Concurrent Session 7: Emerging Risk, Operational Risk and Risk Culture

Joshua Corrigan, Milliman Principal and Convenor of the Actuaries Institute Risk

Management Practice Committee

Dunedin, 21 November 2014

Agenda • Introduction • Operational Risk • Emerging Risk • Risk Culture

INTRODUCTION Section 1

Companies are Complex Adaptive Systems Risk is an undesirable outcome of a complex system

Traditional Risk Management Frameworks Statistical models, assuming constant drivers Registers assuming single characteristics Scenarios “imagined” Emerging risks by spotting events

Frameworks based on complex systems Descriptions of risk profile taken holistically Scenarios derived from risk profile Models integrate all types of information Emerging risks spotted early from system

Risk management can be hard if looked at it through the wrong lens

OPERATIONAL RISK Section 2

Milliman Research Report • Recently published global research report, authored by

myself and Paola Luraschi (Milan) with input from global consultants

• Available for download at http://au.milliman.com/perspective/operational-risk-modelling-framework.php

• All developed markets

• Current and emerging techniques

• Operational risk assessment is a hot topic in the finance

industry and coming under increasing stakeholder scrutiny

Operational Risk Capital • Graph shows aggregate

required risk capital of top 4 Aussie banks as at end-2012 (99.9% VaR in AUD Billions)

• Op risk capital approximately double the aggregate of interest rate and market risk

• Roughly, wealth management accounts for around 10% of this = $0.9 Bn

Nature of Operational Risk Events Distribution of Number of Events by Size (ORX) Distribution of Total Gross Loss by Size (ORX)

Financial and Physical Consequences Industry Low Severity

High Likelihood Medium Severity

Medium Likelihood High Severity

Low Likelihood

Banking ATM failures Online security breach

Rogue trader

Insurance Claims processing Regulatory compliance failure

Mis-selling Mis-pricing

Mining Transport service interruption

Environmental contamination

Mine collapse

Energy Meter reading errors

Environmental contamination

Oil spill Gas plant fire

It’s all about the loss generation mechanisms, which are highly heterogeneous. Is the system generating the LGM stable or dynamic?

Model Framework Choices Risk identification, assessment, monitoring, mitigation, appetite etc. all depend upon the perspective taken. Traditional and statistical frameworks focus mainly on above the water line items, appropriate for stable systems. New complex systems based frameworks focus on dynamic systems, below the line items, embracing: • Holism • System drivers and dynamics • Non-linearity • Human bias • Emergence

Basic Indicators

Standard Formulas

LDA

Causal Models

Scenario Analysis

Basic Indicator and Standard Formula Country / Sector Indicator Factor (indicative)

Global, Basle II Gross income 12% to 18%

EU, Solvency II BSCR, premiums, liabilities, expenses

Floored at 30% of BSCR + 25% UL expenses

Australia, LAGIC Premium, liabilities, claims

Varies for Life vs General

Japan, SSR “BSCR” 3% if P&L < 0 2% if P&L > 0

South Africa, SAaM

BSCR, premiums, liabilities, expenses

Varies for Life vs General; Floored at 30% of BSCR + 25% UL expenses

Taiwan, RBC Premiums, AUM 0.5% life, 1% annuity, 1.5% other, 0.25% AUM

USA, Europe ex EU, Other Asia, Russia, NZ

None!

Operational risk capital scales in line with broad business metrics such as: • Gross income • Premiums, claims, expenses • Liabilities, Assets / AUM • Capital Assumes stable loss generation mechanisms (LGM) Simple, transparent, cheap, but… main problem is that it isn’t linked to the LGM itself ! • Rough proxy only • No incentive to manage op risk • Enables gaming of the system

Quant Risk Assessment or Scenario Analysis 1. Hypothesize loss severity and likelihood of

possible scenarios 2. Generally assume scenario independence, use

generalized binomial distribution to estimate loss distribution and thus capital (VaR / CTE).

3. Or assume linear dependence, use correlations

Common method currently used Typical method used for Australian Superannuation entities (SPS 114) • ORFR must reflect the size, business

mix and complexity of the entity’s business operations

Forward looking and transparent, but suffer from: • selection bias • the when to stop problem • human bias (e.g. 1 in 1000 event?) • rubbery inter-relationship assumps • lack of uncertainty • allowance for complexity • no ability to use inference

Basle II allows for the use of an Advanced Measurement Approach (AMA) with regulatory approval. Current common practice in leading banks (including the big 4 in Aus). Distribution calibration leverages multiple data sources: • Internal loss data (ex-post) • External loss data (ex-post) • Scenario analysis (ex-ante) • Business environment and internal

control factors (ex-post, current, ex-ante)

Loss Distribution Approach (LDA)

LDA Distribution Choices Severity Distributions

• Continuous: Lognormal, Pareto, Gamma, Weibull

Frequency Distributions • Discrete: Poisson, Negative

Binomial

• Choice of prior distribution critical for low frequency events

Aggregation • Typically simulate the compounding effect of variation and uncertainty

through statistical models with dependency structures • Typical to assume independence between frequency and severity

𝜌 =1 ⋯ 𝜌1𝑛⋮ ⋱ ⋮𝜌𝑛1 ⋯ 1

Individual elements modelled on a marginal basis. Variability introduced using “random” behaviours which are assumed to follow particular shapes. Overall behaviour “reconstructed” through the use of dependency structures such as

correlation or copulae.

Issues • “Thing” being modelled is a complex adaptive system • These exhibit emergence and adaptation • Historical data therefore irrelevant for many behaviours

𝜌 =1 ⋯ 𝜌1𝑛⋮ ⋱ ⋮𝜌𝑛1 ⋯ 1

Models are not often used to understand “modal” behaviours…they are used to understand extremes. But the mechanisms of these behaviours are likely to be different to those seen often and are likely to adapt over time. Emergent behaviour requires us to

focus on interactions, but these modelling methods artificially set these.

An Anthropological Study of Op Risk

4. “The Business” gets on with life

2. “The Business” imparts wisdom

3. “The Business” is shown the model

1. Modeler meets “The Business”

Modelling Adaptive Systems x

x

Parametric shape assumed

x

x x x x x x x x Fit to historical data

0 1 2 3 4 5 6 7 8-6

-4

-2

0

2

4

6

8

10

12

x

y

Dependency locked in

Real distributions show far more variety of outcomes

Experts know that behaviours of this risk have two modes of operation

Experts know that this risk is nearly always benign but has a nasty sting in the tail

Structural / Causal Models 1. Elicit system structure

2. Identify critical drivers

3. Define driver states

4. Define inter-relationships

5. Aggregation and analysis

Loss outcomes are conditioned upon the underlying states of the drivers / risks constituting the LGM system “System” in the context of a complex adaptive system Designed to capture the important dynamics actually driving operational risk Incorporates and leverages the beneficial features of SA and LDA

Case Study: Rogue Trader Scenario

System Structure of Causal Drivers

Drivers of Rogue Trader Behaviour Willingness to Commit Fraud

Capture uncertainty in states of each driver

Capture non-linearities

Significant increase in the willingness to commit fraud driven by: – Increase in the view of potential profits

from committing fraud;

– Decrease in risk aversion; and

– Decrease in risk alignment of HR remuneration and benefits policy

Rogue Trader Scenario Modelling the Expected Loss

Model capture core drivers of exposure: – Likelihood of fraud

• Knowledge of Weaknesses • Willingness • Capability

– Severity of fraud

Total Expected Loss: – Mean: ~ 0.2 billion – 99.5%: ~ 2.9 billion

Sensitivity Analysis:

EMERGING RISK Section 3

Complexity / Connectivity / Emergence WEF Global Risks Map 2014

Complex systems mean you can’t understand the whole by only studying the sum of the parts. It is the inherent and dynamic relationships between risks, causal drivers and outcomes that is key. Simple measures of dependency such as linear correlation are typically misleading Risks relating to complex adaptive systems exhibit emergent properties

Predicting Black Swans • Emerging risk events are simply new combinations

of known risk characteristics • We can analyse which risk characteristics exhibit

evolutionary change and hence are more likely to evolve into new emerging risk events

+ =

Paper presented in May 2013 at Actuaries Summit in Sydney

(a) paired fins, (b) jaws, (c) large dermal bones, (d) fin rays, (e) lungs, and (f) rasping tongue

Cladistics Technique - a Simple Example

Cladistic approach Scenario

Characteristics

1 2 3 4 5 6

A N N N N N N

B Y Y N N N Y

C Y N Y Y Y Y

D Y N Y N Y N

Most parsimonious solution (i.e. fewest changes)

Ex-post Case Study Selection of Large Derivative Trading Losses

Socitete GeneraleAmaranth Avisors

LongTerm Capital Management

Sumitomo Corportation

Aracruz CeluloseOrange CountyMetallgesellschaft

UBSBarings Bank

UBSNational Austrailia Bank0

1

2

3

4

5

6

7

8

9

1985 1990 1995 2000 2005 2010 2015

2011

Equ

ival

ent U

SD B

illio

ns

Socitete Generale

Amaranth Avisors

LongTerm Capital Management

Sumitomo Corportation

Aracruz Celulose

Orange County

Metallgesellschaft

Showa Shell Sekiyu

Kashima Oil

UBS

CITIC Pacific

Barings Bank

BAWAG

Daiwa Bank

Groupe Caisse d'Epargne

Sadia

Morgan Granfell & Co

Askin Capital Management

West LB

AIB Allfirst Financial

Bank of Monreal

China Aviation Oil

UBS

• Derivative losses seem to show no sign of abating in term of either frequency or severity

• How can we understand these events?

• Are they homogenous or heterogeneous?

• Are they relevant to my company?

• How can we understand the next emerging operational risk event?

Fraud clade

Normal trading activity gone wrong & primary activity financial / investing

Derivatives clade

1 Involving Fraud

2 Involving Fraudulent Trading

3 To Cover Up a problem

4 Normal trading activity gone wrong

5 Trading in Excess of limits

6 Primary Activity Financial or Investing

7 Failure to Segregate Functions

8 Lax Mgmt/control Problem

9 Long-term accumulated losses >3 years

10 Single Person

11 Physicals

12 Futures

13 Options

14 Derivatives

Cladogram of Drivers / Risks

RISK CULTURE Section 3

People are at the Heart of Risk Management Social sciences – risk is a social construct built on culture

Michael Thompson, IIASA, Dave Ingram, Willis Re

Anthropology

As scenarios are given detail, and cause and effect are described, it

is quite usual to find dis-agreement emerging – especially

with regard to uncertainties.

This is described by the Cultural Theory of Risk which asserts a

four-fold typology with respect to risk attitude – aligned with four types of human organisation.

Social science teaches us that

probability estimates are subjective – risk is socially

constructed.

Fatalist / Pragmatist Hierarchic / Manager

Individualist / Trader Egalitarian / Conservator

Fatalist / Pragmatist Hierarchic / Manager

Individualist / Trader Egalitarian/Conservator

Decision Making Under Contradictory Certainties Different views of risk exists within our stakeholder group. We need to find common ground.

Michael Thompson, IIASA, Dave Ingram, Willis Re

Typical of the sales director.

Risk isn’t a

concern

Typical of CRO / Actuary

Risks needs to be

managed DMUCC

Typical of compliance officer

auditor

See risk everywhere

Non-conformists

Outcomes are unpredictable and

uncontrollable

Diagnosing Risk Culture

• Simple comparative questions elicit opinion about risk processes

• Non-judgemental…diagnostic

Multi-national Insurer: Sub-Culture Insights Significant Differences Prevalent

Group CRO could see who to adapt framework for and in what areas

Multinational Insurer: Culture by Risk Process Significant Differences Prevalent

Questions / Comments?