Chapter 29: Risk measurement and reporting

Question 1

Describe how the risk identification “brainstorming” approach can be extended to obtain a subjective assessment of risk exposure.

Answer 1

The probability and severity of each risk event are both estimated (separately) using a simple scale.

The product of the probability and severity assessments gives a score on a scale. This provides an assessment of each risk event and allows them to be ranked and prioritized.

The assessment would be carried out with and without possible risk controls.

The assessment may be recorded in a risk register.

Question 2

Outline how a model could be used to assess a risk event.

Answer 2

Distributions need to be assigned to both the probability and severity of the risk event (unless the latter is a fixed amount rather than a RV, such as for a without profit term assurance policy).

To quantify the risk simply, the company could define an event and then use historical data to determine a probability distribution for that event. Alternatively, the frequency of the event could be defined and this could be used to determine the loss parameter.

A decision needs to be made as to whether a STOCHASTIC or DETERMINISTIC model is appropriate.

The availability of data to parameterize the model may influence the decision as to which model (if any) is used. This is particularly important when considering RARE EVENTS.

Question 3

State how operational risks can be evaluated.

Answer 3

Operational risk in particular can be difficult to quantify. Typical approaches are:
- a broad-brush addition to other risks (for
capital requirements)
- scenario analysis

Question 4

State 5 ways of evaluating risks.

Answer 4

1. Scenario analysis
2. Stress testing
3. Combined stress and scenario testing
4. Reverse stress testing
5. Stochastic modelling

Question 5

Scenario analysis

Answer 5

Scenario analysis looks at the financial impact of a plausible and possibly adverse set or sequence of events. It is useful where it is difficult to fit full probability distributions to risk events. It provides information of the severity but not the likelihood of the risk.

Question 6

Outline the steps involved in a scenario analysis to evaluate operational risk.

Answer 6

1. Group risks into broad categories. This
   should involve input from a wider range
   of senior individuals in the organization.
2. Develop a plausible adverse scenario of
   risk events for each group of risks, which
   is REPRESENTATIVE of ALL the risks in the
   group.
3. Calculate the consequences/costs of the
   risk event occurring for each scenario,
   again involving senior staff.
4. Calculate the total costs of all risks
   represented by the scenario.

Question 7

Suggest categories into which operational risks might be divided for the purpose of scenario analysis.

Answer 7

1. Fraud
2. Loss of key personnel
3. Mis-selling of financial products
4. Calculation error in the computer system
5. Loss of business premises
6. Loss of company e-mail access

Question 8

Stress testing

Answer 8

Stress testing involves assessing the impact of a specific extreme adverse event over a period of time. It is a deterministic method, commonly used to model extreme market movements, e.g. shock fall in equity values.

Question 9

Outline two types of stress test.

Answer 9

Two types of tests are designed to:
1. Identify ‘weak areas’ in the portfolio and
investigate the effects of localized stress
situations by looking at the effect of
different combinations of correlations
and volatilities.

2. Gauge the impact of major market
   turmoil affecting all model parameters
   while ensuring consistency between
   correlations while they are stressed.

Question 10

Stress scenario

Answer 10

Stress and scenario testing can be combined to determine a stress scenario. In this case, the stress test is performed by considering the impact of a set of related adverse conditions that reflect the chosen scenario.

Question 11

Reverse stress testing

Answer 11

This is the construction of a severe stress scenario that only just allows the company to be able to fulfill its strategic business plan, e.g. having insufficient capital to meet solvency requirements or to cover its minimum risk appetite.

Equivalently, it is the scenario which would just be enough to stop them doing so.

The scenario might be financial or non-financial.

Although it might be an extreme scenario, it must be plausible.

Question 12

Describe how a stochastic model could be used to evaluate a particular risk.

Answer 12

The variables that gives rise to the risk are treated as random variables with probability distributions.

The model must be dynamic, with full interactions/correlations between variables.

The model can be run to determine the amount of capital that is needs to (just) void ruin with a given probability.

Question 13

Outline different approaches to limiting the scope of a stochastic model in order to make the model more practical.

Answer 13

1. Restrict the time horizon that the model
   projects.
2. Limit the number of variables that are
   modelled stochastically and model the
   other variables deterministically with
   scenario testing.
3. Carry out a number of runs each with a
   different single stochastic variable,
   followed by a single deterministic run
   using all the worst case scenarios
   together.

Question 14

List 4 ways of aggregating individual risks, in order to allow for correlations and inter-actions and to determine capital requirements.

Answer 14

1. stochastic modelling (may be impractical)
2. simple formulae
3. correlation matrices
4. copulas

Question 15

Copulas

Answer 15

Functions that take as inputs marginal cumulative distribution functions and output a joint cumulative distribution function.

Different copulas are used to describe different degrees of dependence between random variables, including in the tails of distributions.

Question 16

What simple formulae can be used to determine the overall capital requirements for a combination of risks, if the risk events are fully dependent?

Answer 16

The overall capital requirement is the sum of the individual capital requirement.

Question 17

What simple formulae can be used to determine the overall capital requirements for a combination of risks, if the risk events are fully independent?

Answer 17

The overall capital requirement is LESS than the sum of the individual capital requirements (the difference is the diversification benefit). Under certain assumptions, the overall capital requirement can be determined as the square root of the sum of the squares of the individual risk capital requirements.

Question 18

What simple formulae can be used to determine the overall capital requirements for a combination of risks, if the risk events are partially dependent?

Answer 18

The overall capital requirement is less than the sum of the individual risk capital requirements. The diversification benefit depends on the degree of correlation (possibly negative) between the risks.

Question 19

How can liability risks be measured?

Answer 19

Liability risks can be measured by an analysis of experience, e.g. actual deaths divided by expected deaths.

It is important to ensure consistent classification and measurement of the risk event and the exposure to risk.

Question 20

List deterministic approaches to measuring risk.

Answer 20

1. notional approach
2. factor sensitivity approach
3. scenario sensitivity approach

Question 21

List probabilistic approaches to measuring risk.

Answer 21

1. deviation (including standard deviation
   and tracking error)
2. Value at Risk (VaR)
3. probability of ruin
4. Tail Value at Risk (TVaR)

VaR and TVaR can be calculated using an empirical, parametric or stochastic approach or scenario analysis.

Question 22

Outline 3 drawbacks of using VaR as a measure of risk.

Answer 22

1. It is often calculated assuming a normal
   distribution of returns, whereas this is
   not necessarily true in practice as
   distributions may be ‘fat-tailed’ or
   skewed.
2. VaR can be calculated using a different
   distribution but data is often sparse,
   particularly within the tails, and it is
   difficult to fit an accurate distribution.
3. VaR does not quantify the size of the tail,
   i.e. what the loss might be beyond the
   VaR confidence level.

Question 23

Describe what is meant by a “risk portfolio” and what it might contain.

Answer 23

A risk portfolio is a means of categorizing the various risks to the company or individual. Against each risk the likely impact and probability of occurrence are recorded. The product of these measures gives an idea of the relative importance of the various risks.

The risk portfolio can be extended to indicate how each risk has been dealt with: - accepted (and how much capital is needed
to support it)
- rejected
- diversified (and a revised assessment of
the remaining combination of risks)
- transferred or managed internally (and a
revised assessment of the remaining risk)

For retained risks, the risk portfolio could also include details of control measures, reassessment after controls, risk owners, committee/senior management with oversight of the risk, identification of concentrations of risk and the need for management in these areas.

Question 24

Give 10 reasons why regular risk reporting is important within a business.

Answer 24

FRAUD CRIME

1. Financing (appropriate price, reserves,
   capital requirements)
2. Rating agencies (to help determine
   appropriate rating)
3. Attractiveness to investors
4. Understand better (risks and their
   financial impact)
5. Determine appropriate control systems
6. Changes to risk faced over time
7. Regulator
8. Interactions between risks
9. Monitor effectiveness of existing controls
10. Emerging risk identification

Question 25

Explain why, if risk is managed at the enterprise level, it is necessary to have a coherent system of risk reporting across the whole enterprise.

Answer 25

As part of ERM, each business unit will have been given a risk exposure allocation. The benefits of diversification are likely to rely on each unit taking on the exposure allocated. Therefore, it is necessary that each unit report on the exposure that they are taking, in a CONSISTENT way.

If this does not happen, there is a risk that additional capital will be required to cover the undiversified risks.