1. Tools for Operational
Risk Management
Dr. LAM Yat-fai (林日辉博士林日辉博士林日辉博士林日辉博士)
Doctor of Business Administration (Finance)
CFA, CAIA, FRM, PRM, MCSE, MCNE
PRMIA Award of Merit 2005
E-mail: quanrisk@gmail.com
2
Agenda
Major tools for operational risk management
Risk mapping and loss distribution
Key risk indicators
3
Major tools for OPM
Audit oversight
Business process reviewed by auditors
Control self-assessment
A bank assesses its operations and activities
against a menu of potential risk vulnerabilities
This process is internally driven and often
incorporates checklists and/or workshops to
identify the strengths and weaknesses of the
operational risk environment
4
Major tools for OPM
Risk mapping
In this process, various business units, organizational
functions or process flows are mapped by risk types
This exercise can reveal areas of weakness and help
prioritize subsequent management action
Key risk indicators
Simple measures that provide an indication of whether
risks are changing over time
These are objective early warning signals, e.g. staff
turnover, trade volumes, new client accounts

2. 5
Agenda
Major tools for operational risk management
Risk mapping and loss distribution
Key risk indicators
6
Risk mapping
7
Loss frequency vs loss severity
Loss frequency should be estimated from the
banks own data as far as possible
One possibility is to assume a Poisson
distribution so that we need only to estimate an
average loss frequency.
Loss severity can be based on internal and
external historical data
One possibility is to assume a lognormal
distribution so that we need only estimate the
mean and SD of losses 8
External historical loss severity data
Two possibilities
data sharing
data vendors
Data from vendors is based on publicly
available information and therefore is biased
towards large losses
Data from vendors can therefore only be used
to estimate the relative size of the mean losses
and SD of losses for different risk categories

3. 9
Loss frequency model
Collect operational loss records of last 3 to 5 years
Compute no. of loss events per month
Adjust no. of loss events per month according to
projected business expansion / contraction
Calculate no. of projected loss events per month λ
Annual loss frequency approximated by Poisson
distribution
( ) ( )12 exp 12
( , )
!
n
f n
n
λ λ
λ =
10
Loss severity model
Collect operational loss records of last 3 to 5 years
Adjust loss amounts according to historical and
projected inflations
Calculate the mean and S.D.
Loss severity approximated by lognormal
distribution
11
Aggregate loss model –
compounded Poisson process
Op VaR 99.9%Average 12
Aggregate loss model
- Monte Carlo simulation
Sample from frequency distribution to
determine the number of loss events (n)
Sample n times from the loss severity
distribution to determine the loss severity (x)
for each loss event
Sum loss severities to determine total loss (S)
Repeat above 3 steps for many times
( ) ( )OpLossAverageOpLossPercentileOpVaR −= %9.99,%9.99

4. 13
Categorization of operational risks
Internal fraud
External fraud
Employment practices and workplace safety
Clients, products and business practices
Damage to physical assets
Business disruption and system failures
Execution, delivery and process management
14
Categorization of business lines
Corporate finance
Trading and sales
Retail banking
Commercial banking
Payment and settlement
Agency services
Asset management
Retail brokerage
15
Basel III’s AMA for operational risk
Banks need to estimate their exposure to each
combination of type of risk and business line
Ideally this will lead to 7×8=56 op risk
measures that can be combined into an overall
op risk measure
16
Agenda
Major tools for operational risk management
Risk mapping and loss distribution
Key risk indicators

5. 17
HKMA’s guidelines on KRIs
In monitoring its operational risks, an AI should identify or develop
appropriate indicators that provide management with early warning of
operational risk issues (often referred to as “key risk indicators” (KRIs)
KRIs used by AIs should provide management with predictive information
and reflect potential sources of operational risk so that management can act on
issues before they become major problems to the institution
KRIs are primarily a selection from a pool of operations/control indicators
identified and being tracked by various functions of a bank on a periodic
basis, which are considered to be relevant for management tracking and
escalation triggering
By setting appropriate “goals or limits” or “escalation triggers” to KRIs,
monitoring of the KRIs can provide early warning of an increase in
operational risk or a breakdown in operational risk management and facilitate
communication of potential problems to a higher level of management
18
Practical characteristics of KRIs
Be easily observable and/or computable
Be easily understood
Highly related to operational risk level
Not too many for each function, from 5 to 12
Be consistent
19
Typical KRIs
Business
No. of transactions per day
No. of complaints per month
No. of machine failure per month
Experience
Staff turnover rate
No. of years of relevant experience
No. of changes of procedures per year
Your opinions
http://sites.google.com/site/quanrisk