|
The field of
operational risk management is one that is evolving rapidly. Just a few
years ago, people couldn't agree on a common definition for operational risk.
Today, the debate centers more on how to balance qualitative and quantitative
techniques in assessing and managing operational risks. In this context, a
practitioner is well advised to read several books on the subject offering
different viewpoints. Among these should definitely be Cruz's vigorous, if
somewhat quixotic endorsement of the almost exclusive use of quantitative
techniques.
The book opens
with an excellent chapter on gathering data that is necessary to
perform any sort of statistical modeling of operational risks. This is a very
practical discussion, focusing first on "mapping" the specific forms of
operational risk a firm might want to gather data for:
legal and
liability
regulatory/tax
penalties
loss or damage
to assets
restitution
loss or
recourse
write downs
systems
people/organizational
issues
data flow and
integrity
volume
sensitivity
control gaps
external
environment
Next, procedures
for recording loss events must be specified. This is more easily said than done.
Losses often result from a confluence of events, and identifying one as the
cause can be difficult. The problem is compounded by employees' disinclination
to identify or accept blame for losses they might have prevented. The chapter
offers lots of practical examples and insights. It alone is worth the price of
the book.
The next eight
chapters focus on statistical modeling techniques—some of which are quite
advanced—that might be applied to the data. Discussions are technical, but not
too technical. Reading this book, you will not master all the techniques, but
you will understand what they generally do. You will be able to assess which
might be useful in your own work, and you will know enough to access more
technical references on specific techniques. In this sense, these chapters
provide a high-level roadmap to statistical techniques that might be useful in
modeling operational risk.
A reasonable
criticism is that, if anything, the author offers too many techniques:
extreme value
theory
frequency
models
ruin theory
goodness-of-fit
tests
Akaike
information criterion
Schwarz
Bayesian criterion
spectral
analysis
Kalman filter
neural
networks
fuzzy logic
a data
augmentation algorithm
etc. etc. etc.
These chapters are more a survey of statistical
techniques than a survey of statistical techniques that are useful for modeling
operational risk. It would have been nice if the author had been more selective
or made some effort to identify which techniques are most applicable to specific
forms of operational risk. Instead, he plows along citing statistical technique
after statistical technique. Examples employ actual operational risk data, but
they could just as easily use data on bird migrations or incidents of infectious
disease. The data is just numbers, so there is little that ties the examples to
operational risk management.
|
|
|
|
1 Overview
Database Modeling
2 Database modeling
Stochastic Modeling
3 Severity models
4 Extreme value theory
5 Frequency models
6 Operational value at risk
7 Stochastic processes in operational
risk
Causal Modeling
8 Causal models: applying econometrics
and time series statistics to operational risk
9 Non-linear models in operational risk
10 Bayesian techniques in operational
risk
Operational Risk Management
11 Operational risk reporting, control
and management
12 Stress tests and scenario analysis
Hedging Operational Risk
13 Operational risk derivatives
14 Developing a hedging program for
operational risk
Regulatory Capital
15 Operational risk regulatory capital
Measuring "Other Risks"
16 An enterprise-wide model for
measuring reputational risk
17 Measuring concentration (or key
personnel) risk
18 Using real options in modeling and
measuring operational and "other" risks
|
|
Next, two chapters discuss how to use output from
models to communicate and manage operational risk. Some of these discussions are
quite practical, detailing useful reports. Some are more hypothetical. Cruz
suggests that models might support a system of operational risk limits—and that
risk managers might call a halt to trading activities on any day the models
indicate excessive operational risk. Operational risk is incorporated into
risk-adjusted performance measures. Cruz also discusses stress testing of
operational risk.
Two chapters discuss the hedging of operational
risk through insurance and a hypothetical market for operational risk derivatives.
Another chapter discusses regulatory initiatives
related to operational risk. This gives a good overview of the state of Basle 2
as of 2002.
The final three
chapters return to the topic of statistical modeling techniques, covering:
econometrics
events-analysis models
the Gini
concentration index
multifactor
logit models
real-options
analysis
etc.
I stopped reading when the author presented a
convoluted statistical model for assessing the risk of a key trader quitting. I
couldn't help but wonder if it might be more effective to buy the trader a drink
and ask if he is happy in his job ...
In summary, this book is easy to criticize for its
unbridled and largely uncritical embrace of all conceivable techniques of
statistical modeling. Some of the book's recommendations may be visionary.
Others seem impractical.
On the other hand, there is a tremendous amount of
substance here, and it is informed by the author's experience working for a
number of major institutions. Given its exclusive focus
on quantitative techniques, this should not be the only book you read on
operational risk, but it should definitely be one of the books you read.
|