Operational risk stress testing: Challenges and approaches

Over the course of the last three decades, arguably, operational risk’s most important characteristic has been its sensitivity to economic shocks, making it correlated with both credit and market risk losses. Outside of periods of economic stress it is decidedly idiosyncratic. This sensitivity is underpinned by very complex interactions between rapid and significant changes in economic metrics and human behaviours. Consequently, while stress testing operational risk is clearly important, it remains challenging for companies and regulators alike. In order to address this problem, this paper analyses historical loss data to demonstrate that economic shocks may variously influence the occurrence of operational risk events, trigger the detection of both historical and on-going events, and exacerbate the severity of any resulting losses. This leads to a variety of inherent challenges for quantifying this economic sensitivity, including the difficulties of predicting how the behaviours of different stakeholders may change, and also of assessing the detection of previously unknown issues. Additionally, existing Pillar 1 and 2A capital requirements may already reflect operational risk losses suffered during previous economic shocks, as there is no recognised methodology for excluding operational risk losses that are sensitive to economic shocks from a bank’s minimum capital requirements. There are a range of differing approaches to stress testing propounded by the Bank of England (BoE)/the Prudential Regulation Authority (PRA), the European Banking Authority (EBA) and the US Federal Reserve, which variously address these challenges. This paper concludes that there is no magic bullet, and hence it proposes that companies triangulate between a portfolio of approaches, including qualitative and quantitative assessments, stressed modelled losses, and the EBA’s floor calculations. It also suggests that the balance between minimum capital requirements and loss-absorbing buffers should be fundamentally shifted to reflect how operational risk actually behaves, to address the current double counting of stresses within Pillar 1 and 2A capital requirements, and to make operational risk capital more useable by banks. Finally, a significant part of the value of the stress testing process arises from companies identifying their vulnerabilities and determining the mitigating actions that need to be taken at the outset and during an economic shock.