Joining the dots between operational and non-operational risk

Patrick Kelliher covers issues in modelling dependencies between operational and non-operational risks

From a risk management perspective, modelling dependencies – both between operational risks (ORs) and against non-operational risks (NORs) such as market and insurance risk – is critical to understanding how these risks are interlinked, how likely they are to occur simultaneously, and the degree of diversification between risks.

Modelling OR diversification benefits is critical to the assessment of economic capital requirements. Typically, OR requirements will be first assessed by risk type, using a mixture of loss data and scenario analysis. Given the range and diversity of ORs, most economic capital assessments then allow for diversification between them. The Operational Risk Working Party believes that diversification between ORs and NORs should also be allowed for in order to get a realistic measure of OR capital requirements.
 

Modelling dependencies between operational risks

Identifying correlations between ORs is challenging. There is generally a lack of data, so interactions between OR types at the tail will be missed, and/or random coincidence can give rise to spurious correlation estimates. Low event probabilities can lead to empirical correlation estimates being systematically understated.

There are many empirical studies of OR correlations using industry-wide data. While many suggest low correlations (25% or less), Abdymomunov and Ergen’s notable 2017 study of US bank losses had higher correlation estimates of 30-50%.

Ultimately, given the weaknesses in empirical estimates, there will necessarily be a high degree of reliance on expert judgment. There are challenges in terms of setting correlation assumptions, given the number involved – for example aggregating 20 separate OR categories would require 190 correlation assumptions without simplification. These assumptions must also be properly reviewed and challenged.

While many ORs may be viewed as independent of each other (for instance business continuity and documentation risks), they can often be linked by underlying drivers, such as poor governance, weak culture and quality of staff. Figure 1 highlights how one such driver – poor change management – could trigger losses across multiple categories.

“Operational risks can take many years to emerge – for instance, many PPI mis-selling claims from the noughties and earlier have only recently been settled”

In UK life insurance, the most common approach to modelling OR dependencies is copula aggregation, especially Gaussian copula. This provides a full distribution of aggregate operational losses, consistent with Solvency II requirements. Also, the alternative of variance-covariance aggregation implicitly assumes that the underlying distributions of each risk category are elliptical, which is rarely the case with ORs. This could lead to misstatement of aggregate requirements.
 

As for Gaussian copula, we believe that issues with its zero coefficient of tail dependency are overstated. Depending on the correlation assumption, this can adequately model extreme operational loss events occurring across different categories. Given the subjectivity around such assumptions, further refinement in copula choice may be spurious.

We also carried out a simulation exercise to understand diversification benefits between ORs. Diversification benefits are lower for risk profiles that are concentrated in individual categories such as conduct risk, as well as for more skewed distributions. They are also sensitive to the loss event frequencies, especially lower frequencies.
 

NOR dependencies

While it is common to allow for diversification between ORs and NORs in Solvency II internal models, this is not allowed for in the Solvency II Standard Formula, nor is it normal in bank and asset management economic capital models. We believe that such omission will result in an unrealistic view of OR capital requirements.

We identified a number of generic linkages between ORs and NORs, which are summarised in Figure 2.

From this, we can identify a number of issues with modelling dependencies and diversification benefits between ORs and NORs:  

• Asymmetry – while a NOR event, such as a market fall, could affect ORs such as mis-selling, an individual firm’s operational failings rarely have a bearing on wider markets and claims experience. Typically, correlation assumptions are scaled back to reflect this asymmetry.  
• Reputation – an exception to the above is reputational damage caused by OR events, which may lead to higher lapses, lower sales and, in time, lower in-force volumes and higher unit costs. Reputational damage may be seen as a ‘vector of transmission’ from OR to lapse and expense elements of insurance risk.  
• Contingent severity – operational losses, such as investment product mis-selling, are often contingent on market levels and/or credit losses, which may affect whether historic conduct failings crystallise in loss events in the first place – and when they do, what the costs of such events are. In many instances, the operational failing may lead to a firm effectively writing a put option on the clients’ investments.  
• Implicit allowances for operational losses – this is particularly an issue for insurance risks, where claims experience will implicitly allow for underwriting and claim processing errors and fraud to the extent that these are undetected. Insurance risk models based on this experience will implicitly allow for these ORs, albeit to an unspecified degree – potentially resulting in an element of double counting.

Finally, there is an issue of timeframe. ORs can take many years to emerge – for instance many payment protection insurance (PPI) mis-selling claims from the noughties and earlier have only recently been settled. While in the long run there may be connections between ORs and NORs (possibly lax mortgage underwriting before the global financial crisis of 2007-09 and PPI mis-selling), during the one-year timeframe of most economic capital frameworks these connections are less relevant. Instead, we may be considering the correlation between market, credit and claims experience during the coming year, and operational losses that may have been incurred a decade or more ago.
 

A developing field

OR dependency modelling is still at a nascent stage. We expect further development and refinement during the coming years as more data and better models emerge. One area we would highlight in particular is the Bayesian Networks model. This seeks to develop a combined distribution of operational losses across all categories based on underlying causal factors, such as staff turnover and control weaknesses. There are practical challenges in building and implementing such a model, but this approach is more adaptable, for instance in allowing for asymmetric dependencies. We would encourage those involved in OR modelling to keep abreast of this and other developments.

The paper on which this article is based can be found at bit.ly/2U2JzpH
 

Patrick Kelliher is chair of the Operational Risk Working Party

Picture Credit | iStock