White Paper:

FINANCIAL SERVICES

SCENARIO ANALYSIS FOR BASEL II

OPERATIONAL RISK MANAGEMENT
 SCENARIO ANALYSIS FOR
BASEL II OPERATIONAL RISK MANAGEMENT

IN THIS WHITE PAPER:

INTRODUCTION: SCENARIO ANALYSIS

FOR POTENTIAL CATASTROPHIC LOSSES 2
ADDRESSING OPERATIONAL RISK 3
SCENARIO ANALYSIS IN A RISK
MEASUREMENT FRAMEWORK 5
SCENARIO ANALYSIS IN A RISK
MANAGEMENT FRAMEWORK 6
ACHIEVING RISK MEASUREMENT
AND MANAGEMENT 7
CONCLUSION: BENEFITTING FROM
SCENARIO ANALYSIS 8

The New Basel Capital Accord requires financial insti-

tutions to include operational risk with the traditional
categories of credit risk and market risk that are
currently used to estimate capital requirements.
Scenario analysis can be an indispensable part of an
effective operational risk management program, if
carefully designed and integrated into an institution’s
framework for risk measurement and management.
BearingPoint’s professionals have identified key factors
in designing and implementing effective scenario anal-
ysis programs for large financial organizations.

WHITE PAPER 1
 SCENARIO ANALYSIS FOR BASEL II OPERATIONAL RISK MANAGEMENT

attending, gave them a brief overview of regula-

INTRODUCTION: SCENARIO ANALYSIS FOR
tory requirements, explained the business value of
POTENTIAL CATASTROPHIC LOSSES
the exercise and urged them to think creatively
about potentially large losses.
“Are you saying that you want us to figure out how
to lose $10 million?”, asked the risk manager for
At first the group was reluctant and said that they
the fund technology and services unit of a large
couldn’t think of any set of factors or circumstances
bank. “Obviously, you have no idea how our funds
that would cause a loss of such high magnitude.
are managed or what extreme measures we take to
The business unit manager stated that they were a
make sure that no money is lost.”
support function and did not book losses, “Fraud
is nonexistent in our world. We don’t have trans-
With a hint of pride in his voice, he added, “You action instruments such as credit cards, so we are
know our monthly losses are only in the hundreds typically not targeted by hackers. And our transac-
of dollars, even though we handle billions of dol- tions have good checks and balances, so errors are
lars on average. We are able to do this because typically low.”
we have sound procedures for money manage-
ment, prudent guidelines for investing and highly
After discussing and rejecting a few scenarios, it
trained personnel.”
appeared that the group had reached an impasse.
To spur additional creative thinking, Susan asked if
Not easily dissuaded, Susan, the scenario analysis a few of them could collude to defraud the bank.
manager, responded by acknowledging the risk At this point, the systems and technology manager
manager’s success. However, she urged him to said that he alone could defraud the bank and did
identify a group of key personnel to participate in not need to collude with anyone.
a scenario analysis exercise. The goal of this exercise
would be to identify potential scenarios that could
He added, “I have complete access to customer
create losses above the $10 million threshold,
data tapes and control over their disposal. I can
which had been established for identifying low-
easily look at transaction history over several years
probability, high-severity losses.
and know which accounts are dormant and which
are active — this information, which includes buy-
She added that such scenarios were being devel- ing characteristics, is valuable for the identity theft
oped across the financial institution because of market. I could take tapes from a while back, cre-
heightened emphasis on risk management and ate a disposal trail with fakes, sell the information,
compliance. Although he was skeptical, the risk and no one would ever know how it happened or
manager identified the business unit manager, who did it.”
compliance manager, customer relations manager,
systems and technology manager, and fund
Just by watching the faces of the participants,
operations manager to participate in the exercise.
Susan saw that she had been successful in identify-
ing a potential loss scenario and thanked the
Based on her earlier interaction with the risk man- systems and technology manager for his input
ager, Susan anticipated that she would have to use in developing a scenario under the Basel loss
all her facilitation skills to get the group to do some category, Internal Fraud, Theft and Fraud.
unconstrained thinking. She thanked everyone for

2 BEARINGPOINT
 SCENARIO ANALYSIS FOR BASEL II OPERATIONAL RISK MANAGEMENT

The scenario analysis manager asked the group ADDRESSING OPERATIONAL RISK
of key personnel if a few of them could
collude to defraud the bank. The systems and
By including operational risk in the calculation
technology manager said that he alone could
metrics for the New Capital Accord, Basel II has
defraud the bank and did not need to collude
with anyone. recognized that credit and market risks are not
the only exposures that a bank may face. The
complexity of calculating operational risk is, how-
Several recent events lend credence to such a hypo- ever, compounded by the fact that the internal loss
thetical loss scenario: history of a financial institution does not
adequately account for all the operational risks and
• ChoicePoint acknowledged selling data on over exposures faced by that institution.
140,000 customers to an identity theft ring.

• Bank of America admitted to losing tapes with To augment internal experiential data, Basel II
customer identifiers and account information. recommends that financial institutions look to
external events and scenarios. External loss data
• Citigroup confirmed that UPS had lost
cannot be readily used in capital calculations due
computer tapes containing information on
to the inherent shortcomings of the reliability of
nearly 4 million customers while they were in
loss information and applicability of loss events to
transit to the bank’s credit bureau.
other institutions with different control environ-
ments. Additionally, there are several difficulties
Financial institutions have always recognized the associated with scaling loss events to institutions
importance of safeguarding customer data. of different sizes. The extrapolation of recent loss
However, the impact of data compromise has events (i.e., internal loss data) to create a theoreti-
increased substantially as identities have migrated cal loss distribution has similar problems.
from visual to digital. Scenarios like the ones
mentioned above have become significant due to
never-before-seen levels of regulatory fines and The New Basel Capital Accord (Basel II) requires
financial institutions to develop a comprehen-
litigation expenses.
sive loss distribution so that they can more accu-
rately estimate their risk profile and reserve
The New Basel Capital Accord (Basel II) requires requirements. In particular, Basel II adds opera-
financial institutions to develop a comprehensive tional risk to the traditional categories of credit
risk and market risk that are currently used to
loss distribution so that they can more accurately
estimate capital requirements.
estimate their risk profile and reserve require-
ments. In particular, Basel II adds operational risk
to the traditional categories of credit risk and Internal and external loss events can, however,
market risk that are currently used to estimate help stimulate ideas for loss scenarios. Creating
capital requirements. scenarios addresses the problem of scalability and
provides a mechanism to confirm relevance and
appropriateness. As a result, these scenarios better
reflect the significant operational risks that an
institution may face, and it would be inappropriate

WHITE PAPER 3
 SCENARIO ANALYSIS FOR BASEL II OPERATIONAL RISK MANAGEMENT

Transaction
Model

FIGURE 1. LOSS DISTRIBUTION

Controls and mitigants help reduce loss

Probability of loss

Allocate capital Insurance and business

BEFORE
against residual continuity plans help
unexpected loss reduce catastrophic loss

AFTER

Expected loss Unexpected loss Catastrophic loss

Reported and unreported Large write-offs
ongoing operating expenses covered by capital Severity of loss

to exclude such significant risks from capital estimate the probabilities and impacts of these
calculations. But many institutions are unprepared events should they occur. While this process has
for the inclusion of operational risk into the many advantages, it does have certain limitations,
capital framework because they do not have an largely centered on the high degree of variability
established methodology and system for capturing in the knowledge and participation of business
the multiple inputs that Basel II requires. This is experts. Further, research in behavioral finance
especially true for scenario analysis, one of the has shown that the human mind has little or no
rapidly emerging tools for measuring and manag- ability to estimate very rare occurrences with any
ing operational risk. degree of confidence.

Figure 1 shows an illustrative, theoretical loss dis-

tribution, identifying potential roles for controls,
“Scenario analysis is the process of developing hypothet-
ical loss scenarios along structured dimensions to enable mitigants, insurance and capital. Scenario analysis
business performance improvement, better risk manage- is designed to address the right tail of such a
ment and capital calculation.” loss distribution, particularly the “unexpected loss”
– Basel Committee on Banking Supervision section. While the catastrophic loss section of the
distribution is important in attempting to measure
the impact of rare events such as the terrorist
attacks of September 11, 2001, it is the unexpect-
The scenario analysis process consists of using ed loss section where scenario analysis can provide
groups of business experts to generate feasible, the greatest insight into the potential for losses.
low-probability, high-severity loss events and to

4 BEARINGPOINT
 SCENARIO ANALYSIS FOR BASEL II OPERATIONAL RISK MANAGEMENT

FIGURE 2. APPLICABILITY OF OPERATIONAL RISK MANAGEMENT TOOLS

Scenario analysis
High
Impact of loss event

Out of business
External data
Low

Loss data collection Key risk indicators

Risk and control assessment Monitoring and reporting

Low High

Frequency of loss event

The matrix in Figure 2 shows the potential appli- bility. The risk of rare, catastrophic loss is difficult
cability of operational risk management tools to measure by other means, and it is one of the
across the four quadrants, which characterize the required inputs to an institution’s operational risk
frequency and severity, or impact, of loss events. measurement framework under Basel II.

As the matrix demonstrates, traditional risk man-

agement tools have focused on the two bottom Scenario analysis can be a powerful tool to
quadrants and have typically not been able to cover help address this gap because measuring and
the top left quadrant. Scenario analysis can be a managing low-probability, high-severity risks
powerful tool to help address this gap because is inherently difficult by other means. The
value of scenario analysis primarily reveals itself
measuring and managing low-probability, high-
in two main areas: risk measurement and risk
severity risks is inherently difficult by other means. management.
The value of scenario analysis primarily reveals
itself in two main areas: risk measurement and risk
management.
Of course, the use of scenario analysis in risk
measurement has problems of its own. A large
SCENARIO ANALYSIS IN A RISK body of academic literature on the topic shows that
MEASUREMENT FRAMEWORK humans are notoriously poor at estimating the
probabilities of tail events and are prone to
The use of scenario analysis in measuring opera- systematic errors. These errors are likely to skew
tional risk has increased in popularity and visi- the results of scenario analysis in ways that

WHITE PAPER 5
 SCENARIO ANALYSIS FOR BASEL II OPERATIONAL RISK MANAGEMENT

may dramatically overestimate or underestimate compromise of customer data. This loss may
operational risk. In general, people estimating low- manifest itself as either litigation or a compliance
probability events will either estimate a near-zero fine. Given the number of such incidents over the
probability or treat low-probability events as if they last few years, it is not inconceivable to envision a
were much more likely than what they really are. scenario where 100,000 customer records are lost
Humans have also been shown to be insensitive to and the legal settlement is $1,000 per customer,
small differences in risks. Yet a small absolute leading to a total loss of $10 million. Add to this
difference in the probability of a tail event can the compliance fine and legal expense, and the loss
make a major difference in the expected value of rises well above the threshold. For such a situation,
that event. one may hypothetically derive an expected value
of, say, $20 million and a probability of one event
Alternative approaches have their own limitations. in 10 years, accounting for the prevailing control
The scaling of external loss data suffers many environment.
inherent shortcomings, including the reliability of
the loss information, the applicability of the loss
The scenario analysis process is used to ask the
event to other institutions and problems in scaling
fundamental question, “What can go wrong?”
losses to fit institutions of different sizes. The in a structured, methodical fashion. By bringing
extrapolation of recent loss events to create a theo- together a variety of perspectives, a much fuller
retical loss distribution has similar problems. range of risks can be identified. And by more
fully considering various possible negative out-
comes, plans can be changed to either avoid the
Despite these limitations, Basel II requires the occurrence of negative events or mitigate their
measurement of operational risk, including the risk impact.
of low-probability, high-severity events and the use
of scenario analysis in the calculation of this risk.
Successfully measuring operational risk requires a
well-designed scenario analysis process, the use of SCENARIO ANALYSIS IN A RISK
multiple inputs to the measurement calculation, MANAGEMENT FRAMEWORK
and a robust risk measurement and calculation
framework. The true value of scenario analysis lies in its ability
to allow organizations to manage risks more effec-
tively. Scenario analysis can help identify areas that
Successfully measuring operational risk requires managers believe are exposed to risk and justify the
a well-designed scenario analysis process, the allocation of resources to aid process re-engineer-
use of multiple inputs to the measurement cal-
ing and the development of appropriate controls
culation, and a robust risk measurement and cal-
culation framework.
and mitigation plans. It is important to examine
all business areas for potential scenarios, even if
they seem improbable because of the control
For example, a lost or stolen PC, which contains environment. Typically, large losses occur not
customer information such as account numbers, because controls are lacking, but because multiple
names and social security numbers, has the poten- controls have failed or been circumvented.
tial to create an operational loss because of the

6 BEARINGPOINT
 SCENARIO ANALYSIS FOR BASEL II OPERATIONAL RISK MANAGEMENT

The scenario analysis process is used to ask the and by the control and mitigation processes that
fundamental question, “What can go wrong?” in a are initiated. In other words, the very act of exam-
structured, methodical fashion. How often in our ining risk can reduce risk.
own professional lives have we seen something
unforeseen occur that disrupts the best laid plans?
Yet often, someone had thought of the risk, but ACHIEVING RISK MEASUREMENT AND
either that person hadn’t been asked about it, MANAGEMENT
or they had not fully considered the possibility.
By bringing together a variety of perspectives, a To some extent, simply engaging in a scenario
much fuller range of risks can be identified. And analysis exercise will achieve the dual goals of risk
by more fully considering various possible negative measurement — through the estimation of magni-
outcomes, plans can be changed to either avoid tude and probability of loss —and risk manage-
the occurrence of negative events or mitigate ment— as managers will go back and think of
their impact. ways to lower the probability or impact of the
loss event.
Scenario analysis plays a key role in the identifica-
tion of rare, high-severity risk events. In a robust This was clearly evident in one scenario analysis
risk management framework, the identification of effort where the participants identified a large loss
these risks initiates a comprehensive control and due to a duplicate wire sent overseas that was not
mitigation process. The benefits of effectively con- recoverable. The expected loss was around $10
trolling and mitigating risks directly impact the million and the probability was estimated as one
long-term bottom line of the organization. event in five years. As the group dug in to define
the scenario better, it recognized that the duplicate
wire could be generated in many different ways
and that the loss always involved not being able to
In a robust risk management system, it is diffi-
cult to simultaneously identify and measure a recover the wire.
risk because the measure of a risk is impacted by
the process of identification and by the control
For risk measurement purposes, they got the
and mitigation processes that are initiated. In
numbers; and, for risk management purposes, they
other words, the very act of examining risk can
reduce risk. were able to identify a point of inflection that
would help them drive process efficiency and
effectiveness. A suitable refinement in the control
environment, either the addition of new controls
However, the impact is often hard to measure. For or improvement of existing ones, could directly
example, how is the impact of an avoided loss reduce the probability of occurrence for such a large
measured? In quantum physics, it is impossible to loss event, which in turn would lower the capital.
determine the velocity and location of an object
simultaneously. Similarly, in a robust risk manage-
ment system, it is difficult to simultaneously iden-
tify and measure a risk because the measure of a
risk is impacted by the process of identification

WHITE PAPER 7
 SCENARIO ANALYSIS FOR BASEL II OPERATIONAL RISK MANAGEMENT

CONCLUSION: BENEFITTING FROM BUSINESS AND SYSTEMS ALIGNED.

SCENARIO ANALYSIS BUSINESS EMPOWERED.

Industry studies suggest that a large U.S. bank BearingPoint is a leading global business advisor,
could increase pre-tax net income between 1 per- systems integrator and managed services provider.
cent and 9 percent through the implementation Our experienced professionals help organizations
of more effective operational risk management around the world set direction to reach their goals
programs. In many ways, financial institutions and create enterprise value. By aligning their
have greater ability to influence operational risk business processes and information systems, we
than other types of risk. Six Sigma and similar con- empower our clients with the right business solu-
tinuous improvement efforts can help reduce tions to gain competitive leadership advantage —
losses and risks from low-severity events, while delivering results in an accelerated time frame.
scenario analysis can help anticipate and minimize To learn more, contact us at 1.866.BRNGPNT
the impact of low-probability, high-severity events. (+1.703.747.6748 from outside the United
States and Canada) or visit our Web site at
Scenario analysis can be an indispensable part of www.bearingpoint.com.
an effective operational risk management program,
if carefully designed and integrated into a financial
institution’s framework for risk measurement and
management. It requires that the financial institu-
tion commit to conducting structured brain-
storming sessions that are typically facilitated by
risk professionals, whether internal or external.
This exercise requires significant effort the first
time around. However, updates are largely incre-
mental and not burdensome.

Other industry research has shown that large losses,

especially those that impact reputation risk, have
the potential to erode an institution’s market value
over time unless public perception of the loss is
managed carefully. Implementing a scenario analy-
sis program is a significant step toward anticipating
large losses, developing a strategy to manage mar-
ket perception of such losses, fulfilling compliance
requirements and protecting some of the currently
unrealized income.

8 BEARINGPOINT
STRATEGY, PROCESS & TRANSFORMATION | CUSTOMER RELATIONSHIP MANAGEMENT | SUPPLY CHAIN MANAGEMENT
ENTERPRISE SOLUTIONS | TECHNOLOGY INFRASTRUCTURE & INTEGRATION | MANAGED SERVICES

BearingPoint | 1676 International Drive | McLean, VA 22102

1.866.BRNGPNT
www.bearingpoint.com

©2005 BearingPoint, Inc. All rights reserved. Printed in the United States. C3169 FS-0605-01-USRD559