10 July 2009

Published in: Operational risk

We need clearer and more sophisticated thinking on op risk

Val Amos of Hiscox argues that CEIOPS' proposals have done little to address insurers' concerns about operational risk.

The revised formula for operational risk proposed by the Committee of European Insurance and Occupational Pensions Supervisors (CEIOPS) in consultation paper 53 will result in more than doubling the operational risk charge for companies that adopt the standard formula (see IERM, News, 7 July, "Experts react to CEIOPS' consultation papers).

While this may encourage more firms to try to develop a model, the standard required to get model approval is unreasonable and I do not think that the industry will suddenly launch itself into model development. The standards applied to operational risk models seem to be the same as those for underwriting and market risks, despite the fact that operational risk measurement is a much newer and less well developed concept, and intrinsically more difficult.

Of particular concern is the fact that, when Basel II was implemented, only a small handful of banks managed to get their models for operational risk approved by the Financial Services Authority (FSA) -- despite eye-watering sums of money being spent. In the current climate of heavy regulation there is no reason to assume that the FSA will relax standards for insurers.

The new proposals may push the industry towards trying to find a solution to the modelling problem as many firms will find the revised charge excessive and punitive. However, we urgently need some clearer and more sophisticated thinking on the measurement of operational risk: traditional approaches have not worked and often generate great swathes of management information that do not pass the "so what?" test and do little to improve risk management.

It is a pity CEIOPS missed the opportunity to implement at least a two-tiered standard formula as Basel did -- one relatively high charge that anyone can use regardless of how good or bad their risk management is, and a lower charge for companies that meet a certain minimum standard. Other options could have involved a Pillar 2 top-up if the standard charge was too low.

The proposals have done little to address industry's concerns about operational risk. They lack sensitivity and produce counter-cyclical results. For example, when prices decline, the operational risk charge will also go down. This clearly does not make sense.

There is a pervasive assumption that the operational risk charge should be about 10% of a company's overall capital requirement. Many consultants have claimed the dubious fame of being the one to put a finger in the air and produce this ratio for banks. It then somehow became the standard for insurers too. There is no evidence to support this number. While it may be appropriate for banks that have very high volumes of transactions so that a small error can cause a big loss, this is not the case for many insurers.

We should challenge whether operational risk really is this big.

Val Amos is head of risk at Hiscox

Back to top