Operational Risk Management

Size: px

Start display at page:

Download "Operational Risk Management"

Kerrie Ball
5 years ago
Views:

1 Operational Risk Management A Practical Approach to Intelligent Data Analysis Edited by Ron S. Kenett KPA Ltd, Raanana, Israel; University of Turin, Italy; and NYU-Poly, Center for Risk Engineering, New York, USA Yossi Raanan KPA Ltd, Raanana, Israel; and College of Management, Academic Studies, Rishon Lezion, Israel A John Wiley and Sons, Ltd., Publication

3 Operational Risk Management

4 Statistics in Practice Advisory Editors Human and Biological Sciences Stephen Senn University College London, UK Earth and Environmental Sciences Marian Scott University of Glasgow, UK Industry, Commerce and Finance Wolfgang Jank University of Maryland, USA Founding Editor Vic Barnett Nottingham Trent University, UK Statistics in Practice is an important international series of texts which provide detailed coverage of statistical concepts, methods and worked case studies in specific fields of investigation and study. With sound motivation and many worked practical examples, the books show in down-to-earth terms how to select and use an appropriate range of statistical techniques in a particular practical field within each title s special topic area. The books provide statistical support for professionals and research workers across a range of employment fields and research environments. Subject areas covered include medicine and pharmaceutics; industry, finance and commerce; public services; the earth and environmental sciences, and so on. The books also provide support to students studying statistical courses applied to the above areas. The demand for graduates to be equipped for the work environment has led to such courses becoming increasingly prevalent at universities and colleges. It is our aim to present judiciously chosen and well-written workbooks to meet everyday practical needs. Feedback of views from readers will be most valuable to monitor the success of this aim. A complete list of titles in the series appears at the end of this volume.

5 Operational Risk Management A Practical Approach to Intelligent Data Analysis Edited by Ron S. Kenett KPA Ltd, Raanana, Israel; University of Turin, Italy; and NYU-Poly, Center for Risk Engineering, New York, USA Yossi Raanan KPA Ltd, Raanana, Israel; and College of Management, Academic Studies, Rishon Lezion, Israel A John Wiley and Sons, Ltd., Publication

6 This edition first published John Wiley & Sons Ltd Registered office John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex, PO19 8SQ, United Kingdom For details of our global editorial offices, for customer services and for information about how to apply for permission to reuse the copyright material in this book please see our website at The right of the authors to be identified as the authors of this work has been asserted in accordance with the Copyright, Designs and Patents Act All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, except as permitted by the UK Copyright, Designs and Patents Act 1988, without the prior permission of the publisher. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. Designations used by companies to distinguish their products are often claimed as trademarks. All brand names and product names used in this book are trade names, service marks, trademarks or registered trademarks of their respective owners. The publisher is not associated with any product or vendor mentioned in this book. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold on the understanding that the publisher is not engaged in rendering professional services. If professional advice or other expert assistance is required, the services of a competent professional should be sought. Library of Congress Cataloging-in-Publication Data Operational risk management : a practical approach to intelligent data analysis / edited by Ron S. Kenett, Yossi Raanan. p. cm. Includes bibliographical references and index. ISBN (cloth) 1. Risk management. 2. Quality control. 3. Information technology Quality control. 4. Process control. I. Kenett, Ron. II. Raanan, Yossi. HD61.O dc A catalogue record for this book is available from the British Library. Print ISBN: epdf ISBN: obook ISBN: Set in 10/12pt Times by Laserwords Private Limited, Chennai, India

7 In memory of Roberto Gagliardi

9 Contents Foreword Preface Introduction Notes on Contributors List of Acronyms xiii xv xvii xxv xxxv PART I INTRODUCTION TO OPERATIONAL RISK MANAGEMENT 1 1 Risk management: a general view 3 Ron S. Kenett, Richard Pike and Yossi Raanan 1.1 Introduction Definitions of risk Impact of risk Types of risk Enterprise risk management State of the art in enterprise risk management The negative impact of risk silos Technology s critical role Bringing business into the fold Summary 15 References 17 2 Operational risk management: an overview 19 Yossi Raanan, Ron S. Kenett and Richard Pike 2.1 Introduction Definitions of operational risk management Operational risk management techniques Risk identification 22

10 viii CONTENTS Control assurance Risk event capture Risk and control assessments Key risk indicators Issues and action management Risk mitigation Operational risk statistical models Operational risk measurement techniques The loss distribution approach Scenarios Balanced scorecards Summary 35 References 37 PART II DATA FOR OPERATIONAL RISK MANAGEMENT AND ITS HANDLING 39 3 Ontology-based modelling and reasoning in operational risks 41 Christian Leibold, Hans-Ulrich Krieger and Marcus Spies 3.1 Introduction Modules Conceptual model Generic and axiomatic ontologies Proton extension Temporal ontologies Domain-independent ontologies Company ontology Standard reference ontologies XBRL BACH NACE Operational risk management IT operational risks Summary 58 References 58 4 Semantic analysis of textual input 61 Horacio Saggion, Thierry Declerck and Kalina Bontcheva 4.1 Introduction Information extraction Named entity recognition 64

11 CONTENTS 4.3 The general architecture for text engineering Text analysis components Document structure identification Tokenisation Sentence identification Part of speech tagging Morphological analysis Stemming Gazetteer lookup Name recognition Orthographic co-reference Parsing Ontology support Ontology-based information extraction An example application: market scan Evaluation Summary 76 References 77 5 A case study of ETL for operational risks 79 Valerio Grossi and Andrea Romei 5.1 Introduction ETL (Extract, Transform and Load) Related work Modeling the conceptual ETL work Modeling the execution of ETL Pentaho data integration Case study specification Application scenario Data sources Data merging for risk assessment The issues of data merging in MUSING The ETL-based solution Implementing the map merger activity Implementing the alarms merger activity Implementing the financial merger activity Summary 95 References 95 6 Risk-based testing of web services 99 Xiaoying Bai and Ron S. Kenett 6.1 Introduction Background 103 ix

12 x CONTENTS Risk-based testing Web services progressive group testing Semantic web services Problem statement Risk assessment Semantic web services analysis Failure probability estimation Importance estimation Risk-based adaptive group testing Adaptive measurement Adaptation rules Evaluation Summary 118 References 121 PART III OPERATIONAL RISK ANALYTICS Scoring models for operational risks 127 Paolo Giudici 7.1 Background Actuarial methods Scorecard models Integrated scorecard models Summary 134 References Bayesian merging and calibration for operational risks 137 Silvia Figini 8.1 Introduction Methodological proposal Application Summary 148 References Measures of association applied to operational risks 149 Ron S. Kenett and Silvia Salini 9.1 Introduction The arules R script library Some examples Market basket analysis PBX system risk analysis A bank s operational risk analysis Summary 163 References 166

13 PART IV CONTENTS OPERATIONAL RISK APPLICATIONS AND INTEGRATION WITH OTHER DISCIPLINES 169 xi 10 Operational risk management beyond AMA: new ways to quantify non-recorded losses 171 Giorgio Aprile, Antonio Pippi and Stefano Visinoni 10.1 Introduction The near miss and opportunity loss project The near miss/opportunity loss service Advantage to the user Outline of the chapter Non-recorded losses in a banking context Opportunity losses Near misses Multiple losses Methodology Measure the non-measured IT events vs. operational loss classes Quantification of opportunity losses: likelihood estimates Quantification of near misses: loss approach level Reconnection of multiple losses Performing the analysis: a case study Data availability: source databases IT OpR ontology Critical path of IT events: Bayesian networks Steps of the analysis Outputs of the service Summary 195 References Combining operational risks in financial risk assessment scores 199 Michael Munsch, Silvia Rohe and Monika Jungemann-Dorner 11.1 Interrelations between financial risk management and operational risk management Financial rating systems and scoring systems Data management for rating and scoring Use case: business retail ratings for assessment of probabilities of default Use case: quantitative financial ratings and prediction of fraud Use case: money laundering and identification of the beneficial owner Summary 213 References 214

14 xii CONTENTS 12 Intelligent regulatory compliance 215 Marcus Spies, Rolf Gubser and Markus Schacher 12.1 Introduction to standards and specifications for business governance Specifications for implementing a framework for business governance Business motivation model Semantics of business vocabulary and business rules Operational risk from a BMM/SBVR perspective Intelligent regulatory compliance based on BMM and SBVR Assessing influencers Identify risks and potential rewards Develop risk strategies Implement risk strategy Outlook: build adaptive IT systems Generalization: capturing essential concepts of operational risk in UML and BMM Summary 236 References Democratisation of enterprise risk management 239 Paolo Lombardi, Salvatore Piscuoglio, Ron S. Kenett, Yossi Raanan and Markus Lankinen 13.1 Democratisation of advanced risk management services Semantic-based technologies and enterprise-wide risk management An enterprise-wide risk management vision Integrated risk self-assessment: a service to attract customers A real-life example in the telecommunications industry Summary 250 References Operational risks, quality, accidents and incidents 253 Ron S. Kenett and Yossi Raanan 14.1 The convergence of risk and quality management Risks and the Taleb quadrants The quality ladder Risks, accidents and incidents Operational risks in the oil and gas industry Operational risks: data management, modelling and decision making Summary 273 References 274 Index 281

15 Foreword The recognition from the Basel Committee of Banking Supervisors of operational risks as a separate risk management discipline has promoted in the past years intense and fruitful discussions, both inside and outside the banking and financial sectors, on how operational risks can be managed, assessed and prevented, or at least mitigated. However, for several reasons, including the fact that operational risks appear at the same time multifaceted and of a somewhat indefinite shape, inadequate attention has been given so far to what operational risks really are, and to how they can be correctly identified and captured. Indeed, the first objective of a risk management programme is to identify clearly the playing field to where investments and resources should be directed. This is even more important for operational risk management, since its scope crosses all industry sectors and all types of firms and the fact that it essentially originates from those variables that constitute the heart of any organization: people, processes and systems. This book attempts to give an appropriate level of attention to this significant topic by using an interdisciplinary, integrated and innovative approach. The methodologies and techniques outlined here, reading behind and beyond operational risks, aim to move forward in the interpretation of this type of risk and of the different ways it can reveal. The objective of capturing knowledge on operational risk, rather than just information, is crucial for the building of sound processes for its management, assessment and prevention or mitigation. Another noteworthy feature of this work is the effort pursued by providing practical examples of implementation of an operational risk framework (or part of it) in different industry sectors to demonstrate how concepts, techniques and methodologies developed in a specific field, for the handling of operational risks, can be adopted in (or adapted to) other industrial domains. If considered all together, these aspects can significantly contribute to make this discipline evolve towards high, sustainable and convergent standards and, above all, to change its nature from (a bit less) art to (a bit more) science, which, in the end, is the ultimate objective that all operational risk managers are trying to achieve. Marco Moscadelli Bank of Italy and Committee of European Banking Supervisors

Operational Risk Management

Operational Risk Management A Practical Approach to Intelligent Data Analysis Y Edited by Ron S. Kenett KPA Ltd, Raanana, Israel; University of Turin, Italy; and NYU-Poly, Center for Risk Engineering,