Modeling operational risk capital: The inconvenient truth

Since 2008, over US$200 billion of operational risk losses have been incurred by large banks, mainly as a result of regulatory fines, lawsuits and demands for customer redress for various types of misconduct.A basic assumption underlying the modeling of operational risk regulatory capital (ORRC) under Basel II is that such operational risk losses can be modeled as being idiosyncratic to an individual institution, as this is the (microprudential) level at which banks are currently regulated. This paper challenges that assumption and shows that it is an “inconvenient truth” that the largest losses by banks are not firm specific. Instead, the largest losses involve multiple banks being fined at the same time by multiple regulators for the same types of misconduct. In this paper, such large multi-bank incidents are called systemic operational risk events and it is argued that, in addition to the firm level, ORRC should also be modeled at the “systemic”, or macroprudential, level. The paper also discusses arguments made by academics against current approaches taken to modeling ORRC and, finally, makes a suggestion to the Basel Committee that, similar to the current reviewbeing undertaken for market risk, a comprehensive fundamental review be undertaken for operational risk.