The industry has long been challenged with implementing the concept of operational risk stress testing and operational risk scenario analysis. In practice, these two methods of extreme risk analysis should be linked and used as a combined approach to investigating the operational risk sensitivities of a firm; often requiring risk management software. The point of the evaluation should be to gauge the potential vulnerability of the firm to exceptional but plausible events. These identified (and often artificially constructed) events must have a low probability of occurrence and should be realistic. This is almost paradoxical in nature and is one of the causes of the existing significant challenge to the industry.
Used as a narrowly defined term, stress testing typically refers to changing a single operational risk parameter (often by multiples of the standard deviation or by a fixed percentage) and assessing the change in a firm’s operational risk profile. By contrast, scenario analysis simultaneously moves a number of operational risk parameters each usually by different amounts (based on a combination of statistical results, expert knowledge and/or historically observed events). The term stress testing in this article includes scenario analysis.
By gaining a better understanding of the firm’s operational risks, controls, indicators and potential losses, effective stress testing of a firm’s operational risks will clarify for management the interactions and causal relationships between the risks and allow compensation for the subjective nature of operational risk and control assessments, the incomplete coverage and interpretational difficulties associated with operational risk indicators and the lack of data in recorded operational risk losses.
The first point to consider when developing an effective set of stress tests for operational risk is to build them in conjunction with other techniques used in the business such as forecasting. Many businesses undertake routine business forecasting when developing their rolling 3-year plans and these will yield valuable operational risk data that will, by definition, be consistent with the senior management’s thinking. By taking account of the broader business environment, the chance of an improbable operational risk stress test (or improbable derived event) is reduced. If this technique is followed by a review with senior management of the set of draft operational risk stress tests, a rational set of data that will also pass regulatory scrutiny is far more likely to emerge.
The data used in the stress tests is, of course, paramount to deriving valid results. These data can be obtained from applying the developed stress tests to the firm’s existing operational risk register, indicators and loss database. For example, by considering how the identified risks and controls will change in a given stress test a new stressed risk register is produced for that particular stress test. Consideration of the operational risk indicators and existing losses for the same stress test will yield a complete set of initial operational risk data for that test. Repeating this process for each identified stress test will produce a full set of data for all the developed operational risk tests. Having achieved a complete set of data, it is important to check internal consistency within each stress test and comparability over the full set of tests. Although the operational risk stress tests are likely to be widely varying in detail, there will still be broad comparisons that can be drawn and the data must be checked for coherence.
The mathematical models used for generating stress test results can be the same as the models used for capital calculations, assuming that these models already comply with the regulatory needs of allowing consideration to be given to internal losses, external losses and the internal control environment. The data developed in the stress tests will take these three elements into account and therefore an operational risk stress testing model may already exist in the firm, rather than spending time and money developing another model.
The stress testing screen of a typical model within RiskLogix’ Real Time Capital Analytics risk management software is shown below (click image to see enlarged view):
By running each stress test through the model, a range of values will be produced which will give an insight to the sensitivities of the firm to a variety of extreme operational risk events. Mathematical modelling will not give a complete answer and it is only a starting point. However, modelling will enable the raising of questions in a logical and consistent fashion that will facilitate a more useful management discussion.
In summary, it is therefore possible to develop a range of data for operational risk stress tests that are consistent with the firm’s business forecasts and that give valuable data to senior management to allow further and better understanding of the firm’s operational risk profile. Given a perceived increase in the risk of disruption to the operation of firms from global pandemics, terrorist attacks or natural disasters it is vital that firms carry out stress tests involving their operational risks as well as their market and credit risks.
Tony Blunden
