Operational risk quantification : a risk flow approach

The topic of operational risk has gained increasing attention in both academic research and in practice. We discuss means to quantify operational risk with specific focus on manufacturing companies. In line with the view of depicting operations of a company using material, financial and information flows, we extend the idea of overlaying the three flows with risk flow to assess operational risk. We demonstrate the application of the risk flow concept by discussing a case study with a consumer goods company. We implemented the model using discrete-event and Monte Carlo simulation techniques. Results from the simulation are evaluated to show how specific parameter changes affect the level of operational risk exposure for this company. Introduction The number of major incidences and catastrophic events affecting global business operations is on the rise. The impact of recent volcano eruption in Iceland, earthquakes around the world, the BP oil spill and financial crisis is making headlines but companies may never know the true extent of the loss. These events reinforce the need for companies to consider operational risk in a more formal manner and act strategically to minimize the negative impact of these and other types of disruptions. Having a better view of operational risks can allow a company to act proactively in many cases to come out unscathed in fact such a capability can be converted into a competitive advantage. Quantification and measurement is an integral part of managing operational risk. The topic of operational risk is very central to the financial industry due to the immediate and very direct impact of the bankruptcy of a financial institution on the economy and businesses. Not surprisingly, therefore, it has attracted a lot of attention from regulators, academics and practitioners alike. Targeted efforts have been made in researching operational risk especially since the Basel II guidelines on its assessment and the building of capital reserves came out in 2001 [1]. But the breadth of the catastrophic disasters mentioned above raises an important question: Is the domain of operational risk measurement too narrowly focused on financial institutions and their risk exposures? Clearly, assessing operational risk exposure is necessary in non-financial companies as well. To this end, we propose a method to quantify operational risk for any organization including non-financial companies. From this point forward, we will use risk and operational risk interchangeably and discuss it in the context of a manufacturing environment. A fundamental issue in studying operational risk is a lack of uniform understanding of its meaning among academics and practitioners. Operational risk has been defined in a variety of ways in the literature so for the purpose of this research, we will adopt the definition proposed by the Basel Committee to define operational risk “as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.” [1]. It should be noted that although developed for financial institutions and referring to specific risk elements, this definition is suitable for other industries as well. For more definitions and the historical development of operational risk perception we refer to Cruz [2] and Moosa [3] for extended background information to the topic. In this paper, we will discuss the findings of a project that was completed in 2008/2009 in collaboration between the authors 1 and a Fortune 100 Consumer Packaged Goods company with global footprint, referred to as Company X, the sponsors of the research. Since there are no legislative instruments in place to guide non-financial institutions to build capital reserves for operational risk, Company X, like most other businesses, was focused on understanding the impact of various risks on its overall performance. Indeed, the negative impact on business performance can be directly or indirectly converted into financial terms to gauge the level of risk exposure. We modeled the supply network of Company X using a simulation software package and studied its behavior under different risk scenarios. The rest of the paper is organized as follows. First, we discuss the state of the art with regard to operational risk and its quantification. We then compare and analyze different approaches to operational risk. Next, we propose our model for assessing operational risk, including the introduction to the concept of risk flows and the risk assessment process. A case study is presented to demonstrate the application of the model, followed by a discussion of the results, along with the strategic implications. Conclusions are presented to discuss limitations and potential future research directions. 1 The first two authors were key members of the extended team that worked on this project. Literature Review Many researchers have addressed the topic of operational risk in their work. Different quantification approaches have been proposed and applied. In this section, we will discuss some of the quantification methods available for operational risk and position this paper among the current literature. A majority of the existing literature addresses operational risk of financial institutions with a strong focus on banks. Indeed, insurance companies have also been discussed [4]. Literature not only covers different quantification approaches outlined here [5-10], but also provides background to operational risk such as definitions, categorization and cyclicality [3, 6, 11-15]. The different quantification approaches can be divided into top-down and bottom-up approaches [16]. Top-down approaches use aggregated figures, often derived from financial statements or publicly available information. Little attention is given to the actual sources of risk, limiting the use of these approaches in operational risk management [6, 17]. But the simplicity of implementation has attributed to its popularity. Key among the top-down approaches are the singleand multi-indicator models which assume a correlation between an indicator such as profit and the operational risk exposure. The Basel Committee has also included indicator based quantification methods in their guidelines [1]. Multi-factor regression models use publicly available figures to measure company performance and relate this to input factors of the performance. The residual term is believed to describe operational risk. The CAPM approach is mentioned here only for completeness but its practical relevance and the underlying assumptions limit its validity. Scenario analysis and stress testing are also classified as a quantification approach, but their limitations with regards to expressing risk exposure are obvious. Bottom-up models assess the risk exposure by identifying risk factors at a lower level and aggregating risk to derive the overall level of operational risk. This can be further divided into process-based models and statistical models. Process-based models portray the chain of reaction from event to actual loss. These include Causal models [16, 18, 19], Bayesian models [8, 20], Reliability theory [3, 21] and System Dynamics approach [11]. Statistical models include the value-at-risk approach and the extreme value theory. These are based on the historical loss distribution data. Lambrigger et al. [7] have combined internal and external data with expert opinions using a Bayesian inference method to estimate parameters of frequency and the severity distribution for a Loss Distribution Approach. It should be noted that the above mentioned approaches primarily focus on financial institutions and do not address the specific challenges of risk quantification for manufacturing companies. As mentioned previously, our objective is to propose a general approach to risk quantification that can be applied to non-financial companies as well.