|
ORIC International 2016
3
■
Largest losses (
>
£10 million) 2008–2012: 1% of the occurrences, 55% of the
total severity.
■
Smallest losses (£50,000–100,000): 56% of the occurrences, 2% of the total
severity.
Large European bank (2007–2010)
4
■
Largest losses (
>
€10 million): 0.04% of the occurrences, 43% of the severity.
■
Smallest losses (
<
€5,000): 65% of the occurrences, 2.2% of the severity.
These enlightening statistics have important consequences for risk management
priorities: managers and risk managers must focus on the prevention and remediation
of large incidents and not be caught up in the management of daily volatility – those
minor and insignificant events whose frequency and visibility can easily become a
preoccupation and distraction for novice risk managers.
I encourage every institution to run those statistics on their own database if they
have not done so already (and please let me know if you find anything different –
I would be very surprised). The firms that manage to avoid or even reduce one or two
of their largest operational incidents will significantly reduce overall loss severity for
the year.
2
ORX Annual Report, 2018.
3
ORIC International’s own calculations, 2017.
4
Real data from an anonymous source.
Risk Reporting
167
Large accidents and small day-to-day losses are different and so need different
responses. Large events and large near misses are typically known immediately
throughout the firm as they come as a shock. They are, or should be, the object of
root cause analysis and should trigger actions plans. They are also outliers in the
loss distribution and need to be isolated and reported separately, in order not to
contaminate other summary statistics about small losses, as I will detail further.
Small and frequent losses are usually limited in size, especially if they relate to
small processing errors in an operations-type environment. If they are structurally lim-
ited, stable and repetitive, their cost could be passed through to the customers as part of
the cost of services. In any case, they should be known. Additionally, small losses need
to be checked regularly to see whether they were structurally small, limited by design,
because controls kicked in at a higher stage or because exposure is limited. More wor-
risome cases are small losses limited only by sheer luck. These come from uncapped
risks, incidents with small materialization so far but large loss potential in adverse
circumstances. These include consequences of trading errors (when trading limits are
large or exceeded), rogue trading losses (when unnoticed until spiraling down to disas-
ters), gaps in IT security or, generally, any event signaling weaknesses in key controls
mitigating high inherent risks.
N o A v e r a g e s i n R i s k
Asymmetry of operational losses has more than managerial consequences – it impacts
data treatment and reporting as well. The impact is reflected in four words: “no average
in risk.” Averages are meaningful only in very specific circumstances: for symmetrical,
concentrated (low variance) and uniform (without data clusters) distributions; these
are typically Gaussian (normal) distributions, such as weight and height in popula-
tions. For most managers, arithmetic average is the first metric that comes to mind
when they attempt to describe a dataset. However, averages make no sense in the
following cases:
■
For binomial distributions, where data take only two values: e.g., the old statistical
joke “on average, human beings have one breast and one testicle.”
■
For qualitative distributions, where data represent qualities, such as risk ratings:
on average, the color of the rainbow is black.
■
For asymmetric distributions (skewed, fat-tailed): on average, the gain per player
at the National Lottery is 39.7 pence
5
(about 50 cents).
In risk, the frequency of events is binomial: there is an operational event or there
is not, like for credit defaults. For severity, most operational risks are assessed qual-
itatively on a rating scale and losses are heavily fat tailed: concentrated in a few tail
5
Own calculations based on the distributions of prizes by the U.K. National Lottery.
168
RISK MONITORING
Do'stlaringiz bilan baham: |
