Operational Risk Calculator

Basel II/III defines 7 categories of operational risk events: (1) Internal Fraud — misappropriation of assets, tax evasion, intentional mismarking of positions, bribery by employees; (2) External Fraud — theft, forgery, hacking, cybercrime by external parties; (3) Employment Practices and Workplace Safety — workers' compensation claims, discrimination, organized labor actions; (4) Clients, Products, and Business Practices — fiduciary breaches, product defects, market manipulation, privacy violations, money laundering; (5) Damage to Physical Assets — terrorism, vandalism, earthquakes, fires; (6) Business Disruption and System Failures — hardware failures, software errors, utility outages; (7) Execution, Delivery, and Process Management — failed transactions, data entry errors, accounting errors, vendor disputes.

The AMA was eliminated in the Basel IV final standard (2017, implementing 2023–2028) for several reasons: (1) Excessive variability in AMA capital across banks using similar approaches but different internal assumptions, undermining comparability; (2) Model complexity created opacity — regulators could not easily validate or compare AMA models across institutions; (3) Some banks gamed models to minimize capital requirements; (4) The AMA's flexibility led to pro-cyclical results in some implementations. The SMA replaces AMA with a more standardized formula that still incorporates actual historical losses through the Internal Loss Multiplier, maintaining incentives for loss control while improving consistency and comparability.

The Operational Riskdata eXchange Association (ORX) maintains the world's largest operational risk loss database, collecting anonymized loss event data from member banks worldwide. Member banks contribute operational risk losses above a specified threshold (typically $20,000), and receive consortium statistics in return. External data from ORX is critical for AMA and internal model development because individual banks have insufficient historical data to estimate the tail of the severity distribution for rare, high-impact events — the very losses that drive capital requirements. Without external data, an institution's 10-year internal history may contain no events in the 99th–99.9th percentile, making tail estimation impossible.

Scenario analysis is a forward-looking complement to historical loss data, required under AMA. Expert workshops bring together business managers, risk officers, and control functions to evaluate hypothetical but plausible operational risk scenarios: a major cyber attack, a rogue trader event, a regulatory fine for mis-selling, a business continuity disaster. Experts estimate the probability and severity of each scenario. Scenario data is incorporated into the AMA model alongside historical internal data and external loss data. Scenario analysis is especially important for capturing tail risks not yet observed in a bank's history but known to have occurred elsewhere in the industry.

Credit and market risk capital is allocated in proportion to the risk taken: more credit exposure or more market volatility requires more capital. Operational risk capital is unique because operational risk is generally not a source of return — it is a pure downside from failures in processes, systems, and people. This creates different management incentives: in credit risk, taking more risk earns more spread income; in operational risk, taking more risk earns nothing (no one is rewarded for having more fraud exposure). Operational risk capital is therefore a tax on operational complexity and control weakness, rather than compensation for productive risk-taking.

The Loss Distribution Approach (LDA) is the primary AMA methodology: for each combination of business line and event type (the 56 risk cells), a compound loss distribution is constructed by separately modeling loss frequency (typically Poisson distribution) and loss severity (typically log-normal or generalized Pareto distribution). Frequency and severity are combined using Monte Carlo simulation: draw frequency from the Poisson distribution, then draw that many severity values, sum for aggregate annual loss. After many simulations, the aggregate annual loss distribution is constructed, and the 99.9th percentile minus expected loss equals the capital requirement. Key challenges: fitting fat-tailed severity distributions with limited data, handling correlation across risk cells, and validating extreme quantile estimates.

Effective operational risk controls reduce both loss frequency and severity: (1) Segregation of duties — prevents single-person fraud or error; (2) System access controls — limits who can initiate and approve transactions; (3) Independent confirmation and reconciliation — catches errors and manipulation; (4) Business continuity planning — reduces losses from system failures and physical disasters; (5) Employee training and culture — reduces inadvertent errors and builds ethics consciousness; (6) Insurance — transfers some operational risk losses to insurers; (7) Third-party risk management — controls outsourcing vendor risk. Under AMA, demonstrable control improvements can directly reduce internal model capital estimates, creating a direct financial incentive for operational risk management investment.