Structural Modelling of Operational Risk in Financial Institutions:

Transcription

1 Structural Modelling of Operational Risk in Financial Institutions: Application of Bayesian Networks and Balanced Scorecards to IT Infrastructure Risk Modelling Inaugural-Dissertation zur Erlangung des Grades Doctor oeconomiae publicae (Dr. oec. publ.) an der Ludwig-Maximilians-Universitat Miinchen vorgelegt von Irina Starobinskaya Jahr: 2008 Referent: Prof. Stefan Mittnik, Ph.D. Korreferent: Prof. Dr. Andreas Richter Promotionsabschluftberatung: 16. Juli 2008

2 Contents I Introduction 1 1 Introduction and outline Introduction and motivation Research objectives and scope of the thesis Outline of the thesis 6 II Theoretical background 9 2 Operational risk Operational risk: Definitions Developments in regulatory requirements for operational risk modelling: The Basel II Accord and The Sarbanes-Oxley Act The Basel II Accord The Sarbanes-Oxley Act Review of existing methods for modelling operational risk Methods based on historical data Actuarial models: Loss Distribution Approach Methods based solely on expert knowledge Methods based on a combination of historical data and expert knowledge Problems and challenges of modelling operational risk 23

3 2.4.1 Data insufficiency problem Modelling dependencies 25 3 Bayesian networks Introduction to Bayesian networks Core concepts of Bayesian networks Introduction to the graph theory The Bayes' theorem and probability calculus Conditional independence, d-separation and formal definition of the Bayesian networks Quantification of Bayesian networks Algorithms for learning Bayesian networks from data Known structure and full observability Known structure and partial observability Unknown structure and full observability Unknown structure and partial observability Inference algorithms for evaluation of Bayesian networks Exact inference algorithms Approximate inference algorithms Evaluating quality of Bayesian network models Logarithmic score Model assessment Diagnostic monitors Application areas of Bayesian networks Advantages and limitations of Bayesian networks as a risk modelling tool 50 4 Balanced Scorecards 53

4 4.1 Introduction to Balanced Scorecards Core concepts of Balanced Scorecards Basic principles of Balanced Scorecards Four perspectives of Balanced Scorecards Causality concept in Balanced Scorecard framework Designing a Balanced Scorecard Application areas of Balanced Scorecards Advantages and limitations of Balanced Scorecards as a risk modelling tool 65 5 Expert knowledge elicitation Introduction to expert knowledge elicitation Elicitation process General principles of the elicitation process Elicitation protocols Expert interviews and questionnaires Important facets and pitfalls of the elicitation process Necessary conditions for effective elicitation Consistency of expert estimates 77 *5.3.3 Biases of expert estimates Validation of expert estimates 79 III Application case study 83 6 IT infrastructure risk IT risks IT infrastructure 87 ix

5 6.2.1 IT infrastructure: definition and its role in risk generation Technical aspects of IT infrastructure risk Assessment of IT infrastructure risk Reliability, availability and maintainability analysis Basic principles RAM metrics Financial losses assessment 95 7 Models construction Risk mapping Constructing a Bayesian network model Modelling the network structure Frequency network Severity network Model structure validation Quantification of the network Frequency network Severity network Ill Convolution of the frequency and severity distributions Maintaining the network ' Constructing a Balanced Scorecard model Combining Balanced Scorecard and Bayesian network models Balanced Scorecard perspectives and indicators Balanced Scorecard representation of IT infrastructure risk Results and applications 125

6 8.1 Bayesian network model - Simulation results Descriptive statistics Risk metrics Updating the Bayesian network given event evidence Managing operational risk with a Bayesian network model - Scenario analysis Scenario 1 - Impact of adverse conditions Scenario 2 - Impact of dependence structure Scenario 3 - Impact of additional employee training 133 IV Conclusion Summary and conclusion Summary of the thesis Further research questions Conclusion 140 V Appendices 141 A Prior probability distributions 143 B Posterior probability distributions 145 C Monte-Carlo convolution procedure 147 Bibliography 150