Background

Nowadays, risk management becomes an important module of every industry. However, its magnitude in banking industry is much more obvious because, usually, the profit of every bank is directly related to the amount of risk it takes. It means that the more risk it takes, the more profit it can earn. However, this huge amount of risk should be carefully managed in order to reduce the possibility of loss or bankruptcy. Therefore, the Bank for International Settlements (BIS) has founded the Basel Committee on Banking Supervision (hereafter Basel Committee), which has developed several documents containing basic standards, guidelines, and consultative papers for risk management and banking supervision. One of the most recent and well-known documents of BIS is Basel II accord. It includes the most popular and trusted guidelines in banking supervision and risk management, which are generally acquiesced by central banks all over the world including the Central Bank of Iran.a

Basel II accord has classified major banking risks into three different types: credit risk, market risk, and operational risk. Credit risk is an investor's risk of loss arising from a borrower who does not make payments as promised. Market risk is the risk that the value of a portfolio, either an investment portfolio or a trading portfolio, will decrease due to the change in value of the market risk factors. The four standard market risk factors are stock prices, interest rates, foreign exchange rates, and commodity prices. Operational risk, which is the main focus of this study based on Basel II accord, has been defined as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. This definition includes legal risk, but excludes strategic and reputational risk (Basel Committee on Banking Supervision 2006).

In the last two decades, a significant number of financial institutions have experienced loss or bankruptcy due to the mismanagement of operational risks. Some famous instances are as follows: First, Societe Generale Bank, alleged fraud by a trader, lost 4.9 billion € in 2008. Second, Former currency trader was accused of hiding US $691 million in losses at Allfirst Bank of Baltimore in 2002. Third, UK's Barings Bank collapsed after trader Nick Leeson lost £860 million (US $1.28 billion at the time) on futures trades in 1995 (BBC News 2008). For more related cases, go to Gallati (2003). In the case of Iran, most of the banks have been state-owned up to a few years ago, and the government has prevented them from insolvency. However, emerging of private banks, along with service development of both private and state-owned banks in recent years, led in to a more competitive market, which encounters banks with more complex operational risks that need to be considered. Since the operational risk has greatly affected a large number of banks globally, as seen in non-Iranian cases above, and due to the lack of attention to the subject in Iranian banks and legislators, a new trend of research in this area is indispensable.

Measuring is one of the main steps in operational risk management. Basel II accord introduces three different ways for measuring operational risk in financial institution: the first method is Basic Indicator Approach (BIA), which calculates Capital-at-Risk (CaR) as a fraction of the bank's gross income; the second proposed method is called Standardized Approach (SA), which divides the institution into eight specified business lines and, in each one, computes the business line-specific CaRs as a percentage of their relevant gross incomes then adds these eight CaRs to obtain the bank's total CaR; and finally, Basel II suggests Advanced Measurement Approaches (AMA) in which banks are permitted to develop their own methodology to assess yearly operational risk exposure within a confidence interval of 99.9% or more. The first two methods are easy to apply but undesirable among banks because, as a consequence of their conceptual simplicity, BIA and SA models do not provide any insights into drivers of ethods in Iran, refer to Karafarin Bank (2009) and Erfanian and Sharbatoghli (2006). However, the third category of methods (i.e., AMA) has not been implemented in any bank in Iran, which is much more sensitive to risk; therefore, it is recommended by Basel Committee and widely applied by international banks.

Among the eligible variants of AMA, over the last few years, a statistical model widely used in the insurance sector and often referred to as the Loss Distribution Approach (LDA) has become a standard in the banking industry around the world (for two examples see Chapelle et al. (2007) and Aue and Kalkbrener (2006)). Anyway, to our knowledge, it is not employed by any bank in Iran. When applying the LDA in Iranian banking circumstance, some issues arise: First, operational loss events have not been recorded thoroughly, so available loss data are rare and inferences of their related distributions need special concern. Second, because there is no bankruptcy reported, there are no data available for extreme losses. Third, the previous methods implemented in Iran (BIA and SA) do not explicitly account for dependence structure of risks. Therefore, the objective of this study is to present the comprehensive LDA framework for the measurement of operational risk of banks in Iran, whereas we try to provide recommendations to resolve Iran's specific issues by utilizing available statistical and mathematical techniques.

The methodology of this study has been applied in Karafarin Bank, which is an Iranian private bank. For more information about Karafarin Bank, visit its home page (Karafarin Bank 2010).

This paper is organized as follows: in ‘Methodology’, a comprehensive methodology of measuring operational risk is discussed; then in ‘Empirical analysis’, we apply the methodology to loss data of Karafarin Bank, and results are reported. Finally, concluding remarks will be presented in the last section.

Case description

Methodology

The Basel Committee encourages banks to use Advanced Measurement Approaches for modeling operational risk. Although AMA includes a wide range of proprietary models, the most popular one is by far the Loss Distribution Approach (Chapelle et al. 2007). LDA is a parametric technique that estimates two separate distributions for frequency and severity of operational losses and then combines them through n-convolutionb (see Frachot et al. (2001) for details). However, as mentioned before, the basic LDA encounters some problems when applied to Iranian banks, which suffer from loss data unavailability, unreported large losses, and lack of attention to dependence structure of operational risks.

The Basel Committee has provided a basic framework that banks should use to classify their operational loss data. This framework includes seven operational risk event categories and eight banking business lines. In order to comply with Basel II, it is necessary to consider this classification as presented in Table 1. For more definitions and instances about the categories, see ‘Annexes 8 and 9’ of Basel Committee on Banking Supervision (2006).

Table 1 Business Line Event Type mapping according to Basel II framework

LDA should be applied in all cells of Table 1 separately, and then, the resulting loss distributions will be integrated considering the dependence structure. In order to keep the integrity of the methodology in the following sections (‘Frequency distribution’, ‘Severity distribution’, ‘Loss distribution for a specified risk category’, and ‘Loss distribution for bank as a whole’), the comprehensive methodology of measuring operational risk in a commercial bank will be described as presented in Figure 1.

Figure 1
figure 1

Methodology flowchart of measuring operational risk in a commercial bank.

Frequency distribution

In LDA, occurrence of operational losses of a specified bank is modeled by a so-called frequency distribution. This distribution is discrete and, for short periods of time, usually estimated either by Poisson or by negative binomial distributions (Aue and Kalkbrener 2006). The difference between these two distributions is that the intensity parameter is deterministic in the first case and stochastic in the second. More precisely, if the intensity of a Poisson process follows a gamma distribution, the negative binomial distribution arises (Embrechts et al. 2003).

In this study, a score-based approach (see Panjer (2006) and Klugman et al. (2004)) has been used for selecting between the Poisson and negative binomial distributions. In order to implement the score-based approach, three different statistic hypothesis tests have been utilized including Cramer-von Mises (Anderson 1962), Kolmogorov-Smirnov (Stephens 1974), and likelihood ratio (McGee 2002).

Severity distribution

Modeling severity distribution for economical impact of operational losses is not as straightforward as modeling frequency of losses. Some studies like Chapelle et al. (2007) and de Fontnouvelle et al. (2004) indicate that classical distributions are unable to fit the entire range of observations for modeling the severity of operational losses. Hence, as in Alexander (2003), Chapelle et al. (2007), de Fontnouvelle et al. (2004), and King (2001), in this study, the discrimination between ordinary (i.e., high frequency/low impact) and large (i.e., low frequency/high impact) losses has been considered, as presented in Figure 2. The ‘ordinary distribution’ includes all losses in a limited range denoted L; U (L being the collection threshold used by the bank), while the ‘extreme distribution’ generates all the losses above the cut-off threshold U. The severity distribution will then be defined as a mixture of the corresponding mutually exclusive distributions.

Figure 2
figure 2

Schematic diagram discriminating between ordinary and large losses.

For modeling ordinary losses, distribution such as the exponential, Weibull, gamma, or lognormal distribution that is strictly positive continuous distribution can be employed. More precisely, let f(x;θ) be the chosen parametric density function, where θ denotes the vector of parameters, and let F(x;θ) be the cumulative distribution function (cdf) associated with f(x;θ). Then, the density function f*(x;θ) of the losses in [L; U] can be expressed as

f * x ; θ = f x ; θ F U ; θ F L ; θ
((1))

The corresponding log-likelihood function is:

x ; θ = i = 1 N ln f i x i ; θ F U ; θ F L ; θ
((2))

where x 1 , , x N is the sample of observed ordinary losses. It should be maximized in order to be estimated (Chapelle et al. 2007).

In Iranian banks, due to lack of recorded operational loss data, modeling distribution of large losses is not as clear-cut as ordinary losses because there are not enough observations available for severe operational losses (Momen 2008). For such samples, classical maximum likelihood methods yield inappropriate distributions for estimating the occurrence probability of exceptional losses because the resulting distributions are not sufficiently heavy tailed. To resolve this issue, a procedure developed by Chapelle et al. (2007) has been used. This procedure is built upon the results of Balkema and de Haan (1974) and Pickands (1975), which state that, for a broad class of distributions, the values of the random variables above a sufficiently high threshold U follow a generalized Pareto distribution (GPD) with parameters ξ (shape index or tail parameter), β (the scale index), and U (the location index). The GPD can thus be thought of as the conditional distribution of X given X > U (Embrechts et al. 1997).

As indicated before, another problem with operational risk modeling in Iranian banks is that large catastrophic losses like bankruptcy of a bank have not been reported. Hence, tail of the severity distribution cannot be modeled precisely. This problem is somehow specific to Iran and other developing countries. North American and European banks have access to operational risk databases like Algorithmics® and ORX®. Since Iranian banks do not have access to such databases, the well-known method of scaling external data (see Shih et al. (2000) for a review and refer to Aue and Kalkbrener (2006), Chapelle et al. (2007), and Moscadelli (2005) for some applications) is not applicable to them. Therefore, we used a scenario analysis approach to enrich operational loss database with catastrophic losses (and ordinary losses if needed).

In scenario analysis approach, banking experts are asked to provide following information about operational risks:

Scenario configuration (which event or combination of events)

Impact assessment (how much can it cost)

Frequency of occurrences (how many times can it happen)

Loss distribution for a specified risk category

In LDA, the loss for the business line i and the event type j between times t and t + τ is:

ϑ i , j = n = 1 N i , j ξ n i , j
((3))

where i and j are indices of Table 1, and ξ i , j is the random variable that represents the amount of one loss event for the business line i and the event type j (which follows severity distribution). The loss severity distribution of ξ i , j is denoted by Fi,j. N(i,j) is a random variable indicating the number of events between times t and t + τ , which has a probability function pi,j (frequency distribution).

Let G i , j be the distribution of ϑ i , j . G i , j is then a compound distribution:

G i , j x = { n = 1 p i , j n F i , j n * x , x > 0 p i , j 0 , x = 0
((4))

where * is the convolution operator on distribution functions, and Fn* is the n-fold convolution of F with itself (Frachot et al. 2001).

In general, there is no analytical expression of the compound distribution (Feller 1968; Frachot et al. 2001). Therefore, computing the loss distribution requires using a numerical algorithm. The most widely used algorithms are the Monte Carlo method (Fishman 1996; Panjer 2006), Panjer's recursive approach (Panjer 1981), and the inverse of the characteristic function (Heckman and Meyers 1983; Robertson 1992).

In this study, the Monte Carlo method is used for computing the loss distribution for each cell in Table 1 (Fishman 1996). This method includes the following steps:

  1. 1.

    One random draw from the frequency distribution is taken (n).

  2. 2.

    n random draws from the severity distribution are taken (for example: first draw US $5,000,000, second draw US $1,200,000, …, the n th draw US $12,500,000).

  3. 3.

    The US dollar value of losses is summed (for example: US $45,000,000 result is one observation in aggregate loss distribution).

  4. 4.

    The above steps should be repeated m times (for example: 1,000,000 times).

These m observations are used to model the loss distribution for an individual cell of Table 1.

Loss distribution for bank as a whole

The methodology outlined in the sections ‘Frequency distribution’, ‘Severity distribution’, and ‘Loss distribution for a specified risk category’ is applicable to a specified category of operational loss data (i.e., one cell of Table 1 which is calculated in one loop of Figure 1.) However, in order to comply with Basel II, one should consider all 56 categories of risks according to Table 1. For this purpose, Basel Committee recommends calculating the total capital charge of the bank by simple summation of the capital charges of all 56 risk categories; by this proposal, Basel Committee has assumed a perfect positive dependence between the risks implicitly. In spite of this, banks are interested in considering the dependence structure by other appropriate techniques because the basic assumption of Basel Committee will result in large requirements of capital; therefore, banks will have an unacceptable high level of opportunity costs (Aue and Kalkbrener 2006; Chapelle et al. 2007; Moscadelli 2005). Traditionally, correlation is used to model dependence between variables (risk categories here), but recent studies show the superiority of copula over correlation for modeling dependence due to higher flexibility of the copula compared to conventional correlation. Another important reason to choose copula instead of correlation is that the latter is unable to model dependence between extreme events (Kole et al. 2007), which are the main concern in operational risk modeling. Therefore, in this study, the dependence among aggregate losses will be modeled by copulas in order to combine the marginal distributions of different risk categories into a single joint distribution. A brief definition of copula follows:

Copula. A copula is a multivariate joint distribution defined on the n-dimensional unit cube [0,1]n in a way that every marginal distribution is uniform in the interval [0,1]. Specifically, C : 0 , 1 n 0.1 is an n-dimensional copula (briefly, n-copula) if

  1. 1.
    C u = 0

    whenever u 0 , 1 n has at least one component equal to 0.

  2. 2.
    C u = u i

    whenever u 0 , 1 n has all the components equal to 1 except the i th one, which is equal to u i.

  3. 3.
    C u

    is n-increasing, i.e., for each hyper rectangle

  4. 4.
    B = x i = 1 n x i , y i 0 , 1 n : V C B : = z x i = 1 n x i , y i 1 N z C z 0
    ((5))
  1. 5.

    where N z = card k / z k = x k . V C B is the so-called C-volume of B (for more details see Cherubini et al. (2004), Genest and McKay (1986), Nelsen (1999), and Panjer (2006)).

There are various types of copulas in the literature. In this study, we decide to employ a multivariate copula, which is more applicable in practice; the traditional candidate for modeling dependence is Gaussian copula (for application of this copula in a real bank see Aue and Kalkbrener (2006)). However, due to the following four reasons, we preferred a multidimensional t-copula over it: First, operational loss distributions share some similar characteristics with asset portfolio (like skewness, heavy tails, and tail dependence); according to the findings of Kole et al. (2007) for asset portfolio, their procedure provides clear evidence against Gaussian copula but does not reject the t-copula. Second, t-copula assigns more probability to tail events than the Gaussian copula, which makes it appropriate in operational risk modeling where extreme losses are a subject of more concern for banks. Third, t-copula exhibits tail dependence, which is appealing in operational risk modeling. And finally, t-copula is capable of modeling dependence in the tail without giving up the flexibility to model dependence in the center (Kole et al. 2007); it means that this copula fits well in the entire range of observations. However, to our knowledge, the usage of this copula in a real bank has not been reported anywhere in the world.

t-copula. Multivariate t-copula (MTC) is defined as follows:

T R , υ u 1 , u 2 , , u n = t R , υ t υ 1 u 1 , t υ 1 u 2 , , t υ 1 u n
((6))

where R is a symmetric, positive definite matrix with diag R = 1 , 1 , , 1 T , and t R , υ is the standardized multivariate Student's t distribution with correlation matrix R and υ degrees of freedom. t υ 1 is the inverse of the univariate cdf of Student's t distribution with υ degrees of freedom. Usi, it turns out that the copula density for the MTC is

C R , υ u 1 , u 2 , , u n = R 1 2 Γ Γ + n 2 Γ υ 2 Γ υ 2 Γ υ + 1 2 n 1 + 1 υ ς T R 1 ς υ + n 2 j = 1 n 1 + ς j 2 υ υ + 1 2
((7))

where ς j = t υ 1 u j (Cherubini et al. 2004). Using t-copula, we can now calculate the Capital-at-Risk of the bank.

Capital-at-Risk. With LDA, the capital charge (or the Capital-at-Risk) is a Value-at-Risk measure of risk, which is defined as follows:

Given some confidence level α 0 , 1 , the Value-at-Risk (VaR) at the confidence level α is given by the smallest number l in a way that the probability that the loss L exceeds l is not larger than (1 − α) (McNeil et al. 2005):

VaR a = inf l R : P L > l 1 a = inf l R : F L a
((8))

The left equality is a definition of VaR. The right equality assumes an underlying probability distribution, which makes it true only for the parametric VaR. The left equality means that we are 100(1 − α)% confident that the loss in the related period will not be larger than the VaR.

Discussion and evaluation

Empirical analysis

Operational loss data of Karafarin Bank have been identified and categorized according to the Basel II Event Types (ETs) as follows:

  1. 1.

    Internal fraud

  2. 2.

    External fraud

  3. 3.

    Employment practices and workplace safety

  4. 4.

    Clients, products, and business practices

  5. 5.

    Damage to physical assets

  6. 6.

    Business disruption and system failures

  7. 7.

    Execution, delivery, and process management

For more detailed classification, definition, and examples of these risk categories, please see ‘Annex 9’ of Basel Committee on Banking Supervision (2006). Related data of each of the above risk categories have been gathered in eight Basel II defined Business Lines (BLs) as follows:

  1. 1.

    Corporate finance

  2. 2.

    Trading and sales

  3. 3.

    Retail banking

  4. 4.

    Commercial banking

  5. 5.

    Payment and settlement

  6. 6.

    Agency services

  7. 7.

    Asset management

  8. 8.

    Retail brokerage

Please see ‘Annex 8’ of Basel Committee on Banking Supervision (2006) for more information about activity groups and principle for business line mapping.

A combination of seven ETs and eight BLs provides a 56-cell matrix (Business Line Event Type) as presented in Table 1. Data of this matrix are used for all operational risk calculations.

Karafarin Bank, in line with other banks (for example, Deutsche Bank (Aue and Kalkbrener 2006), National Bank of Belgium (Chapelle et al. 2007), and Bank of Italy (Moscadelli 2005)) considers its operational loss data as confidential; however, main operational risk events related to this study are software and hardware failures, disruption in telecommunication, data entry error, accounting error, collateral management failure, inaccurate reports, incomplete legal documents, unauthorized access to accounts, damage to client assets, and vendor disputes. The methodology mentioned in the section ‘Case description’ (Figure 1) was applied to Karafarin Bank data.

All data in 56 loss categories have been considered and collected, but due to the scarcity of data, only four cells were used for modeling in this study, as presented in Table 2. Distribution of loss data in the four concerning cells is presented in Table 3. For the sake of confidentiality, all data have been multiplied by a constant scalar and then used in calculations.

Table 2 BLET table for Karafarin bank
Table 3 Distribution of loss data

In order to estimate frequency distributions, we employed the methodology presented in the section ‘Frequency distribution’. Three different goodness-of-fit tests were used including Cramer-von Mises, Kolmogorov-Smirnov, and log-likelihood. In order to provide a reliable selection, these three tests were used together, while Aue and Kalkbrener (2006) used one. Another point here is that weighted sum method (Triantaphyllou 2002) was employed in order to guarantee the convergence of several individual goodness-of-fit tests to one best-fitted distribution (see Momen (2008) for details). Analysis of this study like (Chapelle et al. 2007), approved the selection of negative binomial distribution for all risk categories, which was confirmed by dispersion analysis (i.e., variance of frequencies are greater than their mean) as shown in Table 4.

Table 4 Frequency distribution results

With the intention of estimating severity distribution, the methodology presented in the section ‘Severity distribution’ was followed. By using this method, the first barrier for Iranian banks in measuring operational risk (i.e., the effect of insufficient recorded losses) was resolved.

We tested the fitness of exponential, Weibull, lognormal, gamma, extreme value, generalized extreme value, and generalized Pareto distributions for modeling of economic impact of ordinary operational losses. In order to select among the above mentioned distributions, Anderson-Darling, Cramer-von Mises, Kolmogorov-Smirnov, and log-likelihood goodness-of-fit tests were employed. This diversification among distributions and tests increases the reliability of distribution selection procedure.

In the present work, in order to resolve the second problem of Iranian banks in calculating operational risk (i.e., unreported immense losses), additional examples and descriptions of real large loss events, as recommended by Basel Committee, have been provided (Momen 2008). Therefore, bank experts have been asked to provide scenarios about frequency and severity of large losses in 1 year. These scenarios have been summarized in spreadsheets, like Table 5, and added to the database of operational losses of the bank in order to enrich it with enough large losses.

Table 5 Scenario analysis summary table

This type of scenario analysis is more explainable to the management and adds benefits of expert ideas to the quantitative calculations, while previous works in Iran like Erfanian and Sharbatoghli (2006) has missed experts' ideas and only relayed on data of gross income. Tables 6, 7, 8, and 9 show the results of fitting severity distribution for Karafarin Bank's data. Aggregate operational losses for each cell are estimated using Monte Carlo simulation, and approximate distributions are presented in Table 10.

Table 6 Severity distribution results for cell (1,1)
Table 7 Severity distribution results for cell (1,2)
Table 8 Severity distribution results for cell (2,1)
Table 9 Severity distribution results for cell (2,2)
Table 10 Aggregated distributions

According to the section ‘Loss distribution for bank as a whole’, for the aim of integrating different aggregate distributions, we decided to model operational loss of banks using t-copula, which solves the third problem for Iranian banks (i.e., missed dependence structure of risk categories). To our knowledge, this copula is globally new in application of operational risk with data of real bank in the published works.

According to the definition of Capital-at-Risk and the confidentiality factor (multiplied by all raw loss data), Capital-at-Risk of Karafarin Bank modeled with t-copula and 99.9% confidence level is equal to (Momen 2008):

CaR = 746286286124 7.4 × 10 11 IRR

c

This means that with a 99.9% of confidence, the operational loss of Karafarin Bank will not be greater than 7.4 × 10 11 IRR . This result quite satisfied the management of Karafarin Bank because it is in tune with their presumptions of operational risk, and it is reasonable compared to the scale of market and credit risk exposures. Moreover, as presented in Table 11, it requires much less capital compared to other approaches that are provided by Basel II. Therefore, by using the present model, banks have the opportunity to use the extra unallocated capital for creating further income within a controlled level of operational risk.

Table 11 CaR in different methodologies and their capital requirements (IRR)

Conclusions

In this paper, a comprehensive methodology of operational risk assessment was addressed. To our knowledge, there are no published works to model operational risk of an Iranian commercial bank appropriately; the main reason is the existence of some inconveniences to measure operational risk using available methods. Therefore, our main objective was to propose a practical framework for Iranian bankers. In this regard, we presented the most important issues facing operational risk analysts and suggested solutions for them through an all-inclusive methodology. The first issue was lack of recorded operational loss, and the second problem was unreported large losses in Iranian banking system. We suggested dividing the severity distribution to different ranges and to deal with each range separately. Moreover, scenario analysis was used to enrich the loss database, provide examples of magnificent losses, and exploit the opinion of experts. The third issue discussed in this study was the dependency structure of operational loss categories, where we proposed t-copula for modeling. The presented methodology was employed to calculate the operational risk of Karafarin Bank, and then, the successive steps of calculations and modeling in Karafarin Bank were reported.

This framework could be applied to other Iranian commercial banks for modeling operational risk and for calculating the Capital-at-Risk of the bank. All aspects of this research could be extended in various ways, provided more complete and robust operational database (i.e., cells of Table 1). Moreover, some researches could be conducted using other multivariate copulas and compare the results with the present work. Another interesting and unexplored area is modeling operational risk with other advanced measurement approaches rather than Loss Distribution Approach (presented here), like Bayesian approaches, Neural networks, Fuzzy modeling, and so on.

Endnotes

aBank Markazi.

bn is a random variable which follows the frequency distribution.

c 1 USD 10 , 600 Iranian rials IRR .