Risk Measurement and Assessment: formula sheet

Key formulas

Basel definition

Operational risk = loss from inadequate or failed internal processes, people and systems, or from external events

Includes legal risk. Excludes strategic and reputational risk.

Seven Basel event types

1 Internal fraud | 2 External fraud | 3 Employment practices and workplace safety | 4 Clients, products and business practices | 5 Damage to physical assets | 6 Business disruption and system failures | 7 Execution, delivery and process management

Memorise the order and the typical examples of each.

Causal chain

Cause → Event → Effect (loss)

Classify by the event. The loss amount or accounting line is only the effect.

Internal vs external fraud

Internal fraud: at least one internal party involved | External fraud: third party only

Employee collusion with outsiders is internal fraud.

Risk rating (matrix logic)

Risk score = Likelihood score × Impact score

Common convention on a 1-5 scale. Firms may instead map likelihood and impact to colours on a heat map. Method is firm-specific.

Residual risk (conceptual)

Residual risk = Inherent risk − effect of controls

Not a strict arithmetic rule. Many firms use a control-effectiveness matrix, or apply a percentage reduction. Always use the scheme given in the question.

Inherent vs residual ordering

Residual risk ≤ Inherent risk

Controls should not raise risk. A residual score above inherent signals an error in assessment.

Assessment components

Inherent risk → Control assessment (design + operating effectiveness) → Residual risk → Compare with risk appetite → Action

The sequence to remember for any RCSA question.

Threshold logic (traffic light)

Green: within appetite | Amber: early warning | Red: breach, escalate

Thresholds should link to risk appetite and be reviewed regularly. Trigger levels are set per KRI.

KRI vs loss data

KRI = leading (before loss) | Loss data = lagging (after loss)

KRIs support prevention. Loss data supports measurement and learning.

Scenario loss estimate

Scenario loss ≈ frequency estimate × severity estimate (per scenario)

Expert judgment gives both inputs. Severity should be severe but plausible, not worst conceivable.

Poisson frequency

P(N = n) = e^(−λ) × λ^n ÷ n!; E(N) = Var(N) = λ

Used for the number of loss events per year. If sample variance far exceeds the mean, Poisson is a poor fit.

Expected annual loss (independent frequency and severity)

E(S) = E(N) × E(X)

S is annual aggregate loss, N is event count, X is a single loss. Holds when severities are independent of N and each other.

Variance of aggregate loss (compound Poisson)

Var(S) = λ × E(X²)

Equals λ × (Var(X) + E(X)²). Do not use λ × Var(X).

Lognormal severity mean

E(X) = exp(μ + σ² ÷ 2)

μ and σ are the mean and standard deviation of ln(X), not of X.

Unexpected loss for capital

Capital ≈ percentile of S at confidence level − expected loss

Subtract expected loss only if it is covered by provisions or pricing. Otherwise capital is the full percentile.

Basel standardized capital

Operational risk capital = BIC × ILM

BIC uses marginal coefficients on BI buckets: 12% up to €1 billion, 15% from €1 billion to €30 billion, 18% above €30 billion.

Internal loss multiplier

ILM = ln(exp(1) − 1 + (LC ÷ BIC)^0.8)

LC is 15 × average annual operational losses over the past 10 years. ILM equals 1 when LC = BIC. Set to 1 for banks in the lowest bucket.

Risk-weighted assets equivalent

Operational risk RWA = 12.5 × operational risk capital

Converts the capital charge to RWA for capital ratio calculations.

Loss distribution approach

Annual loss S = X₁ + X₂ + … + X_N, where N is the frequency and Xᵢ are severities

Frequency and severity are modelled separately and combined, usually by simulation. Capital is a high quantile such as 99.9%.

Capital from the loss distribution

Unexpected loss = quantile(S, 99.9%) − expected loss

Whether capital covers unexpected loss only or the full quantile depends on the framework in the question. Check the wording.

Simple sum of capitals

Total capital = Σ capital of each cell

Equals the perfect-dependence case for quantile-based VaR where comonotonic. It is a conservative upper benchmark, not always exact.

Independence case

Aggregate loss = sum of independent cell losses; total capital is generally below the simple sum

Understates capital when losses share common drivers.

Copula aggregation

Joint distribution F(x₁,…,xₖ) = C(F₁(x₁),…,Fₖ(xₖ))

Sklar's theorem: marginals describe each cell, the copula C describes dependence. Tail dependence needs a copula such as Student t, not Gaussian.

Quick revision

• A taxonomy gives one consistent set of risk categories, so data and reports can be compared across the firm.
• Separate cause, event and impact when classifying; they are not the same thing.
• RCSA moves from inherent risk, through control effectiveness, to residual risk.
• RCSA is self-assessed and forward-looking, so it can suffer from bias and optimism.
• A good KRI is measurable, predictive, timely and has thresholds that trigger action.
• KRIs are early-warning signals; losses are lagging evidence.
• Scenario analysis explores severe but plausible events that history may not contain.
• Loss data is backward-looking and may miss rare, extreme events.
• Capital models usually combine frequency and severity to describe the loss distribution, with focus on the tail.
• Incomplete or inconsistent loss data biases capital estimates.
• Model risk comes from wrong assumptions, poor data or misuse of a model, so validation and governance matter.
• No single tool is enough; use them together and challenge the results.

Common mistakes

• Classifying an employee's mis-selling to clients as internal fraud. Fix: Internal fraud needs intent to defraud the firm or breach its rules for gain. Mis-selling or suitability failures go under clients, products and business practices.
• Treating a data-entry error that causes a trading loss as market risk. Fix: Classify by cause. A booking or keying error is execution, delivery and process management, even if the loss is a price loss.
• Treating inherent risk as the risk after current controls. Fix: Ask: if every control failed or did not exist, how bad could this be? That is inherent.
• Rating a control as effective because it exists on paper. Fix: Judge both. A well-designed control that is not performed consistently is only partially effective.
• Treating KRIs and KPIs as identical. Fix: Check the purpose. A KRI signals risk or control weakness. A KPI tracks goal achievement.
• Calling KRIs lagging indicators. Fix: KRIs are mainly leading. Actual losses are lagging.
• Adding the 99.9th percentile of frequency to the 99.9th percentile of severity to get capital. Fix: Capital comes from the percentile of the aggregate annual loss, which is built by simulating counts and severities together.
• Applying the 18% Basel coefficient to the whole BI when BI is above €30 billion. Fix: Apply 12% to the first €1 billion, 15% to the next €29 billion and 18% only to the excess.
• Saying a better-fitting distribution removes model risk. Fix: Remember tail data is scarce, so different distributions that fit the body equally well can give very different 99.9% quantiles.
• Assuming summing capitals across categories is the only safe approach and is exact. Fix: Treat it as a conservative benchmark equal to perfect dependence. Diversification benefit needs supportable dependence estimates.

Exam tips

• Expect short scenarios where you must pick one of the seven event types. Focus on the cause and any intent, not on the money amount.
• Learn the boundary lines: internal vs external fraud, mis-selling vs process error, outage vs cyber theft.
• Remember the definition includes legal risk and excludes strategic and reputational risk. This is a favourite distractor.
• Know which identification tool fits which need: loss data looks back, RCSA and scenarios look forward, KRIs give early warning.
• When two options both seem right, choose the one that matches the root event rather than the downstream effect.
• Know the three terms cold: inherent, control effectiveness, residual. Most questions test the order and what each includes.
• For advantages and disadvantages, pair them: ownership and awareness against subjectivity and bias.
• If a question gives a scoring scheme, follow it exactly even if it differs from the usual 1-5 matrix.