Outline the obstacles to reporting operational risk, including the nature of operational loss data, and show how they can be overcome.
The idea
Operational risk reporting faces obstacles that market risk reporting largely avoids. Loss data are scarce in the tail. Severe events are rare, so internal history says little about them, and the cure is to add external data and scenario analysis. Events are under-reported when staff fear blame, so firms need a no-blame culture and reconciliation of loss records to the general ledger. Events are discovered and booked long after they occur, so a trend by accounting date understates recent risk. The occurrence, discovery and booking dates should all be recorded. Self-assessments are subjective and optimistic, so they need independent challenge and comparison with loss data and indicators. Finally, there is no single metric like VaR, so the information is heterogeneous. Common taxonomies and rating scales help. Expect questions that pair an obstacle with its remedy.
A practice question
Which characteristic of operational loss data most limits the statistical analysis of severe events?
- Operational losses are always normally distributed, so the tail is easy to extrapolateWhy not: Wrong on the facts: operational losses are heavily skewed and fat-tailed, not normal.
- Operational losses are recorded daily from observable market pricesWhy not: Confuses operational losses with market risk data; losses are discovered and booked individually, often with delays.
- Severe losses are rare, so tail observations are few - correct
- Every event is captured automatically, which creates an excessive volume of data to analyseWhy not: Reverses the problem: many events are never captured, and severe ones are scarce.
Low-frequency, high-severity events leave internal data thin in the tail, which is why external data and scenarios are needed.
A harder one
A bank's quarterly loss trend, built on the date each loss was booked in the accounts, shows a clear decline over the last four quarters. Why might this be misleading?
- Recent events may not yet be discovered or booked, so latest periods are understated - correct
- Booking dates always overstate losses, since accounts are prepared conservatively and include every possible costWhy not: Assumes a systematic overstatement; the issue is delay in recognition, which leads to understatement of recent periods.
- Losses with later booking dates are not subject to any recoveriesWhy not: Makes up a rule about recoveries; the problem is the time lag between occurrence and booking.
- A decline in booked losses always indicates stronger controls and so is reliableWhy not: Takes the trend at face value, ignoring the lag between occurrence, discovery and booking.
Operational events often come to light and are booked long after they occur. Firms should record occurrence, discovery and booking dates and note the lag when reading trends.
The hardest tier
Business line managers rate all of their controls green in the self-assessment, yet internal loss events in those lines have risen for three consecutive quarters. Which action best addresses the weakness in reporting?
- Accept the green ratings, since managers know their own processes bestWhy not: Ignores the optimism bias of self-assessment and the contradicting loss evidence.
- Drop the loss data from the report because it conflicts with the assessmentsWhy not: Removes objective evidence to preserve the subjective measure, the opposite of validation.
- Have the second line challenge the ratings and compare them with loss data and indicators - correct
- Ask managers to rate their controls again, using the same process and the same rating scales as beforeWhy not: Repeating the same process gives the same biased result; independent challenge is needed.
Self-assessments are subjective and tend to be optimistic. Independent challenge, calibrated scales and cross-checks against objective data bring balance.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →More in Risk Reporting
- Pinpoint what the various organizational committees are responsible for, and show how risk reports ought to be built for each committee or business function.
- Lay out what goes into an operational risk report and set out good practice in reporting such risk.
- Show how exposures should best be reported to regulators and other outside stakeholders.