A new US patent for an operational risk analytical system, which uses Bayesian networks, was awarded to IBM in July. Jonathan Rosenoer, currently head of operational risk at Bank of the West in San Francisco, was the lead developer on the project.
In the middle of the last decade, when operational risk modelling was new, a flurry of patents were filed in the US by vendors, academics and financial services firms, for software products and broader analytical approaches. For example, Rosenoer's application was filed in 2008, but was based on an earlier application filed in 2004. However, a great many of the patent applications have not been successful, which makes the approval of this one somewhat unusual.
The new patent is for a combination of a methodology and computer software to aid analysis of operational risks. "This patent makes the link [between risk measurement and risk management] explicit, and tries to make the link quantitative," says Rosenoer. "We make the analysis of risk in a quantitative way, which allows you to do ‘what if' analysis, so you can look at what the return on investment is from making changes. That can be translated to regulatory capital requirements and the P&L. We do that using probability theory and Bayesian networks. It's interesting because people have been looking at Bayesian networks for a while."
Bayesian networks have long been a study of focus for operational risk quants, but success has been elusive. First, experts felt there was not enough operational risk loss data to perform the analysis – although this problem is not as great as it once was. Second, when using a Bayesian network analysis, the complexity of the computations rose exponentially as more risk events, for example, were added to the problem.
But Rosenoer overcame the second problem by baking the Bayesian network into a fixed spreadsheet. The spreadsheet contains a series of decision points that users plug certain data and estimates into – the network then calculates the end impact on risks and costs [see picture for diagram of network].
The overall operational risk system described in the patent requires the collection of specific, bottom-up information for the analysis. Rosenoer notes that while financial services firms don't tend to do much bottom-up data gathering, other industries such as defence and security do, so this patent may have wider applicability beyond the financial services operational risk sector.
The patent says information is then used to construct a probabilistic network based on a single business process, its underlying physical and logical infrastructure and a taxonomy of operational risks. The system then analyses the overall potential exposure to losses in the current environment, or from proposed countermeasures. According to the patent document, the program is able to evaluate the effectiveness of countermeasures and mitigants that can be employed to prevent loss realisation.
Rosenoer worked on the development of this system while an adjunct professor at Carnegie-Mellon University, but it was IBM that allowed him to undertake a proof-of-concept project, and ultimately apply for the patent – the company's reward is to be the assignee on the patent itself.
Rosenoer and the IBM team on the patent took the project to a major bank that was exploring information security issues. Using the program, the team looked at the unexpected and expected losses the bank incurred around information security, and was able to show 94% of the unexpected losses could be attributed to a very small number of unexpected loss event types. Rosenoer says the results were "interesting because the losses weren't around areas IT people might commonly assume were high-risk loss areas, like viruses or data theft".
On another proof-of-concept project, Rosenoer looked a major European bank's plans to consolidate all its internet banking operations in one location, to improve management efficiencies. "Even though they had a really good IT cost-benefit analysis, we were able to show them that the consolidation plans created single points of failure, such that the risks and the unexpected losses could overwhelm the traditional cost-benefit analysis," he says.
"The concepts [contained in the patent] can help banks take a look at risk appetite, and how to calibrate internal risk and risk appetite, and how to better invest time and resources to remediate problems, to get the best return on investment," says Rosenoer. Users will "be able to show regulators and internal stakeholders how to better recalibrate regulatory capital".
However, it seems for now that IBM is unlikely to market a product based on the patent. A spokesperson notes: "We are, unfortunately, not going to comment on this story. At this time, we have not incorporated the patent into a product or application and cannot speculate about plans for future usage."