LESSON 9: MODELLING

Video Activity Text Additional reading and references

9.1 PURPOSE
Review key risk indicators (KRIs), key performance indicators (KPIs) and key control indicators (KCIs) as fundamental to a risk
management framework.

9.2 KEY CONCEPTS

Internal measurement Loss distribution Scorecard approach
Inclusive approach Distributions Correlations
Gaps Scaling Data cleansing
Weighting Insurance Fat tails
Confidence levels Ratings Internal and external data
Detective controls Preventative controls Linking data and reports
Corrective controls Challenging input Ranking risks and controls

9.3 LEARNING OUTCOMES

On completion of this lesson, you should be able to

 explain the benefits of risk modelling

 identify the previous approaches to operational risk modelling
 identify the practical issues with combining internal and external data
 identify the business benefits from capital modelling
 Identify the business benefits from qualitative modelling

9.4 LEARNING MATERIAL

Chapter 9 of the prescribed book: Indicators.

9.4.1 About operational risk modelling

There are considerable benefits to risk modelling, which can start as soon as the first risk and control assessment is completed,
challenging and validating the data in these assessments. Modelling can use data from any one or more of the three
fundamental operational risk processes (i.e. indicators, assessments and events). It can change the qualitative data obtained
from risk and control assessments into monetary values and be used to make sense of loss and indicator data. Probabilistic
modelling provides validation of these processes by enabling management to challenge the conclusions reached
deterministically. Modelling of operational risk can also be used to determine the economic and regulatory capital
requirements of a firm. In addition, modelling enables capital to be allocated to business units, thereby supporting a risk-
adjusted return on capital approach.

Study “About operational risk modelling?” in chapter 9.

9.4.2 Previous approaches to operational risk modelling

The financial services industry experimented with a wide variety of modelling approaches for operational risk. The Basel
Committee identified three broad approaches:

 internal measurement approach

 loss distribution approach
 scorecard approach

Internal measurement approach

- A deterministic approach that provided a consistent methodology for advanced credit risk and operational risk
calculations.
- Relied on a comprehensive and complete database of losses experienced over a considerable number of years.
- Calculated the annual effect of a risk occurring (i.e. the annual likelihood of the risk occurring multiplied by the
value of the impact).
Loss distribution approach
- Similar to the internal measurement approach in some respects.
- Estimates the likely distribution of operational risk losses over some future horizon for each loss event
type/business line combination.
- Removes the internal measurement approach disadvantage of the assumption of the relationship between
expected and unexpected losses.
Scorecard approach
- Takes a more qualitative view of operational risk capital.
- Includes a forward-looking component intended to reflect improvements in the control environment that may
reduce the frequency/severity of future losses.

Study “Previous approaches to operational risk modelling” in chapter 9.

9.4.3 Towards an inclusive approach

Firms must take internal and external losses, the business and internal control environment and scenario analysis into account
within a comprehensive approach to modelling, combining both quantitative and qualitative approaches.

Study “Towards an inclusive approach” in chapter 9.

9.4.4 Distributions and correlations

Many distributions can be used for modelling operational risk. Continuous distributions are relevant for impact or severity,
whereas discrete distributions are relevant for frequency or likelihood. Typical impact distributions are lognormal, Gumbel,
Pareto and Weibull, and typical discrete distributions used are Poisson, uniform, binomial and negative binomial.

Study “Distributions and correlations” in chapter 9.

9.4.5 Practical problems in combining internal and external data

 gaps in internal loss data

 scaling of external data for a particular firm
 cleansing of external loss data to determine relevance and appropriate size
 weighting of a particular loss event type depending on exposure
 insurance policies, causes of losses and loss event types overlap
  fat tails – a large number of high severity events occurring

Study “Practical problems in combining internal and external data” in chapter 9.

9.4.6 Confidence levels and ratings

Confidence levels vary from 99.5% to 99.9%. A confidence level of 99.9% for a holding period of 1 year means that on average
the capital required will not exceed that level except for a 1 in 1 000 event occurring.

Study “Confidence levels and ratings” in chapter 9.

9.4.7 Obtaining business benefits from capital modelling

In a report from any capital model using a cell approach, there will be many cells containing valuable business data which can
be used to give information on the quality of the firm’s controls and the capital needed to support each of the businesses.

Link model data and reports by looking at the number of losses reported and linking them with the value of capital required.
A firm will benefit from either better reporting of losses and therefore better data on which to manage the businesses, or
from good controls in one business being developed and implemented in other businesses. Either way, the firm’s operational
risk profile will be better managed and potentially significantly reduced.

Modelling will yield data about the quality of the preventative controls as the number of events reported relates directly to
the quality of the preventative controls. The ability to minimise the size of losses speaks directly to the quality of the detective
and corrective controls operated by the business line. Good detective controls will reduce the possibility of a large loss and
good corrective controls will minimise the size of the loss. Modelling can show areas where the firm has good detective and
corrective controls through the average size of the loss and through the standard deviation of the size of the loss.

Study “Obtaining business benefits from capital modelling” in chapter 9.

9.4.8 Modelling qualitative data

Qualitative data is often modelled when quantitative data is either not available or not available in sufficient number.

What qualitative data do we have?

- generated through risk and control assessments
- refers to the risks to the business objectives and their mitigating controls
- data on risk owners and control owners
- assessment of risks and controls at both gross and net levels
- assess the capital required by a firm from a risk management perspective
- further data can be obtained through scenario analysis and stress testing
Why isn’t qualitative data modelled?
- data is changeable
- mainly management’s view of the future
- possibly misjudging strategic risks
- data only good for broad adjustments and is inherently unstable
Scaling the input
 - Risk impact scores should be challenged and revised.
- Likelihood scores are subject to bias.
- control assessments are also subject to bias.
- All data should be challenged and reviewed prior to modelling.

Study “Modelling qualitative data” in chapter 9.

9.4.9 Obtaining business benefits from qualitative modelling

Substantial benefit can be obtained from modelling risk and control assessments by themselves without waiting for significant
volumes of internal loss data to accumulate. Results can be aggregated by risks or controls and a comparison between risk
owners can be made. With the basic simulations completed, it is possible to extract further business benefit by ranking risks
and controls.

Study “Obtaining business benefits from qualitative modelling” in chapter 9.

9.5 SUMMARY

Modelling operational risk should be rooted in the core operational risk framework processes of risk and control assessments,
loss events and indicators, and its assumptions and principles should be understood by the board and senior management.
Since it is used for capital modelling, it can have a direct impact on reports on both product and business line performance.
However, even if all the assumptions are understood and the methodology is thoroughly and independently validated, the
nature of operational risk means that its modelling should be done with caution.

Study “Summary” in chapter 9.

9.6 ACTIVITY

Self-assessment questions: Go to the Online assessment tool to do activity 9.6.

9.7 REFLECTION

Before you continue to the next lesson, reflect on the following personal questions:

a. Where, in your professional life, do you think you will be able to use the skills you have learnt in
this lesson?
b. What did you find difficult? Why do you think you found it difficult? Do you understand it now, or
do you need more help? What are you going to do about it?
c. What did you find interesting in this lesson? Why?
d. How long did it take you to work through chapter 6 for this lesson? Are you still on schedule, or do
you need to adjust your study programme?
e. How do you feel now?
Blunden, T & Thirlwell, J. 2013. Mastering operational risk: a practical guide to understanding operational risk and how to
manage it. 2nd ed. London: Pearson.