FRM Exam Part II · Risk Measurement and Assessment

Loss Distribution Approach and Operational Risk Capital Models

Updated 11 October 2026 · Fact-checked

Operational risk capital is measured by modelling how often losses occur (frequency, often Poisson) and how large they are (severity, often lognormal or heavy-tailed), then combining them into an annual loss distribution. Capital is a high percentile of that distribution. Basel's standardized approach instead uses the Business Indicator and internal loss multiplier.

Understand Loss Data Collection and Operational Risk Capital Models

Operational risk is the risk of loss from failed processes, people, systems or external events. Losses are rare and uneven. Many small losses happen often. A few huge ones happen rarely and drive capital. So the data and the model must capture both patterns.

Loss data comes from two places. Internal loss data is your own record of events, with dates, amounts, event types and business lines, plus recoveries. It reflects your own controls but has few large losses. External loss data comes from other firms or consortia. It adds tail events you have not suffered, but it is biased: firms report mostly big losses, and the losses come from firms of different size and control quality. External data is therefore filtered for relevance and often scaled before use. Scenario analysis fills remaining gaps.

The loss distribution approach (LDA) models two things separately. Frequency is the number of loss events in a year. The Poisson distribution is the usual choice, with mean and variance both equal to λ. If the data show variance well above the mean, a negative binomial fits better. Severity is the size of one loss. It is heavy-tailed, so lognormal, Weibull, or generalized Pareto (for the tail above a threshold) are common. Losses are assumed independent of each other and of frequency.

Annual aggregate loss is the sum of a random number of random losses. There is no simple formula for its percentile, so firms use Monte Carlo simulation: draw a count from the frequency distribution, draw that many severities, add them up, and repeat many thousands of times. Capital is read from a high percentile (for example the 99.9th) of the simulated annual losses. Under advanced-style thinking, capital covers unexpected loss: the percentile minus expected loss, if expected loss is already provisioned or priced.

The Basel III final framework replaced all earlier operational risk approaches with one standardized approach. It starts from the Business Indicator (BI), an income-statement-based size measure built from interest, leases and dividends; services (fees and other operating items); and financial items (trading and banking book). The Business Indicator Component (BIC) applies marginal coefficients that rise with BI size across three buckets. Larger banks also get an Internal Loss Multiplier (ILM) that adjusts capital up or down based on the bank's own ten-year loss history relative to its BIC. Capital equals BIC × ILM. Banks with BI up to €1 billion have ILM set to 1.

Key formulas to remember

Poisson frequency: P(N = n) = e^(−λ) × λ^n ÷ n!; E(N) = Var(N) = λ; Used for the number of loss events per year. If sample variance far exceeds the mean, Poisson is a poor fit.
Expected annual loss (independent frequency and severity): E(S) = E(N) × E(X); S is annual aggregate loss, N is event count, X is a single loss. Holds when severities are independent of N and each other.
Variance of aggregate loss (compound Poisson): Var(S) = λ × E(X²); Equals λ × (Var(X) + E(X)²). Do not use λ × Var(X).
Lognormal severity mean: E(X) = exp(μ + σ² ÷ 2); μ and σ are the mean and standard deviation of ln(X), not of X.
Unexpected loss for capital: Capital ≈ percentile of S at confidence level − expected loss; Subtract expected loss only if it is covered by provisions or pricing. Otherwise capital is the full percentile.
Basel standardized capital: Operational risk capital = BIC × ILM; BIC uses marginal coefficients on BI buckets: 12% up to €1 billion, 15% from €1 billion to €30 billion, 18% above €30 billion.
Internal loss multiplier: ILM = ln(exp(1) − 1 + (LC ÷ BIC)^0.8); LC is 15 × average annual operational losses over the past 10 years. ILM equals 1 when LC = BIC. Set to 1 for banks in the lowest bucket.
Risk-weighted assets equivalent: Operational risk RWA = 12.5 × operational risk capital; Converts the capital charge to RWA for capital ratio calculations.

How to solve Loss Data Collection and Operational Risk Capital Models questions

Most questions fall into three types: choosing or interpreting data, building the aggregate loss, or computing Basel standardized capital. Identify the type first.

1Read what is asked: data issue, distribution choice, expected or unexpected loss, or Basel capital.
2If it is about data, ask whether it is internal or external, then look for bias: reporting threshold, size differences, control differences, or too few tail events.
3For LDA, name the frequency distribution (Poisson unless variance exceeds mean) and the severity distribution (lognormal or heavy-tailed, with GPD for the tail).
4Compute expected loss as E(N) × E(X). Use the lognormal mean exp(μ + σ²/2) when severity is lognormal.
5For capital, identify the percentile and whether expected loss is deducted. Simulated percentiles are given or implied; do not try to derive them by hand.
6For the Basel standardized approach, find BI, apply the marginal coefficients bucket by bucket, then multiply by ILM.
7Convert to RWA with × 12.5 only if the question asks for RWA.
8Check units, currency and that the answer is annual.

Quickest way: Three-question triage

When to use it: Use when time is short and options differ in kind, not only in number.

Is it LDA or Basel standardized? LDA means frequency, severity and simulation. Basel means BI, BIC and ILM.
For LDA, rule out options that add frequency and severity percentiles directly. The aggregate percentile must come from combining the two.
For Basel, apply coefficients marginally, not to the whole BI. Check BIC first, then ILM above or below 1 based on whether LC is above or below BIC.
For data questions, pick the option that fixes bias: scale or filter external data, and combine with internal data and scenarios.

Common mistakes in Loss Data Collection and Operational Risk Capital Models

Adding the 99.9th percentile of frequency to the 99.9th percentile of severity to get capital.
Students treat the two distributions as one number each.
Fix: Capital comes from the percentile of the aggregate annual loss, which is built by simulating counts and severities together.
Applying the 18% Basel coefficient to the whole BI when BI is above €30 billion.
Students forget the coefficients are marginal.
Fix: Apply 12% to the first €1 billion, 15% to the next €29 billion and 18% only to the excess.
Using μ as the lognormal mean loss.
μ is the mean of ln(X), which is easy to misread as the mean of X.
Fix: Use exp(μ + σ²/2) for the mean of X. The median is exp(μ).
Treating external loss data as directly usable for your bank.
More data feels better.
Fix: Remember scale bias, reporting bias and control differences. Filter for relevance and scale before mixing with internal data.
Calling a Poisson fit good when sample variance of annual counts is much larger than the mean.
Poisson is the default and students stop checking.
Fix: Compare mean and variance. Overdispersion points to a negative binomial.
Setting ILM above 1 when internal losses are lower than the BIC benchmark.
Students mix up the direction of the LC to BIC comparison.
Fix: If LC is below BIC, ILM is below 1 and capital falls. If LC is above BIC, ILM is above 1 and capital rises.

Worked examples

Example 1

A bank models annual operational losses in one business line. Events follow a Poisson distribution with λ = 12 per year. Each loss is lognormal with μ = 10 and σ = 1 (losses in USD). Compute the expected annual loss, to the nearest USD.

Show the solution

Mean severity = exp(μ + σ²/2) = exp(10 + 0.5) = exp(10.5).
exp(10.5) = exp(10) × exp(0.5) = 22,026.47 × 1.64872 = 36,315.5 approximately.
Expected annual loss = λ × E(X) = 12 × 36,315.5 = 435,786 approximately.
Check: using the median exp(10) = 22,026 would understate the loss. The mean is correct for expected loss.

Answer: About USD 435,786 per year.

Example 2

A bank has a Business Indicator of €40 billion. Marginal coefficients are 12% up to €1 billion, 15% from €1 billion to €30 billion and 18% above €30 billion. Its internal loss multiplier is 1.1. Compute operational risk capital and RWA.

Show the solution

Bucket 1: 12% × €1 billion = €0.12 billion.
Bucket 2: 15% × (€30 billion − €1 billion) = 15% × €29 billion = €4.35 billion.
Bucket 3: 18% × (€40 billion − €30 billion) = 18% × €10 billion = €1.80 billion.
BIC = 0.12 + 4.35 + 1.80 = €6.27 billion.
Capital = BIC × ILM = 6.27 × 1.1 = €6.897 billion.
RWA = 12.5 × 6.897 = €86.2125 billion.

Answer: Capital is €6.897 billion and operational risk RWA is about €86.21 billion.

Exam tips

Questions often hinge on one precise point: marginal coefficients, lognormal mean versus median, or aggregate versus component percentiles. Check these first.
For external data, expect the answer to mention scaling, filtering and bias, not simply adding the data.
Know the direction of ILM: internal losses above the BIC benchmark raise capital, below lower it.
If the stem gives a simulated percentile, subtract expected loss only if told it is provisioned.
Read currency and period carefully. Basel BI thresholds are in euros; loss examples may be in USD.

Practice questions from Risk Measurement and Assessment

Loss Data Collection and Operational Risk Capital Models in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

FRM Part ILoss Distribution Approach and Modeling

Loss Data Collection and Operational Risk Capital Models: frequently asked questions

Why is Poisson used for loss frequency?

It models counts of independent, rare events in a fixed period with one parameter, λ, which is both the mean and variance. It is simple and fits many operational event counts. If counts are overdispersed, a negative binomial is used.

Why is severity modelled with heavy-tailed distributions?

Operational losses are dominated by a few very large events. Light-tailed distributions understate these. Lognormal, Weibull and generalized Pareto distributions put more probability in the tail.

How is external loss data scaled?

Firms adjust external losses for differences in size, such as revenue or assets, and filter out events that do not fit their business. The aim is to make outside losses comparable to your own exposure. Scaling relationships are estimated and imperfect, so results need judgement.

What is the Business Indicator in Basel's standardized approach?

It is an income-statement-based measure of a bank's size, built from interest, lease and dividend items, services items and financial items. It drives the Business Indicator Component through marginal coefficients that rise with size.

Does the standardized approach use the bank's own loss history?

Yes, for banks above the lowest BI bucket, through the internal loss multiplier. It compares ten years of average losses, scaled to LC, against the BIC. Banks in the lowest bucket have ILM equal to 1.