[Skip to content]

Sign up for our daily newsletter
The Actuary The magazine of the Institute & Faculty of Actuaries

Meeting report: Quantifying operational risk

Staple Inn wasn’t quite packed to the rafters, but the hall was full, and the audience spilled over to the Council Chamber and the balcony. The debate on Michael Tripp’s working party paper was opened by James Orr and closed by Martin White. Members of the Operational Risk Research Forum were present, as well as guests from various business schools. Although the title of the paper referred to general insurance, everyone agreed that the paper deserved a wider audience, and would be of interest to actuaries in the life and pensions areas.
Operational risk is about the preservation of profits and the prevention of losses. The discussion centred on the topics of what people are doing to measure operational risk, what people should be doing, and how the Institute can contribute.
This is a brave paper, taking on a new area for actuaries, and the paper includes a very substantial scoping and discussion of the issues. The paper includes detailed, practical examples, especially those covering group risk, which is of particular concern to the Financial Services Authority (FSA). The section on risk indicators is informative, mentioning exposure, loss-related and cause-related examples. The explanations given of distributions and EVT are very useful.
Along the evolutionary path of operational risk thinking there are five steps (traditional thinking, awareness, monitoring, quantifying, and integration) and most insurance companies are still at the second step of ‘awareness’. The key issue for companies is to cascade their risk appetite through the organisation and to ask the questions: are all staff in the company aware what their company’s appetite for risk is, and do they take this into account when making decisions? As important as the models are, it is the thinking behind the assumptions and the risk assessment that helps embed operational risk awareness and management in the corporate culture. We need an approach for operational risk that can operate now, so we must use data that is currently available. However, we should already be thinking what data to collect, to feed better future models.
An important issue is the one of validation: how will a business validate its own model and how will the FSA validate it? This was a big issue for the banking industry and the FSA. In banking, it is widely believed that the capital number for operational risk helps drive proper behaviour, however, it is not clear if this is the ‘correct number for capital’. The banks have also created the ‘Gold’ database of industry-wide statistics for operational losses. The meeting discussed the idea of a ‘Large Loss Log’ for operational losses in insurance, and whether this should be performed at an industry level to share data on infrequent events.
There was much discussion on the boundaries between insurance and operational losses. Again, the same issue arose for banks in defining credit versus operational losses. To advise on operational risk and quantify provisions for it, we must develop a thorough understanding of business process issues. We must be able to identify risks across a wide range of processes, adopt in advance one set of operational risk definitions and stick to it. We need to decide this before we can share data as an industry.
Going forward, it was felt that it would help readers to see examples of how to assess an ICA number for operational risk, maybe in a future paper. One speaker discussed the potential correlation with other losses, as it is precisely when you get insurance losses that you could get other operational losses. Causal modelling diagrams allow you to build probability models around fundamental causes of remote events, and you can refine them as you get more actual data.
It was agreed that there are many business benefits from quantifying operational risk well:
– you may be able to save on your firm’s capital requirements (by avoiding double counting because some operational losses are already being modelled within insurance losses);
– by helping management document properly the high costs of failed controls you can reduce the cost of future unnecessary losses; and
– by prioritising business improvement projects to find the ones that produce the best relative return.

Runners and riders
In conclusion Jeremy Goford, Institute president, made the following suggestion: in salesrooms you have a board celebrating sales successes, listing big wins, with the amount introduced and name of salesman. So also in the boardroom you could have a ‘risk board’ listing large (potential) losses, the root cause, and the name of the responsible executive. We as actuaries were urged to get involved in operational risk; if you do it well, it will give you the opportunity to make many visible contributions to the running of the company. In addition, we should be driven by the desire to run a company well rather than fear of the potential failure of FSA tests.
The authors have gone beyond the normal zone of actuarial work, and produced a paper of practical benefit.