RISK MANAGEMENT &

FINANCIAL
INSTRUMENTS
Lecture 9 – Operational Risk: Identification
OPERATIONAL RISK: IDENTIFICATION
A. SOURCES
B. BUSINESS LINES
C. INTERNAL OPERATIONAL LOSS
1. Incident reporting
2. The 8X7 matrix
3. Statistical analysis
D. EXTERNAL OPERATIONAL LOSS
E. NEW PRODUCTS & ACTIVITIES & OUTSOURCING
OPERATIONAL RISK: IDENTIFICATION
A. SOURCES

Cause Events Result

People Describes, according to condition Assess under ‘likelihood of
occurrence’ and ‘severity of
occurrence’
Process Eg. fraud, employment
Systems practices/safety, damage to physical
assets, business disruption, execution
External events
OPERATIONAL RISK: IDENTIFICATION
A. SOURCES
• Study not only independently but also interrelationships
• Sets basis to quantify for $ operational risk capital needed to
support the bank’s risk-taking activities

B. BUSINESS LINES
See pp238 to 239: two levels
 OPERATIONAL RISK: IDENTIFICATION
C. OPERATIONAL RISK LOSS DATA – INTERNAL
Unlike market and credit risk, ops risk data is bank-specific (pp240-241)
• specific to bank’s relevant context – size, nature and risk profile
• understand ops risk profile and weaknesses in processes
• so, need to rely on own bank’s loss experience data

Relationship with credit and market risks (also known as ‘boundary events’) e.g.
• Appendix 5 of BNM (2018) Operational Risk Integrated Online Network (ORION) Policy Document
http://www.bnm.gov.my/index.php?ch=57&pg=543&ac=740&bb=file

Read ORION Appendix 5 (p27) – boundary event:

• “a loss event that has both operational risk and credit or market risk components. REs must
identify events that incur operational losses with credit or market risk implications and report
these as boundary events”
• credit related ops risk event – report under credit, boundary event, no ops risk capital calculation
• market related ops risk event – report under ops, boundary event, calculate ops risk capital
OPERATIONAL RISK: IDENTIFICATION
C. OPERATIONAL RISK LOSS DATA – INTERNAL

Event types (p241):

• Loss events
• Near-miss
• Operational risk gain
• Opportunity costs/lost revenues
OPERATIONAL RISK: IDENTIFICATION
C1. Incident Reporting
• Each business line reports its own operational risk losses as they occur
• Report content: date of report/occurrence/accounting, gross loan amt, recovery amt,
business lines, types of operational loss event, description of operational risk losses
Dates of occurrence of internal losses:
• Ideally, should report operational loss event on occurrence date
• But often unable; e.g. discover late, materialise/crystalise later
• Three dates:
 Occurrence – when operational loss event happened
 Discovery – when event was discovered
 Date of accounting – when bank needs to recognise losses for accounting purposes
 Under accounting standards, need specific requirements:
 Remote possibility => no recognition/disclosure
 Possible but not probable => contingent liability
 Probable => may be recognised as a liability
• Banks tend to prefer using (in order): occurrence, discovery, accounting
OPERATIONAL RISK: IDENTIFICATION
Gross loan amount
• Gross operational loss exposure – gross loan loss before recoveries
• But which amount?
• Book value
• Replacement value
• Market value

Internal loss data collection threshold

• Banks may set minimum amount to collect data
• Cost/benefit trade-off consideration

Business lines and event types allocation

• Two options:
 Allocate to the biz line where it has greatest impact
 Allocate pro-rata
OPERATIONAL RISK: IDENTIFICATION
C2. The 8X7 matrix
• Map loss data
• Classify under business lines and event types

C3. Statistical analysis

• Run basic statistical analysis on internal loss data collected
• Eg # incidents, average loss, standard deviation
• Classify under loss events and business lines
OPERATIONAL RISK: IDENTIFICATION
D. External operational risk loss data
• Must use relevant external data
• Data shows operational risk losses experienced by third parties
• Include actual loss amounts, business ops scale, causes/circumstances
of events
• How to use:
 Compare with internal loss data OR
 Explore possible weaknesses in control environment OR
 Consider previously identified risk exposures
• Popular data providers: ORX, bbaGOLD, ORIC
OPERATIONAL RISK: IDENTIFICATION
E. NEW PRODUCTS & BIZ ACTIVITIES & OUTSOURCING ACTIVITIES
E1. New products & biz activities
• E.g. develop new banking products for clients, enter unfamiliar markets, implement new
processes/systems, deal with businesses far from HO
• Need process to review and approve new products/activities/processes/systems
• Consider:
 Inherent risks
 Changes to bank’s operational risk profile, appetite and tolerance
 Necessary controls, risk management processes, mitigation strategies
 Residual risk
 Changes to relevant risk thresholds/limits
 Procedures and tracking of risk of new products/activities
 Appropriate and enough investment in HR, IT
OPERATIONAL RISK: IDENTIFICATION
E2. Outsourcing
• Some banks outsource some activities to save costs
• Eg backoffice, IT, Finance & Accounting, contract functions
• Risk concerns (p250 Table 8.12):
 Strategic, reputation, compliance, operational, exit strategy, counterparty, country
risk, contractual risk, access risk, concentration and systemic risk.
• Banks’ responsibilities (p250 Table 8.13):
 Outsourcing assessment policy, outsourcing risk management programme,
responsibility to clients & regulators, selection process, documentation,
contingency plans, confidentiality
• BNM guideline on outsourcing (23 Oct 2019)
http://www.bnm.gov.my/index.php?ch=57&pg=144&ac=849&bb=file
OPERATIONAL RISK: IDENTIFICATION (RECAP)
A. SOURCES
B. BUSINESS LINES
C. INTERNAL OPERATIONAL LOSS
1. Incident reporting
2. The 8X7 matrix
3. Statistical analysis
D. EXTERNAL OPERATIONAL LOSS
E. NEW PRODUCTS & ACTIVITIES & OUTSOURCING