A SAFETY NET FOR OPERATIONAL RISK

These days, it would be hard to find a trapeze artist that would perform without a safety net. Whether results of rising insurance costs or performance fear, safety nets are prevalent at circuses. In banking, safety nets can also be found in many places. Not the same ones as in a circus, but nonetheless a critical element of banking. Lately, regulators have begun to focus on operational risk. Simply put, operational risk attempts to capture the risk of loss resulting from inadequate or failed internal processes, people and systems (or from external events). Regulators are focusing more attention on it because it is a critical component of Basel II (so competitors will soon be incorporating it when pricing loans), a sound risk management practice and because (in basic form) it forces banks to think in terms of allocating capital to business lines based on risk. While not perfect by any stretch of the imagination, this new risk management tool gives bankers the ability to increase transparency, better measure risk exposures, more accurately assign capital and begin to benchmark performance. Once bankers begin to collect and analyze the data, incentives can be developed to promote sound risk management. As with other risk management techniques, regulators expect banks to review internal policies, controls and procedures to control operational risk. They are particularly concerned that bankers incorporate stress testing to uncover systemic implications of operational risk decisions the bank is making. Investment in technology and frequent reporting are critical elements of a proper operational risk management approach. It is clearly the hope of regulators that once bankers adopt operational risk management techniques, those banks will have a better framework for making decisions (and ultimately reduce operational risk). One critical aspect of such an approach is that it should also capture so called "tail events." This is a fancy way of bringing statistics into the conversation, but essentially refers to events that occur outside the bank's own historical experience. That sounds simple until you begin to think about how to model a bank with no historical operational loss experience. Scenario and peer group analysis can help, but they may not be accurate enough to add much value. In the alternative, consider the bank that has experienced a high severity operational loss. How long should the bank keep the event in their data pool? What if policies, procedures and controls had been enhanced subsequently to the event? Is it even still relevant to include? Maybe the whole thing sounds a bit too far fetched for a community banker to even worry about. Before tuning out completely, however, note that being able to identify and measure operational risk and potential loss has a number of big upside benefits. Banks can model extreme events and quantify the impact, risk parameters and thresholds can be refined, risk reduction techniques are enhanced, IT investments can be analyzed before they are rolled out, overall costs can be significantly reduced and systemic problems can be managed within board and management tolerances. Finally, understanding how to measure and manage operational risk is important because large banks will be allowed under Basel II to set aside capital based on operational loss experiences and expectations within the supervisory framework. Put another way, if a large bank can prove it has a low chance of risk given its profile, it will be able to offer loans to customers at tighter spreads than competitors. The industry is still just beginning to scratch the surface on measuring and managing operational risk, but as with trapeze, concentration is critical to avoid missing and dropping into the safety net.