Account for the difficulties and factors to weigh when building and putting into use models that stress-test operational risk.

FRM® Part II · Operational Risk and Resilience · Integrated Risk Management · FRM2.ORR.7.d

The idea

Stress-testing operational risk is harder than stress-testing market or credit risk. Severe loss events are rare and heavy tailed, so tail data are scarce and unstable. Internal databases are truncated at collection thresholds, losses are recognised years after the event, and external data must be scaled to the firm. Losses are driven mainly by people, process, system and external failures, so their link to macroeconomic variables is weak and shifts as controls change. Scenario workshops depend on expert judgement, which is exposed to anchoring on past losses and other biases. Structured elicitation and challenge are needed. Dependence between loss types matters, because a common cause such as a cyber-attack can hit several business lines at once, and assuming independence understates the total. Backtesting extreme quantiles is not feasible, so validation relies on benchmarking and review. Stress both frequency and severity.

Formulas

Aggregate stress loss of two business lines

aggregate loss = √(a² + b² + 2 × ρ × a × b)

a: the stand-alone stress loss of the first line
b: the stand-alone stress loss of the second line
ρ: the correlation between the two losses

With ρ = 1 the losses simply add. Assuming independence when a common cause such as a cyber-attack hits both lines understates the total.

Expected annual operational loss

expected annual loss = frequency × mean severity

frequency: the expected number of loss events a year
mean severity: the average loss per event

Stress both inputs: the multipliers on frequency and severity combine multiplicatively, so the stressed loss rises by their product.

A practice question

From the question bank, with the reason each wrong option is wrong.

What is the principal data difficulty when calibrating stress-test models for operational risk?

Severe loss events are rare, so tail data are scarce and severity estimates are unstable. - correct
Operational losses are normally distributed, so the tail contributes little and the model has nothing to stress.Why not: Operational losses are heavy tailed, so the tail dominates the capital and stress outcome.
Regulators prohibit the use of external loss data in operational risk stress testing.Why not: External data are used, with scaling, to supplement scarce internal tail observations.
Loss data are plentiful but are recorded in different currencies, which blocks any analysis.Why not: Currency conversion is a minor issue compared with the scarcity of tail events.

Large operational losses are infrequent and heavy tailed, so the tail is thinly observed and parameters are unstable, which forces reliance on scenarios, external data and judgement.

A harder one

In a scenario workshop, experts propose severity estimates that cluster close to the largest loss the bank has already experienced. Which diagnosis and remedy is most appropriate?

Overconfidence from having too much data, remedied by using fewer experts.Why not: The problem is not an excess of data, and fewer experts would reduce challenge and increase the bias.
Survivorship bias, remedied by dropping external loss data and relying on internal events.Why not: Dropping external data removes the information that helps to counter the anchoring on internal history.
Anchoring on past experience, remedied by structured elicitation, challenge and calibration to external losses and near misses. - correct
Selection bias, remedied by weighting recent internal events more heavily.Why not: Weighting recent internal events more heavily strengthens the anchor to the bank's own history.

Estimates that cluster around the bank's own largest loss indicate anchoring and availability bias. Structured elicitation, challenge sessions and external data make scenarios less dependent on past experience.

The hardest tier

An operational risk model has a baseline frequency of 0.4 events per year with a mean severity of USD 5 million, so expected annual loss is USD 2 million. A stress scenario multiplies frequency by 3 and mean severity by 1.5. Assuming the two effects combine multiplicatively, the stressed expected annual loss is closest to:

USD 6.0 millionWhy not: Stresses only the frequency by 3 and leaves severity at the baseline.
USD 9.0 million - correct
USD 7.0 millionWhy not: Adds the two stress effects (3 + 1.5 - 1 = 3.5) instead of multiplying them.
USD 3.0 millionWhy not: Stresses only the severity by 1.5 and leaves frequency at the baseline.

Stressed loss = (0.4 x 3) x (5 x 1.5) = 1.2 x 7.5 = 9.0 million, which is 4.5 times the baseline. Stress both frequency and severity; the effects multiply.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →