Do different banks have different ORPs? Let's see what the loss data says.
To the right is a comparison of the ORP for Wells Fargo and Goldman Sachs.
What can account for the differences?
Let's apply Agile problem-solving. the target state is identifying what accounts for the difference in their respective risk exposures.
Next, we create a first solution through an informed guess. Since we know that WF is mostly a Retail and Commercial bank while GS is mostly Trading and Sales, and Corporate Finance (Investment banking) perhaps their different business mix account for the differences.
Let's test this informed guess. To do that, we have to create ORP by lines of business.
Here are the results using the regulatory standard Lines of Business referred to as Regulatory Lines of Business (RLOB). For further information on RLOBs and their MECE organizational structure.
We do in fact, observe that the ORPs differ significantly across RLOBs. Therefore, we can conclude that the different mix of RLOBs will account for some significant part of the variation in ORPs across banks.
Examining the ORPs across RLOBs we conclude that 90% + of the Exposure is due to Internal Fraud, External Fraud and Clients, Products, & Business Practices
Is internal Fraud the same as Internal Fraud in each of the RLOB?
Let's Find out (Home Work)
Each group is to drill down and create a MECE structure for their RLOB/ LT. For example, Group 1 would create a MECE structure for Internal Fraud in the Trading and Sales RLOB up to 2 sub-levels and each level identify the Sub loss types that contribute up to 80% of its level above
When using external data and scenario analysis, how can we effectively mitigate misinformation from survivor bias through bootstrapping or other techniques? Specifically, when assessing operational risk, how can we ensure that we aren't overlooking important samples that aren't in the data due to failure or withdrawal?
correct!
I have problem with creating 80-20 rules with this structure. It is pactical to list out the causes that makes up 80% of total loss, but how do we illustrate that those risk types only make up to 20% risk types.
Can I conclude that ORP differs across RLOB or different types of business. In addition, we will have to compare the company's ORP with the industry ORP which is a benchmark so that we will be able to identify or further analyze the significant deviation. For example, from the aspect of industry, more than 90% or 80% loss comes from some specific types of risk. We then analzye our own company's ORP to compare the result with the industry level.
I believe the risk profile must be updated frequently as the technology develops and the growth of companies. There might be new business lines and therefore, new risk exposures. How do we determine the usefulness and timeliness, even though we update it frequently, of this profile for the "control" step of operational risk management?