Modern Operational Risk Modelling

For many Financial Services firms, the answer to their ICARA or ICAAP Operational Risk capital quantification challenge is using the Scenario-based LDA approach – its accurate, as-simple-as-possible and easy to implement.

Need to know more: read on, see our website or contact our team.

Now, more than ever, it’s crucial for firms to deploy scarce and stretched resources in ways that can help them solve business problems most efficiently. Seen within this context, modelling Operational Risk (OR) can be a time-consuming minefield. This is because it requires a very specific skillset to execute and can potentially jeopardise credibility with regulators, as well as generate bad or illogical outputs, if not done properly.

Despite this, banks and other Financial Institutions often still decide to use models to assess OR capital requirements sharing their results, interpretations and methodologies with their regulator¹. To add further complexity, there are a wide range of modelling options to choose from, many of which are not fully appropriate for regulatory capital calculation purposes.

To save time and money, and to free up capacity, we believe that more firms should consider modelling OR through Loss Distribution Analysis (LDA), using a blend of frequency, severity and scenario calibration.

Subject matter experts (SME) are typically asked to assess loss scenarios that they can reasonably encounter in their career or lifetime, as well as the frequencies of such events. Under this approach, sensible statistical assumptions are applied to this SME input to extrapolate a range from milder losses to capital severity. This helps for full comparability across different risk profiles – from high-frequency-low-severity to low-frequency-high-severity event types – as well as reducing the impact of diversification benefits on loss events. Importantly, this approach even works when there is no available historical data, as it is calibrated by those expert assessments, which should in turn be informed by the best available insights and estimates when solid data is not available.

As a tried-and-tested methodology, the LDA approach is also consistent with previous regulatory submissions. This carries weight since, if correctly analysed and interpreted, the outputs remain credible and insightful, ultimately leading to better risk decisioning.

This is important as the regulatory environment around OR continues to evolve. In particular we would call out the following:

• Recent Consultation Papers from the Prudential Regulation Authority (PRA) concerning Pillar 2A Capital (CP9/24 – Streamlining the Pillar 2A capital framework and the capital communications process | Bank of England, CP12/25 – Pillar 2A review – Phase 1 | Bank of England, etc)
• Updates to the Basel 3.1 definitions as well as the capture of Operational Risk loss data (cp1622app4.pdf, bankofengland.co.uk)
• The publication by the Financial Conduct Authority (FCA) in 2023 of its observations concerning IFPR implementation (FCA publishes final report on IFPR implementation observations)

Against this complex backdrop, we expect scenario-based LDA to remain a principle method for internal OR capital quantification for many years to come.

We get it, you’re really busy

It takes time to build a model that is able to robustly estimate OR capital in ways that are both sensible (i.e., that pass the ‘use’ test) and defensible in the eyes of any inquisitive model validators, including the board and regulators. Yet, it’s not just the robustness of the model that counts. It is also important to consider the visuals and analytics overlaying the model, which are essential in order for all stakeholders to fully understand, articulate and manage the operational risks they face.

OR team resources are already highly constrained, and firms cannot afford to waste their valuable resources when they have such a wide range of issues to manage, including:

• Assessing cyber controls in the age of hybrid working;
• Monitoring and calibrating IT risk appetites;
• Assessing OR controls; and
• Reporting to the board on the firm’s evolving OR profile.

By adopting a scenario-based-LDA approach, firms can also dramatically reduce their upfront development schedules, benefitting from the presence of well-established methodologies. This can free up management to focus on defining the ‘true’ OR risk profile of the institution, which can then be used as a valuable input into the model, avoiding the problem of ‘GIGO’ (‘garbage in, garbage out’).

OR modelling may not be what you imagined

In many firms, OR teams have extensive experience in control frameworks, conducting internal audits, analysing processes and rolling out risk management frameworks. However, the skill set that got them recruited originally may well not extend to the statistical capabilities required for OR modelling. It is perhaps not surprising then that, historically, many have made embarrassing statistical mistakes leading to some difficult conversations with regulators and other stakeholders.

In addition, asking for help from colleagues with adjascent quantitative skills and experience will not always deliver the right outcome, especially if, for example, you asked a credit or market risk modeller to try modelling operational risk. OR data often ranges from patchy to non-existent and the skills required to assess such low frequency, high severity risk types is very different to other areas of risk modelling. In such circumstances, it will be virtually impossible to reach the right outcome without using some type of model, due to the highly varied nature of potential probability distribution outcomes.

So, in summary, to create an insightful OR modelling methodology and associated reporting suite, firms require a mix of skills and capabilities:

• Experience of operational risk types to properly assess model inputs.
• An understanding of regulatory expectations to ensure models can pass muster.
• Experience of choosing between and applying statistical techniques, understanding a given model’s limitations and being able to carry it through validation.
• Familiarity with scenarios used to generate the raw materials that models require.

It’s rare to find all of these skills in a modestly sized OR team. So, it’s perhaps not surprising that sometimes the models developed by teams generate problems down the line. Three common problems are transparency, plausibility and stability, all of which can render models hard to explain, hard to validate and hard to apply in practice.

As a consequence, firms may end up holding more (or less) OR capital than they really need. Their reputation with their regulator can suffer and a lot of time and energy will have been wasted should internal stakeholders reject a model because it doesn’t align with their understanding of the risk profile of the business.

You may be missing a trick

The LDA approach to OR modelling recommended in this article not only allows institutions to meet their regulatory obligations, but it can also be genuinely insightful. By simplifying model choices, the LDA approach frees up time for risk-type SMEs to assess the true risk profile of the organisation – their sweet-spot.

By harnessing the best insights and channelling them through a model that has passed regulatory scrutiny for many UK and European firms, firms will arrive at capital allocations that are easier to understand and share around the business. Better first- and second-line buy-in will also mean models are more likely to pass the ‘use test’ more easily, forming the basis of future business decisions. In this way, your OR model will become not just a more accurate tool for calculating capital, but a better way to understand your true risk profile and decide on your investment priorities for risk (and capital) reduction.

Want to know more? Please reach out to the contacts below.

______________________________________________________________________________

References:

1. See our recent blog on making the decision to model OR here.