A letter to the editor

Dear Ms. Davis:

I read with great interest your Editor's letter from the December 2006 issue of OpRisk and Compliance. I am a friend and admirer of Ali Samad-Khan's. I happen to share his and your views regarding the crossroad for operational risk.

By way of background, I am a US actuary who has spent the last five years in ERM for both insurers and organisations in general, including banks. My take on this is the industry has spent a lot of effort on op risk measurement and management, and has made great progress. These efforts have resulted in incredible amounts of fundamental, detailed data. What is needed now is an analytic decision-making framework that can translate this risk information into credible decision support for leadership. For assistance with that framework, I modestly propose one consider checking with the risk analytics professionals who have supported the insurance industry for hundreds of years -- actuaries.

I authored a paper for the 2006 ERM Symposium (www.ermsymposium.org) entitled Applying Actuarial Techniques to Operational Risk Modeling.

Citing from the abstract: "There is a growing need for effective, practical methods of operational risk analysis in all industries. Risk professionals are learning to develop business-unit-level risk distributions, combine those distributions into an aggregate risk model, and use that aggregate risk model to either assign risk charges back to the business units, or to evaluate cost-benefit of mitigation strategies. Operational risk modeling is structurally similar to actuarial risk modeling. The operational risk community will benefit from learning actuarial techniques that can be applied to operational risk modeling... First, the paper will outline how operational risk management is similar to an internal insurance program. Second, it will discuss an internal risk modeling framework that ties together risk exposure, likelihood, severity and correlation into an aggregate loss model. Finally, using the model output, it will present several methods to transparently reward risk mitigation efforts and attribute risk costs to their sources."

To translate for your banking-savvy audience, many of the risks bankers are used to dealing with are hedgeable and liquid. Operational risk, at least thus far, is not. It is an 'incomplete market' risk, just like insurance, specialised lending, real estate and hedge funds. These classes require different techniques than, for example, equity market or interest rate risk.

I am hopeful this contribution helps some of your readership.

Kind regards,

Donald Mango, FCAS, MAAA

Guy Carpenter Instrat, Morristown, New Jersey