Scenario Analysis in the Measurement of Operational Risk Capital: A Change of Measure Approach

ABSTRACT At large financial institutions, operational risk is gaining the same importance as market and credit risk in the capital calculation. Although scenario analysis is an important tool for financial risk measurement, its use in the measurement of operational risk capital has been arbitrary and often inaccurate. We propose a method that combines scenario analysis with historical loss data. Using the Change of Measure approach, we evaluate the impact of each scenario on the total estimate of operational risk capital. The method can be used in stress-testing, what-if assessment for scenario analysis, and Loss Given Default estimates used in credit evaluations. INTRODUCTION Scenario analysis is an important tool in decision making. It has been used for several decades in various disciplines, including management, engineering, defense, medicine, finance, and economics. Mulvey and Erkan (2003) illustrate modeling of scenario data for risk management of a property-casualty insurance company. When properly and systematically used, scenario analysis can reveal many important aspects of a situation that would otherwise be missed. Given the current state of an entity, it tries to navigate situations and events that could impact important characteristics of the entity in the future. Thus, scenario analysis has two important elements: 1. Evaluation of future possibilities (future states) with respect to a certain characteristic. 2. Present knowledge (current states) of that characteristic for the entity. Scenarios must pertain to a meaningful duration of time, for the passage of time will ultimately render the scenarios obsolete. Also, the current state of an entity and the environment in which it operates give rise to various possibilities in the future. In management of market risk, scenarios also play an important role. Many scenarios on the future state of an asset are actively traded in the market and could be used for risk management. Derivatives such as call (or put) options on asset prices are linked to its possible future price. Suppose, for example, that Cisco (CSCO) is trading today at $23 in the spot (NASDAQ) market. In the option market, we find many different prices available as future possibilities. Each of these is a scenario for the future state of CSCO. The price for each option reflects the probability that the market attaches to CSCO attaining more (or less) than a particular price on (or before) a certain date in the future. As the market obtains more information, prices of derivatives change and our knowledge of the future state expands. In the language of asset pricing, more information on the future state is revealed. At one time, any risk for a financial institution that was not a market or credit risk was considered an operational risk. This definition of operational risk made data collection and measurement of operational risk intractable. To make it useful for measurement and management, Basel banking regulation narrowed the scope and definition of operational risk. Under this definition, operational risk is the risk of loss, whether direct or indirect, to which the Bank is exposed because of inadequate or failed internal processes or systems, human error, or external events. Operational risk includes legal and regulatory risk, business process and change risk, fiduciary or disclosure breaches, technology failure, financial crime, and environmental risk. It exists in some form in every business and function. Operational risk can cause not only financial loss, but also regulatory damage to the business' reputation, assets, and shareholder value. One may argue that at the core of most of the financial risk, one may be able to observe an operational risk. The Financial Crisis Inquiry Commission (2011) report identifies many of the risks defined under operational risk as among the reasons for the recent financial meltdown. Therefore, it is an important financial risk to consider along with the market and credit risk. …