FRM Handbook Ch 25: Operational Risk

Book: Financial Risk Manager Handbook Plus Test Bank
Author: Philippe Jorion
ISBN: 978-0-470-90401-5

Market risk has VaR. Credit risk has default models. Operational risk? For years it sat in the corner while banks focused on the risks they could price. Jorion’s Chapter 25 makes the case that this was a mistake. Most firm-specific blowups are not pure market or credit events. They are control failures layered on top of trading losses.

The case history wall of shame

The chapter opens with a sobering list. SocGen in 2008: 4.9 billion euros from a trader hiding unauthorized positions. Barings in 1995: Nick Leeson, bankruptcy. Daiwa, Sumitomo, Allied Irish Bank, NatWest. The pattern repeats. A rogue trader or internal fraud. Losses hidden for months or years. Reputation damage that often exceeds the direct hit.

Perry and de Fontnouvelle found something telling in the data. When operational losses come from external events, stock prices fall roughly one-for-one with the loss. When the cause is internal fraud, the market punishes harder. Investors read fraud as a signal that controls are weak and more losses may follow.

What operational risk actually means

Basel settled on a definition that stuck:

The risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.

That covers employee fraud, system failures, legal risk, and external shocks. It excludes strategic and reputational risk because those are nearly impossible to quantify in a consistent way.

The British Bankers’ Association breaks it down further: people risk, process risk, systems risk, and external risk. Model risk sits in the middle. Wrong valuation models are a people problem (lack of knowledge), a process problem (complex products), and sometimes a systems problem (bad code).

Measuring something messy

Unlike market VaR, operational loss data is sparse and lumpy. Big events are rare. Small events happen all the time but may not get reported. Jorion walks through several approaches:

• Loss distribution approach (LDA): Fit a frequency distribution to internal loss data and a severity distribution to loss amounts. Combine them, often with Monte Carlo simulation.
• Scenario analysis: Expert judgment fills gaps where history is thin.
• Scorecards: Qualitative indicators (audit findings, staff turnover, system downtime) mapped to capital estimates.
• Basic Indicator Approach and Standardized Approach: Basel’s simpler methods based on gross income.
• Advanced Measurement Approach (AMA): Banks use their own internal models, subject to regulatory approval.

The conceptual problems are real. Loss data is biased toward what gets reported. External events may not repeat. And the correlation between operational losses and market downturns is hard to pin down.

Economic capital and the Basel charge

Banks now estimate economic capital for operational risk as a real line item. JPMorgan Chase put it at $8.5 billion in 2009, about 11% of total risk. Deutsche Bank estimated 3.5 billion euros, or 17%. Basel’s operational risk charge adds up to roughly 12% of total capital requirements.

The ORC pushed banks to build formal structures: dedicated operational risk teams, loss databases, and board-level reporting. Whether the capital number is precise is debatable. The discipline of collecting and classifying losses is not.

What stuck with me

Operational risk is the risk type everyone knew mattered but few wanted to fund. Rogue trader stories make headlines. Slow process failures (wrong confirmations, bad data entry, missed settlement deadlines) cause quiet damage every day.

The chapter’s honest message: you will not model this as cleanly as market risk. But ignoring it because it is hard to measure is worse than building imperfect frameworks around it.

Previous: FRM Handbook Ch 24: Managing Credit Risk
Next: FRM Handbook Ch 26: Liquidity Risk