Operational losses asymmetry and the trap of over-controlling

About 75 % of operational losses in firms come from the 0.5% largest incidents, while the bottom half of all your losses account for barely 3% of the total severity; the vast majority of incidents that managers record and report account for barely nothing among the total pool of losses.

Below a one-page abstract of my new book, presenting these statistics from different sources (ORX, ORIC and internal bank losses). They are very stable over time. Implications are: don’t fall into the trap of over-controlling daily volatility and over-reporting mini things. Go for the big tickets. Don’t shy away from plausible yet pessimistic scenarios analysis and mitigation as a central activity of risk management.

Is it the same for your organisation? I bet it is. Have you made the sums already? Do not hesitate to send me your results, or share them in a comment.

Book launch and party: join us in London on Dec 11th, last registrations and pre-ordering of copies (signed on the day): https://www.eventbrite.co.uk/e/book-launch-operational-risk-management-tickets-52284403057?aff=ebdssbdestsearch

Also on Amazon.co.uk in hard copies and Kindle edition from next week.

Extract: Chapelle A., Operational Risk Management: Best Practices in the Financial Service Industry (chapter 15, p166), Wiley, 2019.

Rare and large, frequent and small losses

Operational loss data are particularly fat tailed. This means that most of the loss severity is concentrated in a handful of incidents and the mass of small incidents accounts only for a tiny part of the annual loss budget. These statistics are very stable over time and across firms. The data below, from the largest operational risk data consortia, show proportions of losses from aggregated data from their members:

ORX (Operational Risk Data Exchange) 2012-2016[1]

  • Largest losses (> €10M): 0.5% of the occurrences, 74% of the total severity
  • Smallest losses (€20K-100K): 55% of the occurrences, 3% of the total severity

ORIC International 2016[2]

  • Largest losses (> £10M): 1% of the occurrences, 55% of the total severity
  • Smallest losses (£50K-100K): 56% of the occurrences, 2% of the total severity

Large European bank (2007-2010)[3]

  • Largest losses (> €10M): 0.04% of the occurrences, 43% of the severity
  • Smallest losses (< €5,000): 65% of the occurrences, 2.2% of the severity

These enlightening statistics have important consequences for risk management priorities: managers and risk managers must focus on the prevention and remediation of large incidents and not be caught up in the management of daily volatility – those minor and insignificant events whose frequency and visibility can easily become a preoccupation and distraction for novice risk managers. 

I encourage every institution to run those statistics on their own database if they have not done so already (and please let me know if you find anything different – I would be very surprised). The firms who manage to avoid or even reduce one or two of their largest operational incidents will significantly reduce overall loss severity for the year. 

[1] ORX Annual report, 2014.

[2] ORIC International’s own calculations, 2017

[3] Real data from an anonymous source