Survey Finds More Banks Aware Of Operational Risk

LONDON--The long-awaited survey of operational risk management by the British Bankers Association (BBA), the International Swaps and Derivatives Association (Isda) and Robert Morris Associates, covering 40 of the world's 100 largest banks, was released last week.

The survey concluded that firms are successfully identifying operational risks and adding value by implementing operational risk management systems. Banks that have created operational risk management groups say they have been successful in reducing actual losses. The survey also attempts to put a number on the proportion of capital banks say they allocate to operational risk -- around 30 percent - and it attempts to set down an industry-standard definition of what operational risk is.

But while banks are benefiting from managing operational risk, nearly 70 percent of the respondents to the survey said that they are not satisfied with their approach to measuring the economic return from efforts. Few, if any, firms are using their measure of operational risk capital to drive economic decision making.

In total, 55 banks took part in the study, which was published last week after 14 months of research.

The study covered banks' definitions of operational risk, the management structure and tools they use to tackle and report it, and -- critically -- how they are measuring the benefits of establishing an operational risk management group.

Just over half of the banks responding to the survey either had, or said they were in the process of developing, a methodology for estimating a measure of economic capital for operational risk. "This is a considerable advance on the 27 percent of firms which made a similar statement in a UK survey undertaken in 1997 by the BBA," says Simon Wills, a director in the BBA's markets and developments team. "However, the gap identified then between what most firms want to achieve and what they are able to achieve remains significant."

On the other hand, the report does reveal the growing status of operational risk management as a discipline in itself with its own management structure, tools and processes, much like credit or market risk. Up to now, it has often been assumed that the most common definition is the negative statement that operational risk is "everything other than market and credit risk."

In fact, nearly half of those firms surveyed by PriceWaterhouseCoopers, the consultancy that conducted the research for the study, proved to have agreed a far more positive internal definition of operational risk There was also a considerable degree of consensus on what constitutes operational risk. "Eighty percent of firms agreed on what 80 percent of operational risk is," says Wills.

The study even sets down a definition of operational risk that its authors say reflects a growing consensus in the banking industry: "Operational risk is the risk of direct or indirect loss resulting from failed or inadequate process, systems, people or from external events."

The study identified a clear trend in the industry toward the establishment of a group operational risk function. In an increasing number of banks, this means the establishment of a dedicated operational risk group, although the majority of these units have been established only in the last three years.

The function of these operational risk groups increasingly mirrors the structure adopted by the market and credit risk departments, the study found. However, these units are typically quite small with an average of only nine staff at the centre. Banks report that these staff play a critical role in helping execute the policy framework and supporting the business unit management team.

Overall, the majority of banks seem satisfied with the structure of operational risk management that they have in place. However, an area where many suggested there would be more work in the near future was on the clarification of roles, responsibilities and enforcement, mainly in relation to specialist control functions, such as compliance and human resources or internal audit.

The study also looked at the five major risk management tools being employed to manage operational risk. The tool currently most valued and most used is risk and self assessment, followed, in order, by risk mapping, key risk indicators, risk triggers and a loss database. The tool that most firms are looking to develop next is the internal loss database and models.

The table on page four illustrates the strengths and weaknesses of the five major risk management tools, as highlighted by the study:

Survey respondents were also asked to contribute benchmark capital numbers for operational risk as a percentage of total capital. Only 16 banks choose to respond, but the average response suggested that 53 percent of total capital is allocated to credit risk, 17 percent to market risk and 30 percent to a combined measure of operational and strategic risk. "That mean response does hide a significant distribution which ranged from 10 percent to 65 percent of total capital," adds Wills. "This certainly reflects differences in business mix, business environment and loss experience. It also reflects significant differences in the output of different measurement methodologies … If senior management within banks are receiving a similar range of response internally this would go some way to explaining their current reluctance to use capital to drive behaviour."

One important methodological trend that emerged from the survey was a movement toward risk-based or bottom-up methodologies for measuring operational risk, in preference to top-down or activity-based methodologies. Those firms operating bottom-up or risk-based methodologies reported a higher level of internal satisfaction. Interviews supported the conclusion that risk-based approaches are more effective in encouraging the correct behaviour. There is also a clear bias in terms of planned approach with the development of actuarial models very much leading the way.

"Going forward, if the industry is to overcome the gap between aspiration and achievement in this area it will have to overcome three primary obstacles: data; measurement; and management acceptance," says Wills.

"My own conclusion is that in the medium term, for even the most advanced firms, the primary focus [in operational risk management] will remain a more disciplined application of the traditional tools strengthened by a new analytical rigour."

Tool	Applications	Limitations
• Self Risk Assessment	• Reinforces responsibility and raises awareness within business units • Helps to bring about agreement on the operationsl risks and the requires next steps • Brings together independent views	• Depends on method employed--some are more robust than others and can provide greater insights and buy-in • Some alternatives can be time-consuming • Primarily qualitative
• Risk maps	• Detailed understanding of the operations and the specific operational risk activities	• Tool for lower level staff use--too detailed for senior management • Limited value to senior management • Difficult to keep current • Primarily qualitative
• Risk indicators	• Measure of progress in operational risk management • Objective--non-financial measure of risk • As often as daily updates	• Risk/indicator correlations are unproven • Some operational risks difficult to measure • Uncertainty if the right measures are being used or just the measures where data is available
• Risk triggers	• Predetermine decision or intervention point for management	• Dependent upon the quality of the target setting and the risk indicators used
• Loss event database	• Provides financial-based measures • Tool for empirical analysis • Tool for risk modeling and support for cost/benefit analysis	• Data difficult to collect on a consistent basis