OR 7 – Integrated Risk Management

A bank faces credit risk, market risk, liquidity risk and operational risk every day, and enterprise risk management (ERM) is the umbrella that brings the methods for managing and measuring all of them into one coherent structure. Operational risk management and operational resilience are one part of that structure. Looking at the whole picture matters because the same people, committees, policies and capital base serve every risk type, so a weakness in the shared machinery weakens the management of all of them at once.

At the centre of any ERM framework sits the risk management cycle. Its four stages are identifying the risk, assessing it, mitigating it and monitoring it. Risk identification asks what could go wrong; risk assessment asks how likely and how severe it is; risk mitigation decides what to do about it; and risk monitoring tracks whether the exposure and the controls are behaving as expected. In practice the stages are sometimes run one after another and sometimes run together, as when a new product review identifies and assesses its risks in a single workshop. The cycle is drawn as a loop on purpose. Exposures shift as the business changes, new threats appear, and controls decay, so risk management never reaches a finished state and must keep turning.

The elements that surround the cycle

Three elements wrap around the cycle and apply to every risk, not only operational risk. Risk governance sets who is responsible for what and how decisions and reports flow. Risk culture is the set of values and behaviours that shape how people actually treat risk when making choices. Risk appetite states how much risk, and of what kind, the organization is willing to take. Together these set the rules of the game for everything inside the cycle, which is why they form the outer frame of the framework.

In most industries those three elements complete the ERM framework. Financial institutions need a fourth: risk capital and stress testing. Banks and insurers are systemically important, so supervisors require them to keep at least a set amount of equity together with stable, long-dated funding. This is regulatory capital, and the detailed rules for credit, market and operational risk capital, together with minimum liquidity ratios, are set out by the Basel Committee on Banking Supervision (BCBS), whose guidance is adopted by banking supervisors around the world.

Large banks go further than the minimum. They estimate for themselves how much capital they need to absorb unexpected losses from all their risks, to protect their credit rating and to stay solvent and stable if those losses arrive. Arriving at that economic capital figure requires a careful assessment of each risk type and of how the risk types interact, both in normal conditions and under stress. So the fourth element, capital and stress testing, is the place where the bank measures whether its financial resilience is adequate, and financial resilience is itself a necessary condition for operational resilience.

Earlier work on operational risk covered two broad ways of quantifying losses. The statistical approach uses past losses, through the loss distribution approach and extreme value theory. The forward-looking approach uses scenarios and factor models, such as FAIR or fault tree analysis, to quantify tail events. Scenario analysis and its quantification belong to stress testing, and operational resilience work also uses stress and scenario tests to see whether a disruption would breach the firm’s impact tolerances. The rest of this lesson builds out from the ERM structure to the capital measures and finally to stress testing across the enterprise.

Risk governance assigns roles, responsibilities and accountabilities for managing risk across the firm, and it organizes how decisions are taken and reported, usually through a set of committees. The most widely used way of describing these roles is the three lines of defense model. Each line has a distinct job, and the boundaries between the lines are written into the firm’s risk governance policies so that nobody is left guessing who owns a decision.

First line: the risk owners in the business

The first line consists of the staff and managers of the business lines. They carry primary responsibility and accountability for managing the risks their activities create, and they hold the decision-making authority to do so. Within the first line, named risk owners are accountable for identifying, measuring, mitigating and reporting the specific risks assigned to them. A risk owner may commit the firm to risk, but only within the boundaries that the appetite allows. The owner’s real task is to keep risk and reward in balance. For operational risk that balance is judged qualitatively and approximately. For credit and market risk it can be quantified as expected revenue against expected and unexpected losses, often through a risk-adjusted return on capital measure, which is covered later.

Second line: framework and oversight

The second line designs the risk framework and oversees how the first line applies it. It sets the methods, tools and models used to manage and measure each risk type, trains business staff where needed, raises awareness of risk, writes risk policies and checks that risk management is properly embedded in decisions everywhere in the firm. It also reviews and tests whether the ERM framework is working, as part of continuous monitoring, and it offers credible challenge to the risk assessments and controls run by business managers. In a bank the second line normally includes the credit risk, market risk and operational risk management departments, plus oversight functions such as compliance and information security, and the parts of hybrid functions like legal, finance and IT that take part in oversight.

Oversight is often split by risk type under a chief risk officer. The table below gives one illustrative allocation of oversight responsibility.

CORO stands for chief operational risk officer, CFO for chief financial officer, CIO for chief information officer, CISO for chief information security officer and MLRO for money laundering reporting officer. The allocation is an illustration; firms divide oversight in different ways.

Third line, fourth line and the board risk committee

The third line gives independent assurance. It is usually the bank’s internal audit, sometimes supported by external audit or other qualified independent parties. It reports directly to the board of directors and evaluates whether risk management in both the first and second lines is well designed and works in practice. Smaller institutions often outsource internal audit of risk activities to specialist firms acting for them. External audit then provides a further layer of verification, which is sometimes described as a fourth line of defense.

Above the three lines, the board risk committee oversees every risk the organization runs. It is normally an independent committee of the board and works under written terms of reference, also called a committee charter. Regulated firms frequently publish that charter as part of their Pillar 3 disclosures; Bank of New York Mellon, for example, publishes the charter under which its board risk committee works. All three lines report upward to the executive committee and the board, so the board sees risk from the owners, the overseers and the assurers.

Risk culture cannot be separated from corporate culture. At the level of the whole enterprise it is more than the habit of spotting and reporting operational incidents and sharing what was learned from them. A useful shorthand is that culture is what people do when nobody is watching. Corporate culture covers the values, beliefs and behaviours of every employee, shaped by the example that senior managers and executives set. That culture pushes the firm’s attitude to risk somewhere along a range: from prudent to daring, and from compliant to challenging. Governance documents describe how a firm should behave; culture determines how it does behave.

Culture shows up in the firm’s risk preferences in three ways. Informally, it shows in everyday attitudes and in what people feel is acceptable. Indirectly, it shows through incentive structures and business strategy. Formally, it shows through risk policies, risk appetite statements and limits. A firm whose policies say one thing while its bonus scheme rewards another has a culture problem, whatever its documents claim.

Evidence that risk management strength pays off

A widely cited study by Ellul and Yerramilli, published in the Journal of Finance in 2013, tested whether a strong and independent risk function makes a measurable difference. Its authors constructed a risk management index (RMI) for US bank holding companies (BHCs) from six observable features of the risk function. The table restates those features and adds, as a derived column, what each one is meant to capture.

The findings were striking. BHCs that had a higher RMI before the 2007 to 2009 financial crisis showed lower tail risk, fewer nonperforming loans, and stronger operating results and share prices while the crisis lasted. Across the whole sample period of 1995 to 2010, banks with a higher lagged RMI had lower tail risk and a higher return on assets, other things being equal. Those results fit the idea that an independent and well-resourced risk function genuinely reduces a bank’s exposure to extreme losses, rather than merely adding cost.

Why regulators treat culture as a supervisory issue

Supervisors regard risk culture as a key driver of whether an ERM framework works at all. In the United States, the Federal Reserve Bank of New York has run a programme of events, webinars and publications on reforming governance and culture. In the United Kingdom, the Financial Conduct Authority regularly sets out its view of culture and conduct from an enforcement angle. Both treat culture as something that can be observed, assessed and, when it fails, sanctioned.

In May 2018 the Australian Prudential Regulation Authority (APRA) released the final report of an inquiry it had run into the Commonwealth Bank of Australia (CBA). The inquiry traced a string of failings, including money laundering breaches, overcharging of customers and the loss of customer data, back to weak governance and a weak risk culture. The bank ended up paying the biggest fine any Australian regulator had ever imposed and suffered serious damage to the bank’s reputation. The case is useful precisely because it shows governance and culture failing together, each making the other worse.

The inquiry panel concluded that the risks behind these failings were neither properly understood nor clearly owned, that the frameworks meant to control them were heavy and incomplete, and that senior leaders were slow to see and respond to growing threats to the bank’s reputation. The table below sorts the panel’s specific findings by the ERM element that broke down. The mapping is an interpretation added here to connect the case to the framework.

Read against the three lines of defense, the pattern is clear. The first line did not own its risks; the second line lacked the resources and authority to challenge; and the board did not press hard enough on non-financial risk. Incentives then completed the picture by rewarding outcomes that the formal policies did not want. A strong risk appetite statement on paper does little when culture and remuneration point the other way.

The final link is between culture and appetite. The way a firm governs itself and the behaviours it tolerates are the clearest practical expression of how much risk it is really prepared to accept, both financial and non-financial. That is why risk appetite, discussed next, has to be read together with governance and culture rather than as a separate document.

Risk appetite is the amount and type of risk an organization is willing to accept while pursuing its objectives. Banks deliberately take financial risks because those risks are their business. Credit risk is the heart of lending, market risk is the heart of trading and asset management, and liquidity risk comes with the role of financial intermediary that transforms short-term deposits into longer-term loans. Operational risk lives inside the processes, systems and people that carry out all of these activities. Financial risks also earn visible premiums: a credit spread, a market risk premium, a liquidity premium. Even so, banks do not take these rewarded risks without bounds. Allowed exposures, explicit controls and monitoring draw a perimeter around how much of each risk may be taken.

Credit policy as appetite under another name

A bank’s credit risk policy is a risk appetite statement for credit risk in every respect but its name. The policies came first; the phrase risk appetite arrived much later. Take a corporate lending policy. It caps exposure by client, industry, currency and maturity; it sets minimum ratings and solvency and liquidity ratios; it defines acceptable collateral and how to value it; it lists the metrics to watch while the loan is outstanding; and it states the triggers that move a loan onto a watch list. Each of these clauses corresponds to a part of an operational risk appetite framework, as the table shows.

Market risk works the same way. Limits cap exposure by market, product and currency; trading limits are set in terms of value at risk, volatility and deviation from benchmarks; and a trading room’s automated systems track hundreds of such measures, which in operational risk language would be called KRIs. Asset managers achieve the same effect through investment guidelines and portfolio limits.

So an actionable risk appetite, for any risk type, is built from three pieces: limits on exposure, key controls and monitoring metrics. Best practice in operational risk appetite simply follows what credit and market risk managers had been doing for decades before anyone used the term. Recognizing this helps an ERM team, because it can borrow a mature, well-tested structure rather than invent one for non-financial risk.

At enterprise level, risk appetite is written as a small number of overarching statements and criteria rather than detailed limits. Depending on how much it explains about strategy and priorities, the statement may run to a few pages. One large insurance company frames its overarching appetite around three criteria:

The capital criterion is the most telling. Holding capital above the regulatory floor is called supersolvency in insurance and overcapitalization in banking, and the size of that cushion is the most visible signal of how much risk a firm is prepared to run. Insurers traditionally track their surplus over what solvency rules require. Banks keep a buffer above the Basel minimum, partly to protect their credit ratings. At the cautious end, one European clearing house holds capital equal to triple its regulatory requirement, a surplus of 200% over the minimum.

Apart from managing risk, ERM in a financial firm has a second basic job: keeping the institution solvent and sustainable by funding it with enough capital to absorb unexpected losses in any major risk type. That measurement side of ERM has four elements: regulatory capital and supervision, economic capital, RAROC thresholds, and capital aggregation with diversification. This section starts with regulatory capital.

The Basel Committee on Banking Supervision was founded by the governors of the central banks in the Group of Ten (G-10) countries, with members drawn from the banking authorities of each country. It writes guidance for regulating and supervising banks in the G-10 and well beyond. Its prudential regulation has three aims: to keep every financial intermediary solvent and sound; to protect customers from undue risks such as failure, fraud and opportunistic behaviour; and to support efficient and competitive financial institutions. Solvency comes first, because it serves the committee’s mandate of international financial stability, and it is pursued mainly through capital requirements. The other two aims rely on fit and proper tests of senior management’s track record and competence, plus monitoring of and reporting on the bank’s activities.

From the Cooke ratio to Basel III

Capital rules began with credit risk alone. Basel I in 1988 recommended capital equal to 8% of risk-weighted assets (RWA) to cover unexpected credit losses. That ratio became known as the Cooke ratio, after the committee’s chairman at the time. Each exposure was multiplied by a risk weight before the 8% was applied: 100% for commercial and consumer lending, 50% for mortgages and bank guarantees, 20% for interbank loans and 0% for sovereign debt of OECD countries. So the effective charge was 8% of lending to the private sector, 4% of uninsured mortgage loans and 1.6% of interbank loans.

As derivatives grew in the 1990s and off-balance sheet business expanded, regulators extended capital to market risk in 1996, measured with value at risk, while the overall 8% of RWA stayed the same. Basel II, dated here to 2002, added a capital charge for operational risk and rebuilt credit capital around the credit ratings of counterparties; again the 8% total did not move. Basel II also introduced the three-pillar structure described in the next section.

Basel standards are not laws and do not bind anyone by themselves. Some jurisdictions have legislated to give them force. Parts of Basel II and III became law in the European Union, covering most financial institutions there. In the United States, Basel II was compulsory only for banks holding more than $250 billion of assets, or for internationally active banks whose foreign assets exceeded $10 billion, and those banks had to use the Advanced Measurement Approach (AMA) for operational risk.

Basel III absorbed the lessons of the 2007 to 2009 crisis. It added a minimum regulatory liquidity ratio and a countercyclical buffer, presented as an extra 2.5% of RWA on top of the 8% minimum. The buffer is built up in good times, when lending grows quickly, so that it can absorb losses in a recession or market crisis. (In the Basel III text, national authorities set this buffer anywhere from zero up to 2.5%, so 2.5% is its ceiling rather than a fixed rate.)

Basel II recognised that a single capital number could not carry the whole weight of prudential regulation, so it organized the framework into three mutually reinforcing pillars. The first sets the floor, the second tailors it to the individual bank, and the third lets outsiders see the result.

For operational risk, Pillar 1 is accompanied by managerial guidance in the Sound Principles for the Management of Operational Risk, last updated in 2021. Pillar 2 matters greatly for ERM because it is where the bank’s own view of its risk meets the supervisor’s view. Since the crisis, supervisors have used Pillar 2 to impose add-ons on firms whose Pillar 1 number understates their real exposure, which is why the bank’s internal assessment, including its stress tests, has become so important. Pillar 3 works through outside pressure: once risk information is public, investors and counterparties can price a weak bank accordingly. The charter of a board risk committee is one example of what firms publish under these rules.

Regulatory capital is a minimum imposed from outside, and despite steady refinement it is not very sensitive to the true risk of a particular firm. That is especially so when a bank uses the standardized Pillar 1 approaches, which apply the same coefficients to very different businesses. So the regulatory number may not reflect the firm’s actual profile and is a poor guide for internal decisions. Banks therefore also compute economic capital: the own funds, consisting of equity plus subordinated debt, that the bank or insurer itself judges necessary to cover any unexpected loss from one or several risk types.

Pillar 2 was designed to close part of this gap by catching risks that Pillar 1 misses or underweights. So the combination of Pillar 1 and Pillar 2 is the closest regulatory counterpart to economic capital. In practice, Tier-1 banks estimate economic capital with internal models and then often add qualitative overlays for risks that are hard to measure or still emerging, where data are too thin for a model.

The distinction ties back to appetite. Regulatory capital is what the bank’s risk-taking requires of it; economic capital is what it chooses to hold, consistent with its own appetite and its rating goal. The gap between available capital and the regulatory minimum is the buffer discussed earlier, and economic capital is the internal yardstick that tells the bank how large that buffer needs to be.

How much economic capital a large bank wants is driven mainly by the credit rating it aims to keep, because the rating sets its cost of funding. More capital means a thicker cushion against losses, which means better creditworthiness, which in turn means cheaper borrowing. The calculation works like a value at risk applied to the distribution of the whole organization’s annual financial results, with diversification across risk types taken into account.

The link to ratings comes through default probabilities. On average, an AAA-rated firm has a one-year default probability of 0.01%, or 1 basis point, and an AA-rated firm about 3 basis points. To hold an AA rating, a bank sizes its economic capital so that unexpected losses are covered at a 99.97% confidence level; an AAA ambition requires 99.99%. Both sit further into the tail than the 99.9% level used for regulatory capital, which is why economic capital for a highly rated bank normally exceeds the regulatory amount.

Every activity a bank carries out uses some of this capital, and capital is an expensive form of funding. So large banks measure whether each product and service earns enough for the capital it consumes, which is what RAROC does.

Bankers Trust developed RAROC in the late 1970s, and many banks adopted it during the 1980s and 1990s, the era of Basel I. Its starting point is the ordinary profitability ratios. Return on equity (ROE) relates profit to shareholders’ equity. Return on capital (ROC) is the profit earned per unit of capital and resembles ROE except that debt is added to the denominator. RAROC is a risk-adjusted cousin of these ratios, used mainly in banking and mostly for credit, to reflect the particular economics of lending: a loan book carries expected losses from defaults and ties up capital against unexpected losses.

Two adjustments separate RAROC from ROC. The numerator deducts expected loss (EL), the average loss the activity is expected to generate. The denominator is economic capital, the equity required to cover the unexpected losses of the activity, rather than the accounting capital. RAROC suits credit best, where EL can be estimated from historical default data. In market risk, EL is less clear and is often set to zero. For operational risk RAROC is generally not used: revenues cannot easily be attributed to operational risk, and the economic capital figure itself is uncertain.

The ratio can be computed at many levels of granularity, from a single transaction to a client, a portfolio or a whole business line. Revenue, EL and economic capital must all match that scope: credit EL for the portfolio or client segment in question, and the capital set aside or mobilized for that activity.

A minimum RAROC set per transaction, client or business line gives managers a pricing rule. RAROC is used to quantify the bank’s funding cost by transaction, product and client type; to manage capital as a scarce and costly resource; and to set objectives for the bank’s commercial staff.

Once capital has been estimated for each risk class, the bank has to decide how much it needs in total. Losses from credit, market and operational risk are unlikely to peak in the same year, so regulators accept some diversification between these classes. Combining the classes is called inter-risk diversification. It sits on top of intra-risk diversification, the offsetting that already happens inside each class, for example across many borrowers or many operational risk cells.

Aggregation takes the stand-alone capital for each class, joins them through a correlation matrix that describes how the classes move together, and produces one aggregated capital figure. Because the classes follow different dynamics, the aggregated amount is lower than the simple sum of the stand-alone amounts, and that reduction is the diversification benefit.

Operational risk tends to diversify well. Its drivers differ from those of financial risks, so its correlation with them is low. Credit and market risk correlations tend to rise in a crisis, while operational losses tend to move fairly independently. So adding operational risk to the other classes can produce a large benefit, with diversified operational risk capital ending up 30% to 40% below what its components add to on their own.

From capital estimation to stress testing

In the United States the emphasis has moved from estimating capital to stress testing, for operational risk and more widely. Models that banks build for CCAR, the Comprehensive Capital Analysis and Review run by the Federal Reserve, forecast losses that are more concrete than what the AMA asked for, namely the total annual loss exceeded in only 1 in a 1000 years. Stress tests ask for expected losses under specified adverse economic conditions, plus severe but plausible bank-specific events, called idiosyncratic scenarios, that might occur within the stress window. Looking at conditional expected losses across scenarios of differing severity, instead of an extreme percentile, makes the numbers far more useful for managing risk. Capital of either kind is sized through the cycle, whereas a stress test looks at one point in time.

A stress test checks how stable a system or an entity is by pushing it past its normal operating range, sometimes right up to a breaking point, and watching what happens. Banks used stress tests long before 2008, but after the 2007 to 2009 crisis supervisors worldwide adopted them as a tool for judging systemic risk. The tests introduced from 2009 onwards were built to show how institutions would cope with extreme operating conditions, above all severe macroeconomic and market conditions, since those drive most losses. The final purpose is reassurance that a bank could absorb the losses of such a scenario and still continue as a going concern.

The Basel Committee describes stress testing as an important internal risk management tool that supervisors promote within the capital adequacy framework. It warns management about adverse outcomes that were not expected across many risks and indicates how much capital might be needed if large shocks arrive. So a stress test gives a view of the capital level a bank needs to come through a deteriorating economy.

Lessons from the 2009 review

The committee’s 2009 document on sound stress testing practices and their supervision identified four areas in which pre-crisis stress testing had been weak: how stress testing was used and built into risk governance; the methodologies; the choice of scenarios; and the testing of specific risks and products. On scenarios the verdict was blunt. The scenarios banks had used before the crisis turned out to be much milder than the crisis itself, and the losses they projected fell well short of what banks actually lost. The 2009 principles were written to deepen and strengthen banks’ practices and the supervisory assessment of them.

The nine principles of 2018

The committee replaced the 2009 set with nine Stress-testing Principles in 2018. They are pitched at a high level so that they fit banks and jurisdictions of many kinds, recognising how quickly practice had grown in importance, and so that they can stay valid as practice keeps evolving. Together they describe the elements of a sound stress-testing framework. The table restates them and adds a derived column showing the weakness each one guards against.

Principle 4 matters most for operational risk modelling. Rather than fixing a percentile, it asks that the stresses be sufficiently severe, which, as a later section shows, removes a serious design problem in one popular operational risk model.

Stress testing has drifted over time from a purely numerical exercise toward one that blends numbers with judgement. Practices also differ widely between jurisdictions, so a taxonomy helps a bank see where each kind of test sits and choose the right mix when it plans its programme. The taxonomy uses two dimensions, which apply equally to tests a bank designs for itself from the bottom up and to tests a supervisor imposes from the top down: the analytical approach, and the type of risk being captured.

Dimension 1: quantitative to qualitative

The first dimension runs across the range of methods, from highly quantitative to highly qualitative. At the quantitative end, the test measures how sensitive a model is to shocks in its parameters. These are the oldest techniques, mostly found in market and credit risk; shocking a production model to see how it reacts is a typical case. At the qualitative end are scenario-based methods such as macro stress testing and evaluations that rely on no model at all, such as reverse stress testing. Building an idiosyncratic scenario to judge how an event would hurt the bank’s reputation, or working out what a recession would do to the bank’s operational risk exposure, belongs at this end.

Dimension 2: measurable to immeasurable risk

The second dimension runs from fact-based, probabilistic analysis of risks that can be measured to hypothetical, possibilistic analysis of risks that cannot. On the measurable side, outcomes are given concrete probabilities and the analysis rests on them; assuming an 80% chance of a good outcome and a 20% chance of a bad one is an example. Parameter stress testing belongs here. Changing model parameters is routine in credit and market risk, and in operational risk it appears in tail modelling, for example when a factor model’s control failure rates or the costs and impacts of a tail scenario are varied.

On the immeasurable side are the unknown unknowns: risks whose probability cannot be known, so there is no basis for ranking one outcome as likelier than another. This is Knightian uncertainty, risk that cannot be calculated. Exploring the two ways an idiosyncratic risk might materialize for a bank, without assigning odds to either, is an analysis of this kind. Combining both dimensions yields three main categories of test: parameter stress testing, macroeconomic stress testing and reverse stress testing.

Parameter stress testing

Parameter stress testing, also called model stress testing, checks how robust a model is by changing the values of its parameters. It is quantitative, deals with measurable risks and relies entirely on models. Banks use it inside formal stress programmes, where they stress parameters or run sensitivity tests to see what extra pressure does to a model, a portfolio or the whole bank. It has deep roots: before the crisis, simple model-based tests of this kind were the main way banks estimated how stressors would change model output and, through it, real outcomes. Market risk stress testing, among the earliest forms, stressed trading books one by one, or business line by business line, with statistical techniques built on the models in use.

Parameter tests are also run outside formal stress testing, for business and strategic planning. In a Pillar 2 exercise, for example, a bank can shock the parameters behind its sales and revenue projections. A modest change in those inputs can transform the business plan, the projected profit and solvency, and the risk exposure of the firm.

Macroeconomic stress testing

Every year the regulators of major banking jurisdictions, including the United States, the EU, China and Singapore, hand large international institutions, often the globally systemically important banks (G-SIBs), a set of macroeconomic shock scenarios to test their solvency. The scenarios move inflation, unemployment, GDP, exchange rates and similar variables, and the exercise covers the whole bank and every risk type. Macro stress testing is the core of CCAR in the United States, and smaller regulated firms are encouraged to test their capital against a global downturn as well.

Macro stress testing takes the broadest view of risk. It aims to stress both measurable and immeasurable risks, and ideally the dependence between them, and it uses quantitative and qualitative methods together. Here the models are taken as producing accurate projections, and attention goes to how changes in macroeconomic factors change the models’ output. That is the key difference from parameter testing: instead of a statistical shock such as a move of some number of standard deviations, the test estimates outcomes under named economic scenarios. The exercise is not only about required capital; whether capital will be available under stress is just as important. In Europe the results are documented in the ICAAP report to the regulator, precisely to show that capital is sufficient under stress and so that the firm is resilient. Macro stress tests, including tail scenarios and the resilience scenario regulators require, are how banks show financial resilience alongside operational resilience.

Reverse stress testing begins at the end. It takes a predefined bad outcome, such as the point at which the bank would be judged to be failing, the point at which its business model stops being viable, or a breach of its risk limits, and works backward to find the circumstances that could produce it. Ordinary macro and scenario tests move in the other direction, from changed circumstances to resulting outcomes. Reverse testing is mostly qualitative and addresses immeasurable risks. It is scenario driven, drawing on macroeconomic and firm-specific storylines whose likelihood cannot be estimated with confidence.

Typical shocks include a cut in the bank’s credit rating, heavy losses on its portfolios, a major client walking away, or the disappearance of a major revenue source. If the analysis shows that such an event would be unmanageable, the aim becomes reducing its likelihood as far as possible. Reverse stress testing is therefore mainly a risk management tool rather than a way to size financial resources, and it is well suited to assessing operational resilience. It exposes weak points and fault lines in the business and operating model, including tail events, and it helps the bank decide whether to add mitigating actions or controls, or to set triggers that prompt action if the economy or the bank starts moving down the path a scenario describes.

Resolution planning

Where a shock would be unsurvivable, the firm needs a wind-down plan, known in the United States as resolution planning or a living will. Resolution planning prepares for an orderly closure of the institution, if it ever becomes necessary, with as little disruption as possible to stakeholders and to the financial system. The firm first identifies the events that would force a wind-down, for example heavy financial losses, the loss of key clients with no prospect of recovery, or the loss of critical infrastructure. That identification draws on a review of how the firm makes money, what it is exposed to, where its business and operating model is fragile, and which drivers generate most revenue.

The plan must then set out the key indicators that would signal a wind-down and assess how closure would affect internal and external stakeholders. It must provide for a transition period and recognise that resources will be shrinking during it. Finally, it must estimate what an orderly closure would require in liquidity, solvency, people and infrastructure.

For more than a decade after the 2007 to 2009 crisis, stress testing in banks was largely equated with macro stress testing. The COVID-19 pandemic changed that, because it delivered macroeconomic and operational shocks together, and both were far larger than anything in the regulators’ prescribed macro scenarios. Today, operational risk stress testing follows the logic of macro and parameter tests and reaches past the loss distribution approach (LDA) that Basel II had encouraged.

A common misunderstanding is that a macro stress test is simply a move to a higher quantile of the same loss distribution, which is what the AMA effectively did. A genuine macro stress test changes the loss distribution itself, because the stress changes the underlying exposure. So the quantitative part of an operational risk stress framework should assume the whole loss curve shifts, and it should use methods able to produce that shift: regression, LDA-based forecasting and scenario analysis.

The supervisory push: SR 15-18 and SR 15-19

The Federal Reserve’s CCAR programme sets probably the most explicit and advanced expectations for operational risk stress testing. In late 2015 the supervisory letter SR 15-18 made clear that the operational risk capital planning process must connect to the institution’s own risk identification process. The aim was to tie quantitative work back to risk management, after the experience of the AMA roll-out in the mid-2000s, when many Basel models drifted into ivory tower exercises whose capital numbers few people understood or could relate to everyday operational risk. Since SR 15-18 and its counterpart for smaller institutions, SR 15-19, frameworks rely less on the quantitative model for the total forecast and much more on scenarios and the judgment of experts.

The three modules

A comprehensive operational risk stress-testing framework combines quantitative and qualitative techniques in three modules whose outputs add up to a total loss estimate.

The expected non-legal loss forecast module has two parts. The model part is a quantitative model that produces forecasts for every baseline and adverse macroeconomic scenario and every risk type segment in the bank’s framework. The expert refinement part is a qualitative, scenario-based review in which subject matter experts adjust the model output using what they know of the business, the risk profile, the control environment and developments in the industry.

The idiosyncratic add-on covers what neither of the other modules sees: exposures specific to this bank. A storyline may be a single extreme event or a chain of them. For example, an external shock might trigger a system outage, then a cyberattack, then customer withdrawals and reputational damage, each event feeding the next.

The first design question for the model part of the non-legal module is whether the bank’s operational losses respond to the macroeconomy at all. The debate is not closed. Some argue that operational risk is specific to each institution and not driven by economic conditions, and research results have been mixed. Supervisors, particularly in the United States, have nonetheless pressed banks to link operational losses to macroeconomic conditions. The practical expectation is not that every loss type will show a link. Banks are expected to build and understand relationships for some event types, and to state openly that the frequency or severity of other event types does not depend on the economy and will not move much under stress.

A bank can model total losses directly, or model their two components, frequency and severity, separately. Modelling the two drivers separately is generally preferred, and two methods dominate.

Regression models

Regression models capture the dependence between operational losses and macroeconomic variables. Frequency and severity are each regressed on their drivers and the two forecasts are multiplied to give the loss.

LDA and the conditional LDA

The LDA simulates losses by Monte Carlo from a frequency distribution and a severity distribution. It was widely used for AMA regulatory and economic capital, but its output tends to be fragile and unstable. Traditional LDA is usually seen as a second-best choice, used only when regression has failed. Its weakness for stress testing is structural: it has no risk drivers and assumes the bank’s exposure never changes, so a large observed loss is just an unlucky draw from the same distribution. Stress testing is about how exposure changes with the macroeconomic and operating environment, so an immutable exposure is the wrong assumption.

The conditional, or modified, LDA is a compromise between plain LDA and a full regression approach. Frequency, which reacts more to the economy and is easier to model, is forecast by regression. Severity keeps a fixed distribution, and to stress it experts choose a higher percentile reflecting expected average loss per event in a stressed environment. The two are then combined by Monte Carlo as in a normal LDA. This gives a structured way to blend data and judgement, but the percentile is hard to justify. The 99.9th percentile used for regulatory capital does not fit, because a stress test asks whether capital is sufficient to survive a given environment; stressing severity at the capital percentile would show the bank as undercapitalised every time. Regulators resolved this by setting no percentile at all and relying instead on principle 4, that stresses be material, relevant and sufficiently severe.

Modelling severity

Severity is harder to model than frequency because tail events dominate it. The mean is a non-robust estimator that a few outliers can swamp, so banks may use the median severity or other ways of damping outliers. Severity can still depend on the environment: Cope, Piche and Walter (2012) found that internal fraud severity moved with how far executive power is constrained and how common insider trading is; that severity in clients, products and business practices related to securities law, shareholder protection, limits on banking activity, supervisory power and insider trading; and that other event types responded to GDP per head and to a governance index. Some banks regress average severity on macroeconomic or other variables using simple linear or log-linear models, which are seen as credible, data-based projections; others fall back on simpler analytical estimates.

Expert refinement, legal losses and storylines

After the model produces stressed losses, experts refine them through scenario analysis to make sure every material risk is covered, which matters most for risks with little history or risks that are changing. Risk owners and specialists challenge the process, data, chosen methods, the business logic of any macro drivers in the frequency regressions, and whether the resulting frequency, severity and total forecasts are plausible for each risk type. Validation of any operational risk capital model requires this review. Experts also flag recent or potential changes that could make past loss experience partly or wholly irrelevant.

Litigation is a large share of most banks’ operational losses, and the Federal Reserve expects banks to estimate legal costs (expenses, judgments, fines and settlements) under baseline and stress, broken out as their own subcategory. The difficulty is timing: conduct that leads to lawsuits after a market crash may not produce settlements for years. So legal forecasts must build in lags between the drivers, such as macroeconomic variables and firm factors like assets, and the losses themselves. The idiosyncratic add-on, finally, rests on bank-specific storylines expected to materialize under stress. They need no explicit macro link but must target the bank’s own identified vulnerabilities, and they should come from a credible, transparent process: select the top material risks, filter them into a candidate set, then develop the storylines.