4.10.1 Operational Risk from Zero

Basic Prerequisites: Probability & Measure Theory.

---

1. Intuition & Practical Objective

This page builds the why of operational risk with no prior risk knowledge needed. The objective is one idea: a bank loses money not only because the market moves (market risk) or because a borrower fails (credit risk), but because its own processes, people, systems, and external shocks fail - and unlike the first two, this third risk cannot be hedged by trading.

Start with the dumbest question: why does a bank need a whole discipline for “things that go wrong”? Because every other risk can be offset in a market: if you are long the stock, you sell it or buy a put; if you hold a loan, you buy a CDS. But there is no liquid market in “our settlement system crashes” or “a trader fakes positions.” Operational risk is the residual, non-hedgeable layer, and the only tool you have to survive it is capital set aside against its tail. So the whole subject reduces to: how much capital do you need so that, in a bad year, the losses that show up are survivable?

Three steps:

1. Operational losses are random in two ways. In any year the number of loss events is uncertain, and so is the size of each event. “About 20 events, each around €30k, but occasionally one hits €500k” - that double randomness is the frequency–severity decomposition, and it is the foundation of every model that follows.

2. The average loss is cheap; the tail is not. Expected loss (about €0.6M/yr in our running example) is almost trivial next to the 99.9% loss (about €1.35M), which is itself trivial next to the loss for a fat-tailed severity (€7.9M). Operational risk is not a central-tendency problem - it is a tail problem.

3. Regulators forced a number on an unmeasurable tail. Because no market prices operational risk, the Basel Committee invented the convention: hold capital for the loss exceeded only 0.1% of the time over a one-year horizon, plus your expected loss. That 99.9%/1-year “soundness standard” (Basel II AMA ¶667) is the number that defines the discipline - arbitrary, but universally binding.

---

2. Mathematical Ground Truth & Derivations

The official definition (Basel II ¶644, preserved verbatim in Basel III d424): “Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.”

Parse it term by term - each is a modelling boundary:

• inadequate or failed internal processes → Execution, Delivery & Process Management (settlement failures, data errors);
• people → Internal Fraud, Employment Practices & Workplace Safety (rogue traders, discrimination suits);
• systems → Business disruption & system failures (hardware/software/telecom outages);
• external events → External Fraud, Damage to Physical Assets (hacking, floods, terrorism).

The definition includes legal risk (fines, punitive damages) but excludes strategic and reputational risk - because strategic decisions (enter a market, exit a business) and reputation damage have no clean, causally-linked loss process to model. This is not pedantry: the boundary of the definition is also the boundary of what the capital model must capture.

The double-randomness structure. Write the annual loss as

$$S=\sum _{i=1}^N{X}_i,$$

where $N$ is the (random) number of loss events in the year and $X_i$ the size of the $i$-th. The two random objects play different roles:

• Frequency $N$: a count process. The workhorse is the Poisson distribution, $N\sim \text{Poisson}(\lambda )$ with $\mathbb{P}(N=n)=e^{-\lambda }{\lambda }^n/n!$, mean and variance both $\lambda$. It is the “default” because under mild mixing conditions rare-event counts are Poisson (the Poisson limit of binomial counts), and it has exactly one parameter to estimate.
• Severity $X_i$: positive and right-skewed. The key structural fact is that operational severities are heavy-tailed - the probability of a very large single loss decays like a power law, not exponentially. Lognormal is the lightest defensible choice; Pareto/GPD (see EVT & Fat Tails) captures the true tail.

Why frequency and severity must be separated. One cannot model ”$S$ directly” from raw annual totals because you would have, say, 20 annual data points - far too few to pin down a 99.9% quantile. Splitting into “how often” and “how big” multiplies the usable data (every event is a severity observation) and isolates the part that drives the tail. This decomposition is the Loss Distribution Approach.

---

3. Computational Implementation - simulate the two sources of randomness separately

The cleanest way to see the frequency–severity split: simulate both, then watch the aggregate. Stdlib only.

Notice: the count wanders around 20 (it is random!), and each event’s size differs. The annual total is the sum of a random number of random sizes - precisely the object LDA models. This is the whole architecture on one screen.

---

4. Failure Modes & First-Principles Breakdowns

1. “Just average the years.” Averaging 20 annual totals to get a capital number uses ~20 data points to answer a question about the 0.1% tail - statistically hopeless. Frequency–severity separation exists precisely to avoid this; treat any model that skips it with suspicion.
2. Conflating the definition’s boundaries. A fine is operational (legal risk is included); losing a client because of bad press is reputational (excluded); choosing a doomed strategy is strategic (excluded). Misclassifying a loss changes the data pool and therefore the tail estimate.
3. Treating op risk like market risk. There is no volatility to EWMA, no portfolio to rebalance. Because losses cannot be offset by trading, “hedging” means capital and insurance, never a hedge - a beginner who reaches for VaR-on-positions has grabbed the wrong toolkit (that belongs to VaR & ES).
4. The double-randomness is not optional. Collapsing frequency and severity into one object discards the data that makes the tail estimable. If you model only $S$, you have already lost to the data-scarcity problem (05 · Failure Modes).

---

5. References

• BCBS, Basel II (2006), ¶644
• Hull, Risk Management and Financial Institutions (5th ed., 2018), operational-risk chapter
• Panjer, Operational Risk: Modeling Analytics (2006)

---

6. Connected Graph Bridges

• Base: Probability & Measure Theory · Statistics & Inference
• Continue: 02 · Loss Event Types · 03 · Frequency–Severity · Index Hub
• Sibling: VaR & Expected Shortfall (why the market-risk measure toolkit does not transplant here)