Operational Risk Modeling in Financial Services

CHAPTER 11An Exposure-Based Model

Operational risk is generally not considered an exposure-based risk. This is the first usual misconception, and when businesses miss this dimension, they can be overwhelmed by the variety of events, which can seem difficult to identify and to structure. In addition, they are likely to mix up hazards, causes, and events.

But, if one thinks about operational risk with a fresh mind, one will find that it is in fact very clearly exposure-based. Working with employees exposes a firm to fraud; working with traders exposes a firm to rogue trading; selling products exposes a firm to mis-selling; having competitors exposes a firm to cartels; and operating in buildings exposes a firm to natural disasters or terrorist attack. When looked at this way, no single operational risk is not exposure-based.

The single difference is that exposure is not a dollar amount, whereas exposure to credit risk and to market risk is a money amount. One lends a certain amount or takes a position, and this amount of money is exposed to a risk of default or to the volatility of the markets. This “money” exposure may have hidden from banks the true definition of “exposure at risk” – that it is a resource. A firm combines resources to achieve its objectives and any event that may harm a key resource will endanger the achievement of objectives: this is the definition of risk. In the case of banks, customers' money is certainly a resource. But employees, products, suppliers, ...