Chapter 2 Loss Distribution Approach

This chapter introduces a basic model for the Loss Distribution Approach. We discuss the main aspects of the model and basic probabilistic concepts of risk quantification. The essentials of the frequentist and Bayesian statistical approaches are introduced. Basic Markov chain Monte Carlo methods that allow sampling from the posterior distribution, when the sampling cannot be done directly, are also described. 2.1 Loss Distribution Model A popular method under the AMA is the loss distribution approach (LDA). Under the LDA, banks quantify distributions for frequency and severity of operational risk losses for each risk cell (business line/event type) over a 1-year time horizon. The banks can use their own risk cell structure but must be able to map the losses to the Basel II risk cells. Various quantitative aspects of LDA modelling are discussed in King [134]; Cruz [65, 66]; McNeil, Frey and Embrechts [157]; Panjer [181]; Chernobai, Rachev and Fabozzi [55]; Shevchenko [216]. The commonly used LDA model for the total annual loss Zt in a bank can be formulated as Zt = J ∑ j=1 Z ( j) t ; Z ( j) t = N ( j) t ∑ i=1 X ( j) i (t). (2.1) Here: t = 1, 2, . . . is discrete time in annual units. If shorter time steps are used (e.g. quarterly steps to calibrate dependence structure between the risks), then extra summation over these steps can easily be added in (2.1). The annual loss Z ( j) t in risk cell j is modelled as a compound (aggregate) loss over one year with the frequency (annual number of events) N ( j) t implied by a counting process (e.g. Poisson process) and severities X ( j) i (t), i = 1, . . . , N ( j) t . Typically, the frequencies and severities are modelled by independent random variables. P. Shevchenko, Modelling Operational Risk Using Bayesian Inference, DOI 10.1007/978-3-642-15923-7_2, C © Springer-Verlag Berlin Heidelberg 2011 21 22 2 Loss Distribution Approach Estimation of the annual loss distribution by modelling frequency and severity of losses is a well-known actuarial technique; see for example Klugman, Panjer and Willmot [136]. It is also used to model solvency requirements for the insurance industry; see Sandström [207] and Wüthrich and Merz [240]. Under model (2.1), the capital is defined as the 0.999 Value-at-Risk (VaR) which is the quantile of the distribution for the next year annual loss ZT+1: VaRq [ZT+1] = inf{z ∈ R : Pr[ZT+1 > z] ≤ 1− q} (2.2) at the level q = 0.999. Here, index T + 1 refers to the next year. The capital can be calculated as the difference between the 0.999 VaR and the expected loss if the bank can demonstrate that the expected loss is adequately captured through other provisions. If assumptions on correlations between some groups of risks (e.g. between business lines or between risk cells) cannot be validated then the capital should be calculated as the sum of the 0.999 VaRs over these groups. This is equivalent to the assumption of perfect positive dependence between annual losses of these groups. Of course, instead of modelling frequency and severity to obtain the annual loss distribution, one can model aggregate loss per shorter time period (e.g. monthly total loss) and calculate the annual loss as a sum of these aggregate losses. However, the frequency/severity approach is more flexible and has good advantages, because some factors may affect frequency only while other factors may affect severity only. For example: As the business grows (e.g. volume of the transactions grows), the expected number of losses changes and this should be accounted for in forecasting the number of losses (frequency) over the next year. The general economic inflation affects the loss sizes (severity). The insurance for operational risk losses is more easily incorporated. This is because, typically, the insurance policies apply per event and affect the severity. In this book, we focus on some statistical methods proposed in the literature for the LDA model (2.1). In particular we consider the problem of combining different data sources, modelling dependence and large losses, and accounting for parameter uncertainty. 2.2 Operational Risk Data Basel II specifies the data that should be collected and used for AMA. In brief, a bank should have internal data, external data and expert opinion data. In addition, internal control indicators and factors affecting the businesses should be used. Development and maintenance of operational risk databases is a difficult and challenging task. Some of the main features of the required data are summarised as follows. 2.2 Operational Risk Data 23 Internal data. Internal data should be collected over a minimum five-year period to be used for capital charge calculations (when the bank starts the AMA, a three-year period is acceptable). Due to a short observation period, typically the internal data for many risk cells contain few low-frequency/high-severity losses or none. A bank must be able to map its historical internal loss data into the relevant Basel II risk cells; see Tables 1.1, 1.2 and 1.3. The data must capture all material activities and exposures from all appropriate sub-systems and geographic locations. A bank can have an appropriate low reporting threshold for internal loss data collection, typically of the order of EURO 10,000. Aside from information on gross loss amounts, a bank should collect information about the date of the event, any recoveries of gross loss amounts, as well as some descriptive information about the drivers or causes of the loss event. External data. A bank’s operational risk measurement system must use relevant external data (either public data and/or pooled industry data). These external data should include data on actual loss amounts, information on the scale of business operations where the event occurred, and information on the causes and circumstances of the loss events. Industry data are available through external databases from vendors (e.g. Algo OpData provides publicly reported operational risk losses above USD 1million) and consortia of banks (e.g. ORX provides operational risk losses above EURO 20,000 reported by ORX members). External data are difficult to use directly due to different volumes and other factors. Moreover, the data have a survival bias as typically the data of all collapsed companies are not available. As discussed previously in Sect. 1.4, several Loss Data Collection Exercises (LDCE) for historical operational risk losses over many institutions were conducted and their analyses reported in the literature. In this respect, two papers are of high importance: Moscadelli [166] analysing 2002 LDCE and Dutta and Perry [77] analysing 2004 LDCE. In each case the data were mainly above EURO 10,000 and USD 10,000 respectively. Scenario Analysis/expert opinion. A bank must use scenario analysis in conjunction with external data to evaluate its exposure to high-severity events. Scenario analysis is a process undertaken by experienced business managers and risk management experts to identify risks, analyse past internal/external events, consider current and planned controls in the banks, etc. It may involve: workshops to identify weaknesses, strengths and other factors; opinions on the severity and frequency of losses; opinions on sample characteristics or distribution parameters of the potential losses. As a result some rough quantitative assessment of the risk frequency and severity distributions can be obtained. Scenario analysis is very subjective and should be combined with the actual loss data. In addition, it should be used for stress testing, for example to assess the impact of potential losses arising from multiple simultaneous loss events. Business environment and internal control factors. A bank’s methodology must capture key business environment and internal control factors affecting operational risk. These factors should help to make forward-looking estimates, account for the quality of the controls and operating environments, and align capital assessments with risk management objectives. 24 2 Loss Distribution Approach Data important for modelling but often missing in external databases are risk exposure indicators and near-misses. Exposure indicators. The frequency and severity of operational risk events are influenced by indicators such as gross income, number of transactions, number of staff and asset values. For example, frequency of losses typically increases with increasing number of employees. Near-miss losses. These are losses that could occur but were prevented. Often these losses are included in internal datasets to estimate severity of losses but excluded in the estimation of frequency. For detailed discussion on management of near-misses, see Muermann and Oktem [167]. 2.3 A Note on Data Sufficiency Empirical estimation of the annual loss 0.999 quantile, using observed losses only, is impossible in practice. It is instructive to calculate the number of data points needed to estimate the 0.999 quantile empirically within the desired accuracy. Assume that independent data points X1, . . . , Xn with common density f (x) have been observed. Then the quantile qα at confidence level α is estimated empirically as Q̂α = X̃ nα +1, where X̃ is the data sample X sorted into the ascending order. The standard deviation of this empirical estimate is stdev[Q̂α] = √ α(1− α) f (qα) √ n ; (2.3) see Glasserman ([108], section 9.1.2, p. 490). Thus, to calculate the quantile within relative error ε = 2× stdev[Q̂α]/qα , we need n = 4α(1− α) ε2( f (qα)qα) (2.4) observations. Suppose that the data are from the lognormal distributionLN (μ = 0, σ = 2). Then using formula (2.4), we obtain that n = 140, 986 observations are required to achieve 10% accuracy (ε = 0.1) in the 0.999 quantile estimate. In the case of n = 1, 000 data points, we get ε = 1.18, that is, the uncertainty is larger than the quantile we estimate. Moreover, according to the regulatory requirements, the 0.999 quantile of the annual loss (rather than 0.999 quantile of the severity) should be estimated. As will be discussed many times in this book, operational risk losses are typically modelled by the so-called heavy-tailed distributions. In this case, the quantile at level q of the aggregate distributions can be approximated by the quantile of the severity distribution at level p = 1− 1− q E[N ] ;