement. We have chosen this model, but
have made a few exceptions due to these issues. In our model, the total losses from the 56 cells are
aggregated each year; the Value-at-Risk is thus measured on the aggregated number, not on the 56
cells separately. That implies that we do not consider them to be perfectly correlated as in the
“basic” LDA case. All cells, except for some as explained in section 5.3, are instead considered
independent. We have also added a scaling factor that causes risk managers influence to be reflected
in the model.
5.3 Distribution Assumptions
The loss frequency is assumed to be Poisson distributed. This is in line with “best practice” in the
area; Rao and Dev states in the collection by Davis (2006, p. 278) for example that “Most
commonly, a frequency distribution is posited as a Poisson distribution”, Kühn and Neu (2008, p. 3)
say that “Common choices for the loss frequency distribution function are the Poisson or negative
binomial distribution” and Mignola and Ugoccioni (2006, p. 34) mention that “The frequency
distribution is assumed to be a Poisson distribution …”.
There is no consensus about how the severity is distributed; but in order to reflect high severities,
the tail has to be long and heavy tailed. The most common ones to use are according to Rao and
Dev (as presented in the collection by Davis 2006) the lognormal distribution and the Weibull
35
distribution. The authors however mention that the lack of data at the right tail (the very high losses)
implies the use of extreme value theory. They refer to a study conducted by De Koker (2005) which
implies a solid basis for using generalized Pareto distribution (the POT-method in EVT) in the tail
and lognormal or Weibull in the body. Moscadelli (2004) also reports that the extreme value theory,
in its POT-representation, “explains the behaviour of the operational risk data in the tail area well. “
The problem in our model is however that the use of the generalized Pareto distribution (i.e. the
POT-method) implies that one has to make a choice about the value of u. Embrechts, Furrer and
Kaufmann (2003) emphasize that this choice is crucial, but not easily made. The u has to be
significantly high, and there has to be a significant number of losses exceeding this value.
Embrechts, Furrrer and Kaufmann (2003) refer to a simulation study, worked out by McNeil and
Saladin, which considered 200 exceedances over u to be necessary; both if one chooses u to be 70 %
and 90 % of the largest value. Since the bank’s internal data do not fulfil these requirements and
since we lack external data, we are not able to fulfil that requirement in the choice of u. Thus, we can
not use the POT-method for the tail distribution and are left with only one distribution for the
whole body and tail. In the instruction for future updates, a remark about the POT-method is
conducted. In order to make a choice about the lognormal or Weibull distribution for the severity
distribution, two qq-plots were made:
Figure 9. qq-plot of the internal data and the lognormal distribution.
36
Figure 10. qq-plot of the internal data and the Weibull distribution.
Since a straight line indicates that our sample is distributed as the reference distribution (as explained
in section 3.2.3) we decided, by looking at the qq-plots, that the lognormal distribution was the most
appropriate choice for the severity of the data.
5.4 Correlation Assumptions
The correlation among the cells is one major issue that is illustrated in several research reports.
When referring to the correlation; there may be both frequency correlations and severity
correlations. We have in our model tried to make a bottom-up approach, indicating that the cells
have to have obvious dependence in order to be considered correlated. We have thus considered
some cells to be correlated out of the assumption that they have occurred simultaneously by a
reason. No correlation has been applied afterwards.
The assumptions are proposed by key employees within the bank. In order for event types to be
correlated but not reported as one loss, there has to be an “indirect” correlation. Thus, there has to
be something that triggers the loss in the other event type, but nothing that is all too apparent so
that they will be reported as one major loss instead of two separate ones. The Event types that are
considered correlated are Business Disruptions & System Failures & Internal Fraud, Execution, Deliver &
37
Process Management & Internal Fraud and Business Disruption & System Failures & External Fraud.
Examples of these are IT-crashes that cause internal and external fraud, and control failures that lead
to internal fraud. The correlations are illustrated in the figure below. Each colour represents one
type of correlation and there are only correlations within each business line. The number of
correlation pairs thus totals 24.
Figure 11. Overview of the correlation pairs assumed in “our” bank.
The frequencies of the “x-marked” cells are assumed to follow a joint Poisson distribution. That means
that the pairs are Poisson-distributed “together”, recall the definition
p X ,Y (x, y ) = P ( X = x, Y = y ) , − ∞ < x, y < ∞
How the correlations are handled in the model is presented in greater detail in chapter 6.
The potential correlation between severities may be modelled by the use of copulas. Recall that the
copula is a tool that defines a correlation structure between two correlated variables, each with their
own marginal distributions. Marginal distributions refer to the own frequency distribution that each
cell has (even if they both have marginal Poisson distributions, they probably have different
parameter values). By using a copula, the marginal distributions are preserved at the same time as the
correlation structure between the cells is defined. Here, we however made the assumption that the
severities of the cells are not likely to be correlated. I.e. a large loss in Business Disruptions & System
Failures does not imply a large loss in Internal Fraud, only that the frequencies of the losses are
38
dependent. There is however a possibility of implementing a severity correlation in the model, if it
can be shown that there is a substantial positive dependence between them.
5.5 Assumptions regarding Scaling, Inflation & Truncation Bias
When it comes to the mixing of internal and external loss data, there is a potential problem relating
to size. “Our” bank is relatively small compared to the other banks in the ORX database (ORX
Association, 2007). We assume that larger banks have larger operational losses and that the income
thus reflects the amount of risk the bank is exposed to. This is in line with the less sophisticated
models proposed by the Basel Committee, which calculate the capital requirement solely on the
amount of gross income in the bank. Since we want to build the model as flexible as possible, we
want to scale each combination of Business Line/Event Type. That is done by adding a cap for how
large the severities can be in each cell. Unreasonable great losses above a certain threshold are scaled
down in order to better reflect the risk that “our” bank is exposed to in that particular Business
Line/Event Type.
We have decided to adjust for the inflation effect by multiplying the severities with (1 + average
inflation)k. k denotes the number of years since the loss occurred, where the average inflation is
calculated over the last five years.
Different banks have different levels of truncated internal loss data. That means that only losses that
exceed the value of h is reported, causing the dataset to be truncated at the value of h. Baud, Frachot
and Roncalli (2002) report that the truncation affects the estimated parameter values used in the
simulation. That in turn causes an overestimation of the capital charge calculated by Value-at-Risk.
Since “our” bank’s truncation level h is relatively low, we assume there to be a marginal impact on
the parameters.
5.6 Risk & Simulation Method
We have chosen the Value-at-Risk measure in the model, despite Expected Shortfall’s advantages
described in chapter 3.2.2. The reason behind this rationale is three folded; Finansinspektionen does
not require the use of ES in the model, it is best practice to use Value-at-Risk (especially in the loss
distribution approach chosen) and the security level of 99.9 % is expected to be sufficiently high.
39
The simulation method chosen is the Monte Carlo simulation. It is superior to the historical
simulation, since the latter is limited to the losses that have occurred in the bank. By using a Monte
Carlo simulation, it is possible to simulate larger losses than what has happened historically. Major
simulated losses that exceed our yet largest loss are thus possible according to the mean and variance
in the historically data, with the only exception that they have yet not occurred. What nonetheless
needs to be emphasized is that the distribution assumption causes a limit (even though not as severe
as in the historical simulation case) to the losses that can be simulated; the simulated values are
completely dependent on the distribution that has been chosen.
40
6 Description of Our Model
This section describes how our model has been designed. The description is divided into four parts;
an overall view of how the model is designed, description of the import of data, the processing of
data and how the simulation is conducted. N.B. that the Matlab code has not been published due to
confidential reasons.
6.1 Model Overview
The calculations in this model are tested only on internal historical loss data. The model is however
constructed so that it is possible to import external loss data and mix them with the internal ones as
soon as they become available. The data is first imported into Matlab where it is sorted and
structured to facilitate further calculations. Irrelevant data is removed at this stage. After that, we fit
the data into different distributions according to our assumptions. Ultimately we simulate losses
from these distributions and identify VaR0.999 (the Value-at-Risk at confidence level 99.9 %). Each
step is thoroughly explained below.
6.2 Data Import
The historical losses are delivered in excel-sheets. In order to use the data in Matlab, it has to be
“recoded”. This is done as follows:
1. Every Business Line is given a number.
1
2
3
4
5
6
7
8
Business Lines
Corporate Finance
Trading & Sales
Retail Banking
Commercial Banking
Payment & Settlement
Agency Services
Asset Management
Retail Brokerage
Figure 12. Business Line overview.
41
2. Every Event Type is given a number.
1
2
3
4
5
6
7
Event Types
Internal Fraud
External Fraud
Employment Practices & Workplace Safety
Clients, Products & Business Practices
Damage to Physical Assets
Business Disruption & System Failures
Execution, Delivery & Process Management
Figure 13. Event Type overview.
This gives us a matrix of 56 different kinds of losses looking as follows:
Figure 14. Matrix overview.
3. Dates are converted into numbers, where 1900-01-01 is the first day and the all the following
dates are counted up by one (i.e. 2008-09-11 is converted into 39702). This is done, in the
Swedish version of Excel, by using the command ‘=DATUMVÄRDE("2008-09-11")’.
4. Every Region is given a number.
1
2
3
Area
Sweden
Baltic States
International
Figure 15. Area overview.
42
5. Events that have neither BL nor ET are removed since they cannot contribute to the
calculations. There must not be any extra spaces in the data, i.e. a loss of ten thousand SEK
must for example be listed as “10000” and not as “10 000,00”.
6. Once all the text has been coded into digits, the data is imported into Matlab.
6.3 Data Processing
Once imported, the data needs to be processed. This is done as follows:
1. Direct and Indirect (Other) losses are added together. Recoveries are not taken into
consideration, since it is the direct loss that is of interest, not the long-term effect.
2. Data older than date x 7 is removed from the data set. That, since the bank’s data collection
procedures were not fully reliable until year x.
3. When the data is delivered it is sorted in the order of reporting date. However, the reporting
date is not very important, what matters the most is the time of occurrence. The data is thus resorted in order of when it actually happened, starting with the most recent event. It is then
divided into separate years y1, …, yn. Each year gets two matrices, one for frequency and one for
severity.
Figure 16. Overview of how the data is sorted.
4. The average frequency per year and the average severity per occurrence are calculated. This is
done for each Business Line and Event Type. The yearly losses are calculated by starting with
the latest event (not necessarily today) and counting a year from that date. See figure below.
7
The date x is confidential.
43
Figure 17. Frequency calculation.
5. Average frequency and severity for each Business Line and Event Type is calculated for the
different regions as well. As for the frequency calculation, we assume that the data available
represents the same number of years for all regions. That, even though it in reality may not
always be the case. See figure below:
Figure 18. Frequency calculation across different areas.
6. Frequencies are adjusted depending on the relative size of that specific Business Line compared
to the average size of a bank involved in the external data. Size is calculated as the average
turnover per bank per year over the last three years.
7. In order to compensate for losses that are unreasonably large for a bank of “our” bank’s size,
external severities are capped. Each cell has its own cap based on size (measured in gross income
per annum) and expert opinions. The compensated loss for losses exceeding the cap equals the
cap size plus x percent of the residual loss 8 . Losses that are large (more than 50 % of the cap
size) but not larger than the cap are reduced by a percentage based on the size of the loss
compared to the cap. This is done in two steps; at 50 % and at 75 % of the cap size.
8
In our case, we chose 1 %.
44
Figure 19. Illustration of the scaling.
To know exactly what reduction to use we would recommend comparing the average of the top
25 % of the internal losses µint,1 with the average of the top 25 % of the external losses µext,1 (see
figure 20). Then scale the losses by multiplying the external losses that are more than 75 % of
the cap with:
1+
x1 =
μ int,1
μ ext ,1
2
Similar calculations can be made with the top 25 % through 50 % of the external and internal
losses. This means that if the internal losses in the top quadrant are, on average, 80 % of the
external losses in the top quadrant, then we will use 90 % of the external losses that are larger
than 75 % of the cap size in our calculations. Please note that the cap sizes will be set relatively
high, so this adjustment of losses will only be used if the losses are substantially large and thus
unlikely to occur. To smoothen the curve above (i.e. to make sure that losses that are just above
a certain threshold is not counted as lower than a loss just below that same threshold) we adjust
the model by letting the adaptations on the lower levels be used also for the bigger losses. I.e. a
loss that exceeds the cap size C will be adjusted as follows:
~
L = C ⋅ 0.5 + (C ⋅ 0.75 − C ⋅ 0.5) ⋅ x 2 + (C − C ⋅ 0.75) ⋅ x1 + (L − C ) ⋅ x0
45
Where
~
L = Loss used in calculatio ns
C = Cap size
L = Actual external loss
x0 = Constant above cap size
x1 = Constant for top 25 %
x 2 = Constant for top 25 % - 50 %
Figure 20. Illustration of the scaling.
8. All severities are multiplied by (1 + average inflation)k where k is the number of years since the loss
occurred. This is done to compensate for inflation (which is calculated as the average inflation
over the last five years).
9. The severity data is fitted into a lognormal distribution using maximum likelihood estimation at
a 95 % confidence level.
10. The cells that are assumed to be independent, their frequencies are assumed to have a Poisson
distribution.
46
11. The pair cells that are identified as dependent are assumed to have a compound Poissondistribution. We take this into consideration by calculating a new combined frequency for the
correlated cells. The frequency answers the question of how many times each year a loss occurs
in any or both of these two cells. This is not done by just adding the two original frequencies
together, since it may happen that events in these particular cells occur at the same time without
any dependence being the cause. Just adding them would mean that they occur more often than
what is rational to assume. During the simulations, for every occurrence in this new frequency,
we simulate the combination of the two that has actually occurred (the first, the second or both
of them).
Figure 21. Illustration of the assumed correlations.
The severities are not assumed to be correlated. This means that once the number of occurrences
in each cell is calculated, the severities in each cell are simulated independent of the other cells.
Hence, we assume that an occurrence in one cell can lead to an occurrence in another, but
having a large loss in the first does not necessarily imply a large loss in the second as well.
The calculation of the correlated frequencies is conducted as follows:
Event a occurs with frequency λa (assumed given by historical data).
Event b occurs with frequency λb (assumed given by historical data).
Event c occurs with frequency λc (assumed given by historical data).
Event d occurs with frequency λd (assumed given by historical data).
47
a and/or b and/or c and/or d occurs with frequency λ (unknown). However, the combinations
(a,c), (a,d) and (b,d) can not occur in this specific part of the model since they are assumed not to
be correlated.
If a and/or b and/or c and/or d has occurred (λ), how do we know what actually occurred?
Assume:
P(I a = 1, I b = 0, I c = 0, I d = 0 ) = p1,0, 0,0
P(I a = 0, I b = 1, I c = 0, I d = 0 ) = p0,1, 0,0
P(I a = 0, I b = 0, I c = 1, I d = 0 ) = p0, 0,1,0
P(I a = 0, I b = 0, I c = 0, I d = 1) = p0, 0,0,1
P(I a = 1, I b = 1, I c = 0, I d = 0 ) = p1,1,0, 0
P(I a = 0, I b = 1, I c = 1, I d = 0 ) = p0,1,1, 0
P(I a = 0, I b = 0, I c = 1, I d = 1) = p0,0,1,1
where pa,b,c,d is the probability that event a, b, c or d occurs simultaneously or one or the other. We
know that one (and only one) of these will occur. Hence:
p1, 0,0, 0 + p0,1, 0,0 + p0,0,1, 0 + p0, 0,0,1 + p1,1,0, 0 + p0,1,1,0 + p0, 0,1,1 = 1
(1)
In order to be true to our historical data, we must choose λ so that the following holds:
λa = λ ⋅ p1, 0,0, 0 + λ ⋅ p1,1, 0,0 ⇒ p1, 0,0, 0 =
λa − λ ⋅ p1,1, 0,0
λ
(2)
λb = λ ⋅ p0,1,0, 0 + λ ⋅ p1,1, 0,0 + λ ⋅ p0,1,1,0 ⇒ p0,1, 0,0 =
λb − λ ⋅ p1,1, 0,0 − λ ⋅ p0,1,1,0
λ
(3)
λc = λ ⋅ p0,0,1,0 + λ ⋅ p0,1,1, 0 + λ ⋅ p0, 0,1,1 ⇒ p0,0,1,0 =
λc − λ ⋅ p0,1,1,0 − λ ⋅ p0, 0,1,1
λ
(4)
λ d = λ ⋅ p 0, 0,0,1 + λ ⋅ p 0,0,1,1 ⇒ p 0,0 ,0,1 =
λ d − λ ⋅ p 0,0 ,1,1
λ
(2), (3), (4) and (5) are inserted into (1) which gives:
48
(5)
λa − λ ⋅ p1,1,0, 0 λb − λ ⋅ p1,1,0, 0 − λ ⋅ p0,1,1, 0 λc − λ ⋅ p0,1,1,0 − λ ⋅ p0,0,1,1 λd − λ ⋅ p0,0,1,1
+
+
=
+
λ
λ
λ
λ
= 1 − ( p1,1, 0,0 + p0,1,1, 0 + p0, 0,1,1 )
λ is taken out, which gives:
λ=
λa + λb + λc + λd
1 + p1,1,0, 0 + p0,1,1, 0 + p0,0,1,1
So, to be able to calculate λ we first need to estimate p1,1,0,0, p0,1,1,0 and p0,0,1,1 which is done based
on historical data and expert opinions. Since also p1,0,0,0 through p0,0,0,1 will be calculated based on
this, one must be very careful when estimating p1,1,0,0 , p0,1,1,0 and p0,0,1,1, because, for example,
setting p1,1,0,0 too high could result in p1,0,0,0 being negative (which, of course, is not allowed).
Explicitly, the following must hold for p1,1,0,0 and λb:
p1,1, 0,0 + p0,1,1, 0 <
λb
λ
When simulating the correlated losses we first draw from the joint Poisson distribution. Then,
for each occurrence, we draw a number between 0 and 1. a, b, c, d or a combination thereof
occurs depending on what the drawn number is (see figure 22 below).
Figure 22. Illustration of the probabilities in the joint distribution.
The value of p0,1,1,0 may be hard to estimate for the key employees in the bank, since they have to
answer the question; “Dependent on the fact that either A, B, C or D has occurred, what is the
possibility that only B and C have occurred?”. It would have been much easier for the employee
to estimate p1,1, i.e. to answer the question “Dependent on the fact that either B or C has
49
occurred, what is the probability that both B and C have occurred?” In order to be able to ask
this question instead of the first one, we have to find what p0,1,1,0 is dependent of the value of p1,1.
The derivation of this formula is expressed below.
Figure 23. Illustration of four events that are not mutually exclusive.
Assume the four events as given in figure 23, we thus want to find:
⎧
P( X ∩ Y ) ⎫ P((B ∩ C ) ∩ ( A ∪ B ∪ C ∪ D ))
p0,1,1, 0 = P(B ∩ C | A ∪ B ∪ C ∪ D ) = ⎨ P( X | Y ) =
⎬=
P(Y ) ⎭
P( A ∪ B ∪ C ∪ D )
⎩
In this case
P ( A ∪ B ∪ C ∪ D ) = P ( A) + P (B ) + P (C ) + P (D ) − P ( A ∩ B ) − P (B ∩ C ) − P (C ∩ D ) and
P ((B ∩ C ) ∩ ( A ∪ B ∪ C ∪ D )) = P (B ∩ C ) since if (B ∩ C ) is true then
(A ∪ B ∪ C ∪ D)
must also be true. Hence,
p0,1,1, 0 =
P (B ∩ C )
P ( A) + P (B ) + P (C ) + P (D ) − P ( A ∩ B ) − P (B ∩ C ) − P (C ∩ D )
(1)
We need to find P ( A ∩ B ) , P (B ∩ C ) and P (C ∩ D ) . The question we want answered above
gives us p1,1 where, for example p1b,1,c = P(B ∩ C | B ∪ C ) . We can also express this as:
P (B ∩ C | B ∪ C ) =
P ((B ∩ C ) ∩ (B ∪ C ))
, but P ((B ∩ C ) ∩ (B ∪ C )) = P (B ∩ C ) since if
P (B ∪ C )
50
(B ∩ C ) is true then (B ∪ C ) must also be true. Hence,
P (B ∩ C | B ∪ C ) =
P ((B ∩ C ) ∩ (B ∪ C )) P (B ∩ C )
=
⇒
P (B ∪ C )
P (B ∪ C )
⇒ P(B ∩ C ) = P(B ∩ C | B ∪ C ) ⋅
1442443
= p1b,,1c
P (B ∪ C )
1424
3
⇒
=( P ( B )+ P (C )− P ( B∩C ))
⇒ P(B ∩ C ) = p1b,1,c ⋅ (P(B ) + P(C ) − P(B ∩ C )) ⇒
⇒ P(B ∩ C ) + p1b,1,c ⋅ P(B ∩ C ) = p1b,1,c ⋅ (P(B ) + P(C )) ⇒
p1b,1,c ⋅ (P (B ) + P(C )) p1b,1,c ⋅ (P (B ) + P(C )) P(B ) + P (C )
=
=
⇒ P (B ∩ C ) =
1
1 + p1b,1,c
⎛ 1
⎞
b ,c
1 + b ,c
p1,1 ⎜⎜ b ,c + 1⎟⎟
p1,1
⎝ p1,1
⎠
(2)
Note that (2) also holds for P ( A ∩ B ) and P (C ∩ D ) .
(2) is inserted into (1) and we get
p 0,1,1, 0
P(B ) + P(C )
1
1 + b ,c
p1,1
=
P( A) + P(B ) P(B ) + P(C ) P(C ) + P(D )
P( A) + P(B ) + P(C ) + P(D ) −
−
−
1
1
1
1 + a ,b
1 + b ,c
1 + c,d
p1,1
p1,1
p1,1
Since P(A) through P(D) are unknown (actually, we need p0,1,1,0 to get them), we have to use
something else. P(A) through P(D) must be based on our historical data, λa through λd, hence we
can use these to get estimations of P(X) which we call P’(X). If we assume that
P ′( X ) =
λx
λ a + λb + λc + λ d
where X = A, B, C, D. Then we can calculate our p0,1,1,0 and then calculate or “real” P(A)
through P(D). Hence
51
p 0,1,1, 0
P ′(B ) + P ′(C )
1
1 + b ,c
p1,1
=
P ′( A) + P ′(B ) P ′(B ) + P ′(C ) P ′(C ) + P ′(D )
P ′( A) + P ′(B ) + P ′(C ) + P ′(D ) −
−
−
1
1
1
1 + a ,b
1 + b ,c
1 + c,d
p1,1
p1,1
p1,1
This formula provides the value of p0,1,1,0 dependent on the values of p1,1 for each of the
alternatives. Thus, we are able to ask the question “Dependent on the fact that either B or C has
occurred, what is the probability that both B and C have occurred?” and insert the answer in the
formula above.
6.4 Simulation
We are now ready to begin our Monte Carlo simulation. The simulation is conducted as follows:
1. First we simulate the number of occurrences in each cell (BT and ET) each year. By this we
mean how many losses that occur in each cell per year. For the uncorrelated cells, this is done by
assuming a Poisson distribution using our frequencies as λ, and drawing random numbers from
this distribution. For the correlated cells, we use the combined λ calculated above to draw the
number of occurrences for the combination of the different cells. Then, for each occurrence, we
simulate what actually happened using the different pa,b,c,d we have. This gives us the occurrences
for each cell.
2. For each cell we check the number of simulated losses and simulate the size of those losses
using a lognormal distribution. The losses are then saved.
3. For each year, the losses in each cell are added up, giving us the total loss for that specific year.
4. This is repeated a great number of times (105), and simulated losses are saved in a vector l.
5. The vector is sorted in order of increasing size and we identify VaR0.999. Recall from section
3.5.2 that this is calculated by using
VˆaRα = l[n (1−α )]+1 , n
52
7 Model Testing
Usually when it comes to building a model, the testing part of the process is of considerable
importance. One not only wants to test the results; if they are reasonable and how sensitive they are
to changes in the parameters. One also wants to test the programming itself; does it give any results,
are the results logical and is the model flexible enough to handle changes?
One major issue that we were facing in our modelling process was the lack of data. The internal data
are scarce and we did not have access to any external data. This made it impossible to test and verify
the results. It was for example not possible to test what kind of influence different weighing factors,
scaling assumptions, distribution choices and correlation coefficients would have had on the result.
The calculation of the capital requirement itself did not provide any reliable results, since the
estimation of the severity and frequency parameters can not be considered to be statistically valid. It
was further on also impossible to stress test the result, since the lack of data did not give a reliable
result. Our model was thus made as a “shell” for how to calculate the capital requirement once the
necessary data is available. As for the ultimate result, the model does give an output of a relatively
reasonable amount at this point.
The programming could however be tested and that was done thoroughly during the process of
time. When something was added to the code, there was continuously testing of how the model
worked. The same can be said about the logics of the code, so as to be sure that it worked as it was
supposed to. We also continuously tried to make the code more concise, easier to understand and
more flexible. Hard coding was avoided as much as possible.
53
8 Concluding Chapter
What kind of insights has this modelling process provided us? To what level is our model valid and
how may it be criticized? These questions are answered in this last part of the report together with
suggestions of further research in the area of operational risk.
8.1 Insights
Since the bank is given full scope, except for the four requirements previously mentioned in chapter
4.1.3, in the development of an AMA, there is no univocal way of how to develop the model.
During the process it was apparent that it may not always be positive to leave all assumptions free of
choice. It may sound like a fair approach to leave it up to the bank by assuming that the bank gets
more knowledge of its risk exposure by developing the model. One could however argue that it would
be helpful to have more strict guidelines from Finansinspektionen, and that the model itself would
be more fair if there was one approach for all banks to use. We believe that operational risk may not
differ that much between banks so as to argue that totally different approaches would be
appropriate. It could be a better idea to just leave the scaling and correlation assumptions to the
banks, in order to make the data more reliable to the bank’s specific exposure.
During the modelling process it came to our attention how difficult it is to model operational risk.
The majority of the interviewees questioned if it is even possible to model operational risk
appropriately and if it was not better to keep it in Pillar 2 of the Basel II rules 9 . Compared to credit
risk and market risk, operational risk is far more unpredictable; “Hur modellerar man Leeson?”
[How can Leeson be modelled?] was asked by one of the interviewees. The insight that operational
risk is a new and relatively unexplored area of risk modelling was thus central in the development
process.
8.2 Future Required Updates
The lack of data caused, as previously mentioned, problems to the test of the model. The lack of
data was an issue for the choice of method as well; since we lacked reliable data, we could not use
Basel II is divided into 3 Pillars; the calculation of the capital requirement belongs to Pillar 1, the aggregated risk
assessment belongs to Pillar 2 and the rules for publishing information belong to Pillar 3. See Finansinspektionen (2002)
for a more detailed explanation.
9
54
the POT-method for the distribution of the tail. The use of extreme value theory (i.e. the POTmethod) is recommended in literature, but was something we had to forsake at this point. When
data becomes available, it is thus recommended to implement a generalized Pareto distribution for
the tail of the severity distribution. That is, to use extreme value theory’s POT-method in order to
get more high severity data.
If it becomes apparent that external data comes from a substantial number of banks from other
geographical areas than the ones that “our” bank operates in, it is possible to implement a weighing
factor. It may for example be a good idea to weigh non-European banks’ losses as less likely than
European banks’ losses. But it depends on what kind of factors is assumed to drive operational risk;
if the geographical area has a substantial impact on the frequency and severity of events.
Even though this model is only a “mathematical shell”, there are a few quantitative factors that have
to be updated in the future. These include expert opinions for the correlation assumptions as well as
expert opinions for the caps of the cells’ exposures. It is fair to assume that these are factors that
may change in the future and thus need to be updated by key employees within the bank.
It would further on be a good idea to make a qq-plot of the severities of the external data once they
become available. Our qq-plot, with the following assumption of choosing the lognormal
distribution for the data, is based only on the bank’s internal data. To be sure that the external data
behaves similarly, a qq-plot of the external data as the sample and the lognormal distribution as the
reference distribution is thus recommended. The same thing can be said about the frequency of the
data. As it is now, we have not tested the suitability of the Poisson distribution for the frequency of
the losses. One way of testing if the Poisson distribution is appropriate is to do a goodness of fit-test 10 ,
this could however not be conducted at this point since the data points are too few.
As presented by the Basel Committee on Banking Supervision (2006) it is necessary to have scenario
analysis in the model. We have fulfilled a part of the requirement by using expert opinion in the
scaling part of the model (recall that the scenario analysis according to the Basel Committee on
Banking Supervision (2006) incorporates the use of expert opinion in order to evaluate exposure to
high-severity events, see chapter 4.1.3). The Basel Committee on Banking Supervision (2006, p. 154)
10
See http://www.zoology.ubc.ca/~whitlock/bio300/LectureNotes/GoF/GoF.html for an explanation of the test.
55
further mentions that it is necessary to have scenario analysis that “should be used to assess the
impact of deviations from the correlation assumptions”. This is something that has to be added to
the model after the correlation parameters have been chosen and the external data is available.
It would also be a good idea to stress test the model. It would for example be useful to see how
sensitive our parameters are to the addition of one extra large historical loss. It would be a problem
if the capital requirement calculated would change dramatically as a result. Another test that could be
conducted in the stress test is what effect a rise in the cap of one business line has on the capital
requirement. If say Corporate Finance’s income triples, the cap for that business line would rise in
our model. It would be interesting to see how sensitive our model is for the level of these caps. The
stress testing of the model is however nothing that can be done without access to external data.
8.3 Validity & Critique
Validity, as presented by Colorado State University, concerns “the degree to which a study accurately
reflects or assesses the specific concept that the researcher is attempting to measure”. Regarding the
validity of the model, there are a number of things to comment on. First, one may discuss how valid
an AMA model is on the whole. The model shall provide a number that the bank will not exceed
more than one year out of 1000 (i.e. with a 99.9 % confidence level). As a base for that calculation,
the required observation period is only three years (Finansinspektionen, 2007). To make a good
estimation, we would need about a million years of data (another problem would be that the data
has to be identically distributed as well; so if we actually would have a bank that was a million years
old, it would be highly questionable if the loss data from the early years could reflect the situation of
today). Because of the lack of data, the number that our model provides will only at best be a
“qualified guess”. Even though the use of external data provides more losses, one must keep in
mind that the observation period for these is as short as for “our” bank’s internal losses.
Second, one may criticize how the model itself is built. The fact that we do not use extreme value
theory for the tail is one distinct weakness, since potential high losses are the most harmful losses
for the bank. The scaling assumptions that are made are also arguable. Here, we rely on the
assumption that the larger the bank is, the larger the potential losses. A bank of “our” bank’s size is
assumed not able to meet with the high losses that other large banks have had. What really is the
driver of operational risk is however far from clear. In our model we rely on key employees within
56
the bank to decide a cap for the exposure in each cell; for example “it is not possible to loose more
than x kr of Internal Fraud in Corporate Finance”. Here, subjectivity is a large part in the decision of
the maximum loss. The same can be said about the correlation assumption between the cells, which
of the cells that are supposed to be correlated and to which extent they are correlated, is highly
arguable.
Third, there are details in the models that may be “theoretically wrong”. The yearly losses are
calculated by starting with the latest event (not necessarily today) and counting backwards one year
from that date. If there has gone a long time since the last event has occurred, we will be
overestimating the risk. However, the risk/chance that nothing happens for a long time is very
small. See figure below for an illustration of the problem:
Figure 24. Illustration of the weakness in the calculation of the frequency.
A similar problem appears when we calculate the frequency and severity for different regions. We
assume that the data available represents the same number of years for all regions. This may not be
the case, and it becomes a problem if the red area in the figure below becomes large.
Figure 25. Illustration of the weakness in the calculation of the frequency across different areas.
The inflation is calculated as the average inflation over the last five years. A more theoretically
correct way to adjust for the inflation would be to implement that the losses would be multiplied
with the actual inflation for the specific year. That would give a more correct value if, say the
inflation rises dramatically five years in a row.
57
Fourth, the intentions behind the model development may be criticized. One may question the
appropriateness of developing this model for the bank where we work. During the process we had
to find the balance between developing a reasonable model and developing a beneficential one. On
the one hand, if we had tried to make the model as appropriate and reliable as possible, there would
have been a risk of creating a model that no one would have wanted to use (since there are less
sophisticated models giving a lower requirement). On the other hand, if we would have developed
the model as generous as possible, we would have put the bank in a situation where it would have
risked having too low equity for the risks it was exposed to. From a mathematical standpoint it all
comes down to what kind of assumptions that are made, since they have a direct effect on how
ethically correct the model becomes in the end.
8.4 Further Research
As more banks develop an AMA-model, there will be more interest in research concerning this area.
We have encountered some research gaps that would have been good to look into in order to ease
the modelling process.
One possible research area concerns the reporting structure in the bank. In order to build and rely
on a model like the AMA, it is required that the data set available is correct. That means that all data
above a certain threshold should be reported, and reported as to the true loss size. One may
however assume that employees within the bank are more reluctant to report some losses than
others, internal fraud being one example. Some research concerning the employees’ view of
reporting such losses may thus be valuable as to know how reliable the internal data really is.
Another possible research area concerns the bank’s geographic location and what affect that has on
its operational losses. That becomes an issue when one wants to mix external data with internal data;
are the external ones as relevant as our internal data? It is for example possible to assume that banks
in areas where tornados and other nature disasters are relatively frequent are more exposed to losses
caused by Damage of Physical Assets than a bank in the Nordic region. If it could be shown that banks
in specific parts of the world are exposed to greater operational risks, it is possible to scale down
their part of the external data and thus give a more reliable set of data to work with.
58
Another possible research area concerns the impact the age of the bank has on the operational
losses. Are new banks/bank divisions more exposed to operational risk than older banks? This
question becomes an issue as one mixes the internal and external data. Different weights related to
age could be applied to the data if it could be shown to have an impact on the losses.
When we in our model considered correlation among severities to be irrelevant, it was more a logical
assumption than a result from a research analysis conducted. By studying large losses and their
possible dependence to other events, it may be concluded that such correlations really exist. It may
also be arguable that there exists dependence among losses over time; for example that risk control
makes it less probable for a large loss to be followed by another large loss. Research regarding such
correlations could thus be helpful in the modelling process and propose the use of copulas in our
model.
An interesting research approach, regarding the AMA model in overall, is to study the degree of
driving power that this kind of model has on the organization. It would be interesting to see to
which extent such a model goes beyond its “main role” as a pure measuring model, and actually
influences how the risk is managed in the bank.
The last possible future research that we want to discuss concerns the driving factors of operational
risk. In BIA and SA, it is assumed that the size of the firm, in terms of income, is the main driver.
The higher the gross income, the higher the capital requirement ought to be. There is however one
problem; if the bank’s income declines as a result from the economic situation, the capital
requirement will get lower as a result. The question is if the operational losses in reality really do
decline as well. Even if it is not a main assumption in the AMA-model, we have used the fact that
large banks are more exposed to high severity losses when we scale down large losses for “our”
bank. By conducting research with that as a base, one of the major problems within operational risk
modelling could be eased.
59
9. References
9.1 Written Sources
Bank
of
International
Settlements.
BIS
History
Overview.
[Online]
Available
from:
http://www.bis.org/about/history.htm [Accessed September 24, 2008]
Basel Committee on Banking Supervision. (2001). Working Paper on the Regulatory Treatment of
Operational Risk. [Online] Available from:
http://www.bis.org/publ/bcbs_wp8.pdf [Accessed
September 24, 2008]
Basel Committee on Banking Supervision. (2006). Basel II: International Convergence of Capital
Measurement and Capital Standards: A Revised Framework – Comprehensive Version. [Online] Available
from: http://www.bis.org/publ/bcbs128.pdf. [Accessed September 23, 2008]
Baud, N., Frachot, A. & Roncalli, T. (2002). How to Avoid Over-estimating Capital Charge for Operational
Risk? Crédit Lyonnais, France. [Online] Available from:
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1032591 [Accessed September 29, 2008]
BBC News. (1999). How Leeson broke the bank. [Online] Available from:
http://news.bbc.co.uk/2/hi/business/375259.stm [Accessed September 25, 2008]
Blom, G. (2005). Sannolikhetsteori och statistikteori med tillämpningar. Studentlitteratur, Lund.
Cruz, M. (ed). (2004). Operational Risk Modelling and Analysis: Theory and Practice. Risk Books, London.
Colorado State University. Writing Guides Reliability & Validity. [Online] Available from:
http://writing.colostate.edu/guides/research/relval/pop2b.cfm [Accessed December 1, 2008]
Davis, E. (ed). (2006). The Advanced Measurement Approach to Operational Risk. Riskbooks, London.
60
Embrechts, P., Furrer, H. & Kaufmann, R. (2003). Quantifying Regulatory Capital for Operational Risk.
RiskLab, Switzerland. [Online] Available from: http://www.bis.org/bcbs/cp3/embfurkau.pdf
[Accessed September 29, 2008]
Finansförbundet, Finansvärlden. (2005). Vad är Basel II? [Online] Available from:
http://www.finansforbundet.se/Resource.phx/pubman/templates/4.htx?id=478
[Accessed September 24, 2008]
Finansinspektionen. (2002). Riskmätning och kapitalkrav II. [Online] Available from:
www.fi.se/Templates/Page____3746.aspx - 21k [Accessed December 2, 2008]
Finansinspektionen. (2007). Ansökan om internmätningsmetod, operativ risk. [Online] Available from:
http://www.fi.se/upload/30_Regler/50_Kapitaltackning/070131/Ansokan_internmatningsmetode
r_operativa_risker070126.pdf [Accessed September 25, 2008]
Frachot, A., Georges, P. & Roncalli, T. (2001). Loss Distribution Approach for operational risk. Crédit
Lyonnais, France.
Frachot, A. & Roncalli, T. (2002). Mixing internal and external data for managing operational risk. Crédit
Lyonnais, France. [Online] Available from:
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1032525 [Accessed November 31, 2008]
Frachot, A., Roncalli, T. & Salomon, E. (2004). The Correlation Problem in Operational Risk. Crédit
Agricole SA, France. [Online] Available from: http://gro.creditlyonnais.fr/content/wp/ldacorrelations.pdf [Accessed September 19, 2008]
Gallati, R. (2003). Risk Management and Capital Adequacy. The McGraw-Hill Companies.
Gut, A. (1995). An Intermediate Course in Probability. Springer Science+Business Media, Inc., New
York.
Hull, J.C. (2007). Risk Management and Financial Institutions. Pearson International Edition. Pearson
Education, Inc. New Jersey.
61
Hult, H. & Lindskog, F. (2007). Mathematical Modeling and Statistical Methods for Risk Management:
Lecture Notes. Royal Institute of Technology, Stockholm. [Online] Available from:
http://www.math.kth.se/matstat/gru/5b1580/RMlecturenotes07B.pdf
[Accessed
October
31,
2008]
Industry Technical Working Group (ITWG). (2003). The LDA-based Advanced Measurement Approach
for Operational Risk – Current and In Progress Practice. RMG Conference, May 29. [Online] Available
from:
http://fednewyork.org/newsevents/events/banking/2003/con0529e.ppt [Accessed September 26,
2008]
Jobst, A. A. (2007). Operational Risk – The Sting is Still in the Tail But the Poison Depends on the Dose.
[Online] Available from: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1087157 [Accessed
September 26, 2008]
KPMG International. (2003). Basel II: A Closer Look: Managing Operational Risk. [Online] Available
from:
http://www.kpmg.ca/en/industries/fs/banking/documents/Basel%20II_%20A%20closer%20look
_%20managing%20operational%20risk.pdf [Accessed September 24, 2008]
Kühn, R. & Neu, P. (2008). Functional Correlation Approach to Operational Risk in Banking Organizations.
Institut für Theoretische Physik, Universität Heidelberg & Dresdner Bank AG, Germany. [Online]
Available from:
http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6TVG-47G3FV22&_user=10&_rdoc=1&_fmt=&_orig=search&_sort=d&view=c&_version=1&_urlVersion=0&_
userid=10&md5=e97b061eacbe8065db66bf2bdbbb8cf9 [Accessed September 19, 2008]
Mignola, G. & Ugoccioni, R. (2006). Sources of uncertainty in modelling operational risk losses. Journal of
Operational Risk (33-50). Volume 1 / Number 2. Italy. [Online] Available from:
http://www.journalofoperationalrisk.com/data/jop/pdf/jop_v1n2a3.pdf [Accessed September 29,
2008]
62
Moscadelli, M. (2004). The modelling of operational risk: experience with the analysis of the data collected by the
Basel Committee. Banca D’Italia, Italy. [Online] Available from:
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=557214 [Accessed September 19, 2008]
ORX Association. (2007). ORX Reporting Standards: An ORX Members’ Guide to Operational Risk
Event/Loss Reporting. [Online] Available from: http://www.orx.org/lib/dam/1000/ORRS-Feb07.pdf [Accessed September 25, 2008]
Shevchenko, P.V. (2004). Valuation and Modelling Operational Risk: Advanced Measurement Approach.
[Online] Available from:
http://www.cmis.csiro.au/Pavel.Shevchenko/docs/ValuationandModelingOperationalRisk.pdf
[Accessed November 5, 2008]
9.2 Interviews
Andersson, H. PhD & Risk Manager at the commissioner’s department Asset management,
Stockholm. October 23, 2008.
Degen, W. Head of compliance & operational risk at the commissioner’s department Swedish
banking, Stockholm, October 19, 2008.
Elsnitz, C. Risk Analyst at the commissioner’s department Group risk control, Stockholm. October
15, 2008.
Keisu, T. Head of compliance, operational risk & security at the commissioner’s IT department
Stockholm, October 20, 2008.
Lang, H. Associate Professor at KTH Mathematic’s division of mathematical statistics, Stockholm.
September 30, 2008.
Lindskog, F. Associate Professor at KTH Mathematic’s division of mathematical statistics,
Stockholm. September 30, October 16 & October 25, 2008.
63
Gustavsson, A. Risk Analyst at the commissioner’s Group risk control, Stockholm. September 20 &
November 27, 2008.
Lundberg, K. Risk Analyst at the commissioner’s Group risk control, Stockholm. October 15, 2008.
Masourati, G. Risk Analyst at the commissioner’s Group risk control, Stockholm. September 20 &
November 27, 2008.
64