Journal of Operational Risk

Marcelo Cruz

Editor-in-chief

Welcome to the fourth issue of Volume 19 of The Journal of Operational Risk.

Lately, I have discussed the issue of operational resilience with a number of industry practitioners, as the Basel Committee on Banking Supervision recently issued a consultative paper with new proposals. Operational resilience is a critical component of managing operational risk, especially in the face of escalating threats such as cybersecurity breaches and IT system failures as well as other technological disruptions. It focuses on an organization’s ability to prepare for, respond to and recover from adverse events while maintaining essential business operations. With the increasing dependence on digital infrastructure, vulnerabilities in cybersecurity and IT systems pose significant risks, including data breaches, ransomware attacks and service outages. Operational resilience ensures that organizations can identify these risks proactively, can implement robust mitigation strategies and can sustain critical functions even under duress. By fostering resilience, organizations not only safeguard their reputation and customer trust but also enhance their regulatory compliance and long-term business continuity, making this a vital strategy in the modern risk landscape. The Basel Committee’s proposals to strengthen operational resilience, introduced in July 2024, concern, in particular, banks’ reliance on third=party service providers. The proposals require bank board directors to take ultimate responsibility for outsourced services and for ensuring robust risk management practices to mitigate potential outages and disruptions to customer services. The Basel Committee outlined 12 principles for banks and their regulators, emphasizing the need for the thorough documentation of key decisions and comprehensive oversight of third-party arrangements. We welcome submissions that discuss this subject.

The editorial board would also be interested to see papers submitted in other areas, including applications of machine learning (ML) techniques and artificial intelligence (AI) – one of the industry’s hot topics – as well as on cyber and IT risks (not just their quantification but also on better ways to manage them), and on enterprise risk management (ERM) and everything this broad subject encompasses (eg, establishing risk policies and procedures, implementing firmwide controls, risk aggregation, revamping risk organization, internal audit). Analytical papers on operational risk measurement are also welcome, particularly those that focus on stress testing and managing operational risk.

These are certainly exciting times! The Journal of Operational Risk, as the leading publication in this area, aims to be at the forefront of OpRisk discussions and we welcome papers that shed light on all of the above topics.

RESEARCH PAPERS

In the first paper in this issue, “Operational risk modeling under the loss distribution approach: estimation of operational risk capital by business line versus risk category”, Hrair Danageuzian and Ré-Mi Hage model operational risk data via the loss distribution approach under Basel II. Their open-source operational risk data consists of 3192 operational loss events between 2009 and 2018. The authors’ approach is implemented first by business line and then by risk category. For each case the capital requirement is determined using the RSTUDIO environment in the R programming language. Danageuzian and Hage identify significant differences between the yearly capital requirements obtained for each of the two cases. They also consider the whole ten-year period and calculate a weighted average of the yearly capital charges. Their business-line method records a capital charge that is around 15% lower than the risk-category method. Ultimately, to reduce the impact of operational risk, use of the larger of the two capital charges is recommended for the year following the sampled period. The authors’ findings should provide a better understanding of the composition and distribution of operational risk data across risk classes and the corresponding operational risk capital requirements.

The issue’s second paper, “Determination of the fraction of losses and their probabilities by type of risk and business line from aggregate loss data”, Argimiro Arratia and Henryk Gzyl note that Basel III rules require financial institutions to report operational losses and detail them in a database. Operational losses should be classified by the Basel II-determined risk types and also by line of business. While the operational risk capital requirement is now calculated using the standardized measurement approach (SMA) based on gross income, the collected data is nevertheless still useful for risk management purposes. However, the frequency of losses and the incurred losses per line of business and risk type may only be available in aggregate form, and this data needs to be disaggregated for better risk management. The authors propose a disaggregation method to derive the individual loss severities and the frequency of these losses per business line and risk type. This information can be useful to the risk manager because it highlights where their attention should be focused to manage operational risk. The mathematical problem in each case is similar to that of reconstructing a joint probability from its marginals. Arratia and Gzyl solve this problem by minimizing a convex objective function (which happens to be an entropy of the Fermi–Dirac type) subject to the appropriate constraints. Their method is nonparametric and model-free, and therefore it does not require parameters to be fitted.

In “Operational risks: trends and challenges”, our third paper, Emelly Anne Silva de Lima and Maria Silene Alexandre Leite provide a panoramic view of the current state of research on operational risk in financial institutions with the aim of providing different perspectives on the subject. They examine a sample of journal articles through a systematic literature review using VOSVIEWER. Their results indicate a multidisciplinary interest in the topic. Of note are the searches to reduce the monetary value of capital for operational risk management (as recommended by Basel II), the cascading response to such events, the recent emphasis on reputational damage to financial institutions, and approaches that make use of AI (brought about by advances in technology).

In the issue’s fourth paper, “Operational risk and non-life insurers’ performance”, Joseph Oscar Akotey, Anthony Boakye Appiagyei and Godfred Aawaar use three methods (operational lapses, the cost-income ratio and the basic indicator approach) to measure operational risk in the non-life insurance sector in Ghana. They then use a system generalized method of moments (GMM) regression to evaluate how these measures of operational risk affect the overall performance of the country’s non-life insurance industry. The data for the study was collected from the audited annual financial reports of 16 non-life insurers covering the period 2013–21, while their operational lapse data was collected from the database of the National Insurance Commission, the country’s insurance regulator. The paper’s findings show that operational lapses and the cost-income ratio have significant adverse effects on premium growth and financial performance. The effect of operational lapses is negative at both the firm and industry levels. This implies that the lapses of an individual firm are not confined to its specific performance but have cascading effects on the entire industry. These findings have implications for changes in insurers’ business models to improve customers’ confidence and reduce operational cost. Insurers generally obtain earnings from two main sources: investment income and underwriting profit. Currently, investment income is the industry’s “life support” due to huge underwriting losses. However, the debt exchange program initiated by the government of Ghana may wipe out the industry’s investment earnings. Hence, significant improvements in insurers’ operations are urgently needed to reduce operational losses and raise underwriting profits.