Operational risk
Institutions should be aware that relevant risk parameters related to operational risk may derive from inadequate or failed internal processes, people and systems, including legal risks, or from external events, and may affect all products and activities within the institution.
In order to stress relevant risk parameters, institutions should use the profit and loss (P&L) effect of operational losses as the main metric. Any intrinsic impact caused by the operational risk event should be considered as an operational risk loss (e.g. intrinsic impacts from opportunity costs, or internal costs such as overtime/bonuses, etc., where they relate to an operational risk event). In addition, and only for the purpose of stress testing, any loss of future earnings caused by operational risk events (excluding second-line effects on the macroeconomic environment) should be included. At least the institutions under the advanced measurement approach (AMA) should also take these losses into account as they flow into the internal loss database to calculate the additional capital requirements. When using historical data, external data or scenarios as inputs for both P&L and RWA projections, institutions should take into account and avoid possible double-counting effects on the input side.
As operational losses may induce second-round effects (i.e. reputational risk), in order to account for such effects, the operational risk stress testing programme should be thoroughly integrated into the institution-wide stress test and should include interconnections with liquidity and own funds requirements. Institutions should analyse at least:
the exposure of the institution to activities and its associated risk culture and past record of operational losses, with a focus on the level and change in losses and gross income in the past few years;
the business environment, including geographical locations, in which the institution operates and macroeconomic conditions;
the evolution in headcount and in balance-sheet size and complexity over the past few years, including structural changes due to corporate events such as mergers and acquisitions;
changes to significant elements of the information technology infrastructure;
the degree and orientation of incentivising in compensation schemes;
the complexity of processes and procedures, products and information technology systems;
the extent of outsourcing, with regard to the concentration risk associated with all outsourcing arrangements and external market infrastructures; and
the vulnerability of modelling risk, especially in areas related to the trading of financial instruments, risk measurement and management, and capital allocation.
Idiosyncratic risk factors should also be explored and used as inputs for scenario design. Indicatively, institutions under the AMA should stress their business environment and internal control factors (BEICFs).
Institutions should consider the interactions of, and individual exposures to, such idiosyncratic risk factors in determining their operational risk exposure.
Institutions should analyse carefully the possible interaction of operational risk losses with credit and market risks.
The analysis of the stress test events should involve expert judgement, to include at least low-frequency high-severity events.
Institutions should design severe but plausible stress events. Assumptions may differ from assumptions used in credit and market risk stress scenarios. When an institution expands its business in the local or in the international markets through mergers and acquisitions, the design of new products or a new business line, the severe but plausible stress test scenarios should be based on expert judgement to overcome the possible lack of historical information.
Institutions should build their stress testing programme based on both internal and external data, while analysing carefully:
the use of scaling factors (e.g. in a situation where external data were scaled down, the scaling may be reduced) and the possible need for additional impacts stemming from changing scaling factors in a stress situation; and
the criteria for determining the relevance of data (e.g. data on a large loss considered not relevant may be used within the stress test, in addition to Capital Requirements Regulation (CRR) requirements).