1. Sydney December 11, 2006 Seite 1 AMAzing Results first lessons from implementations of Basel II RISK 07 Gerhard Stahl, BaFin

2. Sydney December 11, 2006 | 11.06.2015Seite 2 Database Modelling Data Model Operational Loss Data Key Control Indicators Control Environment Factors data sources: internal data external consortium external collection of publicly known cases

3. Sydney December 11, 2006 | 11.06.2015Seite 3 Database Modelling data quality assurance: internal data: data collection processes external consortium: the custodian’s quality assurance external publicly known: collection bias identification of relevant loss data: boundary to credit, market, timing or irrelevant losses “acceptance” and possibly splitting of losses: assigning external losses to own business lines key risk indicators / control environment factors: often less reliable as an input to modelling nevertheless important risk control

4. Sydney December 11, 2006 | 11.06.2015Seite 4 Stochastic Modelling Extreme Value Theory SeverityFrequency OpVaR issues: extrapolation beyond experience (to the 1000-year event) how to “back-test” “merging” of internal and external data, bias removal infinite mean models?

5. Sydney December 11, 2006 | 11.06.2015Seite 5 facts: almost all data external three models: internal, logNormal, Pareto 1000-year event (regulatory capital) at the edge of the experience (all external data combined!) 5000-year event (economic capital) is beyond any experience

6. Sydney December 11, 2006 | 11.06.2015Seite 6 facts: blue line is model, black dots are internal data model is not conservative in this BL/ET cell 1000-year event (regulatory capital) is beyond internal experience: corresponds to 0.6bp in this graph! again: need to extrapolate from real loss experience to far tail -> “shape factor”

7. Sydney December 11, 2006 | 11.06.2015Seite 7 facts: POT method, GPD fit, estimate of the shape factor for various tresholds one cell of the BL/ET matrix fit “looks good” but xi>1 means infinite mean! Embrechts & Nesl.: mixing of incomparable data ?

8. Sydney December 11, 2006 | 11.06.2015Seite 8 Current state of OpRisk modelling at banks...... lags business practice in P/C insurance: little to none explicit modelling of accumulation alias dependencies little to none modelling of “exposure” (tiny step would be to replace gross loss modelling by loss ratios) little to none modelling of “explaining variables” (e.g. US versus non-US business) risk models are qualitatively ill-prepared to allow optimization of insurance coverage no modelling of “reserve risk”

9. Sydney December 11, 2006 | 11.06.2015Seite 9 Operational Risk Management Operational Risk Reporting, Control and Management Stress Testing and Scenario Analysis aggregation allocation to business lines qualitative adjustments self-assessments own scenarios