Operational risk events in banks and practices for collecting internal loss data

Abstract

This research study had two distinct objectives. The first objective was to determine in which areas in South African banks the most severe operational risk losses are likely to occur (based on the Basel II seven loss event types and eight business lines). Severity was assessed based on single operational risk events that might have significant monetary values attached to them. The likely frequency of single operational risk events was also assessed. The investigation of the aforementioned research problem was explorative and quantitative of nature, as the researcher made extensive use of survey research in the form of a questionnaire to all registered banks. The second part of the research study’s objective was to assess the range of practices in collecting internal loss data for operational risk purposes as required by Basel II. This part was approached from a qualitative perspective, by benchmarking the research findings against the Basel II text, the researcher’s experience in risk management in banks, the Basel Committee on Banking Supervision’s Sound Practices for the Management and Supervision of Operational Risk, and related literature. The literature review, including reference to certain surveys and studies, focuses on the main concepts of operational risk within banks that are pertinent to the research problem. The literature review also includes several references to the Basel II text and other relevant publications and papers issued by the Basel Committee on Banking Supervision. The research results revealed that respondents in South African banks believed that ‘business disruption and system failures’ is the loss event type that is likely to result in the most severe single operational risk loss. ‘Trading and sales’ scored the same high average rating as ‘business disruption and system failures’ as the business line where the most severe single operational risk loss is likely to occur in South African banks. ‘External fraud’ and ‘execution, delivery and process management’ scored the highest average ratings as the loss event types where the most frequent operational risk losses are likely to occur. Respondents indicated that ‘retail banking’ is the business line where the most frequent single operational risk losses are likely to occur in South African banks. Based on the above-mentioned findings the researcher recommends that these high-risk areas be highlighted to the Bank Supervision Department of the South African Reserve Bank, the boards of directors and senior management of banks in order for them to strengthen banks’ internal controls. The researcher recommends the inclusion of near misses and opportunity cost in operational risk loss databases. Banks should at least capture the date of the discovery of an operational risk event as this represents acceptable practice among the majority of banks. Operational risk losses should be assigned to the multiple business activities in which it occurred on a pro-rata basis. All recoveries of operational risk losses should be processed separately, but associated with the original loss event. Replacement cost is seen as the most appropriate way to capture gross loss amounts for the damage to fixed assets. The researcher encourages the recording of overtime cost for fixing systems failures. Market risk losses due to operational risk events should be treated as market risk losses, while loan-related losses due to operational risk failures should be treated as credit risk losses by banks. The researcher’s view is that banks should set different thresholds for the collection of operational risk losses for its various business units based on each business unit’s operations and nature of business. Banks should, as a starting point, map operational risk events to the Basel II 8x7 matrix. Operational risk losses should be assessed by both legal entity and on a consolidated basis.