At present, there is no agreed upon universal definition of operational risk. Many banks have defined operational risk as any risk not categorised as market or credit risk and some have defined it as the risk of loss arising from various types of human or technical error. Many respondent banks associate operational risk with settlement or payments risk and business interruption, administrative and legal risks. Several types of events (settlement, collateral and netting risks) are seen by some banks as not necessarily classifiable as operational risk and may contain elements of more than one risk. All banks see some form of link between credit, market and operational risk. In particular, an operational problem with a business transaction (for example, a settlement fail) could create market or credit risk. While most banks view technology risk as a type of operational risk, some banks view it as a separate risk category with its own discrete risk factors.

The majority of banks associate operational risk with all business lines, including infrastructure, although the mix of risks and their relative magnitude may vary considerably across businesses. Six respondent banks have targeted operational risk as most important in business lines with high volume, high turnover (transactions/time), high degree of structural change, and/or complex support systems. Operational risk is seen to have a high potential impact in business lines with those characteristics, especially if the businesses also have low margins, as occurs in certain transaction processing and payments-system related activities. Operational risk in trading activities was seen by several banks as high. A few banks stressed that operational risk was not limited to traditional "back office" activities, but encompassed the front office and virtually any aspect of the business process in banks.

Measurement

Most banks that are considering measuring operational risk are at a very early stage, with only a few having formal measurement systems and several others actively considering how to measure operational risk. The existing methodologies are relatively simple and experimental, although a few banks seem to have made considerable progress in developing more advanced techniques for allocating capital with regard to operational risk.

The experimental quality of existing operational risk measures reflects several issues. The risk factors usually identified by banks are typically measures of internal performance, such as internal audit ratings, volume, turnover, error rates and income volatility, rather than external factors such as market price movements or a change in a borrower's condition. Uncertainty about which factors are important arises from the absence of a direct relationship between the risk factors usually identified and the size and frequency of losses. This contrasts to market risk, where changes in prices have an easily computed impact on the value of the bank's trading portfolio, and perhaps to credit risk, where changes in the borrower's credit quality are often associated with changes in the interest rate spread of the borrower's obligations over a risk-free rate. To date, there is little research correlating those operational risk factors to experience with operational losses.

Capturing operational loss experience also raises measurement questions. A few banks noted that the costs of investigating and correcting the problems underlying a loss event were significant, and in many cases, exceeded the direct costs of the operational losses. Several banks talked in terms of possibly two broad categories of operational losses. Frequent, smaller operational losses such as those caused by occasional human errors are seen as common in many businesses. Major operational risk losses were seen to have low probabilities, but an impact that could be very large, and perhaps exceed those of market or credit risks. Banks varied widely in their willingness to discuss their operational loss experience, but only a handful acknowledged the larger losses.

Measuring operational risk requires both estimating the probability of an operational loss event and the potential size of the loss. Most approaches described in the interviews rely to some extent on risk factors that provide some indication of the likelihood of an operational loss event occurring. The risk factors are generally quantitative but may be qualitative and subjective assessments translated into grades (such as an audit assessment). The set of factors often used includes variables that measure risk in each business unit, for instance grades from qualitative assessments such as internal audit ratings, generic operational data such as volume, turnover and complexity, and data on quality of operations such as error rate or measures of business riskiness such as revenue volatility. Banks incorporating risk factors into their measurement approach can use them to identify businesses with higher operational risk.

Ideally, the risk factors could be related to historical loss experience to come up with a comprehensive measurement methodology. A few banks have started collecting data on their historical loss experience. Since few firms experience many large operational losses in any case, estimating a historical loss distribution requires data from many firms, especially if the low-probability, large-cost events are to be captured. Another issue that arises is whether data from several banks or firms come from the same distribution. Some banks interviewed had created a proprietary database of external loss experiences and other banks interviewed expressed interest in access to such data. Banks may choose different analytical or judgmental techniques to arrive at an overall operational risk level for the firm. Banks appear to be taking interest in how some insurance risks are measured as possible models for operational risk measures.

Risk monitoring

More banks have some form of monitoring system for operational risk than have formal operational risk measures. Many banks interviewed monitor operational performance measures such as volume, turnover, settlement fails, delays and errors. Several banks monitor operational losses directly, with an analysis of each occurrence and a description of the nature and causes of the loss provided to senior managers or the board of directors.

Many banks interviewed are in the process of reviewing their current risk methodologies to accommodate improved measurement and reporting of operational risk and the development of an on-line monitoring system. The time lines for such efforts vary widely, with some banks currently implementing segments of new systems and other banks still in the planning stages. A significant number of other banks interviewed are not contemplating changes to their management information systems because the bank believes its current methodology serves it well. One bank has recently implemented a new risk policy framework but stated that it was too soon to assess its effectiveness. Contrary to most respondents, one bank stated that it was satisfied with its current information systems for capturing and reporting operational risk.

Control of operational risk

A variety of techniques are used to control or mitigate operational risk. As discussed below, internal controls and the internal audit process are seen by virtually all banks as the primary means to control operational risk.

Banks touched on a variety of other possibilities. A few banks have established some form of operational risk limits, usually based on their measures of operational risk, or other exception reporting mechanisms to highlight potential problems. Some banks mentioned the importance of contingent processing capabilities as a means to mitigate operational risk.

Some banks surveyed cited insurance as an important mitigator for some forms of operational risk. Several banks have established a provision for operational losses similar to traditional loan loss reserves now routinely maintained. Several banks are also exploring the use of reinsurance, in some cases from captive subsidiaries, to cover operational losses. One bank noted that the insurer would have to quantify the amount of risk in the policy and that could provide an approach to measuring operational risk.