Mixing internal and external data for managing operational risk
Antoine Frachot∗ and Thierry Roncalli Groupe de Recherche Op´rationnelle, Cr´dit Lyonnais, France e e This version: January 29, 2002
1
Introduction
According to the last proposals by the Basel Committee [1], banks are allowed to use the Advanced Measurement Approaches (AMA) option for the computation of their capital charge covering operational risks. Among these methods, the Loss Distribution Approach (LDA) is the most sophistic
Mixing internal and external data formanaging operational risk
Antoine Frachot
∗
and Thierry RoncalliGroupe de Recherche Op´erationnelle, Cr´edit Lyonnais, FranceThis version: January 29, 2002
1 Introduction
According to the last proposals by the Basel Committee [1], banks are allowed to use the AdvancedMeasurement Approaches (
AMA
) option for the computation of their capital charge covering operational risks. Among these methods, the Loss Distribution Approach (
LDA
) is the most sophisticatedone (see
Frachot
,
Georges
and
Roncalli
[2001] for an extensive presentation of this method). Itis also expected to be the most risk sensitive as long as internal data are used in the calibration processand then LDA is more closely related to the actual riskiness of each bank. However it is now widelyrecognized that calibration on internal data only does not suﬃce to provide accurate capital charge.In other words, internal data should be supplemented with external data. The goal of this paper is toaddress issues regarding the optimal way to mix internal and external data regarding frequency andseverity.As a matter of fact, frequency and severity data must be treated diﬀerently as they raise ratherdiﬀerent issues. Considering one speciﬁc bank, its internal frequency data likely convey informationon its speciﬁc riskiness and the soundness of its risk management practices. For example, a bank whosepast frequencies of events are particularly good with respect to its exposition should be charged a lowercapital requirement than for an average bank. Unfortunately nothing ensures that this lowerthanaverage frequency does result from an outstanding risk management policy rather than from a “lucky”business history. If lowerthanaverage past frequencies happened by chance, charging a lowerthanaverage capital charge would be misleading. Comparing internal and external data is then a way toseparate what could be attributed to a sound risk management practice (which should be rewardedby lowerthanaverage capital charge) and what comes from a lucky course of business (which hasno reason to last in the future). As the last
QIS
exercise has highlighted the strong heterogeneity of capital allocations among banks, it is all the more important to decide whether a betterthanaveragetrack record of past frequencies results from sound risk management practices or should be suspectedto result from a lucky course of business. We here propose a rigorous way to tackle this issue througha statistical model refered as Credibility Theory in the insurance literature.In the same spirit, internal data on severity should be mixed with external data but for diﬀerentreasons. We assume here that internal severity data do not convey any information on internal riskmanagement practices. In this paper internal severity databases should be supplemented with externalseverity data in order to give a nonzero likelihood to rare events which could be missing in internaldatabases. Unfortunately mixing internal and external data altogether may provide unacceptableresults as external databases are strongly biased toward highseverity events. A rigorous statisticaltreatment is developped in the sequel to make internal and external data comparable and to makesure that merging both databases results in unbiased estimates of the severity distribution.
∗
Address:
Cr´edit Lyonnais – GRO, Immeuble ZEUS, 4
`e
´etage, 90 quai de Bercy — 75613 Paris Cedex 12 — France;
Email:
antoine.frachot@creditlyonnais.fr
1
2 Mixing internal and external frequency data
Mixing internal and external frequency data can be relied on the credibility theory which is at theroot of insurance theory. This theory tells how one should charge a fair premium to each policyholderconsidering the fact that policyholders do not have experienced the same history of claims. Achievinga fair pricing requires to compute how to relate a past history of claims either to a lucky (or unlucky)history or to an intrinsically lower (or greater) riskiness. According to the credibility theory, one mustconsider that policyholder riskiness is a priori unobserved but is partially revealed by the track recordof the policyholder. Then the past information recorded on one speciﬁc policyholder is viewed as ameans to reduce the a priori uncertainty attached to the policyholder riskiness. As a result, there isa discrepancy between the a priori probability distribution of riskiness (before any observation) andthe a posteriori probability distribution obtained by conditioning with respect to past information.This discrepancy between the two distributions is the basic foundation for a fair pricing. This idea isdevelopped in the context of the banking industry.
2.1 Computing the expected frequency of events
Considering one speciﬁc bank, let us focus on one business line and one type of events and note
N
t
the number of corresponding events at year
t
. Internal historical data (regarding frequency data) isrepresented by
N
t
, that is the information set consisting of past number of events
{
N
t
,N
t
−
1
,...
}
.Now deﬁne EI the exposition indicator (i.e. gross income) and make the standard assumption that
N
t
is Poisson distributed with parameter
λ
×
EI, where
λ
is a parameter measuring the (unobserved)riskiness of the bank. The key point is that supervisors should consider that the expected number of events for year
t
is
E
N
t

N
t
−
1
and not
E
[
N
t
]. The latter term relates to the “pure premium” if weuse insurance terminology while
E
N
t

N
t
−
1
is the expected number of events conditionally to thetrack record of the bank. As an example, let us assume that the bank has experienced lowerthanaverage
N
s
for
s < t
; this track record likely conveys information that this bank is intrinsically lessrisky than its competitors. As a result,
E
N
t

N
t
−
1
will be lower than an expectation which wouldignore this information, that is
E
[
N
t
].Regarding risk, banks diﬀer from one another through parameter
λ
(and of course EI). Followingcredibility theory, we assume that
λ
is an unobservable random variable which ranges from lowriskbanks (
λ
close to 0) to highrisk banks. In short, each bank has a speciﬁc unobserved riskiness
λ
and the internal data
N
t
−
1
conveys information on
λ
. Let us go one step further assuming that
λ
isdistributed according to a Gamma law Γ(
a,b
) among the banking industry
1
:
f
(
λ
) =
λ
a
−
1
e
−
λ/b
b
a
Γ(
a
)This means that all banks are not similar in terms of risk management and best practices but theirrespective riskinesses are unobserved. The choice of the Gamma distribution is rather arbitrary buthas many appealing features. First, this class of distributions is large and ﬂexible enough to capturethe kind of heterogeneity one might expect. Secondly, this class of distributions permits easy andnice calculations and provides closedform formulas. In particular, one can compute the unconditionalexpectation
π
0
t
=
E
[
N
t
]=
E
λ
[
E
[
N
t

λ
]]= EI
×
E
[
λ
]
1
Γ(
.
) is the traditional Gamma function deﬁned as:Γ(
x
) =
Z
+
∞
0
u
x
−
1
e
−
u
d
u
2
as well as conditional expectation
π
t
=
E
N
t

N
t
−
1
=
E
E
N
t

λ,N
t
−
1

N
t
−
1
= EI
×
E
λ

N
t
−
1
As shown in Appendix A, computations can be made explicit:
π
0
t
=
a
×
b
×
EI
π
t
=
ω
×
π
0
t
+ (1
−
ω
)
×
1
t
t
k
=1
N
t
−
k
As a result, the expected number of events that relates best to the actual riskiness of this bankis a weighted linear combination between the unconditional expectation (which corresponds to theindustrywide expected number of events) and the historical average number of events experienced bythe bank during its past course of business.
ω
is a parameter depending on the exposition indicator
EI
and the parameters
a
and
b
:
ω
=11 +
t
×
b
×
EIAs a consequence, the expected number of events to be considered is close to the average historicalnumber of events experienced by the bank, if one of the two following conditions is satisﬁed:
ã
the length of track record is important, i.e.
t
is large;
ã
the exposure indicator EI is large.The interpretation is straightforward: when a bank has a long history of frequencies of events and/or ishighly exposed to operational risks, then supervisors should be conﬁdent enough to weigh signiﬁcantlybank’s internal data to assess its riskiness.
2.2 Computing the probability distribution of future frequency
In practice, the expected number of events conditionnally to past experience does not suﬃce tocompute a capital charge. As a matter of fact the entire conditional distribution of
N
t
is required.This distribution results from a classical result (see
Klugman
,
Panjer
and
Willmot
[1998]):Pr
N
t
=
n

N
t
−
1
=Γ(˜
a
+
n
)Γ(˜
a
)
n
!
1 +˜
b
−
˜
a
˜
b
1 +˜
b
n
(1)where˜
a
=
a
+
t
k
=1
N
t
−
k
and˜
b
=
b
×
EI1 +
t
×
b
×
EIIt means that the probability that a bank whose track record amount to
N
t
−
1
experiences
n
losses attime
t
is given by equation (1). This distribution must be compared with the unconditional distribution(in other words the industrywide frequency distribution):Pr
{
N
t
=
n
}
=Γ(
a
+
n
)Γ(
a
)
n
!
1 +
b
0
−
a
b
0
1 +
b
0
n
(2)3
which gives the a priori probability that one bank (whose track record is unknown) experiences
n
losses at time
t
. Note that
b
0
=
b
×
EI.As a result, the a priori and a posteriori distributions are mathematically similar except that the“internal” parameters ˜
a
and˜
b
(caracterizing the actual riskiness of the bank) are adjusted from theirindustrywide counterparts
a
and
b
by taking into account past experiences.
2.3 Calibration
Parameters
a
and
b
have to be estimated on frequency data experienced by the banking industry.Let us assume that a future
QIS
type exercise provides a set of observations of frequency data
N
it
where
i
denotes the
i
th
bank. Then, a maximum likelihood procedure can be easily achieved with thedistribution of (unconditional) numbers of events given by (2):(
a,b
) = argmax
i
lnΓ
a
+
N
it
−
lnΓ(
a
)
−
a
+
N
it
ln
1 +
b
×
EI
i
+
N
it
ln
b
As a summary the optimal combination of internal and external data when dealing with frequencydata is as follows:
ã
estimate the overall riskiness of the banking industry as reﬂected by (industrywide) parameters
a
and
b
;
ã
adjust parameters
a
and
b
to take into account internal past frequencies (i.e. ˜
a
and˜
b
);
ã
use equation (1) to obtain the probability distribution corresponding to a speciﬁc bank
i
whosepast frequencies amount to
N
it
−
1
. If bank
i
has no historical data on its own frequencies, use(1) with ˜
a
=
a
and˜
b
=
b
0
, that is equation (2).Even though the maximum likelihood approach is the most eﬃcient strategy, alternative calibrationprocedures could be adopted in the extent that they are simpler to implement. For example, let usassume that the average ratio
N/
EI (i.e. the number of events relative to the exposition) is known inan industrywide basis as well as its dispersion: these two numbers would be suﬃcient to obtain someﬁrst estimates of parameters
a
and
b
by solving the two equations relating
E
[
N/
EI] et var[
N/
EI]with
a
and
b
.
3 Mixing internal and external severity data
Mixing internal and external severity data is an almost impossible task because no one knows whichdata generating process external severity data are drawn from. As a matter of fact, external severitydata are biased toward high severity events as only large losses are publicly released. Merging internaland external data together gives spurious results which tend to be overpessimistic regarding theactual severity distribution.In other words, as the threshold above which external data are publicly released is unknown, thetrue generating process of external data is also unknown making the mixing process an impossible(and misleading) task. One can not conclude however that external databases are useless for ourpurpose. Indeed, it only means that the threshold should be added to the set of parameters one hasto calibrate. Let us assume that the true loss probability distribution is denoted
(
x
;
θ
) where
θ
isa set of parameters deﬁning the entire severity distribution. Then internal data follow this severitydistribution while external data are drawn from the same distribution but truncated by a (unknown)threshold
H
. If
ξ
j
(respectively
ξ
∗
j
) denotes an internal (resp. external) single loss record, then:
ξ
j
∼
(
·
;
θ
)
ξ
j
∼

H
(
·
;
θ
)4