1. TK 6413 / TK 5413 ISLAMIC RISK MANAGEMENT TOPIC 5 : THE MEASUREMENT OF OPERATIONAL RISK 1

2. (1) INTRODUCTION  Operational risk is defined in BASEL II as “ the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events …. (including) legal risk……. But (excluding) strategic and reputational risk”.  Cases of operational failures in the financial services industry during the 1990s brought operational risk to attention as an important area of regulation. The operational failures manifested themselves in different activities of these institutions, including failure in risk oversight by senior management, and poor accounting and auditing processes.  The followings are some of the reported losses due to operational risk: 2

3. YearDescription of Loss 1991BCCI : Reported loss of USD 10 Billion. Wide range of illegal activities that included fraudulent loans, fictitious deposits. 1995Barings: Concealed huge (USD 1.4 Billion) losses on options and future trading. 1996Sumitomo Copper Scandal : Concealed huge losses (USD 2.6 Billion) losses on forwards and futures trading. Daiwa Securities : Concealed USD 1.4 Billion losses on bond trading 1997Nat West Capital Markets : £90 Million losses concealed on mispricing swaps. 2001World Trade Center attack : The largest ever single operational loss with estimates of total losses to the insurance industry up to USD 70 Billion. 2001Lehman Brothers, London : A dealer traded £300 Million lot instead of an intended £ 3 Million. Allied Irish Bank reported a fraud that had gone on undetected since 1997 had cost the bank USD 691 Million. 3

4. Policies/ Transactions Policies/ Transactions  The different sources of operational risks and where they affect Islamic Financial contracts : Operational Risk People Systems & Technology Systems & Technology Process & Delivery failures Process & Delivery failures Internal & External Events Internal & External Events Ijarah Murabaha Musharakah Istisna Salam Shariah Law Musharakah Mudrabah Istisna Musharakah Mudarabah Ijarah 4

5.  Categorization of Operational risks :  The Basel Committee on Bank Supervision has identified seven categories of operational risk : i.Internal fraud; ii.External fraud; iii.Employment practices and workplace safety; iv.Clients, products and business practices; v.Damage to physical assets; vi.Business disruption and system failure; vii.Execution, delivery and process management  Banks must assess their exposure to each type of risk for each of the eight business lines namely: 5

6. Business LineBeta Factor Corporate finance18% Trading and Sales18% Retail Banking12% Commercial Banking15% Payment and Settlement18% Agency Services15% Asset Management12% Retail Brokerage12%  Ideally this will lead to a result where VaR is estimated for each of 7 x 8 = 56 risk type / business-line combinations. (II)VaR for Operational Risk  Operational risk is notoriously difficult to measure. But, in principle at least, the classic distribution approach to measure risk as seen below can be deployed Cont’d… 6

7. Graph 1.0 Likehood of Loss Severity of Loss ExpectedUnexpected Severe Catastrophic 1 st Percentile Cont’d… 7

8.  From the graph 1.0 i. Severe but not catastrophic losses : Unexpected severe operational failures should be covered by an appropriate allocation of operational risk capital. whose losses are covered by measurement processes described later. ii.Catastrophic losses : These are the most extreme but also the rarest operational risk events – the kind that can destroy the financial institution or bank entirely. VaR and RAROC models are not meant to capture catastrophic risk, since they consider potential losses only up to a certain confidence level (say 1%), and catastrophic risks are by their very nature extremely rare. Banks for instance, may tighten procedures to protect themselves against catastrophic events, or use insurance to hedge catastrophic risk. But the risk capital cannot protect a bank/financial institution against these risks. 8

9.  Capital requirement (Op Va R) = Σ EI N i = 1 ί * βί Where, EI = Exposure Indicator β = Beta factor of the 8 business line set according by the Basel Committee  The loss distribution approach is analogous to the VaR techniques developed to measure market risk in banking, and therefore we will call it operational value-at-risk (OpVaR). Our aim is to determine the expected loss from operational failures, the worse case loss at a desired confidence level, the required economic capital for operational risk, And the concentration of operational risk.  The firms’ activities should be divided into lines of business (LOB), with each business being assigned an exposure indicator (EI). The primary foundation for this analysis is the historical experience of operation losses. Where no loss data, inputs have to to be based on judgment and scenario analysis. 9

10.  For example, a measure of EI for legal liability related to client exposure could be the number of clients multiplied by the average balance per client. The associated probability of an operational risk event (PE) would then be equal to the number of lawsuits divided by the number of clients. The loss given an event (LGE) would equal average loss divided by the average balance per client.  A measure of EI for employee liability could be the number of employees multiplied by the average compensation. The PE of the employee liability would then be the number of lawsuits divided by the number of employees, and the LGE would be the average loss divided by the average employee compensation.  A measure of EI for regulatory, compliance and taxation penalties could be the number of accounts multiplied by the balance per account. The PE would then be the number of penalties (including cost to comply) divided by the number of accounts, and the LGE would be the average balance per account. 10

11.  A measure of EI loss of or damage to assets could be the number of physical assets multiplied by their average value. The associated PE would be the number of damage incidents divided by the number of physical assets; the LGE would be the average loss divided by the average value of physical assets.  The measure of EI for client restitution could be the number of accounts multiplied by the average balance per account. The PE would then be the number of restitutions divided by the number of accounts, and the LGE would be the average restitution divided by the average balance per account.  A measure of EI for theft, fraud and unauthorized activities could be the number of accounts multiplied by the balance per account (of the number of transactions multiplied by the average value per transaction). The corresponding measure for PE would be the number of frauds divided by the number of transactions. The respective LGEs would be the average loss divided by the average balance per account or the average loss divided by the average value per transaction. 11

12.  A measure of EI for transaction-processing risk could be the number of transactions multiplied by the average value per transaction. The PE would then be the number of errors divided by the number of transactions. The LGE would be the average loss divided by the average value per transaction. 12

13. Exposure Base (EI) Internal Loss History Industry Loss History Scenario Analysis Key Risk Drivers (KRD) From Tools for Risk Analysis to OpVaR Calculation of Actual PEs & LGEs Calculation of Actual PEs & LGs Reporting Calculation of Actual PEs & LGs Actual Loss Rates Projected Loss Rates OP VaR RAROC OPVaR Report Stress Scenerio 13

14. (III) THE ROLE OF KEY RISK DRIVERS  The OpVaR number for a line of business or bank activity can be provide an important indication of that business line or activity’s riskiness. But because quantifying operational risk is still in its infancy, and therefore is a very inexact science, most banks make use of the number of techniques to try to understand their level of exposure.  In any bank activity, they are likely to be the number of identifiable factors that tend to drive operational risk exposure and that are also relatively easy to track. For example, in the case of system risk, these key risk drivers (KRDs) might include the age of computer systems, the percentage of downtime as a result of system Failure. Ideally, KRDs would be entirely objective measures of some risk-related factor in a bank activity.  Although KRDs are not a direct measure of operational risk, they are a kind of proxy for it. KRDs can be used to monitor changes in operational risk for each business and for each loss type, providing red flags that alert management of a rise In the likelihood of an operational risk event. Unwelcome changes in KRDs can be used to prompt remedial management action. 14

15.  KRDs are an important management information tool in themselves. But once they have been established, the bank is likely to want to map changes in a driver to the corresponding changes in OpVaR so that the KRD and OpVaR approaches offer consistent feedback to the bank’s business line. (IV) LOSS SEVERITY AND LOSS FREQUENCY  There are two distributions that are important in estimating potential Operational risk losses. One is the loss frequency distribution and the other Is the severity distribution. The loss frequency distribution is the distribution of The number of losses observed during the time horizon (usually a year). The Loss severity distribution is the distribution of the size of the loss given that a loss Occurs. It is usually assumed that loss severity and loss frequency are independent.  For loss frequency, the natural probability distribution to use is a Poisson Distribution where, Probability of losses in time T is e - λ T (λ T) П ! п 15

16.  For the loss severity probability distribution, a lognormal probability distribution is often used.  The loss frequency distribution must be combined to the loss severity distribution for each loss type and business line to determine a total loss distribution. Monte Carlo simulation can be used for this purpose. 16