How to Implement AMA for the Calculation of Capital Requirement for Operational Risk GABRIELLA GREPE IVAN THOMSON Master of Science Thesis Stockholm, Sweden 2008 2 Master of Science Thesis How to Implement AMA for the Calculation of Capital Requirement for Operational Risk Gabriella Grepe & Ivan Thomson INDEK 2008:102 KTH Industrial Engineering and Management Industrial Management SE-100 44 STOCKHOLM 3 Master of Science Thesis INDEK 2008:102 How to Implement AMA for the Calculation of Capital Requirement for Operational Risk Gabriella Grepe Ivan Thomson Approved Examiner Supervisor 2008-12-11 Thomas Westin Birger Ljung Abstract This report presents a case study of the development of an AMA 1 model for the calculation of capital requirement for operational risk. The case study was based on an assignment commissioned by one of Sweden’s largest banks. We were given full scope regarding the choice of the model and the assumptions, and began the process with a literature study of previously research in the area of operational risk. We ultimately chose a loss distribution approach for the base; the frequencies of the losses were assumed to be Poisson distributed, whereas the severities were assumed to follow a lognormal distribution. Instead of the correlation approach suggested in the loss distribution approach, we used a bottom-up approach where some losses were assumed to be jointly Poisson distributed. We also presented a way of scaling data in order to better fit external data to the internal ones. Please not that the model is only a suggestion since the lack of data made it impossible to test the ultimate results. What came to our attention during the development of the model is the lack of univocal guidelines for how the model has to be designed. Our opinion is that operational risk does not differ that much between banks. Hence, it might be a good idea to have uniform rules for the model development and only leave the assumptions about scaling and correlation to the bank. AMA = Advanced Measurement Approaches. The most advanced model for calculating the capital requirement for operational risk. A more thorough explanation will be presented in 4.1.3. 1 4 Acknowledgements We would especially like to thank three people for their significant contribution throughout the process of writing this thesis. Birger Ljung, our supervisor at INDEK, for his traditional finance view as well as his insightful comments about the structure of the report. Filip Lindskog, our supervisor at Mathematical Statistics, for his suggestions to the mathematical parts of the thesis. And last but not least Carl Larsson, our supervisor at the bank, for his servings as a sounding board and his valuable help with the implementation of the model. Stockholm, December 1, 2008 Gabriella Grepe Ivan Thomson 5 Table of Contents 1 Introduction.................................................................................................................................................... 8 1.1 Background ............................................................................................................................................. 8 1.2 Problem Statement................................................................................................................................. 9 1.3 Commissioner & Assignment............................................................................................................... 9 1.4 Aim of Thesis.......................................................................................................................................... 9 1.5 Delimitations......................................................................................................................................... 10 1.6 Disposition ............................................................................................................................................ 10 1.7 Terms & Definitions............................................................................................................................ 12 2 Methodology................................................................................................................................................. 13 2.1 Research Approach .............................................................................................................................. 13 2.2 Work Procedure ................................................................................................................................... 13 2.3 Choices of Path..................................................................................................................................... 14 3 Theoretical Framework ...............................................................................................................................15 3.1 Risk Types ............................................................................................................................................. 15 3.1.1 Credit Risk ..................................................................................................................................... 15 3.1.2 Market Risk.................................................................................................................................... 15 3.1.3 Operational Risk ........................................................................................................................... 15 3.2 Risk Measures and Methods ............................................................................................................... 16 3.2.1 Value-at-Risk ................................................................................................................................. 16 3.2.2. Expected Shortfall ....................................................................................................................... 17 3.2.3 Extreme Value Theory................................................................................................................. 18 3.3 Distribution Functions ........................................................................................................................ 21 3.3.1 Poisson Distribution .................................................................................................................... 22 3.3.2 Lognormal Distribution............................................................................................................... 23 3.4 Copula .................................................................................................................................................... 24 3.5 Simulation Methods for Computing VaR/ES ................................................................................. 26 3.5.1 Historical Simulation.................................................................................................................... 26 3.5.2 Monte Carlo Simulation............................................................................................................... 26 4 Basel Rules & Previous Research .............................................................................................................. 28 4.1 Three Types of Models........................................................................................................................ 28 4.1.1 Basic Indicator Approach (BIA)................................................................................................. 28 4.1.2 Standard Approach (SA).............................................................................................................. 29 4.1.3 Advanced Measurement Approaches (AMA) .......................................................................... 30 4.2 Three Types of AMA Models ............................................................................................................ 30 4.2.1 Internal Measurement Approach (IMA) ................................................................................... 31 4.2.2 Loss Distribution Approach (LDA) .......................................................................................... 31 4.2.3 Scorecard Approach (SCA) ......................................................................................................... 32 4.3 Previous Research – AMA.................................................................................................................. 32 5 Model Choice & Assumptions................................................................................................................... 34 5.1 What is a Good Model?....................................................................................................................... 34 5.2 Overall Approach Choice ................................................................................................................... 35 5.3 Distribution Assumptions................................................................................................................... 35 5.4 Correlation Assumptions .................................................................................................................... 37 5.5 Assumptions regarding Scaling, Inflation & Truncation Bias ....................................................... 39 5.6 Risk & Simulation Method.................................................................................................................. 39 6 Description of Our Model.......................................................................................................................... 41 6 6.1 Model Overview ................................................................................................................................... 41 6.2 Data Import .......................................................................................................................................... 41 6.3 Data Processing .................................................................................................................................... 43 6.4 Simulation.............................................................................................................................................. 52 7 Model Testing............................................................................................................................................... 53 8 Concluding Chapter..................................................................................................................................... 54 8.1 Insights................................................................................................................................................... 54 8.2 Future Required Updates .................................................................................................................... 54 8.3 Validity & Critique ...............................................................................................................................56 8.4 Further Research .................................................................................................................................. 58 9. References .................................................................................................................................................... 60 9.1 Written Sources .................................................................................................................................... 60 9.2 Interviews .............................................................................................................................................. 63 7 1 Introduction 1.1 Background This master thesis has been written during a time of financial turbulence. The acquisitions and/or bankruptcies of the five largest American investment banks have been an indirect result of the burst of the real estate bubble in 2006. The disturbance has spread with falling stock markets and concerns about the survival of other banks as a result. The media has speculated about the risk exposure of European banks and the public has expressed their worries about their saved capital. During such time, the attention has focused on the risk management of the banks. Can the banks stand up against the turbulence, and do they have capital to cover for the unexpected losses? The cooperation of international central banks entered the history books with the formation of the Bank for International Settlements (BIS) in 1930 (Bank of International Settlements. BIS History Overview, 2008). The institution, which initially was formed within the context of World War I reparation payments, came over time to focus on fostering monetary policy cooperation. The regulatory supervision of internationally active banks commenced as an important issue following the oil- and international debt crisis of the 70’s. As a result, The Basel Capital Accord was published in 1988 with the purpose of imposing a minimum capital standard in the banking industry (Basel Committee of Banking Supervision, 1988). Since then, banks need to reserve a specific amount of equity that reflects the risk they are exposed to. This Capital Accord was 13 years later replaced by Basel II, which contains more risk sensitive rules and requirements on the management and board of directors (Finansförbundet. Finansvärlden, 2005). One of the news with Basel II was the inclusion of operational risk as a separate category in the capital requirement framework (KPMG International, 2003). The risk is thus divided into three different categories; credit risk, market risk and operational risk. Operational risk is a fairly new modelling phenomenon and there are several complications in the process. The difficulty of predicting the events combined with the limit of historical data do not form a solid statistic platform on which to build the model. The internal fraud that caused the collapse of Barings Bank in the 90’s (BBC News, 1999) is one example of this. How is it possible to cover for a loss exceeding £ 800 million when it has not happened before? There is not a straightforward approach for how the model has to be designed. The Basel Committee proposes 8 three different types of methods with increasing degree of sophistication; banks are encouraged to move on to the more sophisticated ones in order to more precisely measure their operational risk. 1.2 Problem Statement How can a model for the calculation of capital requirement for operational risk be designed? The problem of aiming for an advanced method causes issues to the modelling process. There are several approaches suggested in the literature and some appear more common than others. Neither does however enclose all modelling issues and possible solutions to these. 1.3 Commissioner & Assignment The assignment has been commissioned by one of Sweden’s largest banks. The bank is active mainly in the Nordic region with considerable exposure in the Baltic area. The development process has been accomplished with guidance from the department Group Operational Risk Control, liable for the operational risks and the security in the bank. The Basel Committee on Banking Supervision (2006) has presented three different types of operational risk models with an increasing degree of sophistication. Since the bank used one of the less sophisticated methods for the capital requirement calculation for operational risk (the Standard Approach), a more advanced method was desirable. The assignment has thus concerned the development of the most advanced method called Advanced Measurement Approaches (AMA). 1.4 Aim of Thesis The aim of this study has been to make a suggestion of how AMA can be implemented. The development has been illustrated with the help of a case. The aim of the case study has been to map out the possibilities, the mathematical difficulties and highlight how the model may be designed in order to give a good measure for the capital requirement for operational risk. The aim is also to give an instruction of how to implement the model at a level that can be conducted at any bank or financial institution. The usage of this report is thus not limited to “our” bank; it can in theory be applied at any financial institution with internal loss data captured over a substantial time period. The way in which this report may be used is either directly as a 9 programming template or as discussion material for how to manage operational risk in the organization. By looking at the model development as a case study, we believe that our report may contribute to the research regarding how operational risk may be measured. 1.5 Delimitations The AMA model includes more than just the programming product. In order to get the model approved by Finansinspektionen (FI), the Swedish Financial Supervisory Authority, the model has to fulfil not only quantitative but also qualitative requirements. These include (among others) information about how the model is to be implemented, how the capital is distributed across the operational risks and how the time plan is designed (FI, 2007). Since our aim has been to map out the mathematical difficulties in the development of the model, the qualitative requirements have been considered to be out of scope. The focus has instead been limited to the quantitative requirements that have to be fulfilled in order to get the model approved. What needs to be acknowledged is that due to issues of confidentiality, the Matlab 2 code will not be included in this report. 1.6 Disposition This thesis is divided into nine chapters as follows: Introduction. This part of the thesis explains the background and the nature of the problem. The aim of the thesis, the assignor and the assignment are described as well as necessary delimitations to the problem statement. Methodology. The research approach and the work procedure are presented in this chapter. These include descriptions of how the assignment is related to the problem statement as well as a description of how the work has developed in the process of time. Theoretical Framework. The basics of Risk Management, as presented in traditional finance literature, are described in this chapter. The aim is to provide a basic understanding of what kind of 2 Matlab is a high-level programming language. See http://www.mathworks.com/products/pfo/ for more information. 10 risks banks are exposed to and how these can be measured. An overview of the distributions and simulations used in the model are presented as well. Basel Rules & Previous Research. This chapter focuses on the base for the capital requirement calculations – the rules of the Basel Committee. It presents the regulatory requirement for the AMAmodel as well as a description of the alternatives. The different approaches for how to construct the AMA and previous research about the model are presented as well. Model Choice & Assumptions. Considering the many different approaches that are presented, this chapter focuses on the method chosen in our case. Critical assumptions about loss distributions, correlations and scaling factors are described and argued for in this chapter. The question of what characterizes a good model is also discussed. Model Description. This part describes the features of our developed model. It explains how the data is imported and processed. It also provides a detailed description of how the correlation and scaling is handled and how the simulation is conducted. Model Testing. This chapter focuses on the tests the model has undergone. Concluding Chapter. The thesis is finished by a chapter that concludes the insights and the updates that has to be made. It also discusses the validity of the model and presents recommendations for further research in the area of operational risk. References. This part contains a list of references as well as a list of the interviewees. The figures that have been used in the report have either been collected from literature (and the sources are thus in the reference list) or made by us. In the case of the latter, the source is solely left out in the figure text. 11 1.7 Terms & Definitions This section provides a list of the abbreviations and some of the technical terms used in this report. AMA (Advanced Measurement Approaches). AMA is a summation name for the approaches that fall into the category of being the most sophisticated kind of model for the calculation of the capital requirement of operational risk. BIA (Basic Indicator Approach). The simplest approach for the calculation of the capital requirement of operational risk. Copula. A dependence measure that defines a correlation structure between two correlated variables. EVT (Extreme Value Theory). A theory of how to estimate the tail (in this case; the high severity losses) of a distribution. IMA (Internal Measurement Approach). An approach for how to build the AMA; an alternative approach to the LDA and SCA approaches. LDA (Loss Distribution Approach). An approach for how to build the AMA; an alternative to the IMA and SCA approaches. Monte Carlo simulation. A simulation technique where one assumes a distribution for how the losses are distributed and then simulates new losses according to it. SA (Standard Approach). An approach calculating the capital requirement of operational risk. It is less sophisticated than AMA, but more sophisticated than BIA. SCA (Scorecard approach). An approach for building the AMA; an alternative approach to the LDA and IMA approaches. Truncation bias. The bias that appears due to the fact that the internal dataset is truncated (i.e. that only losses that exceed a specific threshold are reported) VaR (Value-at-Risk). A risk measure answering the question of how much it is possible to loose within a specified amount of days with a certain certainty. 12 2 Methodology This chapter aims to provide an overview of how the work was conducted; what kind of research approaches that was used and how the work procedure was designed. The important choices of path, including the required mathematical and regulation knowledge, are also explained here. 2.1 Research Approach The research approach of this thesis has been conducted with the aid of a case study. Since the assignment came prior to the idea of research, we had to go backwards and find a way in which this assignment could be scientifically contributing. The case itself is interesting since it touches upon one of the new areas of modelling within risk analysis. There are numerous reports regarding different parts of the AMA-model, but we considered there to be a research gap in the overall view; the model issues, how they may be handled and how the model itself may be criticized. It must however be emphasized that this is only a suggestion of how such a model may be designed. We have tested the programming, but because of the lack of data, we have not been able to test its numerical results. Thus, we have not been able to test the sensitivity of the assumptions made, and this report should be read with this concern in mind. 2.2 Work Procedure The process was initiated with a literature review covering working papers from the Basel Committee as well as academic reports of the area. Most of the material was collected from the Internet, with Social Science Research Network (SSRN) as the main source. Material concerning the theoretical framework was read in order to map out applicable risk measurement techniques and simulation methods that could be used in the model. The next step in the process was to make a choice about the necessary assumptions. These regarded the distributions of the losses (how often they occur, and how much that was lost when they occurred), the correlation (is there any reason to believe that the loss in a may influence a loss in b?) and the potential influence of business line income on operational risk. In order to thoroughly revise these assumptions, a number of semi structured interviews were made both with mathematicians at KTH and with employees within the bank. The interviews with mathematicians at KTH regarded mathematical and modelling issues that 13 were approached in the development process. The interviews within the bank regarded different areas dependent on who was interviewed. The discussions with the risk analysts regarded the mathematical aspects and the discussions with employees earlier employed by FI, regarded FI’s work process and point of view. The interviews with experienced employees within the bank concerned the potential correlation of losses that was important to the development of the model. The programming of the model was conducted continuously throughout the development process. 2.3 Choices of Path In writing this thesis, several important standpoints had to be taken. One regards our theoretical base. The choice of several theoretical sources is made because of an ambition to make the report as pedagogical as possible. We have chosen the, in our view, best description of the phenomenon from different books in order to ease the understanding of the measures and methods used. What needs to be emphasized is that the different authors do not contradict each other regarding the theoretical framework. Another standpoint regards to whom this report is directed to. Our aim is to write this report so that someone with at least some knowledge of probability theory and traditional risk analysis may find it possible to understand. The reader does not have to have any awareness of the Basel Committee and its work; the necessary parts will be thoroughly described in chapter 4. The last, but probably the most important, choice of path is the one regarding our underlying assumptions about risk analysis. We have chosen to accede to the traditional finance theory and its interpretation of how risk ought to be measured. We have thus chosen not to criticize the traditional view of analysing risk, where the history is seen as representative for the future. The discussion of alternatives is considered to be out of scope. 14 3 Theoretical Framework In order to simplify for the reader, this part presents an overview of the risk types, risk measures and mathematical phenomena encountered and involved in the modelling process. The discussion of the methods is saved for chapter 5; the aim of this part is only to provide a background for the methods mentioned further on. It is thus recommended to skip this chapter when reading the report for the first time, and instead use it as a book of reference when reading chapters 5-8. 3.1 Risk Types Hult and Lindskog (2007) present a general definition of risk for an organization as “any event or action that may adversely affect an organization to achieve its obligations and execute its strategies”. When it comes to capital requirement, the risk is divided into three categories; market, credit and operational risk. 3.1.1 Credit Risk The Bank of International Settlement (BIS) defines, according to Gallati (2003, p. 130), credit risk as “the risk that a counterparty will not settle an obligation for full value, either when due or at any time thereafter. In exchange-for-value systems, the risk is generally defined to include replacement risk and principal risk”. 3.1.2 Market Risk The Bank for International Settlement (BIS) defines market risk as “the risk of losses in on- and offbalance-sheet positions arising from movements in market prices”, according to (Gallati, 2003, p. 34). He describes the main factors that contribute to market risk as equity, interest rate, foreign exchange and commodity risk. The aggregation of all risk factors is the total market risk. 3.1.3 Operational Risk There is no established way of how to define operational risk. On the one side of the spectrum is the broad definition of operational risk as “anything in the bank that is not market risk or credit risk” (Hull, 2007). On the other side of the spectrum is the narrow definition of operational risk as 15 any risk arising from operations. The definition that is widely used in banking terms is that of the Basel Committee (Basel Committee on Banking Supervision, 2006, p. 144): “The risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.” Examples of operational risks include among others internal and external fraud, IT-breakdowns and natural disasters. The exposure to operational risk is less predictable than the other risks that the bank faces. While some of the operational risks are measurable, some may thoroughly escape detection (Jobst, 2007). The operational risks do mainly occur as rare high severity events or frequent low severity events. The rare high severity events are for example uncontrolled gambling and natural disasters, whereas frequent low severity events may be exemplified by stolen credit card payments. When it comes to the expected loss in the bank, it is easier to quantify the expected loss for frequent low severity events than it is for rare high severity events (Jobst, 2007). The incorporation of the latter is thus the most complicated, and probably also the most important, part of the risk model. 3.2 Risk Measures and Methods The relevant measures and methods to use regarding the calculation of capital requirement are introduced in this section. These are presented in order to give the reader an understanding of how they are used in the model developed. 3.2.1 Value-at-Risk The Value-at-Risk (VaR) measure is by Hult and Lindskog (2007, p. 14) defined as: “Given a loss L and a confidence level α ∈ (0,1), VaRα(L) is given by the smallest number l such that the probability that the loss L exceeds l is no larger than 1- α, i.e.:” VaRα ( L ) = inf {l ∈ R : P ( L > l ) ≤ 1 − α } = inf {l ∈ R : 1 − FL (l ) ≤ 1 − α } = inf {l ∈ R : FL (l ) ≥ α }. 16 The VaR measure thus presents the value V in the following statement: “We are X percent certain that we will not loose more than V dollars in the next N days. “ (Hull, 2007). X is here the confidence level, whereas N is the time horizon of the statement. One example will illustrate this statement. Imagine a portfolio of assets, whose total risk we want to measure with VaR. Then VaR is the loss over the next N days corresponding to the (100-X)th percentile of the distribution of changes in the value of the portfolio (Hull, 2007). With 98 % confidence level, the VaR-value is the second percentile of the distribution. By simulating from this distribution 100 times, there should on average be two values exceeding this value. Even though Value-at-Risk gives an easily understandable answer, there is a drawback. The VaRmeasure only provides a value for the maximum loss with a certain probability; it does not say anything about the loss if that value is exceeded. Hull (2007) demonstrates that this may have a practical drawback in terms of a trader’s risk limits. If the trader is being told that the one-day 99 % VaR has to be kept at a maximum of 10 million, the trader can construct a portfolio where there is a 99 % chance of losing less than 10 million, but a 1 % chance of losing much more. 3.2.2. Expected Shortfall The previously mentioned weakness may be eased by the use of Expected Shortfall (ES). This measure is presented by Hult and Lindskog (2007) as: “For a loss L with continuous loss distribution function FL the expected shortfall at confidence level α ∈ (0,1), is given by” ESα ( L ) = E ( L L ≥ VaRα ( L )) Instead of asking how bad things can get, ES measures what the expected loss is if things do get bad (Hull, 2007). ES is thus the average amount that is lost over the N day-period, if the loss has exceeded the (100-X)th percentile of the distribution (i.e. the VaR-value). The following figure illustrates the difference between Value-at-Risk and Expected Shortfall. 17 Figure 1. Illustration of Value-at-Risk and Expected Shortfall. See Hull (2007, p. 198) for a similar version. 3.2.3 Extreme Value Theory Extreme Value Theory (EVT) is the science of estimating the tails of a distribution (Hull, 2007). The tail does here refer to the ultimate end of the distribution that, in terms of a loss distribution, consists of very high losses. If the tail is heavy, it means that there is a considerable amount of high losses at the end of the tail. Hult and Lindskog (2007, p. 28) point out that even though there is no definition of what is meant by a heavy tail, it is “common to consider the right tail F ( x ) = 1 − F ( x ) , x large, of the distribution function F heavy if: ” lim x →∞ F (x ) = ∞ , for every λ > 0 e − λx Hult and Lindskog (2007) further present the quantile-quantile plot (qq-plot) as a method to achieve an indication of the heaviness of the tail. It is a useful tool for assessing the distribution of identically and independently distributed variables. By using a reference distribution F, it is possible to plot the sample against the reference distribution and thereby get an understanding of how our sample behaves in reference to F. If Xk,n is our sample, the qq-plot consists of the points (Hult & Lindskog, 2007, p. 29): ⎧⎛ ⎫ ←⎛ n − k +1⎞⎞ ⎟ ⎟⎟ : K = 1,..., n⎬ ⎨⎜⎜ X k ,n , F ⎜ ⎝ n +1 ⎠⎠ ⎩⎝ ⎭ 18 If the plot achieved is linear, it means that the sample has a distribution similar to the reference distribution (Hult & Lindskog, 2007). If the sample has heavier tails than the reference distribution, the plot will curve up at the left and/or down at the right. If the sample has lighter tails than the reference distribution, the plot will curve down at the left and/or up at the right (Hult & Lindskog, 2007). The figure below is a qq-plot that compares the sample of historical losses to a simulation of lognormal ones. Since the plot achieved is linear, it is fair to assume the losses to be approximately lognormally distributed. Figure 2. QQ-plot. Hull (2007) mentions that EVT can be used to improve VaR estimates, since it smoothes and extrapolates the tails of the empirical distribution. This means that EVT may be useful where extreme historical data is relatively scarce. EVT may also be used to estimate VaR when the VaR confidence level is very high, and thus provide a closer estimate (Hull, 2007). One major result within EVT, concerning the right tail of the probability distribution, was proved by Gnedenko in 1943 (Hull, 2007). He found that the right tail of the probability distribution behaves according to the generalized Pareto distribution as the threshold u is increased. Hult and Lindskog (2007, p. 38) present the generalized Pareto distribution (GPD) function as: ⎛ γ x⎞ ⎟ Gγ , β ( x ) = 1 − ⎜⎜1 + β ⎟⎠ ⎝ 19 − 1 λ for x ≥ 0 The estimator of the tail (i.e. of the part of the distribution that exceeds u), is presented by Hult and Lindskog (2007, p. 39) as: N Fˆ (u + x ) = u n ⎛ x⎞ ⎜1 + γˆ ⎟ ⎜ βˆ ⎟⎠ ⎝ − 1 γˆ (1) The estimator of the quantile is presented by Hult and Lindskog (2007, p. 39) as: 3 −γˆ ⎞ ⎞ βˆ ⎛ ⎛ n qˆ p (F ) = u + ⎜ ⎜⎜ (1 − p )⎟⎟ − 1⎟ ⎟ γˆ ⎜ ⎝ Nu ⎠ ⎝ (2) ⎠ In order to use the Peaks Over Threshold (POT) method for the estimation of tail probabilities and quantiles, one first have to choose the high threshold u and count the number Nu that exceed that value. See figure below. Figure 3. Illustration of the POT-method. Given this sample of exceedances (the parts of the losses that exceed u), the next step is to estimate the parameters γ and β. These are found by using a maximum likelihood estimation of the parameters, assuming the losses exceeding u are generalized Pareto distributed. 4 The values of u, Nu,, γ and β may then be inserted into (1) and (2). Simulation from (1) now gives a smoother tail than the original sample. 3 4 For proof, see Hult & Lindskog (2007. p. 39). For a more detailed description, see Hult & Lindskog (2007, p. 41). 20 By using the POT-method, the VaR and ES 5 may be calculated directly as well. Hult and Lindskog (2007, p. 44) present the following formulas, based on the above estimated parameters: −γˆ ⎞ ⎞ βˆ ⎛⎜ ⎛ n ˆ ⎜ ⎟ ( ) ( ) VaRp, POT X = u + ⎜ 1 − p ⎟ −1⎟ ⎜ ⎟ γˆ ⎝ Nu ⎠ ⎝ ⎠ βˆ + γˆ (qˆ p − u ) Eˆ S p , POT ( X ) = qˆ p + 1 − γˆ 3.3 Distribution Functions This report concerns two types of distributions; the discrete distribution (for example binomial, geometric and Poisson distributions) and the continuous distribution (for example exponential, gamma and normal distributions). Why these two are of current interest is explained in more detail in chapter 5.3. The definition of a distribution function FX, of the random variable X, is defined as (Gut, 1995, p. 7): FX ( x ) = P ( X = x ),−∞ < x < ∞ For discrete distributions we introduce the probability function pX, defined as: p X ( x ) =P ( X = x ), for all x For the discrete probability function, the following is true (Gut, 1995, p. 7): FX ( x ) = ∑ p X ( y ) , − ∞ < x < ∞ y≤ x For continuous distributions we introduce the density function fX, for which (Gut, 1995, p. 7): 5 For proof, see Hult & Lindskog (2007, p. 41). 21 FX ( x ) = x ∫ f ( y ) dy , − ∞ < x < ∞ X −∞ What is described above is how one random variable, X, may be distributed. There may also be the case that several variables are distributed together. If we introduce another random variable, Y, the description of how the pair (X,Y) is distributed is given by the joint distribution function, FX,Y (Gut, 1995, p. 9): p X ,Y (x, y ) = P ( X = x, Y = y ) , − ∞ < x, y < ∞ There exists a joint probability function in the discrete case, given by (Gut, 1995, p. 9): FX ,Y ( x, y ) = P ( X ≤ x , Y ≤ y ) , − ∞ < x, y < ∞ There exists a joint density function in the continuous case, given by (Gut, 1995, p. 9) f X ,Y ( x, y ) = ∂ 2 FX ,Y (x, y ) ∂x∂y , − ∞ < x, y < ∞ 3.3.1 Poisson Distribution The Poisson distribution is commonly referred to as Po(m), where m > 0. It belongs to the discrete distribution functions and its probability function is defined as (Gut, 1995, p. 259): p(k ) = e −m mk , k = 0,1,2,... k! Blom (2005) describes the Poisson distribution as a distribution that appears in the study of randomly occurrences in time or room. Example of this is for example the occurrence of a traffic accident or that someone is calling SOS. These may occur at any given time point and are independent of each other (Blom, 2005). k in the formula above is thus the number of events that appear in a given interval of time length t; causing k to be Po(m)-distributed, where m is the expected value of occurrences in that interval. 22 By simulating 1000 times from a Po(5)-distribution, the following plot is achieved. It should be read as the number of occurrences per outcome. I.e. the outcome 0 occurs approximately 48 times, the outcome 1 approximately 92 times etc. Figure 4. Illustration of the Poisson distribution with µ=5. If the variables themselves are Poisson-distributed, they occur in time according to a Poissonprocess. Gut (1995) describes the Poisson process as a discrete stochastic process in continuous time that is commonly used to describe phenomena as the above (the SOS-call and the traffic accident). The Poisson process is by Gut (1995, p. 196) defined as “a stochastic process, {X(t), t ≥ 0}, with independent, stationary, Poisson-distributed increments. Also, X(0) = 0.” X(t) in the definition is the number of occurrences in the time interval between 0 and t. 3.3.2 Lognormal Distribution The lognormal distribution is commonly referred to as LN(μ,σ2), where -∞ < μ < ∞, σ > 0. It belongs to the continuous distribution functions and its density function is defined as (Gut, 1995, p. 261): f (x ) = 1 σ x 2π e 1 − (log x − μ ) 2 / σ 2 2 23 ,x>0 In the lognormal distribution, the log of the random variable is normally distributed. This is easier to grasp by comparing the above formula for the lognormal distribution with the below one for the more common normal distribution. f (x ) = 1 − ( x − μ )2 / σ 1 e 2 , −∞ < x < ∞ σ 2π By simulating 1000 times from a LN(12,2)-distribution and sorting the severity in increasing order, the following plot is achieved: Figure 5. Illustration of the lognormal distribution with µ=12 and σ=2. 3.4 Copula Copula is a well-known concept within Risk Management theory because of its usefulness for building multivariate models with non-standard dependence structures (Hult & Lindskog, 2007). The copula is a function that defines a correlation structure between two correlated variables, each with its own marginal distribution. If the marginal distribution for example is a normal distribution, it is convenient to assume that the variables together are bivariate normally distributed (Hull, 2007). The problem however is that there exists no natural way of defining a correlation structure between the two marginal distributions; the bivariate normally distribution is not the only way the two 24 variables could be jointly distributed. Hull (2007) explains that this is where the use of copulas comes in. This section presents two different ways of explaining what a copula is; the first one is a mathematical explanation by Hult and Lindskog (2007), the second one a descriptive explanation by Hull (2007). Hult and Lindskog (2007, p. 63) present two complementing definitions of the copula (where the second one includes Sklar’s theorem): “A d-dimensional copula is a distribution function on [0,1]d with standard uniform marginal distributions. […] This means that a copula is the distribution function P(U1 ≤ u1, …, Ud ≤ ud) of a random vector (U1, …, Ud) with the property that for all k it holds that P(Uk ≤ u) = u for u ∈ [0,1].” “Let F be a joint distribution function with marginal distribution functions F1, …, Fd. Then there exists a copula C such that for all x1, …, xd ℜ ∈ [- ∞ , ∞ ], F ( x1 ,..., xd ) = C (F1 ( x1 ),..., Fd ( xd )) (10.1) If F1, …, Fd are continuous, then C is unique. Conversely, if C is a copula and F1, …, Fd are distribution functions, then F defined by (10.1) is a joint distribution function with marginal distribution functions F1, …, Fd. […] Let F be a joint distribution function with continuous marginal distribution functions F1, …, Fd. Then the copula C in (10.1) is called the copula of F. If X is a random vector with distribution function F, then we also call C the copula of X. “ Hull (2007) explains the copula phenomenon by taking two variables with triangular probability distributions as an example, he calls them V1 and V2. In order to find out the correlation structure between these two variables, the author uses the Gaussian copula. In order to do so, the variables are each mapped into two new variables (call them U1 and U2) that are standard normally distributed. This is done by looking at V1’s value in each percentile of the distribution and calculating what that is according to the standard normal distribution. By assuming that the variables U1 and U2 are jointly bivariate normal, it implies a joint distribution and correlation structure between V1 and V2 (Hull, 2007). What is done here is what the copula does in practice. Instead of 25 determining the correlation directly out of the original variables (V1 and V2 in this case), these are mapped into other variables (U1 and U2) with well-behaved distributions for which a correlation structure is easily defined. The key property of the copula model here is that the marginal distributions are preserved at the same time as the correlation structure between them is defined (Hull, 2007). 3.5 Simulation Methods for Computing VaR/ES 3.5.1 Historical Simulation In this simulation approach, it is supposed that the historical risk factor changes are representative for the future. I.e. it is supposed that the same changes will occur over the next period (Hult & Lindskog, 2007). With the aid of the risk factor changes we achieve the loss vector l. The losses are then sorted in increasing size, in order to compute the empirical VaR and ES using the formulas below (Hult & Lindskog, 2007, p. 25). n represents the number of losses in the loss vector. ( ) VˆaRα (L ) = qˆ FLn = l[n (1−α )]+1,n [n (1−α )]+1 Eˆ Sα (L ) = ∑l i =1 i ,n [n(1 − α )] + 1 Hult and Lindskog (2007) however mention the disadvantages of the worst case never being worse than what has already happened in the past. “We need a very large sample of relevant historical data to get reliable estimates of Value-at-Risk and expected shortfall” (Hult & Lindskog, 2007, p. 25). 3.5.2 Monte Carlo Simulation The use of the Monte Carlo simulation method requires an assumption of the distribution of the previous mentioned risk factor changes. The real loss distribution is thus approximated by the empirical distribution FLN. Instead of using historical observations, the risk factor changes are in this method simulated according to the distribution chosen. The empirical VaR and ES are then computed the same way as shown above. 26 The authors consider the simulation method to be flexible, since it is possible to choose any model from which it is possible to simulate. It is however computationally intensive as a large amount of simulations have to be done in order to give a statistically correct value of the confidence level chosen (Hult & Lindskog, 2007). 27 4 Basel Rules & Previous Research This chapter aims to give an overview of the Basel Committee’s regulation regarding the calculation of the capital requirement. It provides a description of the three types of models that may be used in this process, where AMA is one. Three different approach of how to build the AMA is also presented in order to give an overview of the alternatives available. The chapter also aims to give an overview of the previous research regarding AMA and its implementation. 4.1 Three Types of Models The Basel Committee on Banking Supervision (2006) has identified three types of models for the calculation of the capital requirement for operational risk. These are, in order of increased sophistication; the Basic Indicator Approach (BIA), the Standard Approach (SA) and the Advanced Measurement Approaches (AMA). 4.1.1 Basic Indicator Approach (BIA) BIA is the simplest approach of the ones available. The Basel Committee on Banking Supervision (2006, p. 144) explains it as follows: “Internationally active banks and banks with significant operational risk exposures (for example, specialized processing banks) are expected to use an approach that is more sophisticated than the Basic Indicator Approach and that is appropriate for the risk profile of the institution”. The bank must thus hold capital for operational risk equal to the average over the previous three years of a fixed percentage (15 %) of positive annual gross income 6 . It is expressed as follows (Basel Committee on Banking Supervision, 2006, p. 144): K BIA = α N N ∑ GI i 1 Where KBIA= the capital requirement under the Basic Indicator Approach, α = 15 % (which is set by the committee), N = number of the three previous years for which the gross income is positive, GIi = annual gross income (if positive). Gross Income = Net Interest Income + Net Non-Interest Income (Basel Committee on Banking Supervision, 2001, p. 7). 6 28 4.1.2 Standard Approach (SA) “In the Standardised Approach, banks’ activities are divided into eight business lines: corporate finance, trading & sales, retail banking, commercial banking, payment & settlement, agency services, asset management, and retail brokerage” (Basel Committee on Banking Supervision, 2006, p. 147). Just like in the Basic Indicator Approach (BIA), you look at an average over the three last years. But instead of using only one fixed percentage for the entire bank, there are different percentages for all of the eight business lines. Similarly to the BIA, if the aggregate gross income for all business lines any given year is negative, it counts as zero. In detail, this is done as follows: ⎛ ⎡ 8 ⎤⎞ ⎜ max , 0 GI β ⎢∑ i , j j ⎥ ⎟⎟ ∑ ⎜ i =1 ⎝ ⎣ j =1 ⎦⎠ = 3 3 K SA Where, KSA = the capital requirement under the Standardized Approach, GIi,j= annual gross income in a given year for each of the eight business lines, βj= a fixed percentage, set by the committee, for each of the eight business lines. The β-values are detailed below: Business Lines Beta Factors Corporate Finance (β1) 18 % Trading & Sales (β2) 18 % Retail Banking (β3) 12 % Commercial Banking (β4) 15 % Payment & Settlement (β5) 18 % Agency Services (β6) 15 % Asset Management (β7) 12 % Retail Brokerage (β8) 12 % Figure 6. List of the β-values in the SA (Basel Committee on Banking Supervision, 2006, p. 147). 29 4.1.3 Advanced Measurement Approaches (AMA) The focus of this study is the development of an Advanced Measurement Approach (AMA). This approach implies that the bank should by itself model the operational risk; there is no direct formula available as above. The measurement system must, according to the Basel Committee on Banking Supervision (2006, p. 144), “reasonably estimate unexpected losses based on the combined use of internal and relevant external loss data, scenario analysis and bank-specific business environment and internal control factors”. Figure 7. The requirements for the AMA-model. The internal data contains the losses that the bank has experienced and reported into its own system. N.B. that all of the reported losses exceed a specific amount, the reporting threshold. That means that all losses that are not as severe as to reach that threshold are not reported into the system. One can thus say that the internal dataset is “truncated” below a specific value. The external data are for example losses from several banks that have been pooled in order for member banks to collect supplementary information. ORX is one of these pools where members are expected to report their full loss data history on a quarterly basis (ORX Association, 2007). The threshold for these data is € 20000. Scenario analysis implies the use of expert opinion in form of risk management experts and experienced managers in order to evaluate exposure to high-severity events. The analysis should also cover how deviations of correlation assumptions may impact the outcome (Basel Committee of Banking Supervision, 2006). Business environment and internal control factors are drivers of risk that should be translatable to quantitative measures. Changes of risk control in the bank should thus be captured by the model. 4.2 Three Types of AMA Models Since there is no specific regulations of how to develop the AMA model, except that it has to fulfil the above requirements, there have been different approaches at different banks. The Basel committee (Basel Committee on Banking Supervision, 2001) has acknowledged three broad types of 30 approaches that are currently under development; the internal measurement approach (IMA), the loss distribution approach (LDA) and the scorecard approach (SCA). 4.2.1 Internal Measurement Approach (IMA) In this type of approach the bank’s losses is generally divided into business lines and event types. For each of these combinations, the expected loss is calculated by the combination of frequency and severity estimates. The capital charge for each of the combinations Ki,j is (Basel Committee of Banking Supervision, 2001): K i , j = γ i , j * EI i , j * PDi , j * LGDi , j = γ i , j * ELi , j Where γi,j= a parameter whose value depends on the combination of business line / event type, EIi,j = the Exposure indicator. The higher EIi,j the larger exposure in that particular business line, PDi,j= Probability of default, LGDi,j= the loss given default. IMA thus assumes the relationship between expected and unexpected loss to be fixed, regardless of the level of expected losses and how the frequency and severity are combined (Basel Committee of Banking Supervision, 2001). 4.2.2 Loss Distribution Approach (LDA) The loss distribution approach has over the recent years emerged as the most common of the three approaches (Jobst, 2007). As in the case of IMA, the bank’s losses are divided into business lines and event types. The approach is founded on certain assumptions about the distributions for the severity and frequency of events (Basel Committee on Banking Supervision, 2001). These are commonly simulated using the Monte Carlo simulation technique (ITWG, 2003). The aggregated loss distribution is the combination of these two distributions. By using the Value-At-Risk of the loss distribution one finds the total risk exposure (EL and UL) for 1 year at 99.9 % statistical confidence level (Jobst, 2007). In other words, this amount should cover all expected and unexpected losses the bank faces during a year with 99.9 % probability. I.e. if the model is correct, the bank’s equity should not be sufficient one year out of 1000. What distinguishes this approach is that it assesses unexpected losses directly. It does not, as in the case of IMA, make an assumption about the relationship 31 between EL and UL (Basel Committee of Banking Supervision, 2001). Haas and Kaiser (Cruz, 2004) present an overview of the Loss Distribution Approach, illustrated as follows: Figure 8. Overview of the Loss Distribution Approach. (Cruz, 2004, p. 18) 4.2.3 Scorecard Approach (SCA) This approach is based on the idea that banks determine an initial level of operational risk capital, which they modify over time as the risk profile changes. The scorecards that are used to reflect improvements of risk control may be based on either actual measures of risks (for example LDA or IMA) or indicators as proxies for particular risk types (Basel Committee on Banking Supervision, 2001). Even though the model has to incorporate both internal and external data in order to be qualified as an AMA, this approach is quite different from LDA and IMA regarding the use of historical information. According to the Basel Committee on Banking Supervision (2001), once the initial amount is set the modification can be made solely on qualitative information. 4.3 Previous Research – AMA The research regarding AMA and its implementation regards everything from qualitative requirements to detailed mathematical derivations. Since we have limited our thesis to the quantitative requirements, we have only searched for reports concerning these. A selection of the empirical research that was found is presented below. Frachot and Roncalli (2002) propose a way of how to mix internal and external data in the AMA; both the frequencies and the severities. 32 Baud, Frachot and Roncalli (2002) present a way to avoid the overestimation of the capital charge in the mix of truncated internal and external data. With the argument that the truncation gives falsely high parameter values, they propose a way to adjust for the unreasonably high capital charge that is calculated. Shevchenko (2004) mentions important aspects in the quantification of the operational risk. These are among others the dependence between risks, the scaling of the internal data and the modelling of the tail. Embrechts, Furrer and Kaufmann (2003) provide a thoroughly explanation of how extreme value theory can be applied in the model. They also propose 200 exceedances above u in the POT-method to be ideal for reliable estimation of the tail. Frachot, Georges and Roncalli (2001) explore the LDA approach. They calculate the capital charge, compare the approach with the IMA and relate it to the economic capital allocation in the bank. Frachot, Roncalli and Salomon (2004) examine the correlation problem in the modelling of operational risk. They present a simplified formula for the total capital charge where the correlation parameter is incorporated. The correlation parameter is, according to their calculations, not higher than 5-10 %. Jobst (2007, p. 32) focuses on the extreme value theory and found that a bank with “distinct lowfrequency, high-severity loss profile” only loses approximately 1.75 % of gross income over five years. This can be compared with the SA where the capital charge approximates 15 % of gross income. Thus, Jobst (2007) argues that business volume may not be a good measure of the drivers behind operational risk. 33 5 Model Choice & Assumptions The literature concerning operational risk, and the AMA in particular, presents a wide range of model approaches as shown. The Basel Committee’s list of approaches (IMA, SCA and LDA) is an attempt to categorize the different models suggested. Since the model choice as well as the assumptions made is critical for the model design, this section concerns these issues. 5.1 What is a Good Model? Since our case study is the development of a model, one may ask what a good model is in this respect. And if there is a difference in the answer depending on who is asked. The reason for turning from simpler to more advanced methods from Finansinspektionen’s point of view is to achieve a more precise calculation of the operational risk that the bank is exposed to. For the bank to have an incentive to run the development from simple to advanced model (more than to get a model that more precisely estimates the risk) the more simple methods have overestimated the risk taken. By developing an AMA-model, the bank has a chance to lower the capital requirement, and thus the equity that has to be held. The question of how to design a good model is thus two folded. Both the bank and Finansinspektionen wants a model that estimates the risk as precisely as possible. From the bank’s perspective, the capital requirement calculated however also has to be lower than with the Standard approach in order to be implemented in the bank. We have tried to rid ourselves off the fact that we work for the bank and have aimed to make the model as precise and “academically correct” as possible. Since we lack the data necessary, it is not possible to figure out if the capital requirement actually turns out to be lower than with the model currently used. A good model according to us is further a model that gives good incentives to improve the risk exposure of the bank. One may argue that the main role for the model itself is not to measure, but to have a driving power on how the risk is managed within the bank. Key employees should further on be able to comment and influence some parameters of the model so as to make it as bank-specific as possible. It should also be flexible to business changes over time; if the risk or size increases, it should be possible to adjust some parameter so that it affects the result. 34 5.2 Overall Approach Choice Our overall approach choice, based on the Basel Committee’s list of approaches, is the Loss Distribution Approach (LDA). The main reason for the choice is the fact that it appears to be more of a “best practice” among academics than the others. Frachot, Roncalli and Salomon (2004, p. 1) emphasize that “we firmly believe that LDA models should be at the root of the AMA method”. Shevchenko (2004, p. 1) mentions that ”Emerging best practices share a common view that AMA based on the Loss Distribution Approach (LDA) is the soundest method”. There are however drawbacks to the “basic” LDA approach presented in chapter 4.2.2. Nyström and Skoglund point out, in the collection by Cruz (2004), that the operational risk event in the basic version is completely exogenous, leaving the risk manager with no control over the risks and the capital charge. It also implies perfect positive dependence between the cells (BL/ET), something that is both unrealistic and gives too high of a capital requirement. We have chosen this model, but have made a few exceptions due to these issues. In our model, the total losses from the 56 cells are aggregated each year; the Value-at-Risk is thus measured on the aggregated number, not on the 56 cells separately. That implies that we do not consider them to be perfectly correlated as in the “basic” LDA case. All cells, except for some as explained in section 5.3, are instead considered independent. We have also added a scaling factor that causes risk managers influence to be reflected in the model. 5.3 Distribution Assumptions The loss frequency is assumed to be Poisson distributed. This is in line with “best practice” in the area; Rao and Dev states in the collection by Davis (2006, p. 278) for example that “Most commonly, a frequency distribution is posited as a Poisson distribution”, Kühn and Neu (2008, p. 3) say that “Common choices for the loss frequency distribution function are the Poisson or negative binomial distribution” and Mignola and Ugoccioni (2006, p. 34) mention that “The frequency distribution is assumed to be a Poisson distribution …”. There is no consensus about how the severity is distributed; but in order to reflect high severities, the tail has to be long and heavy tailed. The most common ones to use are according to Rao and Dev (as presented in the collection by Davis 2006) the lognormal distribution and the Weibull 35 distribution. The authors however mention that the lack of data at the right tail (the very high losses) implies the use of extreme value theory. They refer to a study conducted by De Koker (2005) which implies a solid basis for using generalized Pareto distribution (the POT-method in EVT) in the tail and lognormal or Weibull in the body. Moscadelli (2004) also reports that the extreme value theory, in its POT-representation, “explains the behaviour of the operational risk data in the tail area well. “ The problem in our model is however that the use of the generalized Pareto distribution (i.e. the POT-method) implies that one has to make a choice about the value of u. Embrechts, Furrer and Kaufmann (2003) emphasize that this choice is crucial, but not easily made. The u has to be significantly high, and there has to be a significant number of losses exceeding this value. Embrechts, Furrrer and Kaufmann (2003) refer to a simulation study, worked out by McNeil and Saladin, which considered 200 exceedances over u to be necessary; both if one chooses u to be 70 % and 90 % of the largest value. Since the bank’s internal data do not fulfil these requirements and since we lack external data, we are not able to fulfil that requirement in the choice of u. Thus, we can not use the POT-method for the tail distribution and are left with only one distribution for the whole body and tail. In the instruction for future updates, a remark about the POT-method is conducted. In order to make a choice about the lognormal or Weibull distribution for the severity distribution, two qq-plots were made: Figure 9. qq-plot of the internal data and the lognormal distribution. 36 Figure 10. qq-plot of the internal data and the Weibull distribution. Since a straight line indicates that our sample is distributed as the reference distribution (as explained in section 3.2.3) we decided, by looking at the qq-plots, that the lognormal distribution was the most appropriate choice for the severity of the data. 5.4 Correlation Assumptions The correlation among the cells is one major issue that is illustrated in several research reports. When referring to the correlation; there may be both frequency correlations and severity correlations. We have in our model tried to make a bottom-up approach, indicating that the cells have to have obvious dependence in order to be considered correlated. We have thus considered some cells to be correlated out of the assumption that they have occurred simultaneously by a reason. No correlation has been applied afterwards. The assumptions are proposed by key employees within the bank. In order for event types to be correlated but not reported as one loss, there has to be an “indirect” correlation. Thus, there has to be something that triggers the loss in the other event type, but nothing that is all too apparent so that they will be reported as one major loss instead of two separate ones. The Event types that are considered correlated are Business Disruptions & System Failures & Internal Fraud, Execution, Deliver & 37 Process Management & Internal Fraud and Business Disruption & System Failures & External Fraud. Examples of these are IT-crashes that cause internal and external fraud, and control failures that lead to internal fraud. The correlations are illustrated in the figure below. Each colour represents one type of correlation and there are only correlations within each business line. The number of correlation pairs thus totals 24. Figure 11. Overview of the correlation pairs assumed in “our” bank. The frequencies of the “x-marked” cells are assumed to follow a joint Poisson distribution. That means that the pairs are Poisson-distributed “together”, recall the definition p X ,Y (x, y ) = P ( X = x, Y = y ) , − ∞ < x, y < ∞ How the correlations are handled in the model is presented in greater detail in chapter 6. The potential correlation between severities may be modelled by the use of copulas. Recall that the copula is a tool that defines a correlation structure between two correlated variables, each with their own marginal distributions. Marginal distributions refer to the own frequency distribution that each cell has (even if they both have marginal Poisson distributions, they probably have different parameter values). By using a copula, the marginal distributions are preserved at the same time as the correlation structure between the cells is defined. Here, we however made the assumption that the severities of the cells are not likely to be correlated. I.e. a large loss in Business Disruptions & System Failures does not imply a large loss in Internal Fraud, only that the frequencies of the losses are 38 dependent. There is however a possibility of implementing a severity correlation in the model, if it can be shown that there is a substantial positive dependence between them. 5.5 Assumptions regarding Scaling, Inflation & Truncation Bias When it comes to the mixing of internal and external loss data, there is a potential problem relating to size. “Our” bank is relatively small compared to the other banks in the ORX database (ORX Association, 2007). We assume that larger banks have larger operational losses and that the income thus reflects the amount of risk the bank is exposed to. This is in line with the less sophisticated models proposed by the Basel Committee, which calculate the capital requirement solely on the amount of gross income in the bank. Since we want to build the model as flexible as possible, we want to scale each combination of Business Line/Event Type. That is done by adding a cap for how large the severities can be in each cell. Unreasonable great losses above a certain threshold are scaled down in order to better reflect the risk that “our” bank is exposed to in that particular Business Line/Event Type. We have decided to adjust for the inflation effect by multiplying the severities with (1 + average inflation)k. k denotes the number of years since the loss occurred, where the average inflation is calculated over the last five years. Different banks have different levels of truncated internal loss data. That means that only losses that exceed the value of h is reported, causing the dataset to be truncated at the value of h. Baud, Frachot and Roncalli (2002) report that the truncation affects the estimated parameter values used in the simulation. That in turn causes an overestimation of the capital charge calculated by Value-at-Risk. Since “our” bank’s truncation level h is relatively low, we assume there to be a marginal impact on the parameters. 5.6 Risk & Simulation Method We have chosen the Value-at-Risk measure in the model, despite Expected Shortfall’s advantages described in chapter 3.2.2. The reason behind this rationale is three folded; Finansinspektionen does not require the use of ES in the model, it is best practice to use Value-at-Risk (especially in the loss distribution approach chosen) and the security level of 99.9 % is expected to be sufficiently high. 39 The simulation method chosen is the Monte Carlo simulation. It is superior to the historical simulation, since the latter is limited to the losses that have occurred in the bank. By using a Monte Carlo simulation, it is possible to simulate larger losses than what has happened historically. Major simulated losses that exceed our yet largest loss are thus possible according to the mean and variance in the historically data, with the only exception that they have yet not occurred. What nonetheless needs to be emphasized is that the distribution assumption causes a limit (even though not as severe as in the historical simulation case) to the losses that can be simulated; the simulated values are completely dependent on the distribution that has been chosen. 40 6 Description of Our Model This section describes how our model has been designed. The description is divided into four parts; an overall view of how the model is designed, description of the import of data, the processing of data and how the simulation is conducted. N.B. that the Matlab code has not been published due to confidential reasons. 6.1 Model Overview The calculations in this model are tested only on internal historical loss data. The model is however constructed so that it is possible to import external loss data and mix them with the internal ones as soon as they become available. The data is first imported into Matlab where it is sorted and structured to facilitate further calculations. Irrelevant data is removed at this stage. After that, we fit the data into different distributions according to our assumptions. Ultimately we simulate losses from these distributions and identify VaR0.999 (the Value-at-Risk at confidence level 99.9 %). Each step is thoroughly explained below. 6.2 Data Import The historical losses are delivered in excel-sheets. In order to use the data in Matlab, it has to be “recoded”. This is done as follows: 1. Every Business Line is given a number. 1 2 3 4 5 6 7 8 Business Lines Corporate Finance Trading & Sales Retail Banking Commercial Banking Payment & Settlement Agency Services Asset Management Retail Brokerage Figure 12. Business Line overview. 41 2. Every Event Type is given a number. 1 2 3 4 5 6 7 Event Types Internal Fraud External Fraud Employment Practices & Workplace Safety Clients, Products & Business Practices Damage to Physical Assets Business Disruption & System Failures Execution, Delivery & Process Management Figure 13. Event Type overview. This gives us a matrix of 56 different kinds of losses looking as follows: Figure 14. Matrix overview. 3. Dates are converted into numbers, where 1900-01-01 is the first day and the all the following dates are counted up by one (i.e. 2008-09-11 is converted into 39702). This is done, in the Swedish version of Excel, by using the command ‘=DATUMVÄRDE("2008-09-11")’. 4. Every Region is given a number. 1 2 3 Area Sweden Baltic States International Figure 15. Area overview. 42 5. Events that have neither BL nor ET are removed since they cannot contribute to the calculations. There must not be any extra spaces in the data, i.e. a loss of ten thousand SEK must for example be listed as “10000” and not as “10 000,00”. 6. Once all the text has been coded into digits, the data is imported into Matlab. 6.3 Data Processing Once imported, the data needs to be processed. This is done as follows: 1. Direct and Indirect (Other) losses are added together. Recoveries are not taken into consideration, since it is the direct loss that is of interest, not the long-term effect. 2. Data older than date x 7 is removed from the data set. That, since the bank’s data collection procedures were not fully reliable until year x. 3. When the data is delivered it is sorted in the order of reporting date. However, the reporting date is not very important, what matters the most is the time of occurrence. The data is thus resorted in order of when it actually happened, starting with the most recent event. It is then divided into separate years y1, …, yn. Each year gets two matrices, one for frequency and one for severity. Figure 16. Overview of how the data is sorted. 4. The average frequency per year and the average severity per occurrence are calculated. This is done for each Business Line and Event Type. The yearly losses are calculated by starting with the latest event (not necessarily today) and counting a year from that date. See figure below. 7 The date x is confidential. 43 Figure 17. Frequency calculation. 5. Average frequency and severity for each Business Line and Event Type is calculated for the different regions as well. As for the frequency calculation, we assume that the data available represents the same number of years for all regions. That, even though it in reality may not always be the case. See figure below: Figure 18. Frequency calculation across different areas. 6. Frequencies are adjusted depending on the relative size of that specific Business Line compared to the average size of a bank involved in the external data. Size is calculated as the average turnover per bank per year over the last three years. 7. In order to compensate for losses that are unreasonably large for a bank of “our” bank’s size, external severities are capped. Each cell has its own cap based on size (measured in gross income per annum) and expert opinions. The compensated loss for losses exceeding the cap equals the cap size plus x percent of the residual loss 8 . Losses that are large (more than 50 % of the cap size) but not larger than the cap are reduced by a percentage based on the size of the loss compared to the cap. This is done in two steps; at 50 % and at 75 % of the cap size. 8 In our case, we chose 1 %. 44 Figure 19. Illustration of the scaling. To know exactly what reduction to use we would recommend comparing the average of the top 25 % of the internal losses µint,1 with the average of the top 25 % of the external losses µext,1 (see figure 20). Then scale the losses by multiplying the external losses that are more than 75 % of the cap with: 1+ x1 = μ int,1 μ ext ,1 2 Similar calculations can be made with the top 25 % through 50 % of the external and internal losses. This means that if the internal losses in the top quadrant are, on average, 80 % of the external losses in the top quadrant, then we will use 90 % of the external losses that are larger than 75 % of the cap size in our calculations. Please note that the cap sizes will be set relatively high, so this adjustment of losses will only be used if the losses are substantially large and thus unlikely to occur. To smoothen the curve above (i.e. to make sure that losses that are just above a certain threshold is not counted as lower than a loss just below that same threshold) we adjust the model by letting the adaptations on the lower levels be used also for the bigger losses. I.e. a loss that exceeds the cap size C will be adjusted as follows: ~ L = C ⋅ 0.5 + (C ⋅ 0.75 − C ⋅ 0.5) ⋅ x 2 + (C − C ⋅ 0.75) ⋅ x1 + (L − C ) ⋅ x0 45 Where ~ L = Loss used in calculatio ns C = Cap size L = Actual external loss x0 = Constant above cap size x1 = Constant for top 25 % x 2 = Constant for top 25 % - 50 % Figure 20. Illustration of the scaling. 8. All severities are multiplied by (1 + average inflation)k where k is the number of years since the loss occurred. This is done to compensate for inflation (which is calculated as the average inflation over the last five years). 9. The severity data is fitted into a lognormal distribution using maximum likelihood estimation at a 95 % confidence level. 10. The cells that are assumed to be independent, their frequencies are assumed to have a Poisson distribution. 46 11. The pair cells that are identified as dependent are assumed to have a compound Poissondistribution. We take this into consideration by calculating a new combined frequency for the correlated cells. The frequency answers the question of how many times each year a loss occurs in any or both of these two cells. This is not done by just adding the two original frequencies together, since it may happen that events in these particular cells occur at the same time without any dependence being the cause. Just adding them would mean that they occur more often than what is rational to assume. During the simulations, for every occurrence in this new frequency, we simulate the combination of the two that has actually occurred (the first, the second or both of them). Figure 21. Illustration of the assumed correlations. The severities are not assumed to be correlated. This means that once the number of occurrences in each cell is calculated, the severities in each cell are simulated independent of the other cells. Hence, we assume that an occurrence in one cell can lead to an occurrence in another, but having a large loss in the first does not necessarily imply a large loss in the second as well. The calculation of the correlated frequencies is conducted as follows: Event a occurs with frequency λa (assumed given by historical data). Event b occurs with frequency λb (assumed given by historical data). Event c occurs with frequency λc (assumed given by historical data). Event d occurs with frequency λd (assumed given by historical data). 47 a and/or b and/or c and/or d occurs with frequency λ (unknown). However, the combinations (a,c), (a,d) and (b,d) can not occur in this specific part of the model since they are assumed not to be correlated. If a and/or b and/or c and/or d has occurred (λ), how do we know what actually occurred? Assume: P(I a = 1, I b = 0, I c = 0, I d = 0 ) = p1,0, 0,0 P(I a = 0, I b = 1, I c = 0, I d = 0 ) = p0,1, 0,0 P(I a = 0, I b = 0, I c = 1, I d = 0 ) = p0, 0,1,0 P(I a = 0, I b = 0, I c = 0, I d = 1) = p0, 0,0,1 P(I a = 1, I b = 1, I c = 0, I d = 0 ) = p1,1,0, 0 P(I a = 0, I b = 1, I c = 1, I d = 0 ) = p0,1,1, 0 P(I a = 0, I b = 0, I c = 1, I d = 1) = p0,0,1,1 where pa,b,c,d is the probability that event a, b, c or d occurs simultaneously or one or the other. We know that one (and only one) of these will occur. Hence: p1, 0,0, 0 + p0,1, 0,0 + p0,0,1, 0 + p0, 0,0,1 + p1,1,0, 0 + p0,1,1,0 + p0, 0,1,1 = 1 (1) In order to be true to our historical data, we must choose λ so that the following holds: λa = λ ⋅ p1, 0,0, 0 + λ ⋅ p1,1, 0,0 ⇒ p1, 0,0, 0 = λa − λ ⋅ p1,1, 0,0 λ (2) λb = λ ⋅ p0,1,0, 0 + λ ⋅ p1,1, 0,0 + λ ⋅ p0,1,1,0 ⇒ p0,1, 0,0 = λb − λ ⋅ p1,1, 0,0 − λ ⋅ p0,1,1,0 λ (3) λc = λ ⋅ p0,0,1,0 + λ ⋅ p0,1,1, 0 + λ ⋅ p0, 0,1,1 ⇒ p0,0,1,0 = λc − λ ⋅ p0,1,1,0 − λ ⋅ p0, 0,1,1 λ (4) λ d = λ ⋅ p 0, 0,0,1 + λ ⋅ p 0,0,1,1 ⇒ p 0,0 ,0,1 = λ d − λ ⋅ p 0,0 ,1,1 λ (2), (3), (4) and (5) are inserted into (1) which gives: 48 (5) λa − λ ⋅ p1,1,0, 0 λb − λ ⋅ p1,1,0, 0 − λ ⋅ p0,1,1, 0 λc − λ ⋅ p0,1,1,0 − λ ⋅ p0,0,1,1 λd − λ ⋅ p0,0,1,1 + + = + λ λ λ λ = 1 − ( p1,1, 0,0 + p0,1,1, 0 + p0, 0,1,1 ) λ is taken out, which gives: λ= λa + λb + λc + λd 1 + p1,1,0, 0 + p0,1,1, 0 + p0,0,1,1 So, to be able to calculate λ we first need to estimate p1,1,0,0, p0,1,1,0 and p0,0,1,1 which is done based on historical data and expert opinions. Since also p1,0,0,0 through p0,0,0,1 will be calculated based on this, one must be very careful when estimating p1,1,0,0 , p0,1,1,0 and p0,0,1,1, because, for example, setting p1,1,0,0 too high could result in p1,0,0,0 being negative (which, of course, is not allowed). Explicitly, the following must hold for p1,1,0,0 and λb: p1,1, 0,0 + p0,1,1, 0 < λb λ When simulating the correlated losses we first draw from the joint Poisson distribution. Then, for each occurrence, we draw a number between 0 and 1. a, b, c, d or a combination thereof occurs depending on what the drawn number is (see figure 22 below). Figure 22. Illustration of the probabilities in the joint distribution. The value of p0,1,1,0 may be hard to estimate for the key employees in the bank, since they have to answer the question; “Dependent on the fact that either A, B, C or D has occurred, what is the possibility that only B and C have occurred?”. It would have been much easier for the employee to estimate p1,1, i.e. to answer the question “Dependent on the fact that either B or C has 49 occurred, what is the probability that both B and C have occurred?” In order to be able to ask this question instead of the first one, we have to find what p0,1,1,0 is dependent of the value of p1,1. The derivation of this formula is expressed below. Figure 23. Illustration of four events that are not mutually exclusive. Assume the four events as given in figure 23, we thus want to find: ⎧ P( X ∩ Y ) ⎫ P((B ∩ C ) ∩ ( A ∪ B ∪ C ∪ D )) p0,1,1, 0 = P(B ∩ C | A ∪ B ∪ C ∪ D ) = ⎨ P( X | Y ) = ⎬= P(Y ) ⎭ P( A ∪ B ∪ C ∪ D ) ⎩ In this case P ( A ∪ B ∪ C ∪ D ) = P ( A) + P (B ) + P (C ) + P (D ) − P ( A ∩ B ) − P (B ∩ C ) − P (C ∩ D ) and P ((B ∩ C ) ∩ ( A ∪ B ∪ C ∪ D )) = P (B ∩ C ) since if (B ∩ C ) is true then (A ∪ B ∪ C ∪ D) must also be true. Hence, p0,1,1, 0 = P (B ∩ C ) P ( A) + P (B ) + P (C ) + P (D ) − P ( A ∩ B ) − P (B ∩ C ) − P (C ∩ D ) (1) We need to find P ( A ∩ B ) , P (B ∩ C ) and P (C ∩ D ) . The question we want answered above gives us p1,1 where, for example p1b,1,c = P(B ∩ C | B ∪ C ) . We can also express this as: P (B ∩ C | B ∪ C ) = P ((B ∩ C ) ∩ (B ∪ C )) , but P ((B ∩ C ) ∩ (B ∪ C )) = P (B ∩ C ) since if P (B ∪ C ) 50 (B ∩ C ) is true then (B ∪ C ) must also be true. Hence, P (B ∩ C | B ∪ C ) = P ((B ∩ C ) ∩ (B ∪ C )) P (B ∩ C ) = ⇒ P (B ∪ C ) P (B ∪ C ) ⇒ P(B ∩ C ) = P(B ∩ C | B ∪ C ) ⋅ 1442443 = p1b,,1c P (B ∪ C ) 1424 3 ⇒ =( P ( B )+ P (C )− P ( B∩C )) ⇒ P(B ∩ C ) = p1b,1,c ⋅ (P(B ) + P(C ) − P(B ∩ C )) ⇒ ⇒ P(B ∩ C ) + p1b,1,c ⋅ P(B ∩ C ) = p1b,1,c ⋅ (P(B ) + P(C )) ⇒ p1b,1,c ⋅ (P (B ) + P(C )) p1b,1,c ⋅ (P (B ) + P(C )) P(B ) + P (C ) = = ⇒ P (B ∩ C ) = 1 1 + p1b,1,c ⎛ 1 ⎞ b ,c 1 + b ,c p1,1 ⎜⎜ b ,c + 1⎟⎟ p1,1 ⎝ p1,1 ⎠ (2) Note that (2) also holds for P ( A ∩ B ) and P (C ∩ D ) . (2) is inserted into (1) and we get p 0,1,1, 0 P(B ) + P(C ) 1 1 + b ,c p1,1 = P( A) + P(B ) P(B ) + P(C ) P(C ) + P(D ) P( A) + P(B ) + P(C ) + P(D ) − − − 1 1 1 1 + a ,b 1 + b ,c 1 + c,d p1,1 p1,1 p1,1 Since P(A) through P(D) are unknown (actually, we need p0,1,1,0 to get them), we have to use something else. P(A) through P(D) must be based on our historical data, λa through λd, hence we can use these to get estimations of P(X) which we call P’(X). If we assume that P ′( X ) = λx λ a + λb + λc + λ d where X = A, B, C, D. Then we can calculate our p0,1,1,0 and then calculate or “real” P(A) through P(D). Hence 51 p 0,1,1, 0 P ′(B ) + P ′(C ) 1 1 + b ,c p1,1 = P ′( A) + P ′(B ) P ′(B ) + P ′(C ) P ′(C ) + P ′(D ) P ′( A) + P ′(B ) + P ′(C ) + P ′(D ) − − − 1 1 1 1 + a ,b 1 + b ,c 1 + c,d p1,1 p1,1 p1,1 This formula provides the value of p0,1,1,0 dependent on the values of p1,1 for each of the alternatives. Thus, we are able to ask the question “Dependent on the fact that either B or C has occurred, what is the probability that both B and C have occurred?” and insert the answer in the formula above. 6.4 Simulation We are now ready to begin our Monte Carlo simulation. The simulation is conducted as follows: 1. First we simulate the number of occurrences in each cell (BT and ET) each year. By this we mean how many losses that occur in each cell per year. For the uncorrelated cells, this is done by assuming a Poisson distribution using our frequencies as λ, and drawing random numbers from this distribution. For the correlated cells, we use the combined λ calculated above to draw the number of occurrences for the combination of the different cells. Then, for each occurrence, we simulate what actually happened using the different pa,b,c,d we have. This gives us the occurrences for each cell. 2. For each cell we check the number of simulated losses and simulate the size of those losses using a lognormal distribution. The losses are then saved. 3. For each year, the losses in each cell are added up, giving us the total loss for that specific year. 4. This is repeated a great number of times (105), and simulated losses are saved in a vector l. 5. The vector is sorted in order of increasing size and we identify VaR0.999. Recall from section 3.5.2 that this is calculated by using VˆaRα = l[n (1−α )]+1 , n 52 7 Model Testing Usually when it comes to building a model, the testing part of the process is of considerable importance. One not only wants to test the results; if they are reasonable and how sensitive they are to changes in the parameters. One also wants to test the programming itself; does it give any results, are the results logical and is the model flexible enough to handle changes? One major issue that we were facing in our modelling process was the lack of data. The internal data are scarce and we did not have access to any external data. This made it impossible to test and verify the results. It was for example not possible to test what kind of influence different weighing factors, scaling assumptions, distribution choices and correlation coefficients would have had on the result. The calculation of the capital requirement itself did not provide any reliable results, since the estimation of the severity and frequency parameters can not be considered to be statistically valid. It was further on also impossible to stress test the result, since the lack of data did not give a reliable result. Our model was thus made as a “shell” for how to calculate the capital requirement once the necessary data is available. As for the ultimate result, the model does give an output of a relatively reasonable amount at this point. The programming could however be tested and that was done thoroughly during the process of time. When something was added to the code, there was continuously testing of how the model worked. The same can be said about the logics of the code, so as to be sure that it worked as it was supposed to. We also continuously tried to make the code more concise, easier to understand and more flexible. Hard coding was avoided as much as possible. 53 8 Concluding Chapter What kind of insights has this modelling process provided us? To what level is our model valid and how may it be criticized? These questions are answered in this last part of the report together with suggestions of further research in the area of operational risk. 8.1 Insights Since the bank is given full scope, except for the four requirements previously mentioned in chapter 4.1.3, in the development of an AMA, there is no univocal way of how to develop the model. During the process it was apparent that it may not always be positive to leave all assumptions free of choice. It may sound like a fair approach to leave it up to the bank by assuming that the bank gets more knowledge of its risk exposure by developing the model. One could however argue that it would be helpful to have more strict guidelines from Finansinspektionen, and that the model itself would be more fair if there was one approach for all banks to use. We believe that operational risk may not differ that much between banks so as to argue that totally different approaches would be appropriate. It could be a better idea to just leave the scaling and correlation assumptions to the banks, in order to make the data more reliable to the bank’s specific exposure. During the modelling process it came to our attention how difficult it is to model operational risk. The majority of the interviewees questioned if it is even possible to model operational risk appropriately and if it was not better to keep it in Pillar 2 of the Basel II rules 9 . Compared to credit risk and market risk, operational risk is far more unpredictable; “Hur modellerar man Leeson?” [How can Leeson be modelled?] was asked by one of the interviewees. The insight that operational risk is a new and relatively unexplored area of risk modelling was thus central in the development process. 8.2 Future Required Updates The lack of data caused, as previously mentioned, problems to the test of the model. The lack of data was an issue for the choice of method as well; since we lacked reliable data, we could not use Basel II is divided into 3 Pillars; the calculation of the capital requirement belongs to Pillar 1, the aggregated risk assessment belongs to Pillar 2 and the rules for publishing information belong to Pillar 3. See Finansinspektionen (2002) for a more detailed explanation. 9 54 the POT-method for the distribution of the tail. The use of extreme value theory (i.e. the POTmethod) is recommended in literature, but was something we had to forsake at this point. When data becomes available, it is thus recommended to implement a generalized Pareto distribution for the tail of the severity distribution. That is, to use extreme value theory’s POT-method in order to get more high severity data. If it becomes apparent that external data comes from a substantial number of banks from other geographical areas than the ones that “our” bank operates in, it is possible to implement a weighing factor. It may for example be a good idea to weigh non-European banks’ losses as less likely than European banks’ losses. But it depends on what kind of factors is assumed to drive operational risk; if the geographical area has a substantial impact on the frequency and severity of events. Even though this model is only a “mathematical shell”, there are a few quantitative factors that have to be updated in the future. These include expert opinions for the correlation assumptions as well as expert opinions for the caps of the cells’ exposures. It is fair to assume that these are factors that may change in the future and thus need to be updated by key employees within the bank. It would further on be a good idea to make a qq-plot of the severities of the external data once they become available. Our qq-plot, with the following assumption of choosing the lognormal distribution for the data, is based only on the bank’s internal data. To be sure that the external data behaves similarly, a qq-plot of the external data as the sample and the lognormal distribution as the reference distribution is thus recommended. The same thing can be said about the frequency of the data. As it is now, we have not tested the suitability of the Poisson distribution for the frequency of the losses. One way of testing if the Poisson distribution is appropriate is to do a goodness of fit-test 10 , this could however not be conducted at this point since the data points are too few. As presented by the Basel Committee on Banking Supervision (2006) it is necessary to have scenario analysis in the model. We have fulfilled a part of the requirement by using expert opinion in the scaling part of the model (recall that the scenario analysis according to the Basel Committee on Banking Supervision (2006) incorporates the use of expert opinion in order to evaluate exposure to high-severity events, see chapter 4.1.3). The Basel Committee on Banking Supervision (2006, p. 154) 10 See http://www.zoology.ubc.ca/~whitlock/bio300/LectureNotes/GoF/GoF.html for an explanation of the test. 55 further mentions that it is necessary to have scenario analysis that “should be used to assess the impact of deviations from the correlation assumptions”. This is something that has to be added to the model after the correlation parameters have been chosen and the external data is available. It would also be a good idea to stress test the model. It would for example be useful to see how sensitive our parameters are to the addition of one extra large historical loss. It would be a problem if the capital requirement calculated would change dramatically as a result. Another test that could be conducted in the stress test is what effect a rise in the cap of one business line has on the capital requirement. If say Corporate Finance’s income triples, the cap for that business line would rise in our model. It would be interesting to see how sensitive our model is for the level of these caps. The stress testing of the model is however nothing that can be done without access to external data. 8.3 Validity & Critique Validity, as presented by Colorado State University, concerns “the degree to which a study accurately reflects or assesses the specific concept that the researcher is attempting to measure”. Regarding the validity of the model, there are a number of things to comment on. First, one may discuss how valid an AMA model is on the whole. The model shall provide a number that the bank will not exceed more than one year out of 1000 (i.e. with a 99.9 % confidence level). As a base for that calculation, the required observation period is only three years (Finansinspektionen, 2007). To make a good estimation, we would need about a million years of data (another problem would be that the data has to be identically distributed as well; so if we actually would have a bank that was a million years old, it would be highly questionable if the loss data from the early years could reflect the situation of today). Because of the lack of data, the number that our model provides will only at best be a “qualified guess”. Even though the use of external data provides more losses, one must keep in mind that the observation period for these is as short as for “our” bank’s internal losses. Second, one may criticize how the model itself is built. The fact that we do not use extreme value theory for the tail is one distinct weakness, since potential high losses are the most harmful losses for the bank. The scaling assumptions that are made are also arguable. Here, we rely on the assumption that the larger the bank is, the larger the potential losses. A bank of “our” bank’s size is assumed not able to meet with the high losses that other large banks have had. What really is the driver of operational risk is however far from clear. In our model we rely on key employees within 56 the bank to decide a cap for the exposure in each cell; for example “it is not possible to loose more than x kr of Internal Fraud in Corporate Finance”. Here, subjectivity is a large part in the decision of the maximum loss. The same can be said about the correlation assumption between the cells, which of the cells that are supposed to be correlated and to which extent they are correlated, is highly arguable. Third, there are details in the models that may be “theoretically wrong”. The yearly losses are calculated by starting with the latest event (not necessarily today) and counting backwards one year from that date. If there has gone a long time since the last event has occurred, we will be overestimating the risk. However, the risk/chance that nothing happens for a long time is very small. See figure below for an illustration of the problem: Figure 24. Illustration of the weakness in the calculation of the frequency. A similar problem appears when we calculate the frequency and severity for different regions. We assume that the data available represents the same number of years for all regions. This may not be the case, and it becomes a problem if the red area in the figure below becomes large. Figure 25. Illustration of the weakness in the calculation of the frequency across different areas. The inflation is calculated as the average inflation over the last five years. A more theoretically correct way to adjust for the inflation would be to implement that the losses would be multiplied with the actual inflation for the specific year. That would give a more correct value if, say the inflation rises dramatically five years in a row. 57 Fourth, the intentions behind the model development may be criticized. One may question the appropriateness of developing this model for the bank where we work. During the process we had to find the balance between developing a reasonable model and developing a beneficential one. On the one hand, if we had tried to make the model as appropriate and reliable as possible, there would have been a risk of creating a model that no one would have wanted to use (since there are less sophisticated models giving a lower requirement). On the other hand, if we would have developed the model as generous as possible, we would have put the bank in a situation where it would have risked having too low equity for the risks it was exposed to. From a mathematical standpoint it all comes down to what kind of assumptions that are made, since they have a direct effect on how ethically correct the model becomes in the end. 8.4 Further Research As more banks develop an AMA-model, there will be more interest in research concerning this area. We have encountered some research gaps that would have been good to look into in order to ease the modelling process. One possible research area concerns the reporting structure in the bank. In order to build and rely on a model like the AMA, it is required that the data set available is correct. That means that all data above a certain threshold should be reported, and reported as to the true loss size. One may however assume that employees within the bank are more reluctant to report some losses than others, internal fraud being one example. Some research concerning the employees’ view of reporting such losses may thus be valuable as to know how reliable the internal data really is. Another possible research area concerns the bank’s geographic location and what affect that has on its operational losses. That becomes an issue when one wants to mix external data with internal data; are the external ones as relevant as our internal data? It is for example possible to assume that banks in areas where tornados and other nature disasters are relatively frequent are more exposed to losses caused by Damage of Physical Assets than a bank in the Nordic region. If it could be shown that banks in specific parts of the world are exposed to greater operational risks, it is possible to scale down their part of the external data and thus give a more reliable set of data to work with. 58 Another possible research area concerns the impact the age of the bank has on the operational losses. Are new banks/bank divisions more exposed to operational risk than older banks? This question becomes an issue as one mixes the internal and external data. Different weights related to age could be applied to the data if it could be shown to have an impact on the losses. When we in our model considered correlation among severities to be irrelevant, it was more a logical assumption than a result from a research analysis conducted. By studying large losses and their possible dependence to other events, it may be concluded that such correlations really exist. It may also be arguable that there exists dependence among losses over time; for example that risk control makes it less probable for a large loss to be followed by another large loss. Research regarding such correlations could thus be helpful in the modelling process and propose the use of copulas in our model. An interesting research approach, regarding the AMA model in overall, is to study the degree of driving power that this kind of model has on the organization. It would be interesting to see to which extent such a model goes beyond its “main role” as a pure measuring model, and actually influences how the risk is managed in the bank. The last possible future research that we want to discuss concerns the driving factors of operational risk. In BIA and SA, it is assumed that the size of the firm, in terms of income, is the main driver. The higher the gross income, the higher the capital requirement ought to be. There is however one problem; if the bank’s income declines as a result from the economic situation, the capital requirement will get lower as a result. The question is if the operational losses in reality really do decline as well. Even if it is not a main assumption in the AMA-model, we have used the fact that large banks are more exposed to high severity losses when we scale down large losses for “our” bank. By conducting research with that as a base, one of the major problems within operational risk modelling could be eased. 59 9. References 9.1 Written Sources Bank of International Settlements. BIS History Overview. [Online] Available from: http://www.bis.org/about/history.htm [Accessed September 24, 2008] Basel Committee on Banking Supervision. (2001). Working Paper on the Regulatory Treatment of Operational Risk. [Online] Available from: http://www.bis.org/publ/bcbs_wp8.pdf [Accessed September 24, 2008] Basel Committee on Banking Supervision. (2006). Basel II: International Convergence of Capital Measurement and Capital Standards: A Revised Framework – Comprehensive Version. [Online] Available from: http://www.bis.org/publ/bcbs128.pdf. [Accessed September 23, 2008] Baud, N., Frachot, A. & Roncalli, T. (2002). How to Avoid Over-estimating Capital Charge for Operational Risk? Crédit Lyonnais, France. [Online] Available from: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1032591 [Accessed September 29, 2008] BBC News. (1999). How Leeson broke the bank. [Online] Available from: http://news.bbc.co.uk/2/hi/business/375259.stm [Accessed September 25, 2008] Blom, G. (2005). Sannolikhetsteori och statistikteori med tillämpningar. Studentlitteratur, Lund. Cruz, M. (ed). (2004). Operational Risk Modelling and Analysis: Theory and Practice. Risk Books, London. Colorado State University. Writing Guides Reliability & Validity. [Online] Available from: http://writing.colostate.edu/guides/research/relval/pop2b.cfm [Accessed December 1, 2008] Davis, E. (ed). (2006). The Advanced Measurement Approach to Operational Risk. Riskbooks, London. 60 Embrechts, P., Furrer, H. & Kaufmann, R. (2003). Quantifying Regulatory Capital for Operational Risk. RiskLab, Switzerland. [Online] Available from: http://www.bis.org/bcbs/cp3/embfurkau.pdf [Accessed September 29, 2008] Finansförbundet, Finansvärlden. (2005). Vad är Basel II? [Online] Available from: http://www.finansforbundet.se/Resource.phx/pubman/templates/4.htx?id=478 [Accessed September 24, 2008] Finansinspektionen. (2002). Riskmätning och kapitalkrav II. [Online] Available from: www.fi.se/Templates/Page____3746.aspx - 21k [Accessed December 2, 2008] Finansinspektionen. (2007). Ansökan om internmätningsmetod, operativ risk. [Online] Available from: http://www.fi.se/upload/30_Regler/50_Kapitaltackning/070131/Ansokan_internmatningsmetode r_operativa_risker070126.pdf [Accessed September 25, 2008] Frachot, A., Georges, P. & Roncalli, T. (2001). Loss Distribution Approach for operational risk. Crédit Lyonnais, France. Frachot, A. & Roncalli, T. (2002). Mixing internal and external data for managing operational risk. Crédit Lyonnais, France. [Online] Available from: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1032525 [Accessed November 31, 2008] Frachot, A., Roncalli, T. & Salomon, E. (2004). The Correlation Problem in Operational Risk. Crédit Agricole SA, France. [Online] Available from: http://gro.creditlyonnais.fr/content/wp/ldacorrelations.pdf [Accessed September 19, 2008] Gallati, R. (2003). Risk Management and Capital Adequacy. The McGraw-Hill Companies. Gut, A. (1995). An Intermediate Course in Probability. Springer Science+Business Media, Inc., New York. Hull, J.C. (2007). Risk Management and Financial Institutions. Pearson International Edition. Pearson Education, Inc. New Jersey. 61 Hult, H. & Lindskog, F. (2007). Mathematical Modeling and Statistical Methods for Risk Management: Lecture Notes. Royal Institute of Technology, Stockholm. [Online] Available from: http://www.math.kth.se/matstat/gru/5b1580/RMlecturenotes07B.pdf [Accessed October 31, 2008] Industry Technical Working Group (ITWG). (2003). The LDA-based Advanced Measurement Approach for Operational Risk – Current and In Progress Practice. RMG Conference, May 29. [Online] Available from: http://fednewyork.org/newsevents/events/banking/2003/con0529e.ppt [Accessed September 26, 2008] Jobst, A. A. (2007). Operational Risk – The Sting is Still in the Tail But the Poison Depends on the Dose. [Online] Available from: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1087157 [Accessed September 26, 2008] KPMG International. (2003). Basel II: A Closer Look: Managing Operational Risk. [Online] Available from: http://www.kpmg.ca/en/industries/fs/banking/documents/Basel%20II_%20A%20closer%20look _%20managing%20operational%20risk.pdf [Accessed September 24, 2008] Kühn, R. & Neu, P. (2008). Functional Correlation Approach to Operational Risk in Banking Organizations. Institut für Theoretische Physik, Universität Heidelberg & Dresdner Bank AG, Germany. [Online] Available from: http://www.sciencedirect.com/science?_ob=ArticleURL&_udi=B6TVG-47G3FV22&_user=10&_rdoc=1&_fmt=&_orig=search&_sort=d&view=c&_version=1&_urlVersion=0&_ userid=10&md5=e97b061eacbe8065db66bf2bdbbb8cf9 [Accessed September 19, 2008] Mignola, G. & Ugoccioni, R. (2006). Sources of uncertainty in modelling operational risk losses. Journal of Operational Risk (33-50). Volume 1 / Number 2. Italy. [Online] Available from: http://www.journalofoperationalrisk.com/data/jop/pdf/jop_v1n2a3.pdf [Accessed September 29, 2008] 62 Moscadelli, M. (2004). The modelling of operational risk: experience with the analysis of the data collected by the Basel Committee. Banca D’Italia, Italy. [Online] Available from: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=557214 [Accessed September 19, 2008] ORX Association. (2007). ORX Reporting Standards: An ORX Members’ Guide to Operational Risk Event/Loss Reporting. [Online] Available from: http://www.orx.org/lib/dam/1000/ORRS-Feb07.pdf [Accessed September 25, 2008] Shevchenko, P.V. (2004). Valuation and Modelling Operational Risk: Advanced Measurement Approach. [Online] Available from: http://www.cmis.csiro.au/Pavel.Shevchenko/docs/ValuationandModelingOperationalRisk.pdf [Accessed November 5, 2008] 9.2 Interviews Andersson, H. PhD & Risk Manager at the commissioner’s department Asset management, Stockholm. October 23, 2008. Degen, W. Head of compliance & operational risk at the commissioner’s department Swedish banking, Stockholm, October 19, 2008. Elsnitz, C. Risk Analyst at the commissioner’s department Group risk control, Stockholm. October 15, 2008. Keisu, T. Head of compliance, operational risk & security at the commissioner’s IT department Stockholm, October 20, 2008. Lang, H. Associate Professor at KTH Mathematic’s division of mathematical statistics, Stockholm. September 30, 2008. Lindskog, F. Associate Professor at KTH Mathematic’s division of mathematical statistics, Stockholm. September 30, October 16 & October 25, 2008. 63 Gustavsson, A. Risk Analyst at the commissioner’s Group risk control, Stockholm. September 20 & November 27, 2008. Lundberg, K. Risk Analyst at the commissioner’s Group risk control, Stockholm. October 15, 2008. Masourati, G. Risk Analyst at the commissioner’s Group risk control, Stockholm. September 20 & November 27, 2008. 64

© Copyright 2020