Change font size:   

 
No. 6: If you don’t give it to me you’ll only lend it to someone else and look where that got us
Abigail Hofman:

Abigail Hofman:

I wonder if ______ is an extremely optimistic person or in a cocoon of senior management denial

December 1999

Risk management - Firms grope for definition


Author: David Shirreff




Bankers are trying to beat supervisors to a satisfactory definition of operational risk. That's because last June the Basel committee on banking supervision added operational risk to factors for which it proposes to charge regulatory capital. Bankers fear the committee will rush to a formula based on turnover or asset size to set a capital charge for operational risk. Size and volume isn't the issue here, they say, it's quality of management, organizational structure and systems.

But what is operational risk? The Basel committee simply refers to it as "other risks" after market and credit risk are stripped out. A survey by industry associations has come up with this definition: "Operational risk is the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems, or from external events." - anything from a failed money transfer to Hurricane Mitch. But reaching that definition was hard: 48% of firms quizzed for the survey said they, like the Basel committee, used a negative definition. Much time was spent deciding whether or not to include general business risk, a change in EU competition law, for instance Finally business risk was excluded.

"It took four hours with 15 banks sitting round a table to reach agreement on loss categorization," said one of the sponsors, when the survey was unveiled on November 9. Jonathan Davies, North American regional head of operations risk at Warburg Dillon Read, said his firm uses nine categories of loss. David Lau, operational risk manager at Credit Suisse First Boston, said: "We're trying to identify what are the top five risks."

The survey, commissioned by the British Bankers Association, the International Swaps & Derivatives Association and carried out by Robert Morris Associates, supported by PricewaterhouseCoopers, shows that banks are still struggling with defining operational risk and organizing themselves to manage it. One challenge has been to draw senior management's attention to it. But a lot has been done in a year, most experts agree.

These seers of operational risk reckon a successful approach requires "high quality, experienced people" - they mean themselves, of course.

The big issue, however, is databases: a track record of internal and external failures and what they have cost. Much of this is purely statistical - such as the incidence of out-trades, power failures, systems down time, etc. But when it comes to rogue trading and kidnappings, is it possible to quantify the probability? Since individual firms have very little experience of this it would seem sensible to pool data for the general good. But there are several problems. First, firms haven't been consistent about collecting internal data: they might do it for one or two departments, but not the entire firm. Second, firms are jealous of hard-won data: they are unlikely to make it available for free. Third, data that applies to one firm might not be useful for another.

According to the survey, only 25% of firms questioned said that they had a database in place. "Firms may have sub-databases but few will have across-the-board databases," said Davies of WDR. His firm has a database in only one of five divisions of the bank, he said. The loss database "is the way forward", he insisted. But 25% of the banks surveyed said they were not planning to use a loss event database model.

Perhaps they are waiting for the industry to develop a shared database, suggested Lau of CSFB. Access to such databases would certainly interest the insurance industry, said Davies, but there is no substitute for the data a firm generates internally.

Insurance companies do underwrite some aspects of banks' operational risk. "We had some interesting conversations with the insurance industry," said David Gittleson, a director at PwC. But a snag in buying operational risk insurance is the speed of payment. "Most financial firms would like a quick payout," noted Gittleson, but the insurance industry likes to check covenants, etc, and pay a year later. Nor could the insurance premium be taken as a benchmark for pricing operational risk: prevailing insurance premiums are low because of excess capacity.

WDR, however, has gone through the exercise internally of looking for insurance cover, said Davies. "We use a risk score," said Anthony Peccia, vice-president at CIBC, "and then apply operational risk hedges, which could be insurance or controls."

The pricing of operational risk would lead to the holy grail - allocating operational risk capital business by business.

"Calculating [economic] capital is an important first step because it gets the attention of the organization," said Lars Hansen, operational risk manager at SEB.

Calculating economic capital for each operational risk in theory would help firms get closer to the true profitability of each business area - so-called risk mapping - and to allocate and incentivize accordingly.

But the last thing these firms want is for regulators to use the same models to charge regulatory capital. No, they say, let some of us screw up by trying to allocate economic capital business by business or even firm-wide. But regulators risk seriously skewing the way firms operate if they apply regulatory capital across the board in copycat fashion.

Rather daringly the survey publishes a chart showing the percentage of capital 16 sample firms allocate for operational and business risks: it ranges from 10% to 65%, concentrating around 20% (see chart).

The survey showed that banks have years to go in identifying and quantifying operational risk. And the biggest dangers - extreme event risk and the volatility of reputation risk - may defy modelling for ever.

Maybe, finally, bankers and regulators are just chasing their tails. Banks have always run operational risk and carried a cushion of capital against it. Mark Laycock, head of operational risk at Deutsche Bank, reminded delegates that a capital charge for operational risk is probably implicit in the 1997 Basel market risk guidelines - it was certainly a cushion built into the 1988 credit risk guidelines. Laycock asked the rhetorical question: "Is the multiplier [minimum of three] which is applied to your market risk calculation, a market risk multiplier or an operational risk multiplier?"






You need the best analysis possible to understand what you’re buying. That or a large pair of balls

One US fund manager ponders whether or not to buy real estate assets.

Ruromoney Jobs Post a job