1. Copyright © 2005, SAS Institute Inc. All rights reserved. Quantifying and Controlling Operational Risk with SAS OpRisk VaR Donald Erdman April 11, 2005

2. Copyright © 2005, SAS Institute Inc. All rights reserved. 2 Agenda  Motivation  Background  Demo  Plans

3. Copyright © 2005, SAS Institute Inc. All rights reserved. 3 Operational Risk Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputation risk.  Fire  Fraud  Errors

4. Copyright © 2005, SAS Institute Inc. All rights reserved. 4 Important Goal  Ensure a company has enough resources to recover from a one in 50 year loss

5. Copyright © 2005, SAS Institute Inc. All rights reserved. 5  SAS ® OpRisk Monitor Web-based system for collecting, storing, analyzing, tracking and reporting information about: operational loss events, key risk/performance/scale indicators, risk- assessment results, and control assessment scores.  SAS ® OpRisk VaR An application that integrates risk indicators and control assessment scorecard results for dynamic modeling of operational VaR  SAS ® OpRisk Global Data SAS OpRisk Global Data is the world’s largest, most comprehensive, and most accurate repository of information on publicly reported operational losses in excess of US$1 million. SAS ® OpRisk Solution

6. Copyright © 2005, SAS Institute Inc. All rights reserved. 6 Regulatory Requirements  Utilization of internal data  Combination with external data  Consideration of internal control factors  Integration of expert opinion (Scenario Analysis)  Estimation methodology must accurately represent the Organization’s risk profile.

7. Copyright © 2005, SAS Institute Inc. All rights reserved. 7 Common Problems  Feasibility in current environment Lack of data Use of thresholds  Consideration of systematic biases. Thresholds Sampling biases

8. Copyright © 2005, SAS Institute Inc. All rights reserved. 8 Loss Distribution Approach INDIVIDUAL LOSS EVENTS RISK MATRIX FOR LOSS DATA VAR CALCULATION TOTAL LOSS DISTRIBUTION 74,712,345 74,603,709 74,457,745 74,345,957 74,344,576 167,245 142,456 123,345 113,342 94,458 LOSS DISTRIBUTIONS Frequency of events Severity of loss Annual Aggregate Loss ($) Mean99th Percentile VaR Calculator e.g., Monte Carlo Simulation Engine VaR Calculator e.g., Monte Carlo Simulation Engine

9. Copyright © 2005, SAS Institute Inc. All rights reserved. 9 Architecture Desktop / Workstation OpRiskVar Database SAS/OpRisk VaR Application (Java) JDBC JRE 1.4.1 SAS SAS Server Analytics reporting Configuration Loss Events Monitor Database Configuration Loss Events CSV Files

10. Copyright © 2005, SAS Institute Inc. All rights reserved. 10 Important Point  Users aren’t just interested in determining what their worst loss could be. They want control over their worst case loss.

11. Copyright © 2005, SAS Institute Inc. All rights reserved. 11 Demo of SAS OpRisk VaR

12. Copyright © 2005, SAS Institute Inc. All rights reserved. 12 Future Plans  Consortium Tool  Mixing in Simulation  Frequency Risk Factors  Robust Estimation  Confidence intervals  Incremental loading  SAS data store

13. Copyright © 2005, SAS Institute Inc. All rights reserved. 13 Copyright © 2005, SAS Institute Inc. All rights reserved. 13