It's all relative

The Operational Risk Consortium recently carried out an analysis of its growing database of operational losses in the insurance business. It found evidence of the need for scaling, which suggests no firm's losses should be viewed in isolation. Mariano Selvaggi presents the results

Last June the Operational Risk Consortium (Oric) held its annual conference looking at operational risk management in the insurance industry. One hotspot of the event was the launch of Oric's latest research, Analysing operational losses in insurance, which is our first systematic attempt to apply advanced scaling techniques to Oric's growing database of operational losses in the insurance business. The chief findings of the report can be summarised as follows:

• Operational losses in insurance do not happen often, and take time to crystallise. Internal losses are thus unlikely to provide a full picture of the spectrum of losses the firm could face. They are a biased sample of the universe of potential risks because they reflect idiosyncratic features. While information on losses experienced by peers can fill important gaps in this knowledge, to deliver unbiased estimates it is vital they are 'comparable' to the losses the firm might experience.
• We find the size of the insurer is strongly associated with the severity and number of operational losses. Particularly, loss amounts are positively correlated with the number of full-time employees, whereas the number of losses is more sensitive to premium income.
• Our estimates suggest increasing the number of full-time employees by 1% leads to an increase of about 0.8% in the predicted loss amount, holding other things constant. The standardised operational loss per event could increase from £27,000 to almost £300,000 in firms with a large headcount, all else equal.
• For a standard deviation rise in premium income, roughly £3.7 billion, the projected number of operational losses per quarter could increase by 24%, keeping other things equal.
• For scaling the frequency of operational losses, the negative binomial regression model was preferred to the more commonly used Poisson model.
• While the goodness-of-fit of our scaling models is often better than those reported by similar studies in the banking sector, a great deal of the variability in observed losses remains unexplained. There is room for improvement in the modelling.

Research into robust measurement and modelling of operational risk is a key priority for Oric. This is particularly true ahead of the implementation of the EU's Solvency II framework in 2012, as we intend to support insurers seeking internal model approval for operational risk - an equivalent to Basel II's advanced measurement approach status. Yet we remain receptive to more qualitative and forward-looking approaches to operational risk. We believe, for example, that sound scenario analysis is paramount for the management of operational risk exposures in insurance. Consequently, we are working closely with insurers and regulatory bodies to identify and disseminate good practice in this area. This reflects the idea that a Pillar II approach to operational risk might sometimes be necessary to better understand its complex nature and heterogeneous causes.

What is Oric?

Oric is the leading consortium for the insurance and investment industry that collects, standardises and reports operational risk loss data. It promotes sound op risk practice and manages a quality-controlled database of loss incidents to support firms' solvency capital calculation and risk management frameworks, with the ultimate goal of making more informed business decisions.

Created in 2005 as a not-for-profit organisation, Oric represented a direct industry-led response to the introduction of the Individual Capital Adequacy Standards regime in the UK. Its members are drawn from the global life and non-life insurance business, though. Figure 1 shows the distribution of gross losses in the Oric database, by business function and business units.

Oric's database

Oric's database comprises operational risk loss data - information on loss amounts and incidents due to failures in people, processes, systems or external events. The lower threshold for operational loss amounts in the Oric database is £10,000.

Importantly, Oric contains in-depth narratives of the circumstances surrounding the incident together with a hierarchical classification system for loss event types and root causes. Our members find this descriptive information essential for better operational risk management within their business. Oric's platform can accommodate global submissions involving different geographical areas and currencies. Firms also report information on 'near misses' as they provide valuable information for the day-to-day management of operational risks and the identification of contingency plans.

Figure 2 shows a risk map combining the frequency and severity of operational losses for each Level 2 event type, whereas table 1 shows the severity and frequency of operational loss events.

Quantitative analysis

We used a sample of 1,388 operational loss events reported to Oric by 18 insurers between 2005 and 2008. The total loss amount was £380 million, and the firms' combined annual premium income represented, on average, £60 billion.

Our research studied robust ways to make losses sourced from a consortium-based database more 'comparable' to a firm's losses. To do this, we considered separately distributions of the loss severity and loss frequency. Our main findings are described below.

Scaling model for the size of losses

To examine the severity of operational losses, we used a well-established econometric approach based on regression techniques where the variable of interest is the loss amount. Losses can be of any size but in reality they are normally truncated at a lower threshold.

Given that an operational loss occurred, we assume its size depends on general as well as firm-specific factors. General factors affect all firms similarly and capture an element of the context in which insurers operate, such as the economic or regulatory environment. Firm-specific, or idiosyncratic, factors might in turn vary across firms and events, and include things such as the firm's size or control environment. It is precisely the failure to adjust for idiosyncratic elements through scaling of external losses that could lead to wrong estimates and flawed conclusions when internal and external losses are merged.

In our model, the general component determines the size of a standardised loss that is then scaled up or down by the firm-specific multiplier. We considered five main types of idiosyncratic exposure metrics:

1. Size of the insurer (measured by premium income and full-time employees, excluding contractors and outsourcers).

2. Recovery amounts.

3. Firm-specific (idiosyncratic) effects.

4. Business line and business function effects.

5. Loss event type effects.

Some of our main findings are:

• The size of the insurer is positively correlated with the size of operational losses. While premium income and full-time employees have a positive impact on loss amounts, only the latter effect is statistically significant on a consistent basis.
• The severity of losses is more sensitive to headcount than to premiums.
• Whenever there was a recovery gross losses tended to be larger, other things equal, which might suggest the existence of certain moral hazard.
• Customer- and claims-related activities are negatively associated with the size of losses, other things equal, while advisory activities are linked to bigger losses.

Scaling model for the number of losses

To scale the frequency of loss events, we focused on econometric models for count outcomes and looked at the Poisson and negative binomial regression models. In this case we considered the following exposure metrics:

1. size of the insurer (measured by premium income and full-time employees, excluding contractors and outsourcers); and

2. proportion of losses related to the life business unit.

In summary, we found that:

• The size of the insurer appears to be strongly and positively correlated with the number of losses. For a standard deviation rise in gross written premium, roughly £3.7 billion, the projected number of losses per quarter increases by 24%.
• The estimated models account for 10% to 30% of the observed variability in the actual number of (quarterly) operational losses.
• The negative binomial regression provides a better fit to the observed frequency data than the Poisson regression model.

The insurer's size has a material effect on the predicted number of losses. For example, insurers at the lower end of the distribution of premiums are predicted to experience more than nine losses only 12 out of 100 times, whereas firms in the upper end of the distribution would experience more than nine losses 30 out of 100 times (see figure 4).

Just the beginning

Operational losses in insurance, particularly relatively severe ones, do not happen often and take time to crystallise. Insurance business involves little trading and the volume of transactions is much smaller than in banking - simply think how many times you or your company transacts with a bank and an insurance company in a given year. Collecting and aggregating historical losses are thus time-consuming and challenging tasks.

The findings discussed above are an important contribution to both company practice and regulatory policy in the op risk landscape, but they only reveal early features of the data that will need to be revisited as Oric's database grows. This will represent a good opportunity to calibrate some of our estimates and pick up additional emerging trends.

Click here to download the article, and view figures and tables