Risk-based capital measures for operational risk
management
Philippus Snyman
11761385
Thesis submitted for the degree Doctor of Philosophy in Risk Management at the
Potchefstroom campus of the North-West University
Supervisor: Dr. G. van Vuuren
Co-supervisor: Prof. P. Styger
i
Acknowledgements
Herewith my sincere appreciation to the following people for their continuous support and assistance throughout my study:
My study supervisor, Dr. Gary van Vuuren, for his valuable input and assistance during my study. I appreciate your patience and guidance throughout this time immensely.
My co-supervisor, Prof. Paul Styger, for his ideas, help and guidance, especially at the outset of my study.
My employer, FirstRand, for all the support I received throughout the study and allowing me to use the bank’s information and resources to assist in conducting the research.
All my family and friends for their unconditional support and love.
Flippie Snyman
ii
Abstract
Basel II provides banks with four options that may be used to calculate regulatory capital for operational risk. Each of these options (except the most basic approach) requires an underlying risk measurement and management system, with increasing complexity and more refined capital calculations under the more advanced approaches. Approaches available are BIA, TSA, ASA and AMA.
The most advanced and complex option under Basel II is the AMA. This approach allows a bank to calculate its regulatory and economic capital requirements (using internal models) based on internal risk variables and profiles, rather than exposure proxies like gross income. This is the only risk-sensitive approach allowed by and described in Basel II. Accompanying internal models, complex and sophisticated measurement instruments, risk management processes and frameworks, as well as a robust governance structure need to be implemented.
This study focuses on the practical design and implementation of an AMA capital model. This includes a beginning-to-end solution for capital modelling and covers all elements of data analysis, capital calculation and capital allocation. The proposed capital model is completely risk-based, leading to risk-sensitive capital calculations and allocations for all business lines in a bank. The model was constructed to comply fully with all Basel II requirements and standards.
The proposed model was subsequently applied to one South African bank’s operational risk data, i.e. risk scenario and internal loss data of the bank were used as inputs into the proposed capital model. Regulatory capital requirements were calculated for all business lines in the bank and for the bank as a whole on a group level. Total capital requirements were also allocated to all business lines in the bank. For regulatory capital purposes, this equated to the stand-alone capital requirement of each business line. Calculations excluded the modelling and incorporation of insurance, expected loss offsets and correlation. These capital mitigation techniques were, however, proposed as part of the comprehensive capital model.
AMA based capital calculations for the bank’s business lines resulted in significant capital movements compared to TSA capital requirements for the same calculation periods. The retail banking business line was allocated less capital compared to corresponding TSA estimates. This is mainly attributable to lower levels of tail risk exposure given high income levels (which are the bases for TSA capital calculations). AMA-based capital for the
iii
investment banking business line was higher than corresponding TSA estimates, due to high levels of extreme risk exposure relative to income generated.
Employing capital modelling results in operational risk management and performance measurement was discussed and proposals made. This included the use of capital requirements (modelling results) in day-to-day operational risk management and in strategic decision making processes and strategic risk management. Proposals were also made on how to use modelling results and capital allocations in performance measurement. It was proposed that operational risk capital costs should be included in risk-adjusted performance measures, which can in turn be linked to remuneration principles and processes. Ultimately this would incentivise sound operational risk management practices and also satisfy the Basel II use test requirements with regards to model outputs, i.e. model outputs are actively used in risk management and performance measurement.
iv
Opsomming
Basel II verskaf vier opsies aan banke vir die berekening van regulatoriese kapitaal vir operasionele risiko. Elkeen van hierdie opsies (behalwe die mees basiese benadering) vereis ’n onderliggende risikobestuur- en risikometingstelsel van toenemende kompleksiteit en gesofistikeerde kapitaalberekeninge onder die meer gevorderde benaderings. Benaderings wat gevolg mag word, is die Basiese Aanwyser Benadering, die Gestandaardiseerde Benadering, die Alternatiewe Gestandaardiseerde Benadering en die Gevorderde Metingsbenadering.
Die mees gesofistikeerde en komplekse opsie wat gebied word in Basel II is die Gevorderde Metingsbenadering. Hierdie benadering laat banke toe om regulatoriese en ekonomiese kapitaalvereistes te bereken deur van interne modelle en risikometings gebruik te maak, eerder as om dit af te lei van bruto inkomste (wat die geval is onder die meer basiese benaderings). Die Gevorderde Metingsbenadering is die enigste risiko-sensitiewe benadering wat toegelaat en beskryf word in Basel II. Behalwe interne modelle vir kapitaalberekeninge, moet komplekse en gesofistikeerde risikometingstelsels, risikobestuursprosesse, risikobestuursraamwerke en verskeie toesighoudende strukture geïmplementeer word.
Hierdie studie fokus op die praktiese ontwerp en implementering van ’n kapitaalmodel as deel van die Gevorderde Metingsbenadering. Dit sluit ’n volledige oplossing in vir kapitaalmodellering en dek alle aspekte van data-analise, kapitaalberekeninge en kapitaaltoedeling. Die voorgestelde model is gebaseer op risikometings wat aanleiding gee tot risiko-sensitiewe kapitaalberekeninge en -toedelings vir alle besigheidseenhede in ’n bank. Die model is ontwerp om aan alle Basel II-standaarde en -vereistes te voldoen.
Die voorgestelde model is toegepas op ’n Suid-Afrikaanse bank se operasionele risiko inligting. Scenario-analise en interne verliesdata van die bank is gebruik as direkte invoere vir kapitaalberekeninge. Regulatoriese kapitaalvereistes is bereken vir alle besigheidseenhede van die bank, asook vir die bank in geheel. Totale kapitaalvereistes is gevolglik toegedeel aan besigheidseenhede. In die geval van regulatoriese kapitaal is die gedeelte van totale kapitaal wat toegedeel word aan ’n besigheidseenheid dieselfde as die eenheid se alleenstaande kapitaalvereiste. Berekeninge het die modellering en gebruik van versekering, verwagte verlies-aftrekkings en korrelasie uitgesluit. Hierdie kapitaal- verminderingsprosedures is egter voorgestel en bespreek as deel van die omvattende kapitaalmodel.
v
Risikogebaseerde kapitaalberekeninge vir die bank se besigheidseenhede het aanleiding gegee tot wesenlike kapitaalvereisteveranderinge in vergelyking met Gestandaardiseerde Benadering kapitaalvereistes vir dieselfde periodes. Die handelsbank besigheidseenheid het minder kapitaal ontvang in vergelyking met Gestandaardiseerde Benadering kapitaal- vereistes. Dit was hoofsaaklik as gevolg van ’n laer blootstelling aan uitermatige verliese gegewe hoë inkomstevlakke (wat die basis is van Gestandaardiseerde Benadering kapitaalberekeninge). In teenstelling het die beleggingsbank besigheidseenheid meer kapitaal ontvang in vergelyking met Gestandaardiseerde Benadering kapitaalvereistes. Dit was as gevolg van ʼn groter blootstelling aan uitermatige verliese, gegewe sekere inkomste- vlakke.
Die gebruik van modelleringsresultate in operasionele risikobestuur en prestasiemeting is bespreek en sekere voorstelle is gemaak. Dit het die gebruik van kapitaalvereistes in algemene operasionele risikobestuur, strategiese risikobestuur en strategiese besluitnemingsprosesse ingesluit. Voorstelle is ook gemaak rakende die gebruik van kapitaalvereistes en kapitaaltoedeling in prestasiemeting. Dit is onder andere voorgestel dat die koste van operasionele risikokapitaal ingesluit word in risiko-aangepaste prestasiemaatstawwe, en dat hierdie maatstawwe gekoppel word aan vergoedingsbeginsels en prosesse. Hierdeur sal goeie operasionele risikobestuur aangespoor word. Dit sal ook verseker dat daar aan die Basel II-vereiste voldoen word dat model-resultate in praktiese risikobestuur en prestasiemeting gebruik moet word.
Sleutelwoorde: Basel II, Operasionele risiko, Gevorderde Metingsbenadering, Kapitaalberekening
vi
List of Figures
Chapter 1: Introduction
Figure 1.1 Steps that will be followed to arrive at a solution to the problem as
formulated in the problem statement 5
Chapter 2: Capital modelling methodology – Part 1
Figure 2.1 The flow of data in the AMA measurement and modelling system 13
Figure 2.2 Internal loss data extraction and importation 17
Figure 2.3 Tail plot 21
Figure 2.4 Empirical distribution of losses used in ME calculation 22
Figure 2.5 Mean Excess calculation (step 1) 22
Figure 2.6 Mean Excess calculation (step 2) 22
Figure 2.7 Mean Excess plot (heavy tail example) 23
Figure 2.8 Mean Excess plot (light tail example) 23
Figure 2.9 EVT used as basis for calculating the Hill estimator 24
Figure 2.10 Hill Estimator plot 25
Figure 2.11 HKKP representation 26
Figure 2.12 Stability parameter plot 27
vii
Figure 2.14 Identifying heavy tail behaviour with DEdH plots 29
Figure 2.15 The use of multiple thresholds and models for a single dataset 31
Figure 2.16 Maximum likelihood estimation (MLE) 35
Figure 2.17 Comparison of weightings based on
n
andm
values of a WLS fit 36Figure 2.18 QIS3 results on internal loss data collection thresholds 37
Figure 2.19 Reduction of anomalies with the RLS fitting methodology 38
Figure 2.20 Comparison between outliers and the rest of points with a RLS fit 38
Figure 2.21 Method of Moments distribution fitting 39
Figure 2.22 CDF calculation from interval approach scenario quantification 43
Figure 2.23 Fitting of a theoretical distribution to the empirical CDF (interval
approach) 43
Figure 2.24 CDF calculation from maximum loss specification approach
quantification points (amounts in ZAR) 44
Figure 2.25 Fitting of a theoretical distribution to the empirical CDF (maximum
loss specification approach) 44
Figure 2.26 Simulated frequencies for five scenarios for 20 years (iterations) 49
Figure 2.27
Differences between cumulative observed and theoretical
distributions, i.e. F*
x F
x 53Figure 2.28 Differences between observed and theoretical distributions for the
Kolmogorov-Smirnov and Cramer von Mises tests 55
Figure 2.29 Comparison of weightings for different
m
andn
values inweighted GOF tests 56
Figure 2.30 Comparison of the weights of AD and the general AOFD (per
viii Chapter 3: Capital modelling methodology – Part 2
Figure 3.1 Integrating and aggregating risk scenario and internal loss data
models 67
Figure 3.2 Monte Carlo simulation in a two-segment data cell 70
Figure 3.3 Integrating/aggregating multiple-segment loss data and risk
scenario models 72
Figure 3.4 Multiple-segment model aggregation example 73
Figure 3.5 Rank correlation matrix example 79
Figure 3.6 Copula construction, application and dependent simulation
process 80
Figure 3.7 Two different insurance application options 82
Figure 3.8 Example of target credit ratings and associated confidence
intervals 87
Figure 3.9 Risk measures available from an annual aggregate loss
distribution 88
Figure 3.10 Capital allocation principles and residual risk 89
Figure 3.11 Using normalised contribution to UL as capital allocation measure 91
Chapter 4: Model execution and results
Figure 4.1 Percentage contributions of divisions to group capital under TSA
and AMA respectively (December 2007) 114
Figure 4.2 AMA capital as a percentage of TSA capital for all divisions
(December 2007) 115
Figure 4.3 TSA capital requirements for the divisions from December 2007 to
June 2009 118
Figure 4.4 Percentage TSA capital contributions of divisions to group capital
ix
Figure 4.5 AMA capital requirements for the divisions from December 2007
to June 2009 120
Figure 4.6 Percentage AMA capital contributions of divisions to group capital
from December 2007 to June 2009 122
Figure 4.7 AMA to TSA capital ratios of divisions and the group from
December 2007 to June 2009 124
Chapter 5: The use of capital modelling results in operational risk management
Figure 5.1 Scenario analysis as part of the risk measurement system 131
Figure 5.2 Basic stages of risk scenario generation 132
Figure 5.3 ORX losses per business line for January 2002 – June 2008 140
Figure 5.4 AMA capital requirement contribution percentages of FirstRand
x
List of Tables
Chapter 4: Model execution and results
Table 4.1 Data used as input into the capital model 101
Table 4.2 Risk scenarios and quantification information for FNB, WB and
CC 102
Table 4.3 Risk scenarios and quantification information for RMB 103
Table 4.4 Thresholds, distributions and parameters 107
Table 4.5 Weighting matrix used for risk scenarios 109
Table 4.6 Weights assigned to risk scenarios and internal loss data 110
Table 4.7 AMA capital requirements based on December 2007 data (ZAR
millions) 112
Table 4.8 Expected loss based on December 2007 data (ZAR millions) 112
Table 4.9 TSA and AMA capital requirements for December 2007 113
Table 4.10 Capital contributions and comparison to TSA requirements
(December 2007) 114
Table 4.11 TSA capital requirements for the divisions from December 2007 to
June 2009 (ZAR) 117
Table 4.12 TSA capital contributions of divisions from December 2007 to
June 2009 118
Table 4.13 AMA capital requirements for the divisions from December 2007
to June 2009 (ZAR) 120
Table 4.14 Percentage AMA capital contributions of divisions from December
2007 to June 2009 122
Table 4.15 AMA to TSA capital ratios of divisions and the group from
xi
Chapter 5: The use of capital modelling results in operational risk management
Table 5.1 AMA capital requirements (ZAR millions) based on December
2007 data 142
Table 5.2 AMA capital contributions of divisions from December 2007 to
June 2009 145
xii
Table of contents
Acknowledgements ... i Abstract... ii Opsomming ... iv List of Figures ... vi List of Tables ... x Chapter 1: Introduction ... 1 1.1 Introduction ... 1 1.2 Problem statement ... 3 1.3 Objectives ... 3 1.4 Research methodology ... 4 1.5 Chapter outline ... 5 1.6 Study motivation ... 6 1.7 Conclusion ... 8Chapter 2: Capital modelling methodology – Part 1... 10
2.1 Introduction ... 10
2.2 Basic building blocks of AMA capital modelling ... 11
2.2.1 Capturing of operational risk losses ... 11
2.2.2 Identification and quantification of risk scenarios ... 12
2.2.3 Modelling of severity and frequency ... 12
2.2.4 Capital calculation ... 12
2.2.5 Allocation of capital ... 12
2.3 Data used in the AMA model... 13
2.4 Level of granularity ... 15
2.5 Data import and classification ... 16
2.6 Basic data analysis ... 18
2.7 Extreme value theory (EVT) analysis ... 19
2.7.1 Tail plot ... 20
2.7.2 Mean excess plot (MEP) ... 21
2.7.3 Hill estimator (HE) ... 24
2.7.4 Huisman, Koedijk, Kool and Palm Test (HKKP) ... 26
2.7.5 Stability parameter ... 27
xiii
2.8 Using the data and extreme value theory analysis ... 29
2.9 Threshold determination ... 30
2.9.1 Threshold based on internal data analysis only ... 30
2.9.2 Creating additional thresholds to incorporate risk scenarios ... 32
2.10 Distribution fitting methodologies ... 34
2.10.1 Maximum likelihood estimation (MLE) ... 34
2.10.2 Least squares (LS)... 35
2.10.3 Probability weighted least squares (WLS) ... 35
2.10.4 Robust least squares (RLS) ... 37
2.10.5 Method of moments (MOM) ... 39
2.11 Severity modelling of internal loss data ... 40
2.12 Severity modelling of risk scenarios ... 41
2.12.1 Scenario creation and quantification ... 41
2.12.2 Scenario severity modelling ... 41
2.13 Scenario aggregation ... 45
2.13.1 Numerical aggregation ... 45
2.13.2 Aggregation using simulation ... 45
2.14 Goodness-of-fit (GOF) tests ... 52
2.14.1 Kolmogorov-Smirnov (KS) ... 54
2.14.2 Cramer von Mises (CvM) ... 54
2.14.3 Anderson-Darling (AD) ... 55
2.14.4 Analysis of fit differences (AOFD) ... 55
2.14.5 Evaluation of probabilities and quantiles ... 57
2.14.6 Evaluating the KS and AD measures ... 59
2.15 Conclusion ... 61
Chapter 3: Capital modelling methodology – Part 2... 62
3.1 Introduction ... 62
3.2 Frequency modelling ... 63
3.2.1 Modelling of internal data ... 63
3.2.2 Modelling of risk scenarios ... 64
3.2.3 Goodness-of-fit evaluation ... 65
3.3 Model confirmation and allocation ... 65
3.4 Independent simulation and aggregation ... 66
3.4.1 Integrating risk scenario and internal loss data models ... 66
3.4.2 Monte Carlo simulation ... 68
xiv
3.5 Dependent simulation using copulas ... 74
3.5.1 Overview of copula fundamentals and theory... 75
3.5.2 Rank correlation coefficient ... 76
3.5.3 Correlation matrix calculation ... 78
3.5.4 Construction of copulas and their use in simulation... 79
3.6 Incorporation of insurance ... 81
3.6.1 Qualifying criteria for insurance application ... 81
3.6.2 Applying insurance... 82
3.6.3 Applying insurance haircuts (discounts) ... 84
3.6.4 Modelling of payment uncertainty ... 84
3.7 Capital calculation ... 86 3.7.1 Omitting correlation ... 86 3.7.2 Incorporating correlation ... 87 3.8 Capital allocation... 88 3.8.1 Omitting correlation ... 89 3.8.2 Incorporating correlation ... 89
3.9 Assumptions and achieving the soundness... 91
3.9.1 Model assumptions ... 92
3.9.2 Ensuring conservatism ... 94
3.9.3 Achieving the soundness standard ... 95
3.10 Conclusion ... 96
Chapter 4: Model execution and results ... 98
4.1 Introduction ... 98
4.2 Structure of the banking group ... 99
4.3 Capital calculation for the first AMA period (December 2007) ... 99
4.3.1 Model execution processes ... 100
4.3.2 Capital calculation results ... 111
4.3.3 Capital contributions and comparison to TSA measures ... 113
4.4 Time series of capital requirements... 117
4.4.1 TSA capital requirements ... 117
4.4.2 AMA capital requirements ... 119
4.4.3 AMA to TSA capital ratios ... 123
4.5 Capital adequacy ... 126
4.6 Conclusion ... 127
xv
5.1 Introduction ... 129
5.2 Scenario analysis ... 130
5.2.1 Background of risk scenarios ... 130
5.2.2 Risk scenario framework and implementation ... 132
5.2.3 Defining risk scenarios ... 133
5.2.4 Risk scenario quantification ... 134
5.2.5 Risk scenario workshops ... 134
5.2.6 Underlying risk information used to construct scenarios ... 135
5.2.7 Risk scenario reviews ... 138
5.3 Capital results as consolidated risk measures ... 138
5.3.1 The role of scenarios in capital as a consolidated risk measure ... 138
5.3.2 Benchmarking against ORX data ... 139
5.4 The use of capital modelling results in operational risk management ... 142
5.4.1 Identification and management of high-risk areas ... 142
5.4.2 Assessing risk and income relationships ... 146
5.5 The use of capital modelling results in performance measurement ... 149
5.5.1 Capital and performance measurement ... 149
5.5.2 RAPM ... 150
5.5.3 Operational risk capital as RAPM input ... 151
5.5.4 Risk-adjusted performance measures and remuneration ... 153
5.6 Conclusion ... 154
Chapter 6: Conclusion and recommendations ... 157
6.1 Introduction ... 157
6.2 Research summary ... 157
6.3 Findings and recommendations ... 159
6.3.1 Capital model structure ... 159
6.3.2 Model input data ... 160
6.3.3 Operational risk classes and capital allocation ... 161
6.3.4 Redistribution of capital ... 161
6.3.5 The use of modelling results in risk management ... 162
6.3.6 The use of modelling results in performance measurement ... 163
6.4 Future research... 164
6.4.1 General capital model enhancements ... 164
6.4.2 ORX data as direct model input ... 165
6.4.3 The use of ORX data in scenario analysis ... 166
xvi
Bibliography ... 169 Appendix A: Analytical modelling of FNB data... 173 Appendix B: Capital model execution processes for December 2008 ... 244
1
Chapter 1: Introduction
1.1 Introduction
In recent years (2006 to 2011), advanced risk measurement and management have become an integral and important part of financial institutions. In particular, banking sector risk management has received considerable attention and increased focus, mainly due to increasingly stringent regulation by central banks and international governance bodies. This increased focus on risk management has been driven strongly by the Basel Committee on Banking Supervision (BCBS) and regulators world-wide, forcing banks to adopt more advanced and sensitive approaches for risk management. The BCBS publishes guidelines for risk management and measurement that are in turn adopted by most national regulators as part of their local banking regulations.
In 2006, the BCBS issued a comprehensive version of the Basel II framework (BCBS, 2006a). Basel II introduced a more sophisticated and comprehensive framework for risk management and the determination of minimum capital requirements. In addition to more comprehensive guidelines on market and credit risk, operational risk standards and methods for capital calculation were also included for the first time. Basel II also specified three pillars for regulation across all risk types. The first pillar addressed minimum capital requirements; the second covered the supervisory review process and the third covered aspects of market disclosure.
Basel II gives banks four options that they may use to calculate regulatory capital for operational risk. Each of these options (except the most basic approach) requires an underlying risk measurement and management system, with increasing complexity and more refined capital calculations under the more advanced approaches. Approaches available are the basic indicator approach (BIA), the standardised approach (TSA), alternative standardised approach (ASA) and the advanced measurement approach (AMA).
For the BIA, banks need to multiply their global gross income by a constant factor to arrive at regulatory capital requirements (BCBS, 2006a:144). With the BIA no measurement tools and governance frameworks need to be in place (BCBS, 2006a:145). For the TSA and ASA banks need to map their internal business lines to a series of regulatory (Basel II) business lines. Each regulatory business line’s gross income (or advances for some business lines under the ASA) consequently has to be multiplied with a predefined constant factor to arrive at the capital charge for that business line (BCBS, 2006a:146). The total capital charge would be the sum of the underlying business lines’ capital requirements. For the TSA and ASA, more advanced measurement tools need to be implemented, as well as more
2
sophisticated governance frameworks and robust risk management processes (BCBS, 2006a:148).
The most advanced and complex option under Basel II is the AMA. This approach allows a bank to calculate its regulatory and economic capital requirements (using internal models) based on internal risk variables and profiles, and not based on exposure proxies such as gross income (BCBS, 2006a:147). This is the only risk-sensitive approach allowed and described in Basel II. Accompanying internal models, a series of complex and sophisticated measurement instruments, risk management processes and frameworks, and a robust governance structure need to be implemented (BCBS, 2006a:149).
The basic risk measurement elements that should be implemented as part of an AMA are internal loss data, external loss data, scenario analysis, and tools that measure changes in the business environment and internal control factors (BEICF). Changes in the BEICF are usually measured by risk and control self-assessments (RCSA) and key risk indicators (KRI). These are the fundamental elements of an AMA under Basel II (BCBS, 2006a:151-154) Most banks that adopt Basel II choose to use the BIA or TSA, mainly due to the immaturity of AMA and the lack of industry standards and guidance. This was confirmed by BCBS in their Range of Practices study conducted in 2009 (BCBS, 2009). The BCBS also recently published additional guidance for banks on the implementation and maintenance of advanced measurement approaches under Basel II (BCBS, 2011b). This publication was informed by the Range of Practices survey conducted by BCBS (2009) and provides additional guidance on sound practices relating to governance, data and modelling. Even though more detailed proposals are made than before, guidance is still not detailed and specific enough to enforce a single best-practice approach to modelling, capital and operational risk management in general. All the methodologies and techniques for capital modelling, model application and the use of modelling results in operational risk management that will be proposed in this study will also comply with the requirements stipulated in these latest BCBS publications (BCBS, 2011b).
In addition, the BIA, TSA and ASA have various shortcomings. The main drawback is that none of these approaches is risk sensitive (specifically for capital calculations): this creates serious limitations on a bank’s ability to manage and measure operational risk and associated capital requirements properly.
AMA is the most sophisticated approach allowed under Basel II for the management and measurement of operational risk, and has not yet (November 2011) been adopted by many banks worldwide. There are also few publications and literature available on the implementation of an integrated AMA and capital calculation and allocation systems. This is
3
indicative of the need for more research on and contributions to the field of advanced operational risk management that will ultimately lead to more sophisticated and effective enterprise risk management.
Since operational risk is the newest addition to the list of risk types formally being regulated under Pillar I of Basel II, this study will focus on the practical design and implementation of an AMA capital model, the application of the model and the use of results in enterprise-wide operational risk management.
Currently there are few documented and published best-practices and standards for the practical implementation of an AMA management framework and capital calculation models. Regulations and guidance are open to diverse interpretation by banks, and beginning-to-end processes and methodologies for operational risk management, measurement and capital modelling should still be defined. As a result, a group level AMA framework and models for optimal risk management and capital calculation is still an area that should be researched and developed.
1.2 Problem statement
How may an optimal operational risk management framework be designed and implemented to effectively measure and manage an institution's operational risk and requisite operational risk regulatory capital, under Basel II's AMA?
1.3 Objectives
This study aims to investigate, propose, design and implement an optimal capital calculation and management framework for operational risk. Explicit objectives are
1. to develop a methodology for the modelling of selected AMA risk measures for risk sensitive capital calculation and allocation;
2. to determine the applicability and feasibility of the proposed capital modelling methodology by applying it on empirical operational risk data; and
3. to propose and describe the use of capital model outputs in enterprise-wide operational risk management and performance measurement.
The main foci of the study are as defined in (1) and (2) above. However, objective (3) also needs to be addressed to bridge the gap between risk measurement (capital modelling) and practical risk management in a bank.
4
1.4 Research methodology
The study commences with a detailed literature study. Basel II requirements and local and international regulations will be studied to determine regulatory requirements and boundaries for AMA implementation. Available publications and literature on AMA implementation and capital modelling methodologies will also be studied. This includes publications by practitioners, researchers and regulatory bodies.
A capital modelling methodology will be developed and proposed, using selected AMA elements from the underlying operational risk measurement and management system as data inputs. Two measurement tools’ output information will be used in the quantitative model, namely scenario analysis and internal loss data. It will further be demonstrated that all other basic AMA elements were used to inform the identification, definition and quantification of risk scenarios. All risk components (basic AMA elements) are therefore used in the model, either as direct or indirect inputs.
The proposed capital modelling methodology proposed is based on various published quantitative modelling techniques and makes use of segments of existing methodologies. The overall methodology, however, is unique and fills various gaps in published practices. The capital modelling methodology will subsequently be applied on one South African bank’s operational risk data (loss data and scenario analysis), to determine the applicability and practical feasibility of the proposed methods. This equates to an empirical study, where levels of capital requirements for the bank, based on the proposed methodology, will be calculated and assessed. Basic benchmarking of calculated and allocated capital against external data will also be done, to determine whether allocations are in line with international practices and that of global banks. Data from the Operational Risk Data Exchange (ORX) will be used. ORX is a consortium of banks who pool all their operational losses above €20 000 for consequent use in risk analysis and capital modelling. Currently (2011) ORX has 57 contributing member banks from 17 countries and the loss database contains 180 000 data points. Member banks are some of the largest banking groups in the world and many have already obtained AMA approval from their regulators.
Compiled Matlab® code (executable application) will be used for all calculations when modelling the bank’s operational risk data to estimate a risk-sensitive capital requirement and consequent allocations to business lines. Matlab® is a sophisticated statistical analysis and modelling software package with various toolboxes containing pre-programmed statistical and mathematical functions. Toolboxes used for calculations in this study include the statistical and optimisation toolboxes. Matlab® is widely used in numerous industries with many diverse applications, including the financial industry, engineering and the military.
5
Various possible uses of model outputs in day-to-day operational risk management will also be researched and investigated. After careful consideration, a few key uses of model outputs in risk management will be proposed. This includes the identification and remediation of high-risk areas in the bank, risk-to-income assessments and performance measurement.
1.5 Chapter outline
The study will commence with a proposal of an operational risk capital calculation model. Chapter 2 and Chapter 3 will propose a capital modelling methodology, with specific reference to existing methodologies and enhancements proposed in new techniques. These two chapters will also contain a full literature study. Chapter 4 will focus on the application of the capital modelling methodology and results produced – one South African bank’s data will be modelled and the results discussed. Various uses of capital modelling results in operational risk management will be presented in Chapter 5. To conclude, Chapter 6 will present final findings, conclusions and recommendations. Possible topics for future research will also be highlighted.
Figure 1.1 is a graphical depiction of the process and steps that will be followed to arrive at an answer to the problem as formulated in the problem statement. These steps also correspond to the chapter outline and research methodology that will be followed to achieve all set objectives.
Figure 1.1: Steps that will be followed to arrive at a solution to the problem as formulated in the problem statement.
How may an optimal operation al risk management framework be designed and implemented to effectively measure and man age an in stitu tion's operation al risk and requ isite operation al risk regu latory capital, under Basel II's AMA?
In trodu ction
Develop a capital modelling meth odology for risk sensitive capital calculation, allocation an d performance measu rement – part 1
Develop a capital modelling meth odology for risk sensitive capital calculation, allocation an d performance measu rement – part 2
Apply the capital model on a bank’s operational risk data, demonstratin g th at th e proposed measu rement framework and capital model will lead to optimal capital allocation and in form world
class, advan ced risk man agement
Th e u se of capital modelling resu lts in practical operation al risk management and performan ce measurement
Solu tion to the problem (as formu lated in th e problem statemen t) Problem statement C h a p te r 1 C h a p te r 2 C h a p te r 3 C h a p te r 4 C h a p te r 5
Conclusion, recommendations and fu ture research
C h a p te r 6
6
1.6 Study motivation
Even though there are various approaches available to banks for operational risk management and measurement under Basel II, the more basic approaches (BIA, TSA, and ASA) suffer from several shortcomings. The main drawback of these approaches to operational risk management and measurement is that they are not risk sensitive – or not sufficiently risk sensitive. Capital calculations and allocations are based on gross income, which is not always a good proxy for operational risk exposure. In addition, sophisticated measurement tools and risk management frameworks are not required by these approaches. Simplistic capital requirement calculations as part of Pillar 1 of Basel II are at the core of these approaches.
Due to a lack of risk-sensitive measures and a sophisticated capital model, various problems arise and incorrect risk measures are produced when the basic approaches are used. Capital requirements based on gross income also lead to serious capital-related problems and inconsistencies, and drive inappropriate behaviour with respect to operational risk management in business lines. Because of the shortcomings of the basic approaches, a comprehensive study in the implementation and use of an AMA capital model would greatly enhance the accuracy and effectiveness of operational risk measurement and management. The primary impetus of the study, however, is the lack of standards and practical guidelines regarding the design and implementation of a capital model, the application of the model and the subsequent employment of results in risk management. Regulatory bodies, practitioners and researchers have thus far only provided broad principles and guidelines for the implementation of AMA, including capital calculation and allocation mechanisms.
The BCBS provided basic requirements and standards for the implementation of an AMA, including references to measurement and capital calculation and allocation (BCBS, 2006a). Various papers were also published on the sound practices for AMA implementation (see, for example BCBS, 2003) and additional guidance on specialist topics, for example the treatment of expected losses (BCBS, 2005). Recently the BCBS also provided additional guidance on certain AMA topics, including data, modelling and governance (BCBS, 2011b). These guidance principles, however, are broad and on a high level. No specific guidance on practical implementation, techniques and methods required, scope of implementation or the integration of various components is provided.
Since most regulators adopted Basel II and other proposals by BCBS for operational risk management and measurement under AMA, few guidelines on practical implementation, measurement frameworks and capital calculation/allocation are available (from national banking regulators worldwide). There are also no guidelines on how to use model outputs in
7
risk management, even though banks are expected to use model results in their day-to-day risk management and decision-making processes (BCBS, 2006a and BCBS, 2011b).
This led to a diverse range of practices of AMA implementation and capital calculations by banks that opted to apply for AMA approval. This was confirmed by the BCBS who conducted a study on AMA range of practices via its SIGOR subgroup (Standards Implementation Group for Operational Risk) in 2006 (BCBS, 2006b) and 2009 (BCBS, 2009).
The Committee of European Banking Supervisors (CEBS) also attempted to provide guidance on general AMA implementation (CEBS, 2006), specific specialist components, for example loss collection, use test and capital allocation (CEBS, 2008) and certain capital modelling components, for example insurance and correlation analysis (CEBS, 2009). The Federal Deposit Insurance Corporation (FDIC) also provided additional guidance on Basel II implementation, including notes on operational risk (FDIC, 2007). None of these publications, however, made reference to techniques that should be used or approaches that should be followed for practical AMA implementation, capital calculation or the use of model results in risk management.
In recent times (2006 – 2011), many of the individual components of a management framework (specifically capital modelling techniques) have been researched and tested by practitioners and researchers. However, using only one or a selected combination of these individually developed techniques may pose various problems. Firstly, utilising only one of the developed methods only partially addresses the regulatory requirements (due to the silo-based approach followed by these methods). Each of these individually developed methodologies only addresses a small subsection of the required risk management framework or capital model. Secondly, a selective combination of the individually developed methodologies may not be possible or extremely difficult to achieve. This is mainly due to the diverse nature of underlying theory used in the individual methodologies, and a logical link between individually developed frameworks/measurement components may not be practically possible. Various examples of these problems or shortcomings are provided in subsequent paragraphs.
De Fontnouvelle et al (2004) proposed a methodology for the modelling of internal loss data using data collected during the 2002 Loss Data Collection Exercise (LDCE). Moscadelli (2004) proposed similar methods for the modelling and analysis of internal loss data. Although useful, these methodologies did not include the use of external data, scenario analysis and business environment and internal control factors (BEICF) for capital
8
calculation purposes. In addition, no proposals were made for capital calculations or the use of modelling results in risk management.
Other authors investigated the combined and integrated use of internal and external loss data. Baud et al (2002) proposed simpler techniques for internal data modelling, but with the added ability to select, scale and integrate external data into internal data models.
On the other side of the spectrum, some researchers and banks proposed the use of a scenario-based AMA. Scenario-based AMA methods were proposed by various authors, for example the Scenario-based AMA working group (2003), which included contributors from some of the world’s largest banks.
In many other cases the focus of research was placed on a highly specific data modelling sub-problem. Correlation within datasets (internal or external) received considerable research attention. Refer for example to Mildenhall (2005), Jackel and Rebonato (2000), Perkins and Lane (2003) and Marone et al (2007). The use of insurance in the AMA framework and capital calculation process is another small, unique element of the overall capital model that attracted some research and development. See for example Bazzarello et al (2006).
Many of the proposed methodologies for operational risk modelling only focused on specific subsections of a complete model or measurement framework. In addition, in all cases only one or two of the basic AMA elements were used in the model. Without the inclusion and integration of all AMA fundamental components in a capital model (and the use of modelling results in risk management), the proposed methodology cannot meet regulatory requirements. In addition, a complete view of risk exposures to be used in business and risk management processes would not be possible.
The development of a complete AMA capital calculation and allocation model that utilises all AMA basic elements will therefore address these shortcomings and result in a regulatory compliant risk and capital measurement framework. The application of the proposed capital model on a bank’s operational risk data will further demonstrate the feasibility and efficacy of the model. Proposals on the use of modelling results in risk and performance management will fill a void in current literature and also satisfy expectations and requirements of global and local regulators.
1.7 Conclusion
The most advanced option for operational risk management and measurement under Basel II is the AMA. This approach allows a bank to calculate its regulatory and economic capital requirements using internal models and is not based on exposure proxies like gross income.
9
This is the only risk-sensitive approach allowed and described in Basel II. Accompanying internal models, a series of complex and sophisticated measurement instruments, risk management processes and frameworks, and a robust governance structure need to be implemented.
Most banks that adopt Basel II choose to use the BIA or TSA, mainly due to the immaturity of AMA and the lack of industry standards and guidance. There are also few publications and literature available on the implementation of an integrated AMA framework and capital calculation and allocation systems. This is indicative of the need for more research on and contributions to the field of advanced operational risk management that will ultimately lead to more sophisticated and effective enterprise risk management.
This study presents a capital model for risk-sensitive capital calculations and allocations for operational risk in a bank. The methodology is compliant with Basel II and therefore with the regulations of most local regulators worldwide. The proposed methodology will be applied to one South African bank’s operational risk data (regulatory capital calculation only) to demonstrate the feasibility and practicality of the model. Obtained results will be presented and interpreted. Various uses of capital modelling results in risk management and performance measurement will also be proposed and demonstrated.
This study fills shortcomings in current literature by proposing a Basel II compliant beginning-to-end integrated model for operational risk capital calculations and allocations, as well as ways to use obtained modelling results in practical operational risk management and performance measurement.
The next chapter proposes the first part of a capital modelling methodology that complies with all Basel II requirements, as well as additional guidance and proposals by BCBS (2011b) and researchers. A comprehensive literature study discussing operational risk capital modelling practices, techniques and methodologies is also presented in the next chapter.
10
Chapter 2: Capital modelling methodology – Part 1
2.1 Introduction
Chapter 1 addressed the principles and fundamental elements of a Basel II AMA and discussed various regulatory interpretations and guidance documents. Specific reference was also made to operational risk capital modelling and calculations. Various shortcomings in current methods for capital calculation and allocation were also highlighted, as well as the lack of regulatory and industry guidance on the use of capital modelling results in risk management. A comprehensive study in the field of capital modelling and use of results in risk management was proposed and outlined.
Banks adopting an AMA under Basel II are permitted to use internal models to calculate regulatory capital requirements for operational risk (BCBS, 2006a). These models are typically risk-based and use information from the underlying risk measurement systems as inputs into the model. After numerous complex calculations and steps in the capital model, a risk-sensitive capital requirement is produced for both the banking group and all internal business lines.
The next two chapters (Chapter 2 and Chapter 3) propose a capital modelling methodology that can be used for the calculation of operational risk capital requirements under an AMA. The methodology will be completely risk-based and satisfy all regulatory requirements for the calculation of AMA capital. Apart from basic regulatory capital components, additional elements will be proposed for incorporation into an economic capital model (even though this is not the focus of the study). These elements typically include offsets like correlation and incorporation of insurance, and are predominantly based on publications by other authors. This chapter focuses on the first part of the proposed capital modelling methodology, while the next chapter (Chapter 3) discusses the second part. The first part of this chapter provides a brief overview of the basic building blocks or steps in a generic AMA capital modelling methodology (to provide some context for the detailed techniques that will follow). The focus is then shifted to data acquisition, import and analysis as the first steps in the quantification process.
Extreme Value Theory (EVT) techniques and analysis, used to determine modelling thresholds and applicability of distribution families, are then discussed and explained. Consequently data segmentation using the results from EVT analysis is done and followed by severity modelling of internal data. The severity modelling of risk scenarios (to supplement inadequate internal data) is then explained. This includes details of scenario
11
aggregation and methods to derive frequencies of aggregate scenarios that will be used in consequent modelling steps and during integration with internal data models.
The chapter concludes with a discussion of various goodness-of-fit measures (graphical and numerical) that can be used to evaluate the applicability and accuracy of all severity distributions fitted to internal loss data and risk scenarios. It will be shown that, in each instance, the most appropriate severity distribution is chosen based on a best-fit basis. It is important to note that the focus of the next two chapters is regulatory capital calculation. However, as mentioned before, techniques will also be proposed (on a high level and predominantly based on the work of other authors) for the modelling of elements that are currently mainly used for economic capital calculations.
2.2 Basic building blocks of AMA capital modelling
The following basic steps or building blocks constitute the outline of a generic operational risk capital modelling methodology. Although there are many interim steps and detail below each of these elements, the steps are essential to any capital modelling methodology and provide the basic structure for discussions to follow. It will also provide context for the detailed techniques and methods that will be presented in this chapter, namely:
capturing of operational risk losses;
identification and quantification of risk scenarios; modelling of severity and frequency;
capital calculation; and capital allocation.
These basic building blocks are described briefly in the subsections to follow.
2.2.1 Capturing of operational risk losses
Capturing of operational risk losses suffered by a banking group and storage of the captured data are fundamental steps in the quantification of operational risk exposures. The capture of internal losses is performed using a specific enterprise loss data solution.
The data on the bank’s operational risk losses forms the basis of the quantification process. This process also includes the treatment and analysis of the data captured and the selection of data for use in the quantification process. The methodology employed consists of applying a number of extraction and filter criteria to the data contained in the database and presenting the data in graphs for analysis and comparison with external data. Loss data are a key input into the capital model.
12
2.2.2 Identification and quantification of risk scenarios
Risk scenarios should be defined and quantified for all business lines in a banking group. Workshop packs (including risk profile information from all AMA measurement components) are prepared for all risk scenario workshops and sent out to senior management attending the workshops prior to the meeting. Divisional workshops are then held where senior management (executive committees) identify and quantify risk scenarios. Post workshop refinement, confirmation and sign-off of risk scenarios then take place (coordinated by the various divisions), from where the modeller can use the data in the analysis and modelling process.
The identification and quantification of risk scenarios are informed by the other fundamental AMA components, namely business environment and internal control factors and external data. Scenario analysis is a key input into the capital model.
2.2.3 Modelling of severity and frequency
Modelling of severity and frequency distributions based on the internal loss data and risk scenarios is a fundamental step in the operational risk capital modelling process. This should be performed per business line (Basel II or internal) and Basel II loss event type combination. This process requires various statistical methodologies for the determination of thresholds that should be used for modelling and data segmentation. Sophisticated statistical techniques are also required for the fitting and selection of analytical distributions based on available loss data and risk scenarios.
2.2.4 Capital calculation
Calculation of the bank’s operational risk capital is the next phase in the quantification or modelling process. The overall (aggregate) annualised distribution of the banking group’s operational risk losses is calculated based on the descriptive distributions of operational risk losses of the business lines and loss event types. This calculation requires a simulation based on the frequency and severity distributions calculated in the previous step and the mixing of the internal data and qualitative scenario models. Following the simulation, operational risk capital for the bank as a whole is calculated at the desired confidence level (for example 99.9th percentile for regulatory capital (BCBS, 2006a)).
2.2.5 Allocation of capital
Allocation of capital is the final step in the modelling process. Once the total banking group capital has been calculated, it must be allocated to internal business lines (and possibly loss event types) in order to understand how they contribute to the group’s overall operational
13
risk. The allocation of capital to internal business lines will also provide a good consolidated view of operational risk per business line, and further provide a mechanism to incentivise good risk management behaviour and practices.
2.3 Data used in the AMA model
Numerous data from the various operational risk AMA measurement components are available as inputs into the capital calculation and capital allocation models. However, not all components are used in both the allocation and calculation models, and not all measurement components are used as direct inputs into the models.
Figure 2.1 provides an overview of the flow of data in the capital modelling process. It is also a summary of the chronological steps followed during capital modelling.
Figure 2.1: The flow of data in the AMA measurement and modelling system.
Figure 2.1 further provides an indication of where the AMA capital model (and various input data types) fits into the bigger Basel II Operational risk framework.
Data types used as direct input into the capital calculation model are:
internal loss data: internal losses collected throughout the bank on a central database enterprise application (for example OpenPages, SAS or Algorithmics, utilising an Oracle database); and
BU % x a = Capital Charge BU % x a = Capital Charge BU % x a = Capital Charge BU % x a = Capital Charge BU % x a = Capital Charge FNB RMB WB CC FNB RMB WB CC Div 1 Div 2 Div 3 . . LT 1 LT 2 LT 3… Div 1 Div 2 Div 3 . . LT 1 LT 2 LT 3… Div 1 Div 2 Div 3 . LT 1LT 2LT 3… Div 1 Div 2 Div 3 . LT 1LT 2LT 3… Internal Loss Database Risk Scenarios Div 1 Div 2 Div 3 . LT 1 LT 2 LT 3 … Risk Scenarios Div 1 Div 2 Div 3 . LT 1 LT 2 LT 3 … Div 1 Div 2 Div 3 . LT 1 LT 2 LT 3 … Scorecard External Loss Data Qualitative measures
RCSA KRI Advanced risk reporting
Accepta ble Room f orImpr ovem entUnac cepta ble Control Effec tiveness Impact
Medium Hig h
Low Accepta ble Room f orImpr ovem entUnac cepta ble
Control Effec tiveness Impact
Medium Hig h
Low
Capital allocation (BU) Capital calculation (per main divisions)
14
risk scenarios: qualitatively defined risk scenarios with currency value quantification estimates at various extreme probability levels.
The following operational risk data types are used as indirect input into the capital calculation model:
external data: external loss events from sources like Fitch First and ORX (Operational Risk Data Exchange) are used to inform scenario identification, definition and quantification; and
business environment and internal control factors: KRI and RCSA results are used to inform scenario identification, definition and quantification.
The allocation of total AMA capital calculated for a bank (total group capital) usually takes place in two phases – this is also evident in Figure 2.1. Firstly, capital is allocated to main internal business lines of the bank, using the statistical AMA capital model and business line specific loss data and scenarios used to calculate AMA capital for the banking group. Secondly, capital may need to be allocated to lower levels in the organisation. A pure statistical approach for these allocations may not be possible, since risk information (particularly risk scenarios and loss data) on lower levels in banks are often scarce. For these allocations, risk scorecards are used and are the responsibility of senior managers on various levels in the bank’s main business lines. The allocation of capital to levels below the bank’s main business lines is not within the scope of this study.
The following data are used in the capital allocation process (from group to divisional/main internal business line level):
internal loss data: contributions of internal business lines to the bank’s loss history will determine (together with risk scenarios) divisions’ or business lines’ statistical capital allocation; and
risk scenarios: contributions to risk scenario exposures will determine (together with internal loss data) divisions’ or business line’s statistical capital allocation.
The risk profiles constructed using internal losses and scenario data will therefore drive the capital allocation from aggregate group level to divisional or business line level.
The following data types are used in the capital allocation process (from main business lines to lower levels in the organisation):
Combined risk profile constructed from modelled internal loss data and scenario data for each lower level entity that will be allocated capital. Modelled loss and scenario data may not always be available on lower levels in the bank.
15
Risk scorecard: Risk scorecards compiled using various risk measurement mechanisms (for example key risk indicators, risk and control self-assessment results, audit findings, compliance reviews, insurance claims, and business continuity assessment results) will be used to allocate capital from main business lines to lower levels in the organisation.
The use of internal loss data and scenario analysis in the capital calculation and allocation process will be discussed in depth in subsequent sections of this chapter.
2.4 Level of granularity
An important decision that has to be made by the modeller is the desired level of granularity. During the BCBS’s range of practices surveys in 2006 and 2009 it was found that most banks worldwide classify and model data in a matrix, where the one axis depicts business lines (Basel II business lines or internal business lines) and the other axis depicts Basel II loss event types (BCBS, 2006b and BCBS, 2009). It was therefore decided that the proposed capital methodology would adopt the same dimensions for classifying and modelling data.
Each cell used for modelling is also referred to as an operational risk class. The more operational risk classes are used, the higher the level of granularity and vice versa. It is important to find an optimal level of granularity where enough operational risk classes are used to accurately reflect and measure underlying operational risk in the organisation. However, too many operational risk classes may lead to an unwanted distributional split and scarcity of data. In addition, if the level of granularity is too high, over-fitting and parameterisation of data may be a risk.
An optimal level of granularity is therefore when enough operational risk classes are used to accurately capture operational risk exposures in the organisation, while still maintaining logical simplicity corresponding to the structure used to manage the risks and business in the bank. In a recent range of practice survey conducted by BCBS it was found that most banks use between 20 and 60 operational risk classes for modelling (BCBS, 2009).
The best option may be to model data per main internal business line, which may be four or five business lines, per Basel II loss event type. For example, if a bank has four main divisions in the group, this implies a maximum of 28 cells that may contain data that should be modelled. Such a structure will correspond to the management structure in the banking group, which enables sensible risk-sensitive capital allocation, which can in turn be used to incentivise sound operational risk management and measurement in all the bank’s business lines. If the Basel II business lines are used, a mismatch between calculated capital and
16
internal business lines may be observed, making capital allocation to internal business lines difficult.
As an example it can be argued that a typical bank can usually be divided into the following main business lines:
retail and commercial banking (some corporate banking activities may also be present in this business line);
investment banking and corporate finance; vehicle and asset finance; and
corporate centre (all head office and support functions).
The following Basel II loss event types are used within each division/internal business line to increase granularity and ensure logical groupings of risk profile information (BCBS, 2006a):
internal fraud; external fraud;
employment practices and workplace safety; clients, products and business practices; damage to physical assets;
business disruption and system failures; and execution, delivery and process management.
Once a decision has been made on the modelling structure and level of granularity, data can be classified according to this structure for modelling purposes.
2.5 Data import and classification
As discussed earlier, all internal loss data and risk scenarios will be the primary inputs into the capital model. These variables therefore have to be classified according to the chosen modelling structure.
Usually, all required internal loss data (one of the primary inputs into the capital model) tables and fields are hosted in an enterprise loss data collection and management system (for example Openpages®, utilising an Oracle database). Relevant internal data entries are extracted from various tables in the enterprise application database (for example Openpages®, utilising an Oracle database) and organised in a new database table in a static Microsoft (MS) Access (or similar) staging area. It is important to note that various transformations and clean-ups may need to be performed on the data before they are placed
17
in MS Access or any other modelling application database for use in the capital model. This process is also referred to as extract, transform and load (ETL) of data. This is done to ensure that all internal data comply with minimum data requirements for operational risk capital modelling.
When data are extracted from the database (Figure 2.2), all data should already be mapped to an applicable internal division (business line) and Basel II loss event type (level 1). This is done via mappings from internal classification variables completed by data capturers. When doing certain transformations and tests on the data (before final placement in MS Access or similar), the two mappings are also checked to ensure that the data are adequately and correctly classified for modelling (consistent with regulatory requirements and the required level of granularity). Data in the static MS Access tables therefore already have the correct classification mappings that can be imported into the modelling application.
This static MS Access table is added to the local computer’s/server’s Open Database Connectivity (ODBC) data management system, and easily accessed using the modelling software application (data management and import module). Once the MS Access table has been linked to the modelling application, live feeds are used from the staging database to the application.
The process described above will typically be followed when no direct data feed from the source database to the modelling application or software is possible. However, a more automated data feed is preferred to minimise potential errors during the manual ETL process. Figure 2.2 is an example of the process typically followed when data are manually extracted from the source system and imported into the capital modelling application.
18
Risk scenario data (second primary input into the capital model) are stored in MS Excel or the enterprise data management solution, (for example Openpages®) and are duplicated manually into the capital modelling software solution if no automated feed is available. Since the number of scenarios is usually manageable, the manual duplication process is quite viable and no formal automated import process is needed. All scenario data adjustments and transformations are performed in MS Excel – the data manually duplicated in the software solution will therefore be an exact copy of available MS Excel data.
It is important that data quality and completeness receive priority during this phase of the capital modelling process. Data should comply with internal minimum data standards and policies. In addition, ETL processes and correctness of final datasets (both internal loss data and scenarios) should be reviewed regularly by internal audit and independent, third party reviewers.
Once internal loss data and scenarios have been classified and organised in the specified operational risk modelling structure, formal analysis and modelling of data can commence.
2.6 Basic data analysis
As data (internal loss data) exploration and analysis are essential steps in the overall modelling process, both need to be undertaken before analytical modelling of available internal loss data can be performed. These analyses are performed mainly to determine various thresholds and truncation points, as well as boundaries for tail modelling and risk scenario use. It further informs decisions whether a specific dataset (in a single cell) should be broken down into various sub-segments to better reflect and capture underlying data patterns and behaviour. Lastly, basic data and extreme value theory analysis will greatly assist in the assessment of whether heavy tail or light distribution families are applicable over various datasets and segments within datasets.
Basic data analysis is performed for each operational risk class (modelling cell, i.e. business line/event type combination). This is the first step in the systematic analysis and modelling of each cell in the modelling matrix. Basic data inspection and analysis is performed for each cell in the modelling matrix and forms the basis for all analysis and modelling that will follow. Tabular and graphic data analyses give the modeller an indication of data completeness, spread, classification, patterns, breaks and possible compatibility with certain analytical model families. Typical tools that are utilised are summary tables, regulatory data matrices, multidimensional histograms and empirical distribution representations. Descriptive statistics and associated graphs also play an important role to give the modeller an overview and holistic understanding of the data and certain distributional properties.
