The Tools of Operational Risk Management

For most risk managers, Operational Risk means just five things.

1. KRI
2. Losses
3. RCSA
4. Incident Management
5. Regulatory Capital

First, and possibly most usefully, it means Key Risk Indicators (KRIs), quantitative metrics that capture variance of Key Performance Indicators (KPIs). These might simple counts of incidents over a time period, like the number of payment exceptions over the month, or perhaps the number of overtime days. Second, Operational Risk means loss capture, how much money in terms of opportunity costs have we incurred over the last period. Third, Risk Control Self Assessment (RCSA) allows multiple organizational actors to estimate qualitatively the risks associated with different businesses, processes, incidents in their domain. Incident Management, is the most underused of the techniques - it focuses on how specific problems can be handled adroitly and efficiently, it's priority is internal training and facilitating workflow and efficient processes. Last and probably least useful, is the move towards capital calculation of an operational risk loss distribution, either simplistically through rough approximations like the Basic Indicator Approach and the Standardized Approach, or more ambitiously (but probably no more accurately) with the Advanced Measurement Approach which actually estimates capital by building a loss distibution model based on loss magnitude and loss frequency distributions.

Moral Hazard and Basel II

One of the fundamental precepts of Basel II was simple and yet inspired. It argued that as banks adopt more sophisticated (and probably superior) approaches to measuring risk, their regulatory capital charges should decrease. So for market risk, capital charges for standardized approaches were greater than those for internal models approaches. For credit risk, internal ratings based approaches required less capital than standardized approaches, and for operational risk, AMA and standardized approaches requre less capital than Basic Indicator approaches. But enter crisis driven regulatory changes. Suddenly capital requirements for market risk within a trading book for internal models approaches are likely to more than triple, as modifications to the basic IMA approach such as stress var, removal of tier 3 capital, and the potential introduction of Incremental Risk Capital dramatically increase the capital required. This breaks the fundamental incentive for institutions to move towards more sophisticated (presumably better) risk models. Of course there's the rub, the regulators no longer trust the models. After the crisis is the reaction against quantification of risk and the mathematical finance that underpins it.

VaR and the significance of Model Risk

More than a decade ago i wrote a paper that compared estimates of VaR from different systems, different methodologies, and data sets. Not surprisingly perhaps there were huge differences in outputs. Why should this be? After these models are trying to estimate the same thing for a given portfolio. The variance in VaR esimates is actually a form of Model Risk, caused from alternative systems, models, data sets, even different users. Unlike most other decision support systems (of which VaR is an example), the variance in VaR estimates can be "added" to the actual VaR estimate to produce a VaR that incorporates not just market volatility but also model risk. Take a look at the paper - can be downloaded from:
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1212&rec=1&srcabs=148750
The main points still apply today i believe and slowly we are starting to understand the role of people and systems in interpreting risk measures. Measures are rife with uncertainty, ambiguity and even equivocality that needs to be appreciated even if it cannot be completely understood.

Buy Side vs Sell Side Market Risk Management: What is the difference?

Buy side institutions, such as pension funds, asset managers, hedge funds and the like have a very different perspective to market risk management. Unlike the sell side such as bank, the priority of the buy side is their performance against some benchmark, by which they can determine the extent to which they add value through either asset or security selection. This is what we term the alpha of the portfolio and estimating alpha is at the heart of evaluating an asset manager’s performance. This can be contrasted with beta – the source of systematic risks, driven by market factors. Hence asset managers on the buy side, use VaR like measures just like their colleagues on the sell side. The difference being that they focus on relative measures of risk so called TaR measures (tracking error at risk) which capture variation of returns relative to some predefined benchmark. The sell side typically focuses on absolute return volatility (traditional VaR measures). Also depending on the type of asset manager (e.g., alternative investors), they often have longer investment horizons, and are more concerned with liquidity risk issues.

Central Counterparty Risk Management - No Silver Bullet

The credit crisis has pushed OTC derivatives and securities financing across the world to move to a centralized counterparty (CCP) approach where a single counterparty assumes the settlement and pre-settlement risks of its members. Recent changes to the Basel II accord, namely capital reductions for transactions with CCPs, are fueling this trend. But beware – there is a catch. Moving to a CCP only makes sense if the CCP has a higher credit rating and superior risk management capabilities than the counterparties it is servicing.

But what does it mean for a CCP to perform effective risk management? I think it boils down to a few basic things that the CCP say an exchange, must get right.

These summarize many of the recommendations of the BIS/IOSCO committee back in 2004. It starts with ensuring that clearing members have adequate financial resources to back up the CCP in the event of crisis -- Credit worthiness criteria for new members is crucial as is the ability of the exchange to monitor clearing member positions and prices in real time The primary tools that the exchange uses are margins, initial margins and variation margins. These function on the principle that the defaulter pays by providing margin periodically usually based on some measure of the pre-settlement risk of their exposure. This might be measured by a VaR calculation over the settlement period. The variation margins are typically dynamically adjusted to capture changing market conditions and positions. Daily margin adjustments to a large extent prevent individual clearing members’ defaults having knock-on effects to the other exchange members. Then Back testing can be used to check just how effective the margin measures are in capturing actual members losses over time. Stress testing can determine the default fund, essentially a capital fund used to protect the exchange in the event of extreme shocks beyond the margins, for example by looking at the impact of the two largest members exposures defaulting simultaneously. Of course there are many other risks faced by a CCP, investment risk (of all those margin payments), custodian risks, operational risks, legal risks and so on.

The question it seems to me is whether there are scale economies in managing the counterparty credit risks (probably true), and whether existing CCPs are able to show competence in managing the residual risks (this is less clear, particularly in the light of potential systemic risk and the potential cost to taxpayers of having to pick up the pieces). What do others think?

What do we know about Liquidity Risk?

Liquidity is often described as the new frontier in academic research on financial markets. From a practitioner perspective, financial crises such as the 1997 Asian crisis and the 2007/2008 global financial crisis, have reminded market participants of the importance of taking into account liquidity as a factor when evaluating investment opportunities and when designing risk management systems. But how much do we really know about Liquidity Risk? How do we measure it? How do we manage it?

Liquidity Risk comes in two species – funding risk and market liquidity risk. Each operates at a different level of analysis, the first is liquidity risk at the level of the institution, how do we ensure that an organization (like a bank) can survive the variable inflows and outflows of cash over a particular time period. Such Funding Risk is really an outgrowth of ALM, and seeks to design the balance sheet to be robust when facing sudden outflows of cash. Techniques like cash flow gaps, cash flow forecasting, use of liquidity reserves, contingency planning, crisis management, etc. are all key components of funding risk.

Market liquidity risk is at the level of individual assets, and measures our inability to convert assets into cash in a reasonable timeframe. There are many ways to model market liquidity. Some extend the traditional VaR approach into an Liquidity VaR model based on the bid ask spread, using either an empirical or a theoretical distribution to derive an add-on to the VaR that incorporates the potential change in spread. Others use regression models trying to relate historical price changes to volume changes (after adjusting for all the usual Fama – French beta factors). A third approach looks at limit order books and tries to infer the embedded liquidity in those reserve prices for off market orders. A final stream of research looks at the optimal trading strategies associate with illiquid assets – in the presence of illiquidity and other transaction costs how do bring down my position in illiquid assets within a certain time period.

Although strictly speaking, not liquidity risk per se, another stream of research is hard at work extending trading pricing models (e.g., CAPM) to incorporate systematic illiquidity as a source of asset returns and typically argues that what is often viewed as a source of alpha, is really poorly measured and understood beta in the form of an illiquidity premium.

On the Value of Historians as Risk Managers?

One of the casualties of the recent crash has been the decline in the credibility of the “quant”. This may be no bad thing. Although I certainly do not advocate giving up on quantitative methods, which are here to stay in a world of derivatives, electronic trading and algorithmic trading, I do believe that other disciplines have much to add to the analysis and management of risk. For example, historians. I think of some of the recent work on the impacts of historical banking crises e.g., a lot of the work done by Kenneth Rogoff. Also I think historians offer a natural antidote to the abstractions of modern risk management. History is about specific outcomes, not about abstract concepts or distributions. History is messy and full of unintended consequences. It is about case studies rather than theory. It is accessible to managers who can project themselves into the characters of history. Good managers add value partly because (like grandparents) they have seen tail events before, and know where the nearest bolthole or watering hole might be found, Its interesting to note that historians rarely think about distributions or theoretical models when trying to hesitantly extrapolate into the future (even if they dare). If they do, they don’t base their assessments on recent events but instead long term cultural, demographic and geopolitical forces which might not move this market one way or another but do fundamentally shift the actors (usually governments and to a lesser extent corporations and markets) into one direction based on assessments of their own best interests. Maybe we should have corporate historians as non executive directors!

Time and Space... And Risk

Have you ever thought that risk management always operates in a context, and that context is determined by our sense of space and our view of time. Consider…Space is a buffer that allows us freedom from worrying about risk. That space might be geographical space – think of the luxury provided to the US of having two large oceans between them and any potential enemy, or it might be any buffer that can mitigate the effect of shocks. Consider any inventory, and how it shields a corporate from shocks in supply or in demand. It may be any shared space of common beliefs that facilitate action. For example, space might be an ideology like a religion or like capitalism. A market is an example of a shared space that limits the things we need to worry about (the risks) precisely because it defines the rules that determine how we interact.

Time is more subtle from a risk perspective. We infer risks from the past and extrapolate into the future. We see actual outcomes historically and think we can infer future distributions of potential events over a particular future time horizon (this is a so called frequentist view of statistics). At the very least we look at the past and infer priorities for future action.

It’s interesting I think to realize that we don’t simply have one horizon in space nor in time. For example, we have short term horizons for say monetary policies and long term horizon for fiscal policies. We have one day horizons for liquid assets and one year horizons for changing our suppliers or our technologies. Governments operate in the space of nation states but they also struggle with markets, and ideologies just as much.

Risk is the unexpected, and the unexpected breeds where differences in perspectives on time and space abound.

Greece and other PIGS

The problem of Greece is really a classical financial crisis. Boom times and cheap money from abroad have encouraged uncontrolled lending in the economy. And of course the other side of foreign capital inflows is a huge budget deficit, which will make it difficult to adopt a Keynesian tax and spend approach to getting out of the crisis. Nor can Greece do much of a monetary solution to its problems, being part of the Euro zone. Budget cuts, higher interest rates, greater unemployment seem inevitable, if politically unacceptable, and of course a political reaction might lead them out of the Euro zone altogether putting in jeopardy the whole European expansion project, as the contagion passes to other PIGS (Portugal, Italy, G. and Spain). Whereto then i wonder? Of course the markets are already forecasting these changes, shorting the euro, jacking up long term interest rates and credit spreads, with the sad effect of making inevitable the very crisis that they predict.

The Economist's View

The Economist presents a smorgasbord of reasons for the recent financial crisis without firmly settling on any one as crucial. Still it's a good overview of the themes and some of the limitations of quantitative risk management.

http://www.economist.com/specialreports/displaystory.cfm?story_id=15474137

While we're at it, they have a good video on the dangers of fat tails and stress correlations...http://ow.ly/16Gel

My feeling is that although the limitations of risk measurement contributed to making a bad situation worse, particularly by giving a false sense of security to people who should have known better, it would be unfair to throw the baby out with the bathwater. Models are like walking sticks, they help you get around, but they don't do the walking for you.

Piano Tuners?

OK -courtesy of Wikipedia here goes one answer
1.There are approximately 5,000,000 people living in Chicago.
2.On average, there are two persons in each household in Chicago.
3.Roughly one household in twenty has a piano that is tuned regularly.
4.Pianos that are tuned regularly are tuned on average about once per year.
5.It takes a piano tuner about two hours to tune a piano, including travel time.
6.Each piano tuner works eight hours in a day, five days in a week, and 50 weeks in a year.
From these assumptions we can compute that the number of piano tunings in a single year in Chicago is

(5,000,000 persons in Chicago) / (2 persons/household) × (1 piano/20 households) × (1 piano tuning per piano per year) = 125,000 piano tunings per year in Chicago.
We can similarly calculate that the average piano tuner performs

(50 weeks/year)×(5 days/week)×(8 hours/day)/(1 piano tuning per 2 hours per piano tuner) = 1000 piano tunings per year per piano tuner.
Dividing gives

(125,000 piano tuning per year in Chicago) / (1000 piano tunings per year per piano tuner) = 125 piano tuners in Chicago.

How many piano tuners in Chicago and other Fermi problems?

What's that to do with risk management? What's a Fermi Problem? According to Wikipedia, a Fermi problem is an "estimation problem designed to teach dimensional analysis, approximation, and the importance of clearly identifying one's assumptions". It is named after physicist Enrico Fermi, such problems typically involve making justified guesses about quantities that seem impossible to compute given limited available information. Long ago when I went to an interview at Cambridge, the professor posed one such Fermi problem to me - how many piano tuners in Chicago? He did not about the answer, He cared about the logic of the process by which i produced the answer. The same's true of risk measurement. Should we be more worried about the collapse of the EU or about an assasinated president? An 200 basis point move in interest rates or a drought in the mid west? One of the themes of this blog will be the need to use heuristics to guesstimate results rather than complex models.

And by the way, the answer is - there are 1523 piano tuners. Just kidding - i made it up!

Welcome...

Welcome to my new blog. Risk Management it seems to me, like much of modern society has become siloed and the domain of specialists focusing on one or other narrow technical issue to the exclusion of the more potentially devastating risks that could derail our world, our economies, our businesses and our lives.
Enjoy!