Up to now, a large part of the losses that occurred in the current fi nancial cri- sis seem to have been classifi ed under market or credit risk losses by banks, even though some have been classifi ed under op risk losses corresponding to an increase in legal losses associated with subprime loan issues.
The main reason for this classifi cation is quite simple. It is because the transactions were done at the trading section or loan section, or the transac- tions were already defi ned as market or credit - type transactions. So the risk factor classifi cation heavily depends on the sections that deal with the trans- actions or their types. This is a somewhat strange phenomenon because this method of classifi cation determines the type of loss distribution of the risk factor, which exists behind loss events. Classifi cation into market or credit risk, of course, does not mean an attribution to a single factor. Still, even if we can attribute the causes of loss events to many factors, once we classify them into market or credit risk, this classifi cation principally determines the basic feature of the risks behind the certain loss event. In other words, as already indicated in the section of VaR, they are a normal distribution, and from an intuitive point of view are market random walk and business cycle - driven losses.
Meanwhile, there is a big question whether we can really attribute the risk factors behind the loss events to the factors that we have noted. For example, the op risk factor, which is usually defi ned as the risk of losses resulting from inadequate or failed internal processes, people, and systems, or from external events, is usually considered to follow not the normal distribution but a fat - tail distribution. If such an op risk factor signifi cantly infl uences the losses in the current fi nancial crisis, the current classifi cation of these losses mainly into market or credit risk is not appropriate for assessing the risk.
Indeed, some experts have already argued that the op risk factor might dominate the losses of the current fi nancial crisis. For example, according to Rosengren (2008), 46 cases of more than $ 1 billion losses were reported by fi nancial institutions globally from 2001 to 2007, and among them 14 cases occurred in 2007 alone. Also, all 14 cases were accompanied by litiga- tion, indicating that the litigation ratio has become much higher than the period between 2001 and 2007 where 33 out of 46 cases were accompanied by litigation. In other words, most of the recent high - severity cases could be associated with the current fi nancial crisis. Besides, Algorithmics (2007) also indicated that 83 percent of all losses related to the US subprime loan problem could be attributed to the op risk factor. This implies a need to place more focus on the “ causes ” behind loss events, rather than the conse- quent events, to assess the risks.
We have already seen economic and institutional factors behind the fi nancial crisis in chapter 2. There, I indicated that the credit cycle, a major systemic factor infl uencing credit risk, can be seen as a factor that triggered the eruption. As I indicated, however, it is rather the institutional factors that infl uence the size of the “ lava ” (size of losses). For this reason, international arguments about risk management based on the lessons learned from the current problem also implicitly assume that internal processes, people, and system processes did not work properly to stem this crisis.
This suggests that it might be worth reanalyzing the factors behind the losses under the current fi nancial crisis from an op risk point of view. It is particularly true of 1) the method of risk factor classifi cation based on causes, and 2) the argument assuming the endogenic nature of risk.
The Method of Risk Factor Classifi cation Based on Causes
Unlike credit and market risks, op risk is defi ned based on the features of its causes, even though it uses business type and event type when further clas- sifying op risk into subcategories in the AMA (see table 4.4 ).
These categories may look a little superfi cial but that cannot be helped because we need more consensus among many countries on the criteria as an international rule. Some fi nancial institutions that manage op risk following its original high - minded principles might prefer cause - based
98 POST-CRISIS RISK MANAGEMENT classifi cation instead of event type - based classifi cation, and this looks very reasonable to me. A diffi culty is, however, in how we should set up the cat- egory based on causes that could be shared by many parties.
Table 4.5 gives some proposals for categorizing causes for classifying op risk losses.
There are many similarities between these suggestions and the event types of Basel II. Indeed, Alvarez (2001) noted that the classifi cation item of Zurich IC corresponds item for item to the classifi cation items of Basel II except “ Clients, Products & Business Practices ” and “ Execution, Delivery & Process Management, ” and also insisted that if they further classify these two into more detailed subcategories, all the classifi ed items could be associ- ated with a certain causal type.
Table 4.4 Op risk classifi cation under the AMA B usiness lines L oss event type Corporate fi nance
Trading and sales Retail banking Commercial banking Payment and settlement Agency services Asset management Retail brokerage
Internal fraud External fraud
Employment practices and workplace safety Clients, products and business practices Damage to physical assets
Business disruption and system failures Execution, delivery, and process
management
Table 4.5 Cause items for classifying op risk losses
M uermann and O ktem (2002) Z urich IC — A lvarez (2001) Country risk due to severe changes
in the political system Crime risk due to internal and external fraud
Legal and liability risk due to employment practices, workplace safety, or changes in the regulatory environment
Operational risk due to transaction failures, rogue trading, and so on Physical risk due to loss or damage of assets such as buildings or computers
Business process: loss events arising from a fi rm ’ s execution of business operations
Employee: loss events resulting from the actions or inactions of a person who works for a fi rm
External: loss events caused by people or entities outside a fi rm
Relationships: loss events caused by the connection or contact that a fi rm has with clients, regulators, or third parties
Technology: loss events due to piracy, theft, failure, breakdown, or other disruption in technology, data, or information
If we follow this type of classifi cation, we might end up classifying many loss cases in this crisis under the item “ external factors. ” This might refl ect that individual institutions could face diffi culty in analyzing the systematic factors in further detail beyond judging them just as “ external. ” However, if even large fi nancial institutions will not make efforts to study the back- ground of macro stress events further to classify them into more detailed subcategories, it is very likely that the fi nancial system will not be robust enough to withstand stress events that could occur once every 10 or 20 years. Therefore, it is expected that, at least globally, active large banks that could be vulnerable to global systemic shock should further study this.
There are some academic studies already in this area. For example, based on qualitative information, E.P. Davis (2003) classifi ed past macro stress events into three types: fi nancial crises triggered by banks, market price, and market liquidity. Then he further classifi ed them into ones trig- gered by globalization, currency crisis, individual institution failures, asset markets, commodity prices, and deregulation. Moreover, IMF (2008b) recently identifi ed and classifi ed various fi nancial crises in the past based on objective indicators, and then analyzed them by focusing on their relation to subsequent business conditions. The principal categories of crises in this work look very similar to the classifi cation done by Davis with one mainly related to the banking system, another mainly related to the security market, and one more mainly related to the foreign exchange market.
At any rate, the risks associated with these events are hard to express using only statistical analysis (including VaR) based only on past data, so we need a scenario analysis with some econometric elements. And in this area, too, the perspective of op risk management becomes very important.
Arguments Assuming Endogeny of Risk Control
Because AMA requested banks to consider BEICF as one of the four elements for op risk quantifi cation, this aspect can be seen as a unique feature of op risk. Meanwhile, we have not seen many discussions of risk control assum- ing endogenic risks in the area of credit and market risks partly because they have features strongly infl uenced by exogenous factors.
In this fi nancial crisis, however, even the losses that were classifi ed under credit or market risks by conventional standards could often be caused by inadequate or failed internal processes, people, and systems. If this is the case, it may be necessary also for market and credit risk management to introduce the idea of endogenic risk, or the idea of a good or bad risk management pro- cess, which could surely infl uence the consequent risk amount. In particular, as we often discuss the area of op risk management and internal control, we need to establish the so - called PDCA cycle to keep a certain level of risk manage- ment quality in the area of market and credit risk management. It means that
100 POST-CRISIS RISK MANAGEMENT we have to consider why C (confi rmation) and A (act) of the PDCA cycle did not necessarily work well in this crisis for market and credit risks.