An Extreme Value Approach for Modeling Operational Risk Losses Depending on Covariates

• Date: 01 September 2016
• DOI: http://doi.org/10.1111/jori.12059
• Published date: 01 September 2016

©2015 The Journal of Risk and Insurance. Vol.83, No. 3, 735–776 (2016).

DOI: 10.1111/jori.12059

An Extreme Value Approach for Modeling

Operational Risk Losses Depending on Covariates

Val ´

erie Chavez-Demoulin

Paul Embrechts

Marius Hofert

Abstract

A general methodology for modeling loss data depending on covariates is

developed. The parameters of the frequency and severity distributions of the

losses may depend on covariates. The loss frequency over time is modeled

with a nonhomogeneous Poisson processwith rate function depending on the

covariates. This corresponds to a generalized additive model, which can be

estimated with spline smoothing via penalized maximum likelihood estima-

tion. The loss severity over time is modeled with a nonstationary generalized

Pareto distribution (alternatively, a generalized extreme value distribution)

depending on the covariates. Since spline smoothing cannot directly be ap-

plied in this case, an efficient algorithm based on orthogonal parameters is

suggested. The methodology is applied both to simulated loss data and a

database of operational risk losses collected from public media. Estimates,

including confidence intervals, for risk measures such as Value-at-Risk as

required by the Basel II/III framework are computed. Furthermore, an im-

plementation of the statistical methodology in Ris provided.

Introduction

The aim of the article is threefold: first, we present a statistical approach for the mod-

eling of business loss data as a function of covariates; second, this methodology is

exemplified in the context of an Operational Risk (OpRisk) data set to be detailed

later in the article; third, a publicly available software implementation (including a

simulated data example) is developed to apply the presented methodology.

Val ´

erie Chavez-Demoulin is at the Faculty of Business and Economics, University of Lausanne,

Switzerland. Chavez-Demoulin can be contacted via e-mail: valerie.chavez@unil.ch. Paul Em-

brechts is at the RiskLab, Department of Mathematics and Swiss Finance Institute, ETH Zurich,

8092 Zurich, Switzerland. Embrechts can be contacted via e-mail: embrechts@math.ethz.ch.

Marius Hofert is at the Department of Statistics and Actuarial Science, University of Waterloo,

200 University Avenue West, Waterloo, ON, Canada N2L 3G1. Hofert can be contacted via

e-mail: marius.hofert@math.ethz.ch. The author (Willis Research Fellow) thanks Willis Re for

financial support while this work was being completed. The authors would like to thank the

referees and an editor for various comments that led to a much improved version of the article.

735

736 The Journal of Risk and Insurance

The fact that we apply the new statistical tools to business “loss” data is not really

essential but rather reflects the properties of the OpRisk data set at hand (and data of

a similar kind). “Losses” can, without any problem, be changed into “gains”; relevant

is that we concentrate our analysis on either the left or the right tail of an underlying

performance distribution function. This more general interpretation will become clear

from the sequel. Slightly more precise, the typical data to which our methodology

applies is of the marked point process type; that is, random losses occur at random time

points and one is interested in estimating the aggregate loss distribution dynamically

over time. Key features will be the existence of extreme (rare) events, the availability

of covariate information, and a dynamic modeling of the underlying parameters as

a function of the covariates. OpRisk data typically exhibit such features; see later

references. Our concentration on an example from the financial services industry also

highlights the recent interest shown in more stringent capital buffersfor banks (under

the Basel guidelines) and insurance (referring to Solvency 2); for some background on

these regularity frameworks, see, for instance, McNeil, Frey, and Embrechts (2005) and

the references therein.

The methodology presented in this article is applied to a database of OpRisk losses

collected from public media. We are aware that other databases are available. In par-

ticular,it would have been interesting to get further explanatory variables such as firm

size (not present in our database) that may have an impact on the loss severity and

frequency; see, for instance, Ganegoda and Evans (2013), Shih, Khan, and Medepa

(2000), and Cope and Labbi (2008). The database at our disposal is, however, original,

rather challenging to model (mainly due to data scarcity), and shows stylized features

any OpRisk losses can show. Our findings regarding the estimated parameters are in

accordance with Moscadelli (2004) (infinite-mean models), the latter being based on a

much larger database. We also provide an implementation including a reproducible

simulation study in a realistic OpRisk context; it shows that even under these difficult

features, the methodology provides a convincing fit. We stress that the (limited) public

OpRisk data available to us provided the motivation for developing the new statistical

extreme value theory (EVT) methodology of this article. Wedo not (and indeed cannot)

formulate general conclusions on the Loss Distribution Approach (LDA) modeling of

real, one-company-based OpRisk data. By providing the R-software used, any indus-

try end-user can apply our techniques to his/her internal data. Wevery much hope to

learn from such experiments in the future so that the method provided can be further

enhanced. In the “Discussion” section, we do however make some general comments

on the quantitative LDA modeling of OpRisk data.

Recall that under the capital adequacy guidelines of the Basel Committee on Bank-

ing Supervision (see http://www.bis.org/bcbs, shortened throughout the article as

Basel or the Basel Committee), operational risk (OpRisk) is defined as: “The risk of a loss

resulting from inadequate or failed internal processes, people and systems or from

external events. This definition includes legal risk, but excludes strategic and repu-

tational risk” (see Bank for International Settlements [BIS], 2006, p. 144). By nature,

this risk category,as opposed to Market and Credit Risk, is much more akin to nonlife

insurance risk or loss experience from industrial quality control. OpRisk came under

regulatory scrutiny in the wake of Basel II in the late 90s; see BIS (2006). This is relevant

An Extreme Value Approach for Modeling Operational Risk Losses Depending on Covariates 737

as data were systematically collected only fairly recently, leading to reporting bias in

all OpRisk data sets. We will come back to this issue later in the article. An important

aspect of the Basel framework is industry’s freedom of choice of the internal model.

Of course, industry has to show to the regulators that the model fits well; on the latter,

Dutta and Perry (2006) provide a list of basic principles an internal model has to sat-

isfy.Recent events like Soci ´

et´

eG´

en´

erale (rogue trading), UBS (rogue trading), the May

6, 2010 Flash Crash (algorithmic trading), the Libor scandal (fraud involving several

banks), and litigation coming out of the subprime crisis have catapulted OpRisk very

high on the regulators’ and politicians’ agenda.

Basel II allows banks to opt for an increasingly sophisticated approach, starting from

the Basic Indicator Approach and the Standardized Approach to the Advanced Mea-

surement Approach. The latter is commonly realized via the LDA, which we will

consider in this article. All LDA models in use aim for a (loss-frequency, loss-severity)

approach. Regulators prescribe the use of the risk measure Value-at-Risk (VaR) over

a 1-year horizon at the 99.9 percent confidence level, denoted by VaR0.999. Note that

in this notation we stick to the use of “confidence level” in order to refer to what

statisticians prefer to call “percentile”; this unfortunate choice is by now universal

in the regulatory as well as more practical academic literature. For the latter, see for

instance, Jorion (2007, sect. 16.1.2).

The wisdom of the choice of VaR0.999 ishighly contested; see, for instance, Dan´

ielsson

et al. (2001). We will see later that Expected Shortfall (ES) as another risk measure

is not always a viable alternative, mainly due to the extreme (even infinite mean)

heavy-tailedness of OpRisk data. In this respect, we would like to point to the current

discussion on Market Risk measurement triggered by the Basel documents BIS (2012,

2013). See in particular Question 8 on page 41 of the former: “What are the likely

constraints with moving from VaRto ES, including any challenges in delivering robust

backtesting and how might these be best overcome?” These documents, and the latter

question in particular,led to a very extensive debate between regulators, practitioners

and academics; see Embrechts et al. (2014) for more details. Ingredients of the wider

debate are (1) to what extent can financial or insurance risk be mapped to a number

to be used as a basis for capital requirement; (2) which number, that is, risk measure

to use; and (3) for a given risk measure, how to statistically estimate it and backtest

it on historical data? In this article we mainly look at EVT-based methodology for

answering the first part of (3), that is, statistical estimation, and this with focus on

VaR, at very high quantile levels.

An important question concerns whether OpRisk can be accurately modeled and sta-

tistically estimated as proposed under the Basel guidelines: 1-year VaRat a confidence

level of 99.9 percent. Whereas for certain subcategories like soft- and hardwarefailures

this may be possible, for risk classes like fraud this becomes much more complicated,

if at all possible with the data available. It is worthwhile to compare and contrast this

situation with insurance regulation: under the EU Solvency 2 framework (to come into

force on January 1, 2016) the capital requirement for OpRisk is volume based, that is,

4.5 percent of the technical provisions for life insurance obligations or 3 percent of the

premiums earned during the past 12 months for nonlife. For the Swiss Solvency Test,