While the terms expected, unexpected and catastrophic loss have become ubiquitous in risk management, there's still much confusion about what they mean in the field of operational risk.

Many risk managers are of the view that expected operational losses are "small" losses, unexpected losses are "large but sustainable" losses and catastrophic losses are losses of such magnitude that they would render most institutions bankrupt.

But these definitions are not objective - or practical. For example, it's impossible to determine the point at which an individual loss becomes large enough to be transformed from an expected to an unexpected loss.

Instead, these concepts only make sense within a value-at-risk (VaR) framework. Under this approach, all individual losses are deemed to be unexpected. This makes intuitive sense because any loss that is expected should have been prevented!

In VaR parlance, the expected loss is the mean annual aggregate loss, and the unexpected loss is the annual aggregate loss in excess of this mean, up to a particular confidence level (say, 95 or 99 per cent confidence). A catastrophic loss is any aggregate loss above the specified confidence level. There is an important distinction between the mean, the VaR and the catastrophic loss. The first two are ex ante measures, i.e., they can be predicted based upon specified ex ante probability distributions. The last one is an ex post measure, in that the loss has to be experienced in order to determine the level of catastrophic loss that has taken place (if any).

The figures for expected and unexpected loss are derived from the statistical analysis of internal and external historical data associated with the business in question. Meanwhile, the confidence level used for unexpected losses is set by the risk appetite of the individual company - the more cautious the company, the higher the confidence level.

The VaR definitions have important practical applications. Because the expected loss is the amount of money a business loses on average in one year, it is also the amount a business should budget to cover its annual cost of operational failure. The unexpected loss, or the VaR, is the amount that a cautious manager might think the business would lose in a very bad year in excess of this budgeted amount - and is the amount the business ought to reserve as capital. The catastrophic loss is any loss in excess of the budgeted loss amount plus the capital reserve - and might be transferred through insurance-like mechanisms.

The definitions also feed into business strategy. The curves below show the combined frequency/severity (total loss) probability distributions for operational losses in two very different business lines. In the first, a variance analysis of historical loss data has revealed little reason to associate the business with catastrophic losses, but internal bank data shows that in the recent past it has been difficult to control the mean losses from operational mishaps - for example, petty transactional glitches.

In the second business line, the losses that managers expect from year to year are rather low. But in this case historical data suggests that there is a relatively high chance that the business line will incur a massive loss - for example, through class-action litigation.

Clearly, a company considering buying into the first business line would need to consider whether it had a relative skill advantage in reducing the expected losses. A company considering buying into the second business line might be more concerned to evaluate the price of risk transfer, or the corporate governance implications of assuming new catastrophic risks.