SECTION 1: LEARNING OBJECTIVES

By the end of this lesson, you will be able to:

  • Define operational risk and its key components – people, processes, systems, and external events.

  • Apply the Loss Distribution Approach (LDA) for operational risk.

  • Implement operational risk controls and mitigation.

  • Conduct scenario analysis for operational risk.

  • Measure operational risk using key metrics.

  • Understand the regulatory framework – Basel III, SREP.

  • Develop an operational risk strategy for a digital bank.


SECTION 2: WHAT IS OPERATIONAL RISK?

2.1 Definition

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, systems, or from external events. This includes legal risk but excludes strategic and reputational risk.

2.2 Key Operational Risk Categories
 
 
Category Description Examples
People Human error, misconduct, fraud. Employee errors, insider fraud.
Processes Inadequate or failed processes. Data entry errors, process failures.
Systems IT system failures, cyber attacks. System outages, cyber breaches.
External Events Natural disasters, third-party failures. Power outages, vendor failures.
Legal Legal and compliance risks. Regulatory fines, lawsuits.
2.3 Operational Risk in Digital Banking
 
 
Risk Area Digital Banking Exposure Mitigation
Technology System outages, cyber attacks. Redundancy, security.
Data Data breaches, data loss. Encryption, backups.
Fraud Online fraud, identity theft. AI fraud detection.
Compliance Regulatory fines. Compliance programme.
Third-Party Vendor failures. Vendor management.

SECTION 3: LOSS DISTRIBUTION APPROACH (LDA)

3.1 LDA Framework
text
┌─────────────────────────────────────────────────────────────────────────────┐
│                    LOSS DISTRIBUTION APPROACH                            │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    DATA COLLECTION                                  │   │
│  │  (Internal loss data, external data, scenario data)                 │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    FREQUENCY MODELLING                               │   │
│  │  (Poisson, Negative Binomial)                                       │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    SEVERITY MODELLING                                │   │
│  │  (Lognormal, Weibull, GPD)                                          │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    AGGREGATE LOSS DISTRIBUTION                       │   │
│  │  (Monte Carlo simulation)                                          │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                    │                                        │
│                                    v                                        │
│  ┌──────────────────────────────────────────────────────────────────────┐   │
│  │                    OPERATIONAL VAR (OpVaR)                          │   │
│  │  (99.9% quantile of aggregate loss)                                │   │
│  └──────────────────────────────────────────────────────────────────────┘   │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘
3.2 Key Components
 
 
Component Description Model
Frequency Number of loss events per year. Poisson, Negative Binomial.
Severity Size of individual losses. Lognormal, Weibull, GPD.
Aggregate Loss Total annual loss. Convolution, Monte Carlo.
OpVaR 99.9% quantile. Simulation result.

SECTION 4: OPERATIONAL RISK CONTROLS

4.1 Control Categories
 
 
Category Description Examples
Preventive Stop risks from occurring. Training, access controls.
Detective Identify risks after they occur. Monitoring, audits.
Corrective Fix issues after detection. Incident response, remediation.
Directive Guide behaviour. Policies, procedures.
4.2 Key Controls in Digital Banking
 
 
Risk Area Control Description
Cyber MFA Multi-factor authentication.
Data Encryption Data encryption at rest and in transit.
System Redundancy System redundancy and backup.
Fraud AI Detection Real-time fraud detection.
People Training Security awareness training.
Third-Party Due Diligence Vendor risk management.

SECTION 5: REGULATORY FRAMEWORK

5.1 Key Regulations
 
 
Regulation Region Focus
Basel III Global Operational risk capital.
SREP EU Supervisory review.
SR 11-7 US Model risk management.
GDPR EU Data protection.
5.2 Basel III Operational Risk

Basel III Standardised Approach:

ORC=BIC×ILM

  • BIC: Business Indicator Component (based on income).

  • ILM: Internal Loss Multiplier (based on historical losses).


SECTION 6: IMPLEMENTATION IN PYTHON – OPERATIONAL RISK

python
# ===================================================================
# MODULE 8, LESSON 4: OPERATIONAL RISK MANAGEMENT
# ===================================================================

import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns
from scipy.stats import poisson, lognorm
import warnings
warnings.filterwarnings('ignore')

print("="*70)
print("OPERATIONAL RISK MANAGEMENT IN DIGITAL BANKING")
print("="*70)

# ----------------------------------------------------------------
# PART A: GENERATE OPERATIONAL LOSS DATA
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART A: Generating Operational Loss Data")
print("-"*60)

np.random.seed(42)
n_years = 10
lambda_events = 20  # Average events per year
mu_sev = 4.5
sigma_sev = 1.8

# Simulate loss data
loss_data = []
events_per_year = []

for year in range(n_years):
    n_events = np.random.poisson(lambda_events)
    events_per_year.append(n_events)
    amounts = np.random.lognormal(mu_sev, sigma_sev, n_events)
    loss_data.extend(amounts)

loss_data = np.array(loss_data)
losses_by_year = np.array_split(loss_data, n_years)

print(f"Total loss events: {len(loss_data)}")
print(f"Average events per year: {np.mean(events_per_year):.1f}")
print(f"Loss statistics: mean=${loss_data.mean():,.2f}, max=${loss_data.max():,.2f}")

# ----------------------------------------------------------------
# PART B: FREQUENCY AND SEVERITY MODELLING
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART B: Frequency and Severity Modelling")
print("-"*60)

# Frequency: Poisson
lambda_est = np.mean(events_per_year)
print(f"Estimated λ (events/year): {lambda_est:.2f}")

# Severity: Lognormal
log_losses = np.log(loss_data)
mu_sev_est = np.mean(log_losses)
sigma_sev_est = np.std(log_losses, ddof=1)
print(f"Lognormal parameters: μ={mu_sev_est:.4f}, σ={sigma_sev_est:.4f}")

# Visualise
fig, axes = plt.subplots(2, 2, figsize=(14, 10))

# Loss Histogram
ax = axes[0, 0]
ax.hist(loss_data, bins=50, edgecolor='black', alpha=0.7, color='blue')
ax.set_xlabel('Loss Amount ($)')
ax.set_ylabel('Frequency')
ax.set_title('Operational Loss Distribution')
ax.grid(True, alpha=0.3)

# Frequency Distribution
ax = axes[0, 1]
ax.hist(events_per_year, bins=np.arange(0, max(events_per_year)+2)-0.5, edgecolor='black', alpha=0.7, color='green')
ax.set_xlabel('Events per Year')
ax.set_ylabel('Frequency')
ax.set_title('Frequency Distribution (Poisson)')
ax.grid(True, alpha=0.3)

# Log-Loss Histogram
ax = axes[1, 0]
ax.hist(np.log(loss_data), bins=30, edgecolor='black', alpha=0.7, color='orange')
ax.set_xlabel('Log(Loss)')
ax.set_ylabel('Frequency')
ax.set_title('Log-Loss Distribution')
ax.grid(True, alpha=0.3)

# Q-Q Plot
ax = axes[1, 1]
from scipy import stats
stats.probplot(np.log(loss_data), dist="norm", plot=ax)
ax.set_title('Q-Q Plot (Log-Normal)')
ax.grid(True, alpha=0.3)

plt.tight_layout()
plt.savefig('operational_loss_analysis.png', dpi=300, bbox_inches='tight')
plt.show()
print("Operational loss analysis visualisation saved as 'operational_loss_analysis.png'")

# ----------------------------------------------------------------
# PART C: MONTE CARLO SIMULATION
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART C: Monte Carlo Simulation")
print("-"*60)

def simulate_operational_loss(lambda_est, mu_est, sigma_est, n_sim=100000):
    """Simulate annual aggregate operational losses."""
    aggregate_losses = []
    for _ in range(n_sim):
        n_events = np.random.poisson(lambda_est)
        if n_events == 0:
            aggregate_losses.append(0)
        else:
            sev = np.random.lognormal(mu_est, sigma_est, n_events)
            aggregate_losses.append(np.sum(sev))
    return np.array(aggregate_losses)

# Simulate
aggregate_losses = simulate_operational_loss(lambda_est, mu_sev_est, sigma_sev_est)

# Calculate OpVaR (99.9%)
op_var = np.percentile(aggregate_losses, 99.9)
expected_loss = np.mean(aggregate_losses)

print(f"Expected Loss (EL): ${expected_loss:,.2f}")
print(f"Operational VaR (99.9%): ${op_var:,.2f}")
print(f"Economic Capital (UL): ${op_var - expected_loss:,.2f}")

# ----------------------------------------------------------------
# PART D: SCENARIO ANALYSIS
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART D: Scenario Analysis")
print("-"*60)

scenarios = {
    'Baseline': {'lambda_mult': 1.0, 'severity_mult': 1.0},
    'Moderate Stress': {'lambda_mult': 1.5, 'severity_mult': 1.3},
    'Severe Stress': {'lambda_mult': 2.0, 'severity_mult': 1.8},
    'Extreme': {'lambda_mult': 3.0, 'severity_mult': 2.5}
}

scenario_results = []
for name, params in scenarios.items():
    lam = lambda_est * params['lambda_mult']
    mu_scaled = mu_sev_est + np.log(params['severity_mult'])
    agg_loss = simulate_operational_loss(lam, mu_scaled, sigma_sev_est, n_sim=50000)
    op_var_scen = np.percentile(agg_loss, 99.9)
    el_scen = np.mean(agg_loss)
    scenario_results.append({
        'Scenario': name,
        'EL': el_scen,
        'OpVaR 99.9%': op_var_scen,
        'UL': op_var_scen - el_scen
    })

scenario_df = pd.DataFrame(scenario_results)
print("Scenario Analysis Results:")
print(scenario_df.to_string(index=False))

# Visualise
fig, ax = plt.subplots(figsize=(10, 6))
scenario_df[['EL', 'OpVaR 99.9%']].plot(kind='bar', ax=ax)
ax.set_title('Scenario Analysis – Expected Loss and OpVaR')
ax.set_ylabel('Loss ($)')
ax.set_xlabel('Scenario')
ax.legend()
ax.grid(True, alpha=0.3)
plt.tight_layout()
plt.savefig('operational_scenario_analysis.png', dpi=300, bbox_inches='tight')
plt.show()
print("Scenario analysis visualisation saved as 'operational_scenario_analysis.png'")

# ----------------------------------------------------------------
# PART E: OPERATIONAL RISK METRICS
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART E: Operational Risk Metrics Dashboard")
print("-"*60)

op_metrics = pd.DataFrame({
    'Metric': [
        'Operational Risk Capital',
        'Loss Event Frequency',
        'Average Loss Severity',
        'Maximum Loss',
        'Risk Control Self-Assessment Score',
        'Incident Resolution Time',
        'Regulatory Compliance Score',
        'Third-Party Risk Score'
    ],
    'Current Value': [
        f'${op_var:,.0f}',
        f'{lambda_est:.1f}/year',
        f'${np.mean(loss_data):,.0f}',
        f'${np.max(loss_data):,.0f}',
        '78/100',
        '3.2 days',
        '85%',
        '72/100'
    ],
    'Target Value': [
        '< $20M',
        '< 15/year',
        '< $50K',
        '< $5M',
        '> 85/100',
        '< 2 days',
        '> 95%',
        '> 85/100'
    ],
    'Status': ['🟢', '🟢', '🟢', '🟢', '🟡', '🟡', '🟡', '🟡']
})

print("Operational Risk Metrics Dashboard:")
print(op_metrics.to_string(index=False))

# ----------------------------------------------------------------
# PART F: OPERATIONAL RISK ROADMAP
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART F: Operational Risk Roadmap")
print("-"*60)

roadmap = {
    "Phase 1 (0-6 months) – Foundation": {
        "Focus": "Build operational risk foundation.",
        "Activities": [
            "Establish operational risk framework.",
            "Implement loss data collection.",
            "Develop risk control self-assessment.",
            "Establish incident reporting."
        ],
        "Success Metrics": ["Risk framework in place", "Loss data collected"]
    },
    "Phase 2 (6-12 months) – Scale": {
        "Focus": "Scale operational risk capabilities.",
        "Activities": [
            "Implement LDA for capital calculation.",
            "Enhance scenario analysis.",
            "Deploy operational risk monitoring.",
            "Implement risk controls."
        ],
        "Success Metrics": ["LDA model implemented", "Risk controls in place"]
    },
    "Phase 3 (12-24 months) – Advanced": {
        "Focus": "Advanced operational risk.",
        "Activities": [
            "Implement AI-powered risk detection.",
            "Deploy predictive analytics.",
            "Build risk dashboards.",
            "Achieve regulatory excellence."
        ],
        "Success Metrics": ["Advanced analytics in place", "Regulatory compliance > 95%"]
    },
    "Phase 4 (24+ months) – Leadership": {
        "Focus": "Industry-leading operational risk.",
        "Activities": [
            "Implement autonomous risk management.",
            "Build predictive risk intelligence.",
            "Achieve industry leadership.",
            "Establish risk culture."
        ],
        "Success Metrics": ["Industry-leading risk management", "Continuous improvement"]
    }
}

for phase, details in roadmap.items():
    print(f"\n{phase}:")
    print(f"  Focus: {details['Focus']}")
    print("  Activities:")
    for activity in details['Activities']:
        print(f"    • {activity}")
    print("  Success Metrics:")
    for metric in details['Success Metrics']:
        print(f"    • {metric}")

# ----------------------------------------------------------------
# PART G: SUMMARY AND RECOMMENDATIONS
# ----------------------------------------------------------------

print("\n" + "="*70)
print("PART G: Summary and Recommendations")
print("="*70)

print("""
Operational Risk Management – Key Takeaways:

1. Operational risk arises from people, processes, systems, and external events.
2. LDA models frequency and severity to calculate OpVaR.
3. Key controls: preventive, detective, corrective, directive.
4. Scenario analysis tests resilience under extreme scenarios.
5. Regulatory framework: Basel III, SREP, SR 11-7.
6. Key metrics: OpVaR, loss frequency, severity, incident resolution.
7. Roadmap: foundation → scale → advanced → leadership.

Recommendations:
  - Establish operational risk framework.
  - Implement LDA for capital calculation.
  - Conduct regular scenario analysis.
  - Implement risk controls and monitoring.
  - Ensure regulatory compliance.
  - Foster a risk-aware culture.
""")

print("="*70)
print("END OF LESSON 4 – MODULE 8")
print("="*70)

SECTION 8: SUMMARY FOR THE DATA PRACTITIONER

  • Operational risk arises from inadequate or failed internal processes, people, systems, or external events.

  • Loss Distribution Approach (LDA) models frequency (Poisson) and severity (Lognormal) to calculate operational VaR (OpVaR) at 99.9% confidence.

  • Key controls include preventive, detective, corrective, and directive controls.

  • Scenario analysis evaluates operational risk resilience under extreme scenarios.

  • Regulatory framework includes Basel III, SREP, and SR 11-7.

  • Key metrics include OpVaR, loss event frequency, average loss severity, maximum loss, and incident resolution time.


SECTION 9: RECOMMENDED NEXT STEPS

  1. Establish operational risk framework.

  2. Implement LDA for capital calculation.

  3. Conduct regular scenario analysis.

  4. Implement risk controls and monitoring.

  5. Ensure regulatory compliance.

  6. Foster a risk-aware culture.

  7. Prepare for Lesson 5: Liquidity Risk Management.


[END OF LESSON 4 – MODULE 8]

This response is AI-generated, for reference only.