Risk measurement and reporting (Example operational risk categories (Fraud…
Risk measurement and reporting
Subjective assessment of risk exposure
The probability and severity of each risk event are both estimated (separately) using a simple scale such as: 5= high, 4= medium-high, 3= medium, 2= medium-low, 1= low/ (A three-point scale might instead be used).
The product of the probability and severity assessments gives a score on a scale of 1 to 25. This provides an assessment of each risk event and allows them to be ranked and prioritised.
The assessment would be carried out with and without possible risk controls
Using a model to assess risk exposure
Distributions need to be assigned to both the probability and severity of the risk event (unless the latter is a fixed amount rather than a random variable, such as for a without-profit term assurance policy).
To quantify the risk simply, the company could define an event (e.g. 25% fall in equity price over a year) and then use historical data to determine a probability distribution for that event. Alternatively, the frequency of the event could be defined and this could be used to determine the loss parameter (e.g. 0.5% probability would indicate an equity fall of 40%)
A decision needs to be made as to whether a stochastic or deterministic model is appropriate
The availability of data to parameterise the model may influence the decision as to which model (if any) is used. This is particularly important when considering rare events.
Combined stress and scenario testing
Reverse stress testing
This is the construction of a severe stress scenario that only just allows the company to be able to continue to fulfil its strategic business plan. Equivalently, it is the scenario which would just be enough to stop them doing so.
The scenario might be financial or non-financial (e.g. external event that causes the company to no longer have access to its major market).
Although it might be an extreme scenario, it must be plausible.
Scenario analysis to evaluate operational risk
Group risks into broad categories. This should involve input from a wide range of senior individuals in the organisation
Develop a plausible adverse scenario of risk events for each group of risks, which is representative of all risks in the group.
Calculate the consequences/ costs of the risk event occurring for each scenario, again involving input from senior staff. Consequences are likely to include redress to those involved, costs of correcting systems and records, regulatory fees and fines and the opportunity costs while the corrections are made.
Calculate the total costs of all risks represented by the scenario.
Example operational risk categories
Loss of key personnel
Mis-selling of financial products
Calculation error in the computer system
Loss of business premises
Loss of company e-mail access
Stress testing is a deterministic method of modelling extreme risk events. It is commonly used to model extreme market movements, but can be applied to other risks (e.g. credit, liquidity).
In relation to market risk, it involves subjecting a portfolio to extreme market movements by radically changing the underlying assumptions and characteristics- including changing asset class correlations and volatilities, which are often observed to increase during extreme market events.
Two types of test are designed to:
identfy 'weak areas' in the portfolio and investigate the effects of localised stress situations by looking at the effect of different combinations of correlations and volatilities
gauge the impact of major market turmoil affecting all model parameters while ensuring consistency between correlations while they are stressed.
Stress scenario: lower equity market- impact on UL investment bonds
The model would need to allow for the impact of the sustained reduction in equity market values on:
income received from fund management charges
persistency of existing bonds
new business volumes
regulatory capital requirements
value of shareholders' interests
probability of any guarantess biting
other economic factors, such as interest rates, inflation and investment returns on other asset classes
Stochastic model to evaluate risk
The variables that give rise to the risk are treated as random variables with probability distributions
The model must be dynamic, with full interactions/ correlations between variables
The model can be run to determine the amount of capital that is needed to (just) avoid ruin with a given probability.
Making a stochastic model more practical to run
Restrict the time horizon that the model projects, e.g. to two years if the risk criterion is expressed as a one-year ruin probability
Limit the number of variables that are modelled stochastically and model the other variables deterministically with scenario testing.
Carry out a number or runs each with a different single stochastic variable, followed by a single deterministic run using all the worst case scenarios together.
1 in 200-year event
Can be misleading to non-experts as it could imply that, if that event has just occurred, it will be another 200 years before they need to worry about the next one.
In practice 'rare' events, such as stock market crashes and extreme weather events. appear to be happening more frequently than the assumed probability indicates
Care also has to be taken because a 1 in 200-year overall combined event is not the same as combining individual 1 in 200-year events (due to less than perfect correlation).
Relationship between overall and individual risk capital requirements
the overall capital requirement is the sum of the individual risk capital requirements.
the overall capital requirement is less than the sum of the individual risk capital requirements (the difference is the diversification benefit). Under certain assumptions the overall capital requirement can be determined as the square root of the sum of the squares of the individual risk capital requirements,
the overall capital requirement is less than the sum of the individual risk capital requirements. The diversification benefit depends on the degree of correlation (possibly negative) between the risks.