Operational Risk is one of the most difficult risks to model. It is a large and diverse category covering anything from cyber losses to mis-selling fines; and from processing errors to HR issues. Data is usually lacking, particularly for low frequency, high impact losses, and consequently there can be a heavy reliance on expert judgement. This paper seeks to help actuaries and other risk professionals tasked with the challenge of validating models of operational risks. It covers the loss distribution and scenario-based approaches most commonly used to model operational risks, as well as Bayesian Networks. It aims to give a comprehensive yet practical guide to how one may validate each of these and provide assurance that the model is appropriate for a firm’s operational risk profile.

This paper explores dependencies between operational risks and between operational risks and other risks such as market, credit and insurance risk. The paper starts by setting the regulatory context and then goes into practical aspects of operational risk dependencies. Next, methods of modelling operational risk dependencies are considered with a simulation study exploring the sensitivity of diversification benefits arising from dependency models. The following two sections consider how correlation assumptions may be set, highlighting some generic dependencies between operational risks and with non-operational risks to assist in the assessment of dependencies and correlation assumptions. Supplementary appendices provide further detail on generic dependencies as well as a case study of how business models can lead to operational risks interacting with other risks. Finally, the paper finishes with a literature review of operational risk dependency papers including correlation studies and benchmark reports.

Cyber Operational Risk: Cyber risk is routinely cited as one of the most important sources of operational risks facing organisations today, in various publications and surveys. Further, in recent years, cyber risk has entered the public conscience through highly publicised events involving affected UK organisations such as TalkTalk, Morrisons and the NHS. Regulators and legislators are increasing their focus on this topic, with General Data Protection Regulation (“GDPR”) a notable example of this. Risk actuaries and other risk management professionals at insurance companies therefore need to have a robust assessment of the potential losses stemming from cyber risk that their organisations may face. They should be able to do this as part of an overall risk management framework and be able to demonstrate this to stakeholders such as regulators and shareholders. Given that cyber risks are still very much new territory for insurers and there is no commonly accepted practice, this paper describes a proposed framework in which to perform such an assessment. As part of this, we leverage two existing frameworks – the Chief Risk Officer (“CRO”) Forum cyber incident taxonomy, and the National Institute of Standards and Technology (“NIST”) framework – to describe the taxonomy of a cyber incident, and the relevant cyber security and risk mitigation items for the incident in question, respectively.Summary of Results: Three detailed scenarios have been investigated by the working party:

• ∙ Employee leaks data at a general (non-life) insurer: Internal attack through social engineering, causing large compensation costs and regulatory fines, driving a 1 in 200 loss of £210.5m (c. 2% of annual revenue).

• ∙ Cyber extortion at a life insurer: External attack through social engineering, causing large business interruption and reputational damage, driving a 1 in 200 loss of £179.5m (c. 6% of annual revenue).

• ∙ Motor insurer telematics device hack: External attack through software vulnerabilities, causing large remediation / device replacement costs, driving a 1 in 200 loss of £70.0m (c. 18% of annual revenue).

• ∙ While the presented scenarios are deemed material at this point in time, the threat landscape moves fast and could render specific narratives and calibrations obsolete within a short-time frame.

• ∙ There is a lack of historical data to base certain scenarios on and therefore a high level of subjectivity is used to calibrate them.

• ∙ No attempt has been made to make an allowance for seasonality of renewals (a cyber event coinciding with peak renewal season could exacerbate cost impacts)

• ∙ No consideration has been given to the impact of the event on the share price of the company.

• ∙ Correlation with other risk types has not been explicitly considered.

We consider a resource allocation model to analyze investment strategies for financial services firms in order to minimize their operational risk losses. A firm has to decide how much to invest in human resources and in infrastructure (information technology). The operational risk losses are a function of the activity level of the firm, of the amounts invested in personnel and in infrastructure, and of interaction effects between the amounts invested in personnel and infrastructure. We first consider a deterministic setting and show certain monotonicity properties of the optimal investments assuming general loss functions that are convex. We find that because of the interaction effects “economies of scale" may not hold in our setting, in contrast to a typical manufacturing environment. We then consider a general polynomial loss function in a stochastic setting with the number of transactions at the firm being a random variable. We characterize the asymptotic behaviors of the optimal investments in both heavy and light trading environments. We show that when the market is very liquid, that is, it is subject to heavy transaction volumes, it is optimal for a financial firm that is highly risk sensitive to use a balanced investment strategy. Both a heavier right tail of the distribution of transaction volume and a firm's risk sensitivity necessitate larger investments; in a heavy trading environment these two factors reinforce one another. However, in a light trading environment with the transaction volume having a heavy left tail the investment will be independent of the firm's sensitivity to risk.

This paper explores the characteristics of 2,141 operational risk events amongst European (EU) and US banks over the period 2008–2014. We have analysed the operational risk events using a method originating in biology for the study of interrelatedness of characteristics in a complex adaptive system. The methodology, called cladistics, provides insights into the relationships between characteristics of operational risk events in banks that is not available from the traditional statistical analysis. We have used cladistics to explore if there are consistent patterns of operational risk characteristics across banks in single and different geographic zones. One significant pattern emerged which indicates there are key, stable characteristics across both geographic zones and across banks in each zone. The results identify the characteristics that could then be managed by the banks to reduce operational risk losses. We also have analysed separately the characteristics of operational risk events for “big” banks and extreme events and these results indicate that big banks and small banks have similar key operational risk characteristics, but the characteristics of extreme operational risk events are different to those for the non-extreme events.

The quantification of operational risk has to deal with various concerns regarding data, much more than other types of risk which banks and insurers are obliged to manage. One of the main questions that worries both researchers and practitioners is the bias in the data on the operational losses amounts recorded. We support the assertions made by several authors and defend that this concern is serious when modeling operational losses data and, typically, is presented in all the databases. We show that it's possible, based on mild assumptions on the internal procedures put in place to manage operational losses, to make parametric inference using loss data statistics, that is, to estimate the parameters for the losses amounts, taking in consideration the bias that, not being considered, generates a two fold error in the estimators for the mean loss amount and the total loss amount, the former being overvalued and the last undervalued. In this paper, we do not consider the existence of a threshold for which, all losses above, are reported and available for analysis and estimation procedures. In this sense, we follow a different approach to the parametric inference. Here, we consider that the probability that a loss is reported and ends up recorded for analysis, increases with the size of the loss, what causes the bias in the database but, at the same time, we do not consider the existence of a threshold, above which, all losses are recorded. Hence, no loss has probability one of being recorded, in what we defend is a realist framework. We deduce the general formulae, present simulations for common theoretical distributions used to model (operational reported) losses amounts, estimate the impact for not considering the bias factor when estimating the value at risk and estimate the true total operational losses the bank incurred.

In this paper, we investigate the problem of how to combine operational losses collected from various banks of different sizes and loss reporting thresholds in order to estimate the distribution of operational loss severities for a bank of a given size. We model the severity of operational losses by using the extreme value theory to account for the reporting bias of the external data, and a regression analysis based on the GAMLSS framework to model the scaling properties of operational losses. In contrast to previous studies on the scaling problem, our analysis gives particular emphasis to the scaling properties of the tail of the loss distribution. Contrary to existing knowledge, we find that the size of a bank is an important determinant of the severity of operational losses and that the tail index of the distribution is negatively correlated with the size of the bank. The results indicate that for very large banks, distribution of the operational loss severity can be extremely heavy tailed (i.e. tail index less than 1), a finding which have significant implications for capital calculation as well as for risk management. Furthermore, we also demonstrate that the capital estimates provided by our model is consistent with the industry standards and the model can be used by individual banks to simulate data to complement their internal data.

Risk terminology varies from organisation to organisation, and actuaries working in different organisations may use different terms to refer to the same risk, or use the same nomenclature for completely different risks. This paper sets out a classification system developed by the Risk Classification Working Party for the Profession that can be used as a common reference point for discussing risk. Actuaries will not be required to use this system, but it is hoped that common terminology will reduce the possibility of confusion in discussing risks.

This paper overviews a practical approach to the assessment of operational risk in life insurance companies. It considers how actuaries, working in conjunction with risk management professionals and senior management, can develop a framework to assess the capital requirements relating to operational risk, taking into account the capital requirements of other risks and their interaction.

This paper recognises that we do not live in an ideal world, and that a lot of the data which one might want for operational risk assessment are not, and in some cases never will be, available. Consequently, the approach outlined in this paper takes into account the fact that management and assessment of operational risk is at an early stage of development in the life industry. In addition, it outlines some of the areas where development is necessary or desirable in the coming years.

There is a section on the operational risks against which it is appropriate to hold capital. As this is a new area for insurance companies, and given the governance requirements for Individual Capital Assessments, it is important to explain the results effectively to senior management. Therefore, a brief review of techniques for reporting the results of the assessment is provided.

The paper concludes with some thoughts on how operational risk management can be embedded more in the business, and then considers what future work will help develop the framework. To echo the thoughts of the authors of the general insurance paper on this topic (Tripp et al., 2004), we hope that the paper will sow seeds for the development of best practice in dealing with operational risk, and will raise the awareness and increase the interest of actuaries in this emerging topic.

This paper represents the views of the individuals in the working party, and not necessarily the views of their employers or the Actuarial Profession.

The paper overviews the application of existing actuarial techniques to operational risk. It considers how, working in conjunction with other experts, actuaries can develop a new framework to monitor/review, establish context, identify, understand and decide what to do in terms of the management and mitigation of operational risk. It suggests categorisations of risk to help analyses and proposes how new risk indicators may be needed, in conjunction with more normal quantification approaches.

Using a case study, it explores the application of stress and scenario testing, statistical curve fitting (including the application of extreme value theory), causal (Bayesian) modelling and the extension of dynamic financial analysis to include operational risk. It suggests there is no one correct approach and that the choice of parameters and modelling assumptions is critical. It lists a number of other techniques for future consideration.

There is a section about how ‘soft issues’ including dominance risk, the impact of belief systems and culture, the focus of performance management systems and the psychology of organisations affect operational risk. An approach to rating the people aspects of risk in parallel with quantification may help give a better overall assessment of risk and improve the understanding for capital implications.

The paper concludes with a brief review of implications for reporting and considers what future work will help develop the actuarial contribution. It is hoped the paper will sow seeds for the development of best practice in dealing with operational risk and increase the interest of actuaries in this emerging new topic.

This paper looks at the risks faced by financial institutions, and how they can be modelled and managed. I compare the way in which each of the risks affects different types of financial institution and look for similarities (and differences) across industries. Finally, I consider what makes a good risk management system.

In this paper we estimate operational risk by using the convex risk measure Expected Shortfall (ES) and provide an approximation as the confidence level converges to 100% in the univariate case. Then we extend this approach to the multivariate case, where we represent the dependence structure by using a Lévy copula as in Böcker and Klüppelberg (2006) and Böcker and Klüppelberg, C. (2008). We compare our results to the ones obtained in Böcker and Klüppelberg (2006) and (2008) for Operational VaR and discuss their practical relevance.

We discuss some issues regarding the accuracy of a quantile-based estimation of risk capital. In this context, extreme value theory (EVT) emerges naturally. The paper sheds some further light on the ongoing discussion concerning the use of a semi-parametric approach like EVT and the use of specific parametric models such as the g-and-h. In particular, we discusses problems and pitfalls evolving from such parametric models when using EVT and highlight the importance of the underlying second-order tail behavior.

Operational risk has become an important risk component in the banking and insurance world. The availability of (few) reasonable data sets has given some authors the opportunity to analyze operational risk data and to propose different models for quantification. As proposed in Dutta and Perry [12], the parametric g-and-h distribution has recently emerged as an interesting candidate.

In our paper, we discuss some fundamental properties of the g-and-h distribution and their link to extreme value theory (EVT). We show that for the g-and-h distribution, convergence of the excess distribution to the generalized Pareto distribution (GPD) is extremely slow and therefore quantile estimation using EVT may lead to inaccurate results if data are well modeled by a g-and-h distribution. We further discuss the subadditivity property of Value-at-Risk (VaR) for g-and-h random variables and show that for reasonable g and h parameter values, superadditivity may appear when estimating high quantiles. Finally, we look at the g-and-h distribution in the one-claim-causes-ruin paradigm.

In contrast to recent successful developments in macro monetary policies, the modelling, measurement and management of systemic financial stability has remained problematical. Indeed, the focus of most effort has been on improving individual, rather than systemic, bank risk management; the Basel II objective has been to bring regulatory bank capital into line with the (sophisticated) banks‘ assessment of their own economic capital. Even at the individual bank level there are concerns over (i) appropriate diversification allowances, (ii) differing objectives of banks and regulators, (iii) the need for a buffer over regulatory minima, and (iv) the distinction between expected and unexpected losses (EL and UL). At the systemic level the quite complex and prescriptive content of Basel II raises dangers of ‘endogenous risk’ and procyclicality. Simulations suggest that this latter could be a serious problem.