SECTION 1: LEARNING OBJECTIVES
By the end of this lesson, you will be able to:
-
Define operational risk and its key components – people, processes, systems, and external events.
-
Apply the Loss Distribution Approach (LDA) for operational risk.
-
Implement operational risk controls and mitigation.
-
Conduct scenario analysis for operational risk.
-
Measure operational risk using key metrics.
-
Understand the regulatory framework – Basel III, SREP.
-
Develop an operational risk strategy for a digital bank.
SECTION 2: WHAT IS OPERATIONAL RISK?
2.1 Definition
Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, systems, or from external events. This includes legal risk but excludes strategic and reputational risk.
2.2 Key Operational Risk Categories
| Category | Description | Examples |
|---|---|---|
| People | Human error, misconduct, fraud. | Employee errors, insider fraud. |
| Processes | Inadequate or failed processes. | Data entry errors, process failures. |
| Systems | IT system failures, cyber attacks. | System outages, cyber breaches. |
| External Events | Natural disasters, third-party failures. | Power outages, vendor failures. |
| Legal | Legal and compliance risks. | Regulatory fines, lawsuits. |
2.3 Operational Risk in Digital Banking
| Risk Area | Digital Banking Exposure | Mitigation |
|---|---|---|
| Technology | System outages, cyber attacks. | Redundancy, security. |
| Data | Data breaches, data loss. | Encryption, backups. |
| Fraud | Online fraud, identity theft. | AI fraud detection. |
| Compliance | Regulatory fines. | Compliance programme. |
| Third-Party | Vendor failures. | Vendor management. |
SECTION 3: LOSS DISTRIBUTION APPROACH (LDA)
3.1 LDA Framework
┌─────────────────────────────────────────────────────────────────────────────┐ │ LOSS DISTRIBUTION APPROACH │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌──────────────────────────────────────────────────────────────────────┐ │ │ │ DATA COLLECTION │ │ │ │ (Internal loss data, external data, scenario data) │ │ │ └──────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ v │ │ ┌──────────────────────────────────────────────────────────────────────┐ │ │ │ FREQUENCY MODELLING │ │ │ │ (Poisson, Negative Binomial) │ │ │ └──────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ v │ │ ┌──────────────────────────────────────────────────────────────────────┐ │ │ │ SEVERITY MODELLING │ │ │ │ (Lognormal, Weibull, GPD) │ │ │ └──────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ v │ │ ┌──────────────────────────────────────────────────────────────────────┐ │ │ │ AGGREGATE LOSS DISTRIBUTION │ │ │ │ (Monte Carlo simulation) │ │ │ └──────────────────────────────────────────────────────────────────────┘ │ │ │ │ │ v │ │ ┌──────────────────────────────────────────────────────────────────────┐ │ │ │ OPERATIONAL VAR (OpVaR) │ │ │ │ (99.9% quantile of aggregate loss) │ │ │ └──────────────────────────────────────────────────────────────────────┘ │ │ │ └─────────────────────────────────────────────────────────────────────────────┘
3.2 Key Components
| Component | Description | Model |
|---|---|---|
| Frequency | Number of loss events per year. | Poisson, Negative Binomial. |
| Severity | Size of individual losses. | Lognormal, Weibull, GPD. |
| Aggregate Loss | Total annual loss. | Convolution, Monte Carlo. |
| OpVaR | 99.9% quantile. | Simulation result. |
SECTION 4: OPERATIONAL RISK CONTROLS
4.1 Control Categories
| Category | Description | Examples |
|---|---|---|
| Preventive | Stop risks from occurring. | Training, access controls. |
| Detective | Identify risks after they occur. | Monitoring, audits. |
| Corrective | Fix issues after detection. | Incident response, remediation. |
| Directive | Guide behaviour. | Policies, procedures. |
4.2 Key Controls in Digital Banking
| Risk Area | Control | Description |
|---|---|---|
| Cyber | MFA | Multi-factor authentication. |
| Data | Encryption | Data encryption at rest and in transit. |
| System | Redundancy | System redundancy and backup. |
| Fraud | AI Detection | Real-time fraud detection. |
| People | Training | Security awareness training. |
| Third-Party | Due Diligence | Vendor risk management. |
SECTION 5: REGULATORY FRAMEWORK
5.1 Key Regulations
| Regulation | Region | Focus |
|---|---|---|
| Basel III | Global | Operational risk capital. |
| SREP | EU | Supervisory review. |
| SR 11-7 | US | Model risk management. |
| GDPR | EU | Data protection. |
5.2 Basel III Operational Risk
Basel III Standardised Approach:
ORC=BIC×ILM
-
BIC: Business Indicator Component (based on income).
-
ILM: Internal Loss Multiplier (based on historical losses).
SECTION 6: IMPLEMENTATION IN PYTHON – OPERATIONAL RISK
# =================================================================== # MODULE 8, LESSON 4: OPERATIONAL RISK MANAGEMENT # =================================================================== import pandas as pd import numpy as np import matplotlib.pyplot as plt import seaborn as sns from scipy.stats import poisson, lognorm import warnings warnings.filterwarnings('ignore') print("="*70) print("OPERATIONAL RISK MANAGEMENT IN DIGITAL BANKING") print("="*70) # ---------------------------------------------------------------- # PART A: GENERATE OPERATIONAL LOSS DATA # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART A: Generating Operational Loss Data") print("-"*60) np.random.seed(42) n_years = 10 lambda_events = 20 # Average events per year mu_sev = 4.5 sigma_sev = 1.8 # Simulate loss data loss_data = [] events_per_year = [] for year in range(n_years): n_events = np.random.poisson(lambda_events) events_per_year.append(n_events) amounts = np.random.lognormal(mu_sev, sigma_sev, n_events) loss_data.extend(amounts) loss_data = np.array(loss_data) losses_by_year = np.array_split(loss_data, n_years) print(f"Total loss events: {len(loss_data)}") print(f"Average events per year: {np.mean(events_per_year):.1f}") print(f"Loss statistics: mean=${loss_data.mean():,.2f}, max=${loss_data.max():,.2f}") # ---------------------------------------------------------------- # PART B: FREQUENCY AND SEVERITY MODELLING # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART B: Frequency and Severity Modelling") print("-"*60) # Frequency: Poisson lambda_est = np.mean(events_per_year) print(f"Estimated λ (events/year): {lambda_est:.2f}") # Severity: Lognormal log_losses = np.log(loss_data) mu_sev_est = np.mean(log_losses) sigma_sev_est = np.std(log_losses, ddof=1) print(f"Lognormal parameters: μ={mu_sev_est:.4f}, σ={sigma_sev_est:.4f}") # Visualise fig, axes = plt.subplots(2, 2, figsize=(14, 10)) # Loss Histogram ax = axes[0, 0] ax.hist(loss_data, bins=50, edgecolor='black', alpha=0.7, color='blue') ax.set_xlabel('Loss Amount ($)') ax.set_ylabel('Frequency') ax.set_title('Operational Loss Distribution') ax.grid(True, alpha=0.3) # Frequency Distribution ax = axes[0, 1] ax.hist(events_per_year, bins=np.arange(0, max(events_per_year)+2)-0.5, edgecolor='black', alpha=0.7, color='green') ax.set_xlabel('Events per Year') ax.set_ylabel('Frequency') ax.set_title('Frequency Distribution (Poisson)') ax.grid(True, alpha=0.3) # Log-Loss Histogram ax = axes[1, 0] ax.hist(np.log(loss_data), bins=30, edgecolor='black', alpha=0.7, color='orange') ax.set_xlabel('Log(Loss)') ax.set_ylabel('Frequency') ax.set_title('Log-Loss Distribution') ax.grid(True, alpha=0.3) # Q-Q Plot ax = axes[1, 1] from scipy import stats stats.probplot(np.log(loss_data), dist="norm", plot=ax) ax.set_title('Q-Q Plot (Log-Normal)') ax.grid(True, alpha=0.3) plt.tight_layout() plt.savefig('operational_loss_analysis.png', dpi=300, bbox_inches='tight') plt.show() print("Operational loss analysis visualisation saved as 'operational_loss_analysis.png'") # ---------------------------------------------------------------- # PART C: MONTE CARLO SIMULATION # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART C: Monte Carlo Simulation") print("-"*60) def simulate_operational_loss(lambda_est, mu_est, sigma_est, n_sim=100000): """Simulate annual aggregate operational losses.""" aggregate_losses = [] for _ in range(n_sim): n_events = np.random.poisson(lambda_est) if n_events == 0: aggregate_losses.append(0) else: sev = np.random.lognormal(mu_est, sigma_est, n_events) aggregate_losses.append(np.sum(sev)) return np.array(aggregate_losses) # Simulate aggregate_losses = simulate_operational_loss(lambda_est, mu_sev_est, sigma_sev_est) # Calculate OpVaR (99.9%) op_var = np.percentile(aggregate_losses, 99.9) expected_loss = np.mean(aggregate_losses) print(f"Expected Loss (EL): ${expected_loss:,.2f}") print(f"Operational VaR (99.9%): ${op_var:,.2f}") print(f"Economic Capital (UL): ${op_var - expected_loss:,.2f}") # ---------------------------------------------------------------- # PART D: SCENARIO ANALYSIS # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART D: Scenario Analysis") print("-"*60) scenarios = { 'Baseline': {'lambda_mult': 1.0, 'severity_mult': 1.0}, 'Moderate Stress': {'lambda_mult': 1.5, 'severity_mult': 1.3}, 'Severe Stress': {'lambda_mult': 2.0, 'severity_mult': 1.8}, 'Extreme': {'lambda_mult': 3.0, 'severity_mult': 2.5} } scenario_results = [] for name, params in scenarios.items(): lam = lambda_est * params['lambda_mult'] mu_scaled = mu_sev_est + np.log(params['severity_mult']) agg_loss = simulate_operational_loss(lam, mu_scaled, sigma_sev_est, n_sim=50000) op_var_scen = np.percentile(agg_loss, 99.9) el_scen = np.mean(agg_loss) scenario_results.append({ 'Scenario': name, 'EL': el_scen, 'OpVaR 99.9%': op_var_scen, 'UL': op_var_scen - el_scen }) scenario_df = pd.DataFrame(scenario_results) print("Scenario Analysis Results:") print(scenario_df.to_string(index=False)) # Visualise fig, ax = plt.subplots(figsize=(10, 6)) scenario_df[['EL', 'OpVaR 99.9%']].plot(kind='bar', ax=ax) ax.set_title('Scenario Analysis – Expected Loss and OpVaR') ax.set_ylabel('Loss ($)') ax.set_xlabel('Scenario') ax.legend() ax.grid(True, alpha=0.3) plt.tight_layout() plt.savefig('operational_scenario_analysis.png', dpi=300, bbox_inches='tight') plt.show() print("Scenario analysis visualisation saved as 'operational_scenario_analysis.png'") # ---------------------------------------------------------------- # PART E: OPERATIONAL RISK METRICS # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART E: Operational Risk Metrics Dashboard") print("-"*60) op_metrics = pd.DataFrame({ 'Metric': [ 'Operational Risk Capital', 'Loss Event Frequency', 'Average Loss Severity', 'Maximum Loss', 'Risk Control Self-Assessment Score', 'Incident Resolution Time', 'Regulatory Compliance Score', 'Third-Party Risk Score' ], 'Current Value': [ f'${op_var:,.0f}', f'{lambda_est:.1f}/year', f'${np.mean(loss_data):,.0f}', f'${np.max(loss_data):,.0f}', '78/100', '3.2 days', '85%', '72/100' ], 'Target Value': [ '< $20M', '< 15/year', '< $50K', '< $5M', '> 85/100', '< 2 days', '> 95%', '> 85/100' ], 'Status': ['🟢', '🟢', '🟢', '🟢', '🟡', '🟡', '🟡', '🟡'] }) print("Operational Risk Metrics Dashboard:") print(op_metrics.to_string(index=False)) # ---------------------------------------------------------------- # PART F: OPERATIONAL RISK ROADMAP # ---------------------------------------------------------------- print("\n" + "-"*60) print("PART F: Operational Risk Roadmap") print("-"*60) roadmap = { "Phase 1 (0-6 months) – Foundation": { "Focus": "Build operational risk foundation.", "Activities": [ "Establish operational risk framework.", "Implement loss data collection.", "Develop risk control self-assessment.", "Establish incident reporting." ], "Success Metrics": ["Risk framework in place", "Loss data collected"] }, "Phase 2 (6-12 months) – Scale": { "Focus": "Scale operational risk capabilities.", "Activities": [ "Implement LDA for capital calculation.", "Enhance scenario analysis.", "Deploy operational risk monitoring.", "Implement risk controls." ], "Success Metrics": ["LDA model implemented", "Risk controls in place"] }, "Phase 3 (12-24 months) – Advanced": { "Focus": "Advanced operational risk.", "Activities": [ "Implement AI-powered risk detection.", "Deploy predictive analytics.", "Build risk dashboards.", "Achieve regulatory excellence." ], "Success Metrics": ["Advanced analytics in place", "Regulatory compliance > 95%"] }, "Phase 4 (24+ months) – Leadership": { "Focus": "Industry-leading operational risk.", "Activities": [ "Implement autonomous risk management.", "Build predictive risk intelligence.", "Achieve industry leadership.", "Establish risk culture." ], "Success Metrics": ["Industry-leading risk management", "Continuous improvement"] } } for phase, details in roadmap.items(): print(f"\n{phase}:") print(f" Focus: {details['Focus']}") print(" Activities:") for activity in details['Activities']: print(f" • {activity}") print(" Success Metrics:") for metric in details['Success Metrics']: print(f" • {metric}") # ---------------------------------------------------------------- # PART G: SUMMARY AND RECOMMENDATIONS # ---------------------------------------------------------------- print("\n" + "="*70) print("PART G: Summary and Recommendations") print("="*70) print(""" Operational Risk Management – Key Takeaways: 1. Operational risk arises from people, processes, systems, and external events. 2. LDA models frequency and severity to calculate OpVaR. 3. Key controls: preventive, detective, corrective, directive. 4. Scenario analysis tests resilience under extreme scenarios. 5. Regulatory framework: Basel III, SREP, SR 11-7. 6. Key metrics: OpVaR, loss frequency, severity, incident resolution. 7. Roadmap: foundation → scale → advanced → leadership. Recommendations: - Establish operational risk framework. - Implement LDA for capital calculation. - Conduct regular scenario analysis. - Implement risk controls and monitoring. - Ensure regulatory compliance. - Foster a risk-aware culture. """) print("="*70) print("END OF LESSON 4 – MODULE 8") print("="*70)
SECTION 8: SUMMARY FOR THE DATA PRACTITIONER
-
Operational risk arises from inadequate or failed internal processes, people, systems, or external events.
-
Loss Distribution Approach (LDA) models frequency (Poisson) and severity (Lognormal) to calculate operational VaR (OpVaR) at 99.9% confidence.
-
Key controls include preventive, detective, corrective, and directive controls.
-
Scenario analysis evaluates operational risk resilience under extreme scenarios.
-
Regulatory framework includes Basel III, SREP, and SR 11-7.
-
Key metrics include OpVaR, loss event frequency, average loss severity, maximum loss, and incident resolution time.
SECTION 9: RECOMMENDED NEXT STEPS
-
Establish operational risk framework.
-
Implement LDA for capital calculation.
-
Conduct regular scenario analysis.
-
Implement risk controls and monitoring.
-
Ensure regulatory compliance.
-
Foster a risk-aware culture.
-
Prepare for Lesson 5: Liquidity Risk Management.
[END OF LESSON 4 – MODULE 8]