Operational Risk and (super)models

Have been researching Op Risk modelling under Sol II recently (having not touched the subject for some time), and have been struck by the lack of clarity in the area.

Our friends at the Institute of Risk Management have made some sterling attempts to rectify this with a series of seminars over the last 18 months, the presentations from which I have had a run through (not solely dedicated to Op Risk, but all Sol II themed).

One entitled "Op Risk Modelling - What's the point" maybe says it all, though the content is much less dismissive! The reasons against are all valid, in particular lack of data (which I suspect the QIS4 Op Risk Questionnaire may have highlighted in concert across the EU) and relatively small capital saving available against, say, Insurance and Market. Less inclined to agree that the data is "infuriatingly inconsistent", certainly if an organisation is even remotely ERM-enabled. I especially liked the correlation piece at the end, which should be perhaps number 1 reason for modelling (diversification opportunities across the rest of the correlation matrix).

This excellent Dec 2010 survey on Op Risk modelling is perfect for benchmarking for UK guys (and still valid for you sportsfans further afield!). Relatively small sample at 36 participants (and three quarters internal modelling), but some great ideas on what "the industry" is contemplating;

• Around half already at 10% or more for their ICA Op Risk capital proportion (so, worth playing for)
• Only around 20% are banking on a fall in this amount under Sol II
• Scenario Analysis, Self Assessments and Internal Loss Events were the most popular quantitative techniques planned for their Sol II preparations (only around half using external loss events)
• Of the half not using external loss event data, half have no plans to (ORIC database of course being the main source)

So while there is money in it (some respondents being in the 15% of ICA bracket), it doesn't look like the sweet science of loss event numbers can carry the load on their own at the moment.

In addition to this, a fantastic article from Risk.net covers in some detail the Sol II Op Risk zeitgeist, most notably;

• Won't come up the priority list for most companies
•  Little incentive to make the ICA-generated number more precise
• Capital consequences not thought of in current regime (they had better be soon!)
• Anecdotal evidence of FSA pushing the loading towards 15-20% during arrow visits
• ORIC and IRM heads naturally supporting full modelling of Op Risk (indeed, to pass ORSA how could one not?)
• Need to reconcile with standard model approach, and perhaps add a levy to their internal model outputs
• Diversification effects on other categories are a bigger carrot than in isolation
• 5 years of back data would be a suprise, and external databases "insufficent"
• ORIC looking to drive standards (already doing so for scenario analysis). With 27 members out of the 100 in the the pre-application model queue, lobbying potential.
• Use output to justify mitigation techniques for "use test" evidence

Love to hear from anyone fishing in the same pond at the moment - my view is that, as there is an obligation in the Level 3 papers for collecting Op Risk loss event data, the time to refine what needs to be collected, and indeed start capturing it, is right now, regardless of other pressures. There will be plenty of time for Risk and Actuarial to plug it in next year...