The Tools of Operational Risk Management

For most risk managers, Operational Risk means just five things.

1. KRI
2. Losses
3. RCSA
4. Incident Management
5. Regulatory Capital

First, and possibly most usefully, it means Key Risk Indicators (KRIs), quantitative metrics that capture variance of Key Performance Indicators (KPIs). These might simple counts of incidents over a time period, like the number of payment exceptions over the month, or perhaps the number of overtime days. Second, Operational Risk means loss capture, how much money in terms of opportunity costs have we incurred over the last period. Third, Risk Control Self Assessment (RCSA) allows multiple organizational actors to estimate qualitatively the risks associated with different businesses, processes, incidents in their domain. Incident Management, is the most underused of the techniques - it focuses on how specific problems can be handled adroitly and efficiently, it's priority is internal training and facilitating workflow and efficient processes. Last and probably least useful, is the move towards capital calculation of an operational risk loss distribution, either simplistically through rough approximations like the Basic Indicator Approach and the Standardized Approach, or more ambitiously (but probably no more accurately) with the Advanced Measurement Approach which actually estimates capital by building a loss distibution model based on loss magnitude and loss frequency distributions.

Moral Hazard and Basel II

One of the fundamental precepts of Basel II was simple and yet inspired. It argued that as banks adopt more sophisticated (and probably superior) approaches to measuring risk, their regulatory capital charges should decrease. So for market risk, capital charges for standardized approaches were greater than those for internal models approaches. For credit risk, internal ratings based approaches required less capital than standardized approaches, and for operational risk, AMA and standardized approaches requre less capital than Basic Indicator approaches. But enter crisis driven regulatory changes. Suddenly capital requirements for market risk within a trading book for internal models approaches are likely to more than triple, as modifications to the basic IMA approach such as stress var, removal of tier 3 capital, and the potential introduction of Incremental Risk Capital dramatically increase the capital required. This breaks the fundamental incentive for institutions to move towards more sophisticated (presumably better) risk models. Of course there's the rub, the regulators no longer trust the models. After the crisis is the reaction against quantification of risk and the mathematical finance that underpins it.

VaR and the significance of Model Risk

More than a decade ago i wrote a paper that compared estimates of VaR from different systems, different methodologies, and data sets. Not surprisingly perhaps there were huge differences in outputs. Why should this be? After these models are trying to estimate the same thing for a given portfolio. The variance in VaR esimates is actually a form of Model Risk, caused from alternative systems, models, data sets, even different users. Unlike most other decision support systems (of which VaR is an example), the variance in VaR estimates can be "added" to the actual VaR estimate to produce a VaR that incorporates not just market volatility but also model risk. Take a look at the paper - can be downloaded from:
http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1212&rec=1&srcabs=148750
The main points still apply today i believe and slowly we are starting to understand the role of people and systems in interpreting risk measures. Measures are rife with uncertainty, ambiguity and even equivocality that needs to be appreciated even if it cannot be completely understood.

Buy Side vs Sell Side Market Risk Management: What is the difference?

Buy side institutions, such as pension funds, asset managers, hedge funds and the like have a very different perspective to market risk management. Unlike the sell side such as bank, the priority of the buy side is their performance against some benchmark, by which they can determine the extent to which they add value through either asset or security selection. This is what we term the alpha of the portfolio and estimating alpha is at the heart of evaluating an asset manager’s performance. This can be contrasted with beta – the source of systematic risks, driven by market factors. Hence asset managers on the buy side, use VaR like measures just like their colleagues on the sell side. The difference being that they focus on relative measures of risk so called TaR measures (tracking error at risk) which capture variation of returns relative to some predefined benchmark. The sell side typically focuses on absolute return volatility (traditional VaR measures). Also depending on the type of asset manager (e.g., alternative investors), they often have longer investment horizons, and are more concerned with liquidity risk issues.

Central Counterparty Risk Management - No Silver Bullet

The credit crisis has pushed OTC derivatives and securities financing across the world to move to a centralized counterparty (CCP) approach where a single counterparty assumes the settlement and pre-settlement risks of its members. Recent changes to the Basel II accord, namely capital reductions for transactions with CCPs, are fueling this trend. But beware – there is a catch. Moving to a CCP only makes sense if the CCP has a higher credit rating and superior risk management capabilities than the counterparties it is servicing.

But what does it mean for a CCP to perform effective risk management? I think it boils down to a few basic things that the CCP say an exchange, must get right.

These summarize many of the recommendations of the BIS/IOSCO committee back in 2004. It starts with ensuring that clearing members have adequate financial resources to back up the CCP in the event of crisis -- Credit worthiness criteria for new members is crucial as is the ability of the exchange to monitor clearing member positions and prices in real time The primary tools that the exchange uses are margins, initial margins and variation margins. These function on the principle that the defaulter pays by providing margin periodically usually based on some measure of the pre-settlement risk of their exposure. This might be measured by a VaR calculation over the settlement period. The variation margins are typically dynamically adjusted to capture changing market conditions and positions. Daily margin adjustments to a large extent prevent individual clearing members’ defaults having knock-on effects to the other exchange members. Then Back testing can be used to check just how effective the margin measures are in capturing actual members losses over time. Stress testing can determine the default fund, essentially a capital fund used to protect the exchange in the event of extreme shocks beyond the margins, for example by looking at the impact of the two largest members exposures defaulting simultaneously. Of course there are many other risks faced by a CCP, investment risk (of all those margin payments), custodian risks, operational risks, legal risks and so on.

The question it seems to me is whether there are scale economies in managing the counterparty credit risks (probably true), and whether existing CCPs are able to show competence in managing the residual risks (this is less clear, particularly in the light of potential systemic risk and the potential cost to taxpayers of having to pick up the pieces). What do others think?

What do we know about Liquidity Risk?

Liquidity is often described as the new frontier in academic research on financial markets. From a practitioner perspective, financial crises such as the 1997 Asian crisis and the 2007/2008 global financial crisis, have reminded market participants of the importance of taking into account liquidity as a factor when evaluating investment opportunities and when designing risk management systems. But how much do we really know about Liquidity Risk? How do we measure it? How do we manage it?

Liquidity Risk comes in two species – funding risk and market liquidity risk. Each operates at a different level of analysis, the first is liquidity risk at the level of the institution, how do we ensure that an organization (like a bank) can survive the variable inflows and outflows of cash over a particular time period. Such Funding Risk is really an outgrowth of ALM, and seeks to design the balance sheet to be robust when facing sudden outflows of cash. Techniques like cash flow gaps, cash flow forecasting, use of liquidity reserves, contingency planning, crisis management, etc. are all key components of funding risk.

Market liquidity risk is at the level of individual assets, and measures our inability to convert assets into cash in a reasonable timeframe. There are many ways to model market liquidity. Some extend the traditional VaR approach into an Liquidity VaR model based on the bid ask spread, using either an empirical or a theoretical distribution to derive an add-on to the VaR that incorporates the potential change in spread. Others use regression models trying to relate historical price changes to volume changes (after adjusting for all the usual Fama – French beta factors). A third approach looks at limit order books and tries to infer the embedded liquidity in those reserve prices for off market orders. A final stream of research looks at the optimal trading strategies associate with illiquid assets – in the presence of illiquidity and other transaction costs how do bring down my position in illiquid assets within a certain time period.

Although strictly speaking, not liquidity risk per se, another stream of research is hard at work extending trading pricing models (e.g., CAPM) to incorporate systematic illiquidity as a source of asset returns and typically argues that what is often viewed as a source of alpha, is really poorly measured and understood beta in the form of an illiquidity premium.

On the Value of Historians as Risk Managers?

One of the casualties of the recent crash has been the decline in the credibility of the “quant”. This may be no bad thing. Although I certainly do not advocate giving up on quantitative methods, which are here to stay in a world of derivatives, electronic trading and algorithmic trading, I do believe that other disciplines have much to add to the analysis and management of risk. For example, historians. I think of some of the recent work on the impacts of historical banking crises e.g., a lot of the work done by Kenneth Rogoff. Also I think historians offer a natural antidote to the abstractions of modern risk management. History is about specific outcomes, not about abstract concepts or distributions. History is messy and full of unintended consequences. It is about case studies rather than theory. It is accessible to managers who can project themselves into the characters of history. Good managers add value partly because (like grandparents) they have seen tail events before, and know where the nearest bolthole or watering hole might be found, Its interesting to note that historians rarely think about distributions or theoretical models when trying to hesitantly extrapolate into the future (even if they dare). If they do, they don’t base their assessments on recent events but instead long term cultural, demographic and geopolitical forces which might not move this market one way or another but do fundamentally shift the actors (usually governments and to a lesser extent corporations and markets) into one direction based on assessments of their own best interests. Maybe we should have corporate historians as non executive directors!