Applying existing scenario techniques to the quantification of emerging operational risks

Michael Grimwade

Abstract

It is emerging operational risks that are habitually cited as keeping executives awake at night. These risks are dynamic and inspire the fear of the unknown, and it is precisely these characteristics that make their quantification so challenging. While there are no perfect solutions, this paper sets out techniques for

• identifying systematically emerging threats, their timescales, and interrelation- ships (eg, feedback loops and domino effects);
• quantifying operational risks through structured scenario analysis processes that analyze the drivers of impacts and likelihoods; and
• validating the outputs of scenario analysis through backtesting against internal and external data sources.

The paper then applies these techniques to three categories of emerging operational risks, providing:

• an explanation of the mechanism of how economic shocks lead to operational risk losses through a real options model;
• cyber and IT risk taxonomies, aligned to Basel II, based on analysis of industry events; and
• case studies illustrating how some emerging risks come in waves, peaking and then declining, leading to their potential overestimation, while others are yet to result in losses, leading to their potential underestimation (the techniques set out early in the paper are modified to mitigate these different challenges).