Next Article in Journal
The Valuation of Equities and the GDP Growth Effect: A Global Empirical Study
Previous Article in Journal
The Effect of Straight-Line and Accelerated Depreciation Rules on Risky Investment Decisions—An Experimental Study
 
 
Search for Articles:
Title / Keyword
Author / Affiliation / Email
Journal
Article Type
 
 
Advanced Search
 
Section
Special Issue
Volume
Issue
Number
Page
 
Journals
IJFS
Volume 4
Issue 4
10.3390/ijfs4040020
ijfs-logo
Submit to this Journal Review for this Journal Propose a Special Issue
► Article Menu

Article Menu

share Share announcement Help format_quote Cite question_answer Discuss in SciProfiles thumb_up
...
Endorse textsms
...
Comment
first_page
settings
Order Article Reprints
Font Type:
Arial Georgia Verdana
Font Size:
Aa Aa Aa
Line Spacing:
Column Width:
Background:
Review

Operational Risk Management in Financial Institutions: A Literature Review

by
Suren Pakhchanyan
Area Finance and Banking, Department of Business Administration, Economics, and Law, University of Oldenburg, D-26111 Oldenburg, Germany
Int. J. Financial Stud. 2016, 4(4), 20; https://doi.org/10.3390/ijfs4040020
Submission received: 27 July 2016 / Revised: 30 September 2016 / Accepted: 3 October 2016 / Published: 19 October 2016
Browse Figures
Versions Notes

Abstract

:
Following the three-pillar structure of the Basel II/III framework, the article categorises and surveys 279 academic papers on operational risk in financial institutions, covering the period from 1998 to 2014. In doing so, different lines of both theoretical and empirical directions for research are identified. In addition, this study provides an overview of existing consortia databases and other publicly available sources on operational loss that may be incorporated into empirical research, as well as in risk measurement processes by financial institutions. Finally, this paper highlights the research gaps in operational risk and outlines recommendations for further research.
Keywords:
Basel framework; operational risk; risk management; risk indicators
JEL Classification:
G00; G20; G32

1. Introduction

The main objective of the Basel II Accord is to enhance the stability and soundness of the international banking system, in particular by strengthening risk management practices and developing significantly more risk-sensitive capital requirements. However, several significant operational risk events from the past decade, including fraudulent actions such as those of Lloyds Banking Group and Barclays in 2006 that created €5.9 billion and €4 billion losses, respectively; those of Bernard L. Madoff Investment Securities and Société Générale in 2008 resulting in a loss of almost $17 billion and €6.3 billion, respectively; those of Bank of America and Citigroup in 2012 causing losses of $175.5 million and $22 million, respectively; and those of Rabobank and Fondiaria-SAI in 2013 generating losses of $1 billion and €252 million,1 respectively, indicate that even financial institutions operating presumably complicated risk management systems are vulnerable to severe operational loss events. In a document issued in 2006 by the Basel Committee of Banking Supervision, the following operational risk definition is provided:
“Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk” [1] (p. 144).
The current study is the result of a survey of operational risk literature based on the aforementioned definition.2 Reviewing collected articles, we identify two studies that provide an overview of the operational risk literature, highlighting its importance and assessment methodologies. In particular, Moosa [2] surveys the operational risk literature, focusing on the definition, classification, characteristics, measurement and management of operational risk. Furthermore, he argues that operational risk is “truly a controversial topic, which has led to the emergence of a new strand of research that did not exist some ten years ago” [2] (p. 193). Galloppo and Rogora [3] provide a literature review, concentrating their attention on operational risk measurements methods used in the literature. Comparing various estimation approaches, they observe that generalised parametric distributions, such as a g-and-h distribution, as well as several limit distributions under extreme value theory, such as Generalized Pareto Distribution, can be used to estimate the fat-tailed behaviour of operational risk under the Loss Distribution Approach (LDA). Moreover, they provide an overview of existing operational risk management practices and show that LDA is the most prominent approach used under Advanced Measurement Approaches.
In contrast to the aforementioned studies, we first perform methodological research and assessment of articles, extending the methodology used by Lagner and Knyphausen-Aufseß [4]. This methodology enables us to provide an extensive literature review based on analyses of articles that cover a wide range of topics related to operational risk in financial institutions. Our final sample consists of 279 articles published between 1998 and 2014. Second, we review the identified articles by categorising them in the Basel II/III frameworks to reveal the gaps or under-researched areas within the three pillars of the Basel framework and shed light on the lack of definiteness (distinctness) of business environmental and internal control factors as well as on the controversial debate about the availability of external operational loss databases (see Figure 1 for a graphical illustration). Third, we highlight the lack of research in areas beyond the Basel frameworks that are relevant for market participants.
In this context, the current article proposes reviving discussions and views on the problem of operational risk indicators, operational loss databases and operational risk disclosure in quantitative and qualitative research. In particular, our results show that, even though a broad spectrum of articles can be found on operational risk by financial institutions, the aforementioned themes that serve as the cornerstone of and provide motivation for this study are worth discussing. Regarding the first topic, we identify only 26 articles (almost 9%) dealing with risk indicators. Concerns on this topic should, however, be significantly higher, as the Basel Committee requires financial institutions to implement risk indicators in internal measurement frameworks to capture operational risk drivers. In this context, the current article reviews the previous research and identifies factors determining operational loss frequency and severity. The identified determinants can be considered business environmental and internal control factors and serve, for risk managers, as a basis for estimating a bank’s exposure to operational risk.
To calculate operational risk capital, financial institutions are required to use four data elements: internal loss data, external loss data, scenario analysis and business environmental and internal control factors [1]. However, it is often suggested that operational risk data are scarce or inaccessible [5,6,7,8]. Considering this view, the present study attempts to provide empirical evidence to support these arguments. Although we identify 97 empirical studies based on operational loss data, the vast majority of these studies use the Bank’s internal or self-collected data (almost 54%), and only the remaining 46% apply consortia data. This finding may be interpreted as contradictory regarding whether or not enough databases are available. One can argue that 97 articles (or almost 54%) use operational loss databases, which indicates that sufficient access to these data is granted. However, among the 39 articles that use operational loss datasets provided by consortia, 31 items are clustered among three databases, namely ORX, Algo FIRST and Algo OpVantage. Moreover, the last two databases are available through the same provider, Algorithmics (currently IBM)3. We further identify two databases, GOLD from the British Banker Association and DakOR, managed by the Association of German Public Sector Banks, that are not used in previous research, but are prominently used by various banks, suggesting possible accessibility limitations.
With respect to the third topic, we emphasize a lack of research (only 18 articles) on operational risk disclosure requirements. Within this topic, we cannot identify articles that discuss operational risk disclosure from a theoretical perspective or provide theoretical models that explain disclosure practices. Most of the former research within this pillar (Pillar III—Market Discipline) reflects the anticipation of operational risk disclosure by the market and provides approaches to measure the reputational risk following an operational risk announcement. Furthermore, reviewing the operational risk literature, Moosa [10] criticizes the views that operational risk is not systemic and one-sided by arguing that severe losses by an individual financial institution can affect other banks as well. However, research on such an effect, namely information transfer within the interbank market caused by operational loss announcements, is lacking. Surprisingly, we also cannot find studies dealing with information transfer between ownership-related firms that occurred because of an operational loss announcement by a financial institution since, on the one hand, it is well documented in the research that large operational loss announcements are informative and cause a significant market value decline by the affected firm4 and, on the other hand, the ownership-related firm performance is tied directly to the affected firm’s performance and the firm-ownership link is ex ante publicly available (for instance, see disclosure requirements under SEC 13F filings required by Section 13(f) of the Securities Exchange Act for the U.S. and Section 21 of the Securities Trading Act for Germany). The latter two issues might be viewed as on-going questions that require further research.
The rest of this paper is organized as follows. The research methodology and classification of articles are described in Section 2. Section 3 discusses the results of the classification of the operational risk literature into the three pillars of the Basel framework. Section 4 provides an overview of operational risk event databases applied in former research as well as those used by various financial institutions. Section 5 reviews the articles covering risk indicators based on business environmental and internal control factors, and Section 6 points out the gaps in research going beyond the Basel II/III requirements and summarises our main findings.

2. Methodology for the Literature Research

Consistent with the methodology for searching and collecting the desired literature used by Lagner and Knyphausen-Aufseß [4], we use electronic databases such as EBSCO Business Source Premier and Google Scholar.5 Furthermore, we complete our collection by including articles referred to in previously identified studies and separately screen for relevance all the selected articles. The selection process is conducted using the following filters.
First, we restrict our attention to academic articles published in peer-reviewed scientific journals. Moreover, unlike Lagner and Knyphausen-Aufseß [4], we include papers irrespective of journal ranking6 since journals ranking may be biased towards “expert opinion”. Moreover, when taking only A*, A or B labelled journals, the Journal of Operational Risk, which is of considerable importance in this field, would not be considered, as it is a “C” or “3” journal by the Australian Business Deans Council (ABCD—Journal Quality List 2013) and by the Association of Business Schools’ (ABS—Academic Journal Guide 2015), respectively, and is not listed by the German Academic Association of Business Research (VBA—JOURQUAL3 2016)7.
Second, we search for and select articles published between 1998 and 2014 because the first definition of operational risk, which is similar to the definition of the Basel Committee on Banking Supervision (2001)8, appears in a paper published by the Risk Management Sub-group of the Basel Committee on Banking Supervision in 1998 (see [13]). The earliest article in our sample “Modeling and Measuring Operational Risk” is by Cruz et al. [14], published in the Journal of Risk.9 Figure 2 shows the development of the literature on operational risk among financial institutions. The rapid growth in 2006 (almost twice that of the previous year) may be a result of a new regulation put forward by the Basel Committee on Banking Supervision, known as “International Convergence of Capital Measurement and Capital Standards” and published in 2006. Under this document, banks are required to hold capital for operational risk (see [1]).
Third, we exclude non-financial institutions from our sample and restrict our attention to financial institutions that adhere to the Basel framework.
Further, we exclude books from our library to provide some homogeneity to our sample. Moreover, we eliminate articles later published in a book.
Finally, after applying all the filters discussed above, our sample consisted of 279 peer-reviewed articles.

3. Categorisation of the Operational Risk Literature in the Basel II/III Framework

In January 2001, the Basel Committee on Banking Supervision issued a new capital adequacy framework, commonly referred to as Basel II, to improve how regulatory capital requirements reflect key bank risks [16]. This document contains several new aspects regarding the regulation and supervision of financial institutions, comprised in three pillars, and replaces the 1988 Capital Adequacy Accord, which was found to have a number of faults (see [17]). Pillar I, capital adequacy requirements, specifies the determination of capital for the major risks the banks face. Pillar II deals with supervisory reviewing of a bank’s capital adequacy and the internal assessment process that enables the supervisory authorities to define additional capital requirements for particular banks and ensure that the negative externalities that can arise from the failure of a bank are minimised and managed. Moreover, it lays out a set of standards for banking regulators to ensure consistent treatment across different jurisdictions. Pillar III addresses a wide range of disclosure initiatives that enhance the effective use of market discipline in “regulating” bank behaviour to encourage the soundness of banking practices.
Operational risk, as one of the key risks that banks face, is reflected in the Basel II framework, which expects banks to identify, measure and manage this risk. Moreover, the Basel Committee requires banks to hold capital against operational risk [1]. These new rules led researchers to study measurement and management techniques that would comply with the Basel II requirements. As part of this process, this section categorises previous research by the pillars of the Basel II/III framework (see Figure 3) and aims at identifying less researched areas. Our results indicate that a majority of the former research (almost 60%) deals with the measurement of required regulatory capital and hence is categorised under Pillar I. The second largest subcategory includes almost 20% of all collected articles that study qualitative approaches to supervising financial institutions considered under Pillar II. The smallest subcategory, with only 18 articles, covers disclosure requirements in accordance with Pillar III. The latter category, inter alia, contains articles that analyse reputational losses caused by operational loss announcements, though the Basel Committee explicitly excludes reputational risk from operational risk definition (see [1] (p. 144))10. The reason for doing so is in line with the research purposes of the study at hand by identifying articles that investigate the market reaction to operational loss announcements. Moreover, this purpose is, in turn, consistent with the intention of the Basel Committee on Banking Supervision to reward or to penalise financial institutions using market power (see [19]).
The next category, labelled “Pillar Cross-cutting”, contains nine articles that cover two or more pillars simultaneously. For instance, Kessler [20] introduces an operational risk management framework (Pillar II) that includes some operational risk measurement models and discusses these quantitative models with respect to their applicability (Pillar I). A further example is the article by Jobst [21], which discusses the methods of integrating operational risk in systemic risk frameworks and managing these risks (Pillar II), as well as regulatory short-comings regarding the calculation of required capital for operational risk (Pillar I).
Finally, the articles that cannot be exactly classified in one of the previous four categories are placed in a separate category called “General Topics in OpRisk”. This category comprises articles, such as that of Moosa [2], which examines and exposes numerous controversies surrounding the concept of operational risk, especially its definition and nature; that of Cope et al. [22], which analyses various regulatory, legal, geographical and economic factors that may influence operational loss severity; that of Chernobai et al. [23], which provides a comprehensive analysis of firm-specific and macroeconomic factors that determine the occurrence of operational risk events; and that of Hess [24], which analyses the relation between operational losses and financial crises, just to mention a few. However, one can argue that the latter articles can be classified in the “Pillar Cross-cutting” category, as these studies investigate factors that can be used on the one side by calculating regulatory capital under Advanced Measurement Approaches (AMA) put forward by the Basel Committee on Banking Supervision (Pillar I)11 and on the other side by developing better internal control and management practices (Pillar II).

3.1. Pillar I

To identify dominant themes within each pillar separately, we divide the aforementioned categories into different subcategories. Within Pillar I, we identify three leading themes as shown in Table 1.12
Among the articles concerned with Pillar I (almost 49%), the subcategory “Estimation” received the most attention. Articles within this subcategory develop various models to measure regulatory capital against operational risk (see, e.g., [25,26,27,28,29,30,31,32,33,34]). The second largest topic (with 79 articles) is the “Application” of different models on the systematically collected internal or external operational loss databases (see, for instance, [5,35,36,37,38,39,40,41,42,43,44]). Studies that apply their models using simulated data are excluded from this subcategory and are part of the first subcategory and include, for instance, [45,46,47,48,49,50].
The last subcategory discusses themes other than the requirements set for the first two subcategories. In light of these studies, Moosa [51] criticises AMA regarding its adequacy, costs and difficulties caused by implementation, as well as regarding the lack of agreement between the methods for calculating capital against operational risk. Chaudhury [52] discusses some challenges and pitfalls that financial institutions face by developing and implementing AMA in calculating regulatory capital. Correa and Raju [53] analyse capital charges against operational risk based on various approaches and argue that financial institutions in India hold more operational risk capital than required under the Basel II framework. Berg-Yuen and Medova [54], based on a sample of 50 internationally operating banks for the period from 2005 to 2006, analyse the relationship between economic capital and required regulatory capital set aside for operational risk. The last study in this subgroup, conducted by Galloppo and Previati [6], introduces several approaches that mix internal and external data to estimate the frequency and severity of operational losses.
The prominent attention paid to this subject (Pillar I) may be explained by its relevance for both agents: practitioners, who are supposed to find an appropriate model that captures the bank’s internal and external losses as well as business environment and internal control factors (BEICF) for calculating regulatory capital under AMA requirements, and regulators to ensure that the applied models are accurate.

3.2. Pillar II

In the next step, through the literature assessment process, we identify three dominant themes across Pillar II, displayed in Table 1.13 The theme that has received the most attention in the literature concerning Pillar II (almost 72%) is dealt with under subcategory “Model/Concept”. The main subject of these articles is the development and discussion of various models or concepts for operational risk management (see, e.g., [55,56,57,58,59,60,61]).
In the second subcategory, the articles discuss diverse operational risk management models implemented in a firm. For example, Bergeon and Hensley [62] discuss operational risk management techniques used by the aviation industry and can be applied in the banking sector. Moodie [63] addresses the pitfalls of operational risk management at Société Générale and provides some methods to prevent fraudulent activities such as rogue trading. Macklin et al. [64] present approaches and tools for managing operational risk used by JP Morgan Chase, whereas Hanssen [65] highlights the importance of a strong operational risk culture for the management of operational risk management based on Wachovia’s approach.
The remaining articles within Pillar II are categorised under the “Other” subgroup and address themes such as the key operational risk qualitative elements required for an appropriate risk management framework [66], or discuss weaknesses in the management of operational risks and inadequate practices in information systems outsourcing used in commercial banks in Nigeria [67].
The aforementioned studies may need bank risk management units and regulators to implement operational risk management frameworks as well as to identify appropriate practices. From the perspective of investors and other market participants, the highlighted themes contribute to a better understanding of existing practices in operational risk management.

3.3. Pillar III

The disclosure of risk confronting a bank has a significant effect on market efficiency, as it can increase the trust of various stakeholders because of a reduction of information asymmetry and serve as a monitoring mechanism for investors. Moreover, the Financial Stability Board [68] emphasises that the investors’ trust in banks has been reduced since the latest financial crisis, and better risk disclosure is emphasised as a valid tool to achieve a healthy financial system. After assessing the collected papers, we found that sparse attention (only 18 articles) has been given to operational risk disclosure requirements as yet. Moreover, in connection with this pillar of the Basel II framework, we cannot specify articles that discuss operational risk disclosure from a theoretical perspective (e.g., within the frame of economic theories) or provide theoretical models that explain disclosure practices (e.g., a model that would help in analysing operational risk disclosure in terms of the content and the quality of a report). Most of the studies (almost 72%) within the second subgroup conduct event studies to analyse the market reaction to operational loss announcements and are classified in the “Event Study” subgroup. Several studies in this subgroup examine the stock market reaction and reputational damage caused by announcements of large operational loss events. Moreover, most of these studies analyse whether the impact of operational losses on a firm’s market value and reputation differs depending on the event type.14 The identified studies cover six large markets: the U.S. financial industry, the European banking sector, U.S. and European financial institutions, the Australian banking sector and British financial and non-financial firms. Table 2 provides details on these studies, the data and sample period they analyse, and their key findings.
Another steam of research analyses the impact of operational loss events on bonds, on effective spreads and the price impact of trades, as well as on credit default swaps. In particular, Plunus et al. [80] analyse the bond market response to the announcement of 71 operational loss events that occurred between 1994 and 2006 across 41 U.S. firms. They find significantly negative bond market reactions to operational loss disclosures around the first press release date. Furthermore, they show that debtholders’ response is more averse to operational losses of the event type “Clients, Products and Business Practices”. Barakat et al. [81], based on 331 operational loss events from 1995 to 2009, show that an operational loss announcement increases information asymmetry (measured by effective spreads and the price impact of trades) across U.S. financial firms around the first announcement date and that the effect is more pronounced for events caused by internal fraud. Moreover, they find that the level of information asymmetry is lower for financial institutions with stronger governance and around the settlement date. Finally, Sturm [82], analysing the effect of 99 operational loss events that occurred in European financial institutions from 2004 to 2010 on credit default swaps (CDS), finds a significant increase (almost 5%) in CDS spreads around the settlement date of operational losses. Further cross-sectional analysis shows that the size of the loss positively impacts the CDS spread and that the CDS spreads of banks with a good credit rating are more vulnerable to operational loss announcements.
The second subcategory (“Other”), for which there are only four studies, summarises topics on the determinants of operational risk reporting. For instance, Helbok and Wagner [83], based on assessments of annual reports from 142 financial institutions from North America, Europe and Asia over the period 1998–2001, provide a comprehensive analysis of factors that determine the extent and content of operational risk reporting. They hypothesise that, since a higher level of disclosure of operational risk reduces capital and agency costs, as well as the concerns of market participants, the firms with lower equity/assets and profitability ratios should tend to report more about their operational risk assessment and management practices. The results support the aforementioned hypothesis, suggesting that firms with lower capital and profitability ratios are perceived as more vulnerable to operational loss events. Furthermore, they observe that both the extent and the content of operational risk reporting increased throughout the investigation period. Oliveira et al. [84], conducting a content analysis of a sample of 111 Portuguese banks for 2006, analyse, on the one hand, the determinants of voluntary operational risk reporting and, on the other, whether this reporting complies with the requirements put forward by the Basel II framework. They show that the perception of a bank’s public visibility and reputation are leading factors in determining operational risk disclosure practices and that Portuguese banks are deemed to satisfy the regulatory requirements concerning operational risk reporting. The article within this subgroup by Haija and Al Hayek [85] is in line with Helbok and Wagner [83] and Oliveira et al. [84] regarding the purpose and methodology of the study, though focusing on the Jordanian banking sector. Analysing annual reports from 12 banks, they argue that operational risk reporting conforms to Jordan’s central bank requirements but does not comply with the requirements set by the Basel Committee. Finally, the comprehensive study by Barakat and Hussainey [86] analyses the direct and joint effect of bank governance, regulation and supervision on the quality of operational risk reporting by 85 European banks from 2008 to 2010. In particular, they analyse the impact of restrictions on non-traditional banking activities, regulations promoting bank competition, the official powers and independence of banking supervisory authorities, board composition, outside ownership concentration, governmental blockholding, executive ownership, audit committee activity and interactions between bank governance, regulation and supervision on operational risk reporting quality (measured as a self-constructed disclosure index). The findings show that banks with a higher proportion of outside board directors, lower executive ownership, concentrated outside non-governmental ownership, more active audit committee and operating under regulations that promote bank competition disclose higher-quality operational risk reports.
To sum up, the findings in this subsection generally reflect the perception of operational risk disclosure by the market participants and provide approaches to measure the reputational risk following an operational risk announcement. Since investors’ attitude towards unexpected operational risk events occurring in a bank is shown to be severe, financial institutions are supposed to implement internal control frameworks to identify and eliminate causes of operational risk and therefore have a straightforward implication for practice. From the perspective of investors, to make market discipline effective, more efforts in monitoring the internal control practices and the content of operational risk reporting should be undertaken.
The research reviewed in Section 3 offers useful insights into enhanced risk practice, prudential supervision and understanding of market reaction.

4. Operational Loss Databases

Since internal databases of single banks are generally biased towards high-frequency and low-severity events, as they lack a sufficient number of tail events that would limit accurate modelling of the tail part of loss distribution, Basel II requires banks using AMA to supplement their internal data with external data to measure operational risk capital [1]. However, as noted throughout the current article, the literature highlights the shortage of systematically recorded operational loss databases for conducting empirical research or testing the validity of newly developed models on “real”15 operational loss data (see, e.g., [5,6,7,8,87]). Taking these claims into the consideration, we identify operational risk databases used in the assessed articles and provide an overview of the content as well as on implication’s frequency of identified databases that are listed in Table 3. We find that a majority of articles (almost 54%) conducting empirical research use a bank’s internal databases (see, e.g., [87,88,89,90,91]) or does not identify the source and/or provider of loss data (such as [8,92,93,94,95,96])16. A possible explanation for the latter might be the damage to banks’ market value and reputation arising from the disclosure of the operational risk events, as shown in the previous section.
In the next step, the specified databases are clustered into four classes based first on their providers, namely non-profit associations and private vendors, and second on the availability of the operational event to the public. For instance, the vendor of the Algo First database collects information on operational loss events that occur in financial and non-financial institutions around the world from public sources such as newspapers and regulatory agencies (e.g., the Consumer Financial Protection Bureau (CFPB) and the Securities and Exchange Commssion (SEC)), whereas ORX contains internal loss data from consortia member banks and can also be classified as pooled industry data. The latter is the most frequently used database among publicly unavailable classes provided by a non-profit association with a loss reporting threshold equal to or greater than €20,00017 (used by Cope et al. [22], Cope and Antonini [36], Cope and Labbi [37], Aue and Kalkbrenner [98]). Across databases providing publicly available operational loss information, we identify Algo First as being most frequently used (for instance by Dahen and Dionne [40], Jarrow et al. [99], Moosa [100] and Horbenko et al. [101]).
At the time of writing, we cannot identify any article that uses databases such as GOLD and DakOR, provided by the British Banker Association and by the Association of German Public Sector Banks, respectively. However, these databases are widely used by numerous banks, such as Bayerische Landesbank, Deutsche Postbank AG, etc.18 This indicates that these databases are not accessible for research purposes and thus partially confirms the claims of researchers.
In sum, the research reviewed in this section shows that there is a sufficient number of internal and external operational loss databases for potential use. However, the external databases discussed in this section systematically collect losses for developed countries. Under these conditions, conducting empirical research on developing countries is not possible because of a lack of data.

5. Risk Indicators

To adopt AMA, financial institutions are required to apply business environmental and internal control factors (BECIF) in their risk measurement systems (see [1] (p. 152)). Moreover, the Basel Committee expects banks to choose factors that are sensitive to the firm’s exposure to operational risk and are justified as a key driver of risk (see [1] (p. 154)). In a report by the Standards Implementation Group’s Operational Risk Subgroup (SIGOR) BECIFs are defined as “indicators of a bank’s operational risk profile that reflect underlying business risk factors and an assessment of the effectiveness of the internal control environment” [102] (p. 21). In addition, the report provides only a few examples of both business environmental factors, such as staff turnover, rate of growth and introduction of new products, and internal control factors, such as findings from the challenge process and internal audit as well as system downtime. From a practical viewpoint, this small number of examples could be argued as insufficient, after considering the importance of selecting relevant and risk-reflecting factors in assessing operational risk. For this purpose, this section aims to identify BECIF in academic research and find out whether the literature fills this gap.
Academic research on developing risk indicators in financial institutions can be broadly divided into theoretical studies focusing on the discussion of causes and drivers of operational risk and empirical studies exploring the link between operational losses and particular internal control or business environmental factors.
Among the first class of studies, Fheili [103] discusses the role of the human resources (HR) management unit of an organisation in enhancing personal management. He argues that various information on employees, such as turnover levels and number of sick days, should be collected and analysed to develop HR key risk indicators that enable the forecasting of employee behaviour and therefore the management of people risk as a part of operational risk. In a later study, Fheili [104] analyses the factors that influence a firm’s staff-related operational risk and provides some risk-mitigation strategies. In particular, he focuses on determinants that influence the retention of core employees, since new employees typically still have to build relevant skills and knowledge and hence are more likely to make mistakes. Moreover, he argues that any delay in providing new employees with guidance, equipment and training as well as a lack of autonomy, recognition, lack of an interesting work environment and opportunities for growth lead to unintended staff turnover. As a strategy for retention, he suggests clarifying what the employee finds rewarding, recognising engaged and motivated employees and establishing the firm’s internal compensation and individual treatment mechanisms. Breden [56] discusses the effectiveness of key risk indicators in monitoring the risk environment of financial institutions and suggests some activities (such as a bank’s overseas payment business) that may be connected with higher risk and therefore may cause higher losses. He argues that activities that bear higher risk exposure should be identified and incorporated as elements when creating risk indicators, suggesting, for instance, the volume of errors and unreconciled items as a frequent indicator of risk. Moreover, he argues that alerts provided by risk indicators (e.g., the number and volume of payments exceeding an ex ante specified monetary figure) enable the institution to address the problem quicker and should be communicated to all corresponding parties. Focusing on one of the four categories of operational risk, McConnell [61] introduces a model for specifying and managing people risk as a key element in an operational risk framework. In line with the aforementioned arguments, he suggests developing risk indicators based inter alia on staff dissatisfaction and staff turnover for alerting operational risk management about possible hazards.
Scandizzo [105] provides a comprehensive analysis of risk mapping and risk indicators in an operational risk management framework. Moreover, he provides some properties that risk indicators should satisfy, such as relevance, measurability, and auditability, as well as features to classify risk indicators into two types, namely performance indicators and descriptive indicators. Developing and applying a risk mapping methodology to several cases, he shows how the relevant risk indicators may be identified and provides various examples of quantitative risk indicators, such as the cancellation rate, number of new products presented, error rate, transactions rate and qualitative risk indicators such as system adequacy and the competence of personnel. Finally, Cech [106] argues that risk managers should identify in advance the causal elements generating operational risk events and then develop risk indicators to validate the drivers of these events within their organisations. Furthermore, he argues that causes may result from or be associated with, some firm-specific factors, such as the firm’s processing activities and external factors such as high market volatility driven in particular by data entry error. The studies on BECIF reviewed so far rely on theories and provide no empirical evidence.
The second class of articles, those by Chernobai et al. [23], Moosa [100], Cope [107] and Cope et al. [22], make valuable contributions to identifying business environment, regulatory and firm-specific factors that can be applied for creating risk indicators. Moreover, the control variables used in the studies categorised under “Event Study” by Pillar III can be employed as variables to establish risk indicators (see the Pillar III subsection).
Across the second class of literature, the pioneering study by Chernobai et al. [23] provides a comprehensive analysis of the firm-specific and macroeconomic variables that determine the operational risk event occurrence among 176 U.S. financial institutions. Analysing the incidence of publicly disclosed operational risk events that occurred between 1980 and 2005, they report that most operational losses can be attributed to internal control weaknesses. Moreover, they find that younger, more complex and financially weaker firms with a high number of antitakeover provisions and those with CEOs with larger options and bonus-based compensation experience more operational losses. Finally, they show a positive relation between operational risk and credit risk, recommending that financial institutions’ risk managers consider it while estimating firm-wide loss distribution. Focusing on the macroeconomic environment, Moosa [100] analyses the relationship between unemployment rate and 3239 operational loss events at U.S. firms from 1990 to 2007. The results show a significantly positive association between the unemployment rate and operational loss severity on the one side and an insignificant relation to operational loss frequency on the other side, suggesting that operational losses are less severe in a strong economy. An extensive study by Cope [107] complements the aforementioned studies, focusing on consortium data (ORX) from international banks. Based on a large sample of operational risk events (57,000 losses) across 130 countries from 2002 to 2010, they analyse various regulatory, legal, geographical and economic factors that influence operational loss severity. They find a significant relationship between losses caused by internal fraud on the one side and constraints on executive power and the prevalence of insider trading on the other; between losses of the event type “Clients, Products and Business Practices” on the one hand and securities and shareholder protection laws, restrictions on banking activity, supervisory power and the prevalence of insider trading on the other; and between losses caused by external fraud on one side and geographic region, governance index and GDP on the other. With respect to the losses corresponding to event type “Employment Practices and Workplace Safety”, they report a significant relationship with geographic region and GDP.
All in all, we can conclude that the existing research literature has filled the gap with respect to identifying BECIF that most likely drive operational risk events and can be implemented in risk measurement systems under AMA. In addition, BECIF can be used by developing risk indicators for the early identification of potential risk, hence minimising it. Based on our assessment methodology, we identify 26 articles (or almost 9%) that shed light on identifying business environmental and internal control factors. When addressing only empirical articles, we can observe 17 items, a majority of which (42%) conduct their research on U.S. financial institutions, followed by a mixture of U.S. and European (24%) and only European (12%) financial institutions. Given that, we can observe a gap in the research on financial institutions in single European (only two) and developing countries. Moreover, we observe a bias in the research regarding: (a) relatively small financial institutions such as public-sector banks and cooperative banks typical of German-speaking countries; and (b) financial institutions that are not publicly listed.

6. Conclusion and Directions for Future Research

Two previous surveys on operational risk provide a discussion on various subjects of operational risk, such as the definition, classification, features, measurement and management of operational risk (by [2]), as well as a focus on several estimation methods used in research (by [3]). We extend these studies by highlighting the gaps in the operational risk literature that were not mentioned in these studies and suggest future research opportunities.
In the banking literature, it is often suggested that higher transparency reduces uncertainty among market participants leading to an increase in market efficiency and is often established through regulatory requirements, such as the Basel Accords (see, e.g., [108]). In fact, the transparency of the interbank market is criticised for being the cause of many recent scandals, such as the London Interbank Offered Rate (LIBOR) and the Euro Interbank Offered Rate (EURIBOR) manipulations [109]. In contrast it is suggested in the literature that operational risk is firm-specific, implying the absence of a spillover effect within the financial industry. Reviewing the literature, Moosa [10] criticises the view that operational risk is idiosyncratic and suggests that operational risk events have a systemic effect. However, the papers discussed so far in the Pillar III subsection study the information transfer between an affected firm and its shareholders, leaving open the question whether operational risk events are systemic or idiosyncratic. Considering the interconnectedness of financial institutions, it is less clear whether and how other market participants are affected by an unexpected event in a financial institution. Based on an analysis of 279 operational risk-related articles, we highlight two operational risk-related areas with the research shortage.19 First, we could not identify any study analysing the existence of an information transfer between an operational loss announcing firm and its rivals. This finding is a bit surprising, as several previous studies on financial contagion have analysed the market response across industry peers to bank failure, indicating the importance and relevance of a contagion effect (for instance, [110,111,112,113,114,115]). Moreover, several recent events covered in the media, should alter market participants’ perceptions regarding the soundness and exposure of rival firms within the industry. In July 2012, the Consumer Financial Protection Bureau (CFPB) ordered Capital One Bank to refund $140 million to its customers and charged it a $25 million penalty for misleading consumers into buying “add-on products” [116]. At that time, Capital One Bank was the first bank to be prosecuted by CFPB, but further investigation concerning similar allegations has led to repayment orders and fines against several other financial institutions, including Bank of America ($747 million) [117] in 2014 and J.P. Morgan Chase ($380 million) [118] and American Express Co. ($70 million) [119] one year earlier. The aforementioned example is an illustration of a negative spillover based on the announcements of operational risk events. However, an operational risk event may shift stakeholders from one bank to another, inducing a positive spillover effect. Our analyses further indicate that research falls short of investigating factors that may impact the information transfer between affected firms and their competitors.
Second, although it seems obvious that the performance of large shareholders (also known as blockholders) is related to the underlying firm performance and that the firm-blockholder link is ex ante publicly available for larger shareholders (for instance, in the U.S. from SEC 13F filings), we could not identify any research studying the effect of an operational loss event on blockholder’s market value. This is hardly surprising since the previous literature has so far focused on studying the impact of blockholders on target firms20 and has not asked, whether the market reacts rationally to blockholders in the presence of large unexpected events in target firms.
Finally, the recent changes in regulation, particularly the introduction of a new methodology for calculating operational risk capital (called the Standardized Measurement Approach (SMA)), may guide future research in this field. With this amendment BCBS proposes to replace all the currently available methods for estimating regulatory capital (BIA, STA, and AMA) through a single standardised approach called the Standardized Measurement Approach aiming to enhance the simplicity of the capital calculation and enable greater comparability across financial institutions (see [123]).
To sum up, the current study highlights the gaps in the operational risk literature by separately analysing previous research in compliance with the Basel frameworks and beyond. In particular, the study provides an overview of existing consortia databases and other publicly available sources on operational loss that may be incorporated into empirical research as well as in the risk measurement process by financial institutions. Moreover, different theoretical and empirical directions for research in determining risk indicators based on business environmental and firm-specific variables as well as on the impact of the disclosure of operational risk on market participants are outlined. Finally, the outcome of the literature review shows that there is an evident need for research on the impact of operational loss events on rival firms and ownership-linked firms, such as blockholders. The results might be useful to shareholders and financial analysts for adjusting their portfolios and recommendations, respectively, following an operational loss event.

Acknowledgments

The author would like to thank Jörg Prokop and Benno Kammann from the University of Oldenburg, and the participants in the 23rd Annual Conference of the Multinational Finance Society (Stockholm) for their constructive comments and suggestions. Comments and feedbacks by the anonymous referee were useful in improving the quality of the paper.

Conflicts of Interest

The author declares no conflict of interest.

References

  1. Basel Committee on Banking Supervision (BCBS). “Basel II: International Convergence of Capital Measurement and Capital Standards: A Revised Framework—Comprehensive Version.” June 2006. Available online: http://www.bis.org/publ/bcbs128.htm (accessed on 13 October 2015).
  2. I.A. Moosa. “Operational Risk: A Survey.” Financial Mark. Inst. Instrum. 16 (2007): 167–200. [Google Scholar] [CrossRef]
  3. G. Galloppo, and A. Rogora. “What Has Worked in Operational Risk? ” Glob. J. Bus. Res. 5 (2011): 1–17. [Google Scholar]
  4. T. Lagner, and D. Knyphausen-Aufseß. “Rating Agencies as Gatekeepers to the Capital Market: Practical Implications of 40 Years of Research.” Financial Mark. Inst. Instrum. 21 (2012): 157–202. [Google Scholar] [CrossRef]
  5. E. Brechmann, C. Czado, and S. Paterlini. “Flexible dependence modeling of operational risk losses and its impact on total capital requirements.” J. Bank. Finance 40 (2014): 271–285. [Google Scholar] [CrossRef]
  6. G. Galloppo, and D. Previati. “A review of methods for combining internal and external data.” J. Oper. Risk 9 (2014): 83–103. [Google Scholar] [CrossRef]
  7. S. Kerbl. “Evidence, estimates and extreme values from Austria.” J. Oper. Risk 9 (2014): 89–123. [Google Scholar] [CrossRef]
  8. X. Zhou, R. Giacometti, F.J. Fabozzi, and A.H. Tucker. “Bayesian estimation of truncated data with applications to operational risk measurement.” Quant. Finance 14 (2014): 863–888. [Google Scholar] [CrossRef]
  9. IBM Media Relations. “IBM to Acquire Algorithmics, 2011.” IBM Web Site. Available online: http://www-03.ibm.com/press/us/en/pressrelease/35176.wss (accessed on 29 August 2016).
  10. I.A. Moosa. “Misconceptions about operational risk.” J. Oper. Risk 1 (2006): 97–104. [Google Scholar]
  11. Ebscohost. “Business Source Premier. Magazines and Journals, 2016.” Ebscohot Research Database Web Site. Available online: https://www.ebscohost.com/titleLists/buh-journals.pdf (accessed on 7 October 2016).
  12. I.A. Moosa. “A Critique of the Bucket Classification of Journals: The ABDC List as an Example.” Econ. Rec. 92 (2016): 448–463. [Google Scholar] [CrossRef]
  13. Basel Committee on Banking Supervision (BCBS). “Operational Risk Management.” September 1998. Available online: http://www.bis.org/publ/bcbs42.pdf (accessed on 13 October 2015).
  14. M. Cruz, R. Coleman, and G. Salkin. “Modeling and measuring operational risk.” J. Risk 1 (1998): 63–72. [Google Scholar] [CrossRef]
  15. R.H. Barros, and M.I.M. Torre-Enciso. “Capital assessment of operational risk for the solvency of health insurance companies.” J. Oper. Risk 7 (2012): 43–65. [Google Scholar] [CrossRef]
  16. Basel Committee on Banking Supervision (BCBS). “Basel II: The New Basel Capital Accord—second consultative paper.” January 2001. Available online: http://www.bis.org/bcbs/bcbscp2.htm (accessed on 14 October 2015).
  17. J.A.C. Santos. “Bank Capital Regulation in Contemporary Banking Theory: A Review of the Literature.” Financial Mark. Inst. Instrum. 10 (2001): 41–84. [Google Scholar] [CrossRef]
  18. Basel Committee on Banking Supervision (BCBS). “Enhancements to the Basel II framework.” July 2009. Available online: http://www.bis.org/publ/bcbs157.htm (accessed on 28 October 2015).
  19. M.B. Gordy, and B. Howells. “Procyclicality in Basel II: Can we treat the disease without killing the patient? ” J. Financial Intermediation 15 (2006): 395–417. [Google Scholar] [CrossRef]
  20. A.-M. Kessler. “A systemic approach to operational risk measurement in financial institutions.” J. Oper. Risk 2 (2007): 27–68. [Google Scholar]
  21. A.A. Jobst. “The credit crisis and operational risk - implications for practitioners and regulators.” J. Oper. Risk 5 (2010): 43–62. [Google Scholar] [CrossRef]
  22. E.W. Cope, M.T. Piche, and J.S. Walter. “Macroenvironmental determinants of operational loss severity.” J. Bank. Finance 36 (2012): 1362–1380. [Google Scholar] [CrossRef]
  23. A. Chernobai, P. Jorion, and F. Yu. “The Determinants of Operational Risk in U.S. Financial Institutions.” J. Financial Quant. Anal. 46 (2011): 1683–1725. [Google Scholar] [CrossRef]
  24. C. Hess. “The impact of the financial crisis on operational risk in the financial services industry: Empirical evidence.” J. Oper. Risk 6 (2011): 23–35. [Google Scholar] [CrossRef]
  25. C. Andreatta, and D. Mazza. “Alternative approaches to generalized Pareto distribution shape parameter estimation through expert opinions.” J. Oper. Risk 8 (2013): 47–72. [Google Scholar] [CrossRef]
  26. G. Arlt, F. Neumann, and U. Milkau. “A simple model for pseudo-nonstationarity in operational risk loss data due to interest rate dependency and reporting threshold.” J. Oper. Risk 8 (2013): 27–37. [Google Scholar] [CrossRef]
  27. S. Carrillo, H. Gzyl, and A. Tagliani. “Reconstructing heavy-tailed distributions by splicing with maximum entropy in the mean.” J. Oper. Risk 7 (2012): 3–15. [Google Scholar] [CrossRef]
  28. A. Cavallo, B. Rosenthalm, X. Wang, and J. Yan. “Treatment of the data collection threshold in operational risk: A case study using the lognormal distribution.” J. Oper. Risk 7 (2012): 3–38. [Google Scholar] [CrossRef]
  29. B. Ergashev, S. Mittnik, and E. Sekeris. “A Bayesian approach to extreme value estimation in operational risk modeling.” J. Oper. Risk 8 (2013): 55–81. [Google Scholar] [CrossRef]
  30. D. Guégan, and B.K. Hassani. “A Mathematical Resurgence of Risk Management: An Extreme Modeling of Expert Opinions.” Front. Finance Econ. 11 (2014): 25–45. [Google Scholar]
  31. V.S. Hari Rao, and K.V.N.M. Ramesh. “A checklist-based weighted fuzzy severity approach for calculating operational risk exposure on foreign exchange trades under the Basel II regime.” J. Oper. Risk 9 (2014): 105–124. [Google Scholar] [CrossRef]
  32. R.A. Jarrow. “Operational risk.” J. Bank. Finance 32 (2008): 870–879. [Google Scholar] [CrossRef]
  33. L. Tibiletti. “Value-at-risk: Is lacking in sub-additivity just an annoying technicality? ” Int. J. Risk Assess. Manag. 9 (2008): 44–51. [Google Scholar] [CrossRef]
  34. B. Tong, and C. Wu. “Asymptotics for operational risk quantified with a spectral risk measure.” J. Oper. Risk 7 (2012): 91–116. [Google Scholar] [CrossRef]
  35. A. Chernobai, and Y. Yildirim. “The dynamics of operational loss clustering.” J. Bank. Finance 32 (2007): 2655–2666. [Google Scholar] [CrossRef]
  36. E.W. Cope, and G. Antonini. “Observed correlations and dependencies among operational losses in the ORX consortium database.” J. Oper. Risk 3 (2008): 47–74. [Google Scholar]
  37. E.W. Cope, and A. Labbi. “Operational loss scaling by exposure indicators: evidence from the ORX database.” J. Oper. Risk 3 (2008): 25–45. [Google Scholar]
  38. E.W. Cope. “Modeling operational loss severity distributions from consortium data.” J. Oper. Risk 5 (2010): 35–64. [Google Scholar]
  39. E.W. Cope, G. Mignola, G. Antonini, and R. Ugoccioni. “Challenges and pitfalls in measuring operational risk from loss data.” J. Oper. Risk 4 (2009): 3–27. [Google Scholar] [CrossRef]
  40. H. Dahen, and G. Dionne. “Scaling models for the severity and frequency of external operational loss data.” J. Bank. Finance 34 (2010): 1484–1496. [Google Scholar] [CrossRef]
  41. P. De Fontnouvelle, V. Dejesus-Rueff, J.S. Jordan, and E.S. Rosengren. “Capital and Risk: New Evidence on Implications of Large Operational Losses.” J. Money Credit Bank 38 (2006): 1819–1846. [Google Scholar] [CrossRef]
  42. E. Gourier, W. Farkas, and D. Abbate. “Operational risk quantification using extreme value theory and copulas: From theory to practice.” J. Oper. Risk 4 (2009): 3–26. [Google Scholar]
  43. S. Li, D. Black, C. Lee, F. Famoye, and S. Li. “Dependence Models Arising from the Lagrangian Probability Distributions.” Commun. Stat. Theory Methods 39 (2010): 1729–1742. [Google Scholar] [CrossRef]
  44. R. Wei. “Quantification of operational losses using firm-specific information and external database.” J. Oper. Risk 1 (2006): 3–34. [Google Scholar]
  45. S. Figini, P. Giudici, and P. Uberti. “A threshold based approach to merge data in financial risk management.” J. Appl. Stat. 37 (2010): 1815–1824. [Google Scholar] [CrossRef]
  46. S. Figini, P. Giudici, P. Uberti, and A. Sanyal. “A statistical method to optimize the combination of internal and external data in operational risk measurement.” J. Oper. Risk 2 (2007): 69–78. [Google Scholar]
  47. C.-L. Liang. “Bayesian analysis of extreme operational losses.” J. Oper. Risk 4 (2009): 27–43. [Google Scholar]
  48. S. Mittnik, and T. Yener. “Estimating operational risk capital for correlated, rare events.” J. Oper. Risk 4 (2009): 29–51. [Google Scholar]
  49. J.D. Opdyke, and A. Cavallo. “Estimating operational risk capital: The challenges of truncation, the hazards of maximum likelihood estimation, and the promise of robust statistics.” J. Oper. Risk 7 (2012): 3–90. [Google Scholar] [CrossRef]
  50. J.D. Opdyke. “Estimating operational risk capital with greater accuracy, precision and robustness.” J. Oper. Risk 9 (2014): 3–79. [Google Scholar] [CrossRef]
  51. I.A. Moosa. “A critique of the advanced measurement approach to regulatory capital against operational risk.” J. Bank. Regul. 9 (2008): 151–164. [Google Scholar] [CrossRef]
  52. M. Chaudhury. “A review of the key issues in operational risk capital modeling.” J. Oper. Risk 5 (2010): 37–66. [Google Scholar]
  53. R. Correa, and S. Raju. “Capital charges for operational risk in the Indian banking sector: Alternative measures.” J. Oper. Risk 5 (2010): 65–82. [Google Scholar]
  54. P.E.K. Berg-Yuen, and E.A. Medova. “Economic capital gauged.” J. Bank. Regul. 6 (2005): 353–378. [Google Scholar] [CrossRef]
  55. S. Ashby. “Operational risk: Lessons from non-financial organisations.” J. Risk Manag. Financial Inst. 1 (2008): 406–415. [Google Scholar]
  56. D. Breden. “Monitoring the operational risk environment effectively.” J. Risk Manag. Financial Inst. 1 (2008): 156–164. [Google Scholar]
  57. D. Cernauskas, and A. Tarantino. “Operational risk management with process control and business process modeling.” J. Oper. Risk 4 (2009): 3–17. [Google Scholar]
  58. M.I. Fheili. “Information technology at the forefront of operational risk: Banks are at a greater risk.” J. Oper. Risk 6 (2011): 47–67. [Google Scholar] [CrossRef]
  59. A.D. Grody, and P.J. Hughes. “Financial services in crisis: Operational risk management to the rescue! ” J. Risk Manag. Financial Inst. 2 (2008): 47–56. [Google Scholar]
  60. P. McConnell. “LIBOR manipulation: operational risks resulting from brokers’ misbehavior.” J. Oper. Risk 9 (2014): 77–102. [Google Scholar] [CrossRef]
  61. P. McConnell. “People risk: Where are the boundaries? ” J. Risk Manag. Financial Inst. 1 (2008): 370–381. [Google Scholar]
  62. F. Bergeon, and M. Hensley. “Swiss cheese and the PRiMA model: What can information technology learn from aviation accidents? ” J. Oper. Risk 4 (2009): 47–58. [Google Scholar]
  63. J. Moodie. “Internal systems and controls that help to prevent rogue trading.” J. Secur. Oper. Custody 2 (2009): 169–180. [Google Scholar]
  64. B. Macklin, D. De Tora, E. Rath, and P. Rothman. “A Partnership Approach to Operational Risk Management.” Bank Account. Finance 16 (2003): 9–14. [Google Scholar]
  65. J. Hanssen. “Corporate Culture and Operational Risk Management.” Bank Account. Finance 18 (2005): 35–38. [Google Scholar]
  66. A. Sheen. “Implementing the EU Capital Requirement Directive—key operational risk elements.” J. Financ. Regul. Compliance 13 (2005): 313–323. [Google Scholar] [CrossRef]
  67. B.C. Adeleye, F. Annansingh, and M.B. Nunes. “Risk management practices in IS outsourcing: An investigation into commercial banks in Nigeria.” Int. J. Inf. Management 24 (2004): 167–180. [Google Scholar] [CrossRef]
  68. Financial Stability Board. Enhancing the Risk Disclosures of Banks. Report of the Enhanced Disclosure Task Force; Basel, Switzerland: Financial Stability Board, 29 October 2012. [Google Scholar]
  69. J.D. Cummins, C.M. Lewis, and R. Wei. “The market value impact of operational loss events for US banks and insurers.” J. Bank. Finance 30 (2006): 2605–2634. [Google Scholar] [CrossRef]
  70. J. Goldstein, A. Chernobai, and M. Benaroch. “An Event Study Analysis of the Economic Impact of IT Operational Risk and its Subcategories.” J. Assoc. Inf. Syst. 12 (2011): 606–631. [Google Scholar]
  71. M. Benaroch, A. Chernobai, and J. Goldstein. “An internal control perspective on the market value consequences of IT operational risk events.” Int. J. Account. Inf. Syst. 13 (2012): 357–381. [Google Scholar] [CrossRef]
  72. R. Gillet, G. Hübner, and S. Plunus. “Operational risk and reputation in the financial industry.” J. Bank. Finance 34 (2010): 224–235. [Google Scholar] [CrossRef]
  73. F. Fiordelisi, M.-G. Soana, and P. Schwizer. “The determinants of reputational risk in the banking sector.” J. Bank. Finance 37 (2013): 1359–1371. [Google Scholar] [CrossRef]
  74. F. Fiordelisi, M.-G. Soana, and P. Schwizer. “Reputational losses and operational risk in banking.” Eur. J. Finance 20 (2014): 105–124. [Google Scholar] [CrossRef]
  75. G. Cannas, G. Masala, and M. Micocci. “Quantifying reputational effects for publicly traded financial institutions.” J. Financ. Transform. 27 (2009): 76–81. [Google Scholar]
  76. P. Sturm. “Operational and reputational risk in the European banking industry: The market reaction to operational risk events.” J. Econ. Behav. Organ. 85 (2013): 191–206. [Google Scholar] [CrossRef]
  77. L. Biell, and A. Muller. “Sudden crash or long torture: The timing of market reactions to operational loss events.” J. Bank. Finance 37 (2013): 2628–2638. [Google Scholar] [CrossRef]
  78. I.A. Moosa, and L. Li. “The frequency and severity of operational losses: A cross-country comparison.” Appl. Econ. Lett. 20 (2013): 167–172. [Google Scholar] [CrossRef]
  79. I.A. Moosa, and P. Silvapulle. “An empirical analysis of the operational losses of Australian banks.” Account. Finance 52 (2012): 165–185. [Google Scholar] [CrossRef]
  80. S. Plunus, R. Gillet, and G. Hübner. “Reputational damage of operational loss on the bond market: Evidence from the financial industry.” Int. Rev. Financial Anal. 24 (2012): 66–73. [Google Scholar] [CrossRef]
  81. A. Barakat, A. Chernobai, and M. Wahrenburg. “Information asymmetry around operational risk announcements.” J. Bank. Finance 48 (2014): 152–179. [Google Scholar] [CrossRef]
  82. P. Sturm. “How much should creditors worry about operational risk? The credit default swap spread reaction to operational risk events.” J. Oper. Risk 8 (2013): 3–25. [Google Scholar] [CrossRef]
  83. G. Helbok, and C. Wagner. “Determinants of operational risk reporting in the banking industry.” J. Risk 9 (2006): 49–74. [Google Scholar] [CrossRef]
  84. J. Oliveira, L.L. Rodrigues, and R. Craig. “Voluntary risk reporting to enhance institutional and organizational legitimacy: Evidence from Portuguese banks.” J. Financial Regul. Compliance 19 (2011): 271–289. [Google Scholar] [CrossRef] [Green Version]
  85. M.F.A.E. Haija, and A.F. Al Hayek. “Operational Risk Disclosures in Jordanian Commercials Banks: It’s Enough.” Int. Res. J. Finance Econ. 83 (2012): 49–61. [Google Scholar]
  86. A. Barakat, and K. Hussainey. “Bank governance, regulation, supervision, and risk reporting: Evidence from operational risk disclosures in European banks.” Int. Rev. Financial Anal. 30 (2013): 254–273. [Google Scholar] [CrossRef]
  87. H. Sataputera Na, J. van den Berg, L.C. Miranda, and M. Leipoldt. “An econometric model to scale operational losses.” J. Oper. Risk 1 (2006): 11–31. [Google Scholar]
  88. M. Brunner, F. Piacenza, F. Monti, and D. Bazzarello. “Capital allocation for operational risk.” J. Risk Manag. Financial Inst. 2 (2009): 165–174. [Google Scholar]
  89. S. Ebnöther, P. Vanini, A. McNeil, and P. Antolinez. “Operational risk: A practitioner’s view.” J. Risk 5 (2003): 1–15. [Google Scholar] [CrossRef]
  90. D. Guégan, and B.K. Hassani. “Multivariate VaRs for operational risk capital computation: A vine structure approach.” Int. J. Risk Assess. Manag. 17 (2013): 148–170. [Google Scholar] [CrossRef]
  91. F. Monti, M. Brunner, F. Piacenza, and D. Bazzarello. “Diversification effects in operational risk: A robust approach.” J. Risk Manag. Financial Inst. 3 (2010): 243–258. [Google Scholar]
  92. A. Agostini, P. Talamo, and V. Vecchione. “Combining operational loss data with expert opinions through advanced credibility theory.” J. Oper. Risk 5 (2010): 3–28. [Google Scholar]
  93. A. Chernobai, and T.R. Svetlozar. “Applying robust methods to operational risk modeling.” J. Oper. Risk 1 (2006): 27–41. [Google Scholar] [CrossRef]
  94. M. Guillén, J. Gustafsson, and J.P. Nielsen. “Combining underreported internal and external data for operational risk measurement.” J. Oper. Risk 3 (2008): 3–24. [Google Scholar] [CrossRef]
  95. S. Lavaud, and V. Lehérissé. “Goodness-of-fit tests and selection methods for operational risk.” J. Oper. Risk 9 (2014): 21–50. [Google Scholar] [CrossRef]
  96. I.K. Mitov, S.T. Rachev, and F.J. Fabozzi. “Approximation of aggregate and extremal losses within the very heavy tails framework.” Quant. Finance 10 (2010): 1153–1162. [Google Scholar] [CrossRef]
  97. J. Feng, J. Li, L. Gao, and Z. Hua. “A combination model for operational risk estimation in a Chinese banking industry case.” J. Oper. Risk 7 (2012): 17–39. [Google Scholar] [CrossRef]
  98. F. Aue, and M. Kalkbrenner. “LDA at work: Deutsche Bank’s approach to quantifying operational risk.” J. Oper. Risk 1 (2006): 49–93. [Google Scholar]
  99. R.A. Jarrow, J. Oxman, and Y. Yildirim. “The cost of operational risk loss insurance.” Rev. Deriv. Res. 13 (2010): 273–295. [Google Scholar] [CrossRef]
  100. I.A. Moosa. “Operational risk as a function of the state of the economy.” Econ. Model. 28 (2011): 2137–2142. [Google Scholar] [CrossRef]
  101. N. Horbenko, P. Ruckdeschel, and T. Bae. “Robust estimation of operational risk.” J. Oper. Risk 6 (2011): 3–30. [Google Scholar]
  102. Standards Implementation Group’s Operational Risk Subgroup (SIGOR). Observed Range of Practice in Key Elements of Advanced Measurement Approaches (AMA) 2009. Basel, Switzerland: Bank for International Settlements. Press & Communications. Available online: http://www.bis.org/publ/bcbs160b.pdf (accessed on 13 October 2015).
  103. M.I. Fheili. “Developing human resources key risk indicators—Know Your Staff (KYS) practices.” J. Oper. Risk 1 (2006): 71–85. [Google Scholar]
  104. M.I. Fheili. “Employee turnover: An HR risk with firm-specific context.” J. Oper. Risk 2 (2007): 69–84. [Google Scholar]
  105. S. Scandizzo. “Risk Mapping and Key Risk Indicators in Operational Risk Management.” Econ. Notes 34 (2005): 231–256. [Google Scholar] [CrossRef]
  106. R. Cech. “Measuring causal influences in operational risk.” J. Oper. Risk 4 (2009): 59–76. [Google Scholar]
  107. E.W. Cope. “Combining scenario analysis with loss data in operational risk quantification.” J. Oper. Risk 7 (2012): 39–56. [Google Scholar] [CrossRef]
  108. U. Broll, and B. Eckwert. “Transparency in the interbank market and the volume of bank intermediated loans.” Int. J. Econ. Theory 2 (2006): 123–133. [Google Scholar] [CrossRef]
  109. Financial Services Authority (FSA). “FSA Final Notice 2012: Barclays Bank Plc, 2012.” FSA Web Site. Available online: http://www.fsa.gov.uk/static/pubs/final/barclays-jun12.pdf (accessed on 27 August 2016).
  110. J. Aharony, and I. Swary. “Contagion Effects of Bank Failures: Evidence from Capital Markets.” J. Bus. 56 (1983): 305–322. [Google Scholar] [CrossRef]
  111. A. Akhigbe, and J. Madura. “Why do contagion effects vary among bank failures? ” J. Bank. Finance 25 (2001): 657–680. [Google Scholar] [CrossRef]
  112. P. Jorion, and G. Zhang. “Good and bad credit contagion: Evidence from credit default swaps.” J. Financial Econ. 84 (2007): 860–883. [Google Scholar] [CrossRef]
  113. R.E. Lamy, and G.R. Thompson. “Penn Square, Problem Loans, and Insolvency Risk.” J. Financial Res. 9 (1986): 103–111. [Google Scholar] [CrossRef]
  114. R.H. Pettway. “Potential Insolvency, Market Efficiency, and Bank Regulation of Large Commercial Banks.” J. Financial Quant. Anal. 15 (1980): 219–236. [Google Scholar] [CrossRef]
  115. I. Swary. “Stock Market Reaction to Regulatory Action in the Continental Illinois Crisis.” J. Bus. 59 (1986): 451–473. [Google Scholar] [CrossRef]
  116. Consumer Financial Protection Bureau (CFBP). “CFPB Probe into Capital One Credit Card Marketing Results in $140 Million Consumer Refund, 2012.” CFBP Web Site. Available online: http://www.consumerfinance.gov/newsroom/cfpb-capital-one-probe/ (accessed on 27 August 2016).
  117. Consumer Financial Protection Bureau (CFBP). “CFPB Orders Bank of America to Pay $727 Million in Consumer Relief for Illegal Credit Card Practices, 2014.” CFBP Web Site. Available online: http://www.consumerfinance.gov/newsroom/cfpb-orders-bank-of-america-to-pay-727-million-in-consumer-relief-for-illegal-credit-card-practices/ (accessed on 27 August 2016).
  118. Consumer Financial Protection Bureau (CFBP). “CFPB Orders Chase and JPMorgan Chase to Pay $309 Million Refund for Illegal Credit Card Practices, 2013.” CFBP Web Site. Available online: http://www.consumerfinance.gov/newsroom/cfpb-orders-chase-and-jpmorgan-chase-to-pay-309-million-refund-for-illegal-credit-card-practices/ (accessed on 27 August 2016).
  119. Consumer Financial Protection Bureau (CFBP). “CFPB Orders American Express to Pay $59.5 Million for Illegal Credit Card Practices, 2013.” CFBP Web Site. Available online: http://www.consumerfinance.gov/about-us/newsroom/cfpb-orders-american-express-to-pay-59-5-million-for-illegal-credit-card-practices/ (accessed on 27 August 2016).
  120. A. Edmans. “Blockholders and Corporate Governance.” Annu. Rev. Financial Econ. 6 (2014): 23–50. [Google Scholar] [CrossRef]
  121. A.R. Admati, and P. Pfleiderer. “The “Wall Street Walk” and Shareholder Activism: Exit as a Form of Voice.” Rev. Financial Stud. 22 (2009): 2645–2685. [Google Scholar] [CrossRef]
  122. J. Zwiebel. “Block Investment and Partial Benefits of Corporate Control.” Rev. Econ. Stud. 62 (1995): 161–185. [Google Scholar] [CrossRef]
  123. Basel Committee on Banking Supervision (BCBS). Standardised Measurement Approach for operational risk. Consultative Document; Basel, Switzerland: Bank for International Settlements, 2016. [Google Scholar]
Ijfs 04 00020 g001 550
Figure 1. An overview of our categorisation’s method.
Figure 1. An overview of our categorisation’s method.
Ijfs 04 00020 g001
Ijfs 04 00020 g002 550
Figure 2. Development of the operational risk literature.
Figure 2. Development of the operational risk literature.
Ijfs 04 00020 g002
Ijfs 04 00020 g003 550
Figure 3. Classification of the identified articles into the pillars of the Basel II/III framework.
Figure 3. Classification of the identified articles into the pillars of the Basel II/III framework.
Ijfs 04 00020 g003
Table
Table 1. Dominant themes among Pillar I–III.
Table 1. Dominant themes among Pillar I–III.
CategorySubcategoryNumber of ArticlesPercentage
Pillar I
a) Estimation 8149.09%
b) Application 7947.88%
c) Other 53.03%
Sum165100%
Pillar II
a) Model/Concept 4171.93%
b) Application 1017.54%
c) Other 610.53%
Sum57100%
Pillar III
a) Theoretical 00.00%
b) Empirical 18100.00%
1) Event study1477.78%
2) Other422.22%
Sum 18100%
Table
Table 2. Empirical studies analysing the impact of operational loss events on announcing firm´s market value and reputation.
Table 2. Empirical studies analysing the impact of operational loss events on announcing firm´s market value and reputation.
StudySample PeriodNum. of OL EventsMarketOperational Loss DatabaseMarket ValueReputational DamageDependence on Basel II Event Types
[69]1978–2003492U.S.Algo OpVantagedeclineYESNO
[70]1985–2009142U.S.Algo FIRSTdeclinenot examinednot examined
[71]1985–2009142U.S.Algo FIRSTdeclinenot examinednot examined
[72]1990–2004154U.S. + EUAlgo OpVantagedeclineYESYES
[73]2003–2008 215U.S. + EUAlgo OpVantagedeclineYESYES
[74]1994–2008430U.S. + EUAlgo OpVantagedeclineYESYES
[75]2000–200620U.S. + EUAlgo OpVantagedeclineYESnot examined
[76]2000–2009136EUÖffschORdeclineYESNO
[77]1974–2009279EUAlgo OpVantagedeclineYESYES
[78]1999–2008163GBAlgo FIRSTdeclineNONO
[79]1990–200754AustraliaAlgo FIRSTdeclineYESNO
Table
Table 3. Operational loss databases.
Table 3. Operational loss databases.
DatabasesBanks’ Internal Databases or UnidentifiedSelf-Collected ORXGOLDDakORÖffschOROperational Loss Data Sharing ConsortiumAlgo FIRST Algo OpVantageSAS OpRisk Global DataItalian Database of Operational Losses (DIPO)Austrian Loss Data Collection
non-profit associations006002100001
private vendors00000001311330
publicly available events06000201311300
publicly not-available events5206000100011
Total96
ORX database is available from Operational Riskdata eXchange Association (www.orx.org). Global Operational Loss Database (GOLD) is run by the British Bankers’ Association (www.bbagold.org). DakOR and ÖffSchOR databases are manged by Association of German Public Sector Banks (www.voeb-service.de). Operational Loss Data Sharing Consortium is managed by The American Bankers Association (www.aba.com). Both Algo OpData and Algo FIRST are provided by Algorithmics (www.algorithmics.com). SAS OpRisk Global Data is provided by SAS (www.sas.com). Italian database of operational losses (DIPO) is governed by the Italian Banking Association (www.dipo-operationalrisk.it). All the websites have been accessed on 29 August 2016. Austrian Loss Data Collection is a database run by Austrian regulators (see [7]).
  • 1Losses are taken from the ÖffSchOR Database provided by the Association of German Public Sector Banks (Bundesverband öffentlicher Banken, VÖB).
  • 2While assessing the literature on operational risk, we observe a wide range of definitions on operational risk that are discussed in detail by Moosa [2].
  • 3Algorithmics was acquired by IBM in 2011 (see [9]).
  • 4See the Pillar III subsection.
  • 5EBSCO Business Source Premier provides full text for nearly 6159 scholarly business journals and magazines, including full text for more than 1114 peer-reviewed business publications. For more details, see [11]. Google Scholar provides a search of scholarly literature across many disciplines and sources. For more details, see https://scholar.google.com/intl/us/scholar/help.html#coverage (accessed on 07 October 2016).
  • 6Lagner and Knyphausen-Aufseß [4] collect articles from journals ranked with A and B by the German Academic Association of Business Research (VBA) and papers available in the Social Science Research Network (SSRN) over the last three years.
  • 7For more detailed critique of journal ranking see [12].
  • 8This definition has not been changed until now.
  • 9For comparison, the literature related to operational risk in the insurance sector can be identified only up to 2004 and reached its peak in 2012, indicating a growth of interest in the topic (see, for example, [15]).
  • 10Despite the fact that the Basel Committee excludes reputational risk from the operational risk definition and defines it as “the risk arising from negative perception on the part of customers, counterparties, shareholders, investors, debt-holders, market analysts, other relevant parties or regulators that can adversely affect a bank’s ability to maintain existing, or establish new, business relationships and continued access to sources of funding” [18] (p. 19), former research focuses on measuring the extent of reputation losses based on the market reaction to an operational loss announcement and provides empirical evidence about significant reputational damage. As a measure of reputational damage, the operational risk literature suggests the market value decline by the operational risk event announcing firm that exceeds the reported loss amount (see the review of literature in the following “Pillar III” section).
  • 11Under the Basel II framework, banks are required to use one of the three methods for the estimation of regulatory capital for operational risk: (i) the Basic Indicator Approach (BIA); (ii) the Standardized Approach (STA); and (iii) Advanced Measurement Approaches (AMA) (see [1]).
  • 12A list of articles included in this subcategory is available from the authors upon request.
  • 13A list of articles included in this subcategory is available from the authors upon request.
  • 14The Basel Committee classifies operational risk events into seven loss event type categories: Internal Fraud (ET1), External Fraud (ET2), Employment Practices and Workplace Safety (ET3), Clients, Products, and Business Practices (ET4), Damage to Physical Assets (ET5), Business Disruption and System Failures (ET6) and Execution, Delivery, and Process Management (ET7) (see [1]).
  • 15The expression ‘“real” operational loss’ is defined in this paper as losses collected in compliance with the Basel II definition of operational risk.
  • 16Among these studies, Chernobai and Svetlozar [93] note that the data used in their study are obtained from major European operational public loss data and provide no further information. Mitov et al. [96] resample their data with added heavy-tailed noise to ensure the anonymity of provided data. Feng et al. [97] conduct research based on 860 self-collected operational loss events from various publicly available sources, such as newspapers and court judgments.
  • 17For further details, see www.ORX.org (accessed on 29 August 2016).
  • 18More details are available under http://www.voeb-service.de/ (accessed on 29 August 2016).
  • 19Although the study at hand provides a comprehensive review of the operational risk literature, our sample can be biased against studies not published in peer-reviewed journals.
  • 20Just to mention a few: [120,121,122].

Share and Cite

MDPI and ACS Style

Pakhchanyan, S. Operational Risk Management in Financial Institutions: A Literature Review. Int. J. Financial Stud. 2016, 4, 20. https://doi.org/10.3390/ijfs4040020

AMA Style

Pakhchanyan S. Operational Risk Management in Financial Institutions: A Literature Review. International Journal of Financial Studies. 2016; 4(4):20. https://doi.org/10.3390/ijfs4040020

Chicago/Turabian Style

Pakhchanyan, Suren. 2016. "Operational Risk Management in Financial Institutions: A Literature Review" International Journal of Financial Studies 4, no. 4: 20. https://doi.org/10.3390/ijfs4040020

Note that from the first issue of 2016, this journal uses article numbers instead of page numbers. See further details here.

Article Metrics

Back to TopTop