Jack King is the managing director of Genoa (UK) Limited, a financial risk and software consulting firm near London. He’s about to publish, with Wiley, a comprehensive book on the quantification of operational risk, and until autumn 2000 worked as director, operational risk, for risk software house Algorithmics International.

His career has crossed industries but has a constant theme – the interface between technology, risk modelling and risk management. From 1992–96, King was a diplomatic scientist with the United Nations’ International Atomic Energy Agency, where he developed systems to control global nuclear risk. He has also helped build training simulators for semi-invasive surgery and air-traffic control training systems. Rob Jameson talked to him in the wake of the new Basle Committee proposals on calculating operational risk charges for banking, released on January 16.

How did you feel when you read the regulators’ new proposals for calculating operational risk charges?

I was elated that the regulators came out with this document. But I was excited mainly because I knew it would motivate people in the financial industry to move more quickly. The detail of the proposal is likely to cause some problems. It seems so far removed from the treatment for credit and market risk, and it’s not easy to see how it’s all going to mesh together without a lot of double-counting and so on.

Does that mean tying down the regulatory reform proposals is the frontline in operational risk at the moment?

No. Clearly, regulatory treatments are very topical. But I think the real focus is how banks can measure and model operational risk for the purpose of allocating economic rather than regulatory capital. This is the key, because it’s what allows banks to improve the running of their business, and to add value to their business line.

You mean by avoiding costly operational mistakes?

Yes, but more generally by reducing revenue volatility and improving shareholder value. Banks have for some time been thinking in terms of economic value added (EVA), but they’ve largely thought of it in terms of the sustainability of earnings. We’ve got to start bringing risk into that calculation.

But some people still doubt it’s possible to measure operational risk.

You have to do it, otherwise the bank’s officers can increase performance artificially by increasing the risk that they take on. What the shareholders want you to do, on the other hand, is to increase performance at a given level of risk. Operational risk is a big chunk of bank risk, so if it’s not measured adequately it gives managers the chance to game their institution’s capital allocation metrics.

So is the key to the problem getting hold of better data on losses, as many experts argue?

No. I think we are in danger of putting the cart before the horse. We need to decide how we are going to model operational risk, and then we need to collect data in a way that makes sense for that project. The loss databases are a good idea, and might function well as benchmarks. But it seems to me that we are going down an actuarial route, influenced by the insurance industry, when we need to look much more closely at banking approaches to risk measurement. There are also problems with predicting operational risks through historical records.

You mean that some risks don’t enter the record?

And some suddenly become much more important than they were. I spent some of my career with the United Nations’ International Atomic Energy Agency, trying to find ways to prevent the proliferation of nuclear risks. But in the history of the nuclear industry, the risk of proliferation didn’t seem to exist for the first 50 years. Then all of a sudden, as a result of the Gulf War, it was realised that Iraq had a programme to develop nuclear capabilities. From that moment, it was a huge and continuing danger.

Nuclear industry risk management sounds a long way from the bean counting of the banking world.

Not so very far. A lot of the work that I did was on the problem of accounting for nuclear materials at nuclear fuel processing sites. A facility might produce 10,000 kilograms of bomb-grade nuclear material, and only 3 kilograms needs to go missing before you have the danger of a bomb that can destroy New York. So you’ve got to account for it accurately. But it’s extremely difficult to track the material over time, and to take account of complications such as the half-life of nuclear material. We ended up using techniques that are analogous to the Bayesian models some practitioners are trying to apply in operational risk today, and others that looked like the co-variance models that the banking industry was developing for market and credit risk at about the same time. By the way, no-one counts beans any more in financial institutions – that’s part of the problem.

What do you mean?

The balance sheet of a large institution is, in essence, an estimate. The figures you see on it often don’t bear any simple and direct relation to what comes in and out of the institution. I’m not sure that this has yet been taken on board in the wider world. What we are doing is trying to make sure that the models we use for these estimates are not too far off the mark. We are not producing exact results.

You said earlier that loss databases are not the answer to operational risk modelling, so what is?

Look at how the banking industry has ended up treating market risk and credit risk. It’s an approach driven by risk factors. In the search for economic capital measures for operational risk we need to pause for a moment and ask what exactly it is that we are looking for. I’d say we are looking for the things that drive volatility in revenue and that are not accounted for in our existing market and credit risk models.

This sounds like a quant version of the “other than market and credit risk” definition of operational risk – the one that the banking industry has just abandoned.

Yes, but with the important addition of the word “models”. It’s not so important, for economic capital purposes, whether a cause of volatility is classed as a "credit” or “market” risk. What is important is whether that risk is accounted for within the credit or market risk models. I’m not sure, from an economic capital standpoint, that the industry’s first cover-all definition of operational risk was such a bad one. I think this is also consistent with regulators who have repeatedly expressed the idea that the overall level of capital seems to be about right, but that modelling should be changed to correspond to good banking practices.

What would this mean in terms of regulatory practice?

Well, the regulators could adopt an “internal models” approach that let a bank estimate its own required capital, and then penalised the bank for any underestimation after validating that estimate against any realised losses. Regardless of the technique recommended or used by the bank, the validation procedure keeps them motivated to get the best figure that is still above the minimum requirements. There’s an old engineering adage that says: “Anybody can build a bridge that won’t fall down. It takes a good engineer to build a bridge that JUST ABOUT won’t fall down.”

Earlier you mentioned double-counting as a key problem…

The danger is that we double-count some risks, and ignore others all together. For example, at the moment most credit risk models do not take account of the danger that a bank fails to ask its counterparty for an appropriate level of collateral for a specific credit risk position. That mistake might give rise to a credit loss, but the factors driving the probability of the bank making the mistake are largely operational and nothing to do with default probabilities.

People are scratching their heads wondering whether a bank that loses money in this way ought to record the loss as a credit or an operational risk. But, again, the important point is to decide whether such a risk factor is covered in your credit risk model. If it’s not, the revenue volatility needs to be included in the economic capital model somewhere else. Much the same applies to valuation models and market risk.

Jack King’s Web site can be found at: www.genoauk.com

Jack King’s book Operational Risk: Measurement and Modeling is available from:

Amazon.com