Draft:Operational risk quantification

Submission declined on 2 August 2026 by MSK (talk). This draft appears to contain text generated by a large language model (such as ChatGPT). You cannot use LLMs to generate article content. LLM-generated pages with certain obvious signs of being machine generated may be deleted without notice. Instead, only summarize in your own words a range of independent, reliable, published sources that discuss the subject. See the advice page on large language models for more information. If you would like to continue working on the submission, click on the "Edit" tab at the top of the window. If you have not resolved the issues listed above, your draft will be declined again and potentially deleted. If you need extra help, please ask us a question at the AfC Help Desk or get live help from experienced editors. Please do not remove reviewer comments or this notice until the submission is accepted. Where to get help If you need help editing or submitting your draft, please ask us a question at the AfC Help Desk or get live help from experienced editors. These venues are only for help with editing and the submission process, not to get reviews. If you need feedback on your draft, or if the review is taking a lot of time, you can try asking for help on the talk page of a relevant WikiProject. Some WikiProjects are more active than others so a speedy reply is not guaranteed. How to improve a draft Wikipedia:Contributing to Wikipedia – a basic overview on how to edit Wikipedia. Help:Wikitext – how to use the markup Help:Referencing for beginners – how to include references Wikipedia:Article development – how to develop your article Wikipedia:Writing better articles – how to improve your article Wikipedia:Verifiability – make sure your article includes reliable third-party sources You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Add tags to your draft Editor resources Easy tools: Citation bot (help) | Advanced: Fix bare URLs Declined by MSK 9 days ago. Last edited by Colorado001 7 days ago. Reviewer: Inform author. Resubmit Please note that if the issues are not fixed, the draft will be declined again.

Operational risk quantification refers to the statistical and analytical methods used to assess an organization's potential financial losses related to operational risk — losses arising from internal failures (fraud, processing errors) or from external events beyond the organization's control (natural disasters, pandemics). In banking, for example, a borrower's default is classified as credit risk rather than operational risk, whereas an error made in granting a loan is classified as operational risk.

The Basel Committee on Banking Supervision formally defined operational risk in the Basel II Accords (2004) as "the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events."^[1] Basel II requires banks to quantify this risk in order to determine a portion of their regulatory capital and economic capital under Pillar 2 (ICAAP), the equity institutions must hold to absorb losses.

Institutions combine qualitative approaches, such as Risk and Control Self-Assessment (RCSA), with quantitative approaches, such as the Standardized Measurement Approach (SMA) and the Loss Distribution Approach (LDA).

Since the 2020s, in response to the emergence of systemic threats linked to climate risks and dependence on technological service providers, these methodologies have integrated forward-looking scenario analyses. These practices are framed by new supervisory standards (such as the European regulation DORA, Digital Operational Resilience for the financial sector and Amending regulations) and rely technically on machine learning and Big data processing.

Financial institutions employ various methodological approaches to quantify their exposure to operational risk. The choice of model depends on the depth of historical data^[2], regulatory constraints^[3], and the institution's internal objectives regarding resilience^[4].

Quantitative models are divided into two main categories. Statistical methods jointly evaluate the frequency and severity of historical losses, while forward-looking scenario analyses estimate the impact of rare but critical events, such as cyberattacks, compliance litigation, or system failures^[5]. Both approaches frequently rely on modeling techniques, such as Monte Carlo simulation, to generate loss distributions^[6]. Under Basel III, banks using such models must calculate capital requirements at a 99.9% confidence level^[7].

The implementation of these mathematical models raises several technical challenges documented by supervisory authorities^[8]:

• The scarcity of historical loss data and reporting bias in externally sourced data, which are especially pronounced for extreme, low-frequency events;
• The high sensitivity of capital requirements to distributional assumptions, notably the shape of the severity distribution's tail and the choice of dependence (correlation) structure between risk categories;
• The difficulty of combining statistical loss data with qualitative inputs, such as business environment and internal control factors (BEICFs).

To address these limitations, banking and insurance institutions no longer use these models in isolation. They combine quantitative measures with qualitative assessments within a comprehensive risk management framework.

The Standardized Measurement Approach (SMA) was introduced by the Basel Committee on Banking Supervision (BCBS) in December 2017 during the finalization of the Basel III accords. This method aims to simplify the calculation of capital requirements and reduce model variability, thereby ensuring better comparability between financial institutions^[9]. The SMA definitively replaces the Advanced Measurement Approach (AMA), which previously granted banks a level of flexibility that was deemed too heterogeneous. In Europe, this standard is transposed by the CRR 3 regulation, applicable from 2025^[10].

The capital requirement calculation is based on two key components^[11]:

• The Business Indicator (BI): it measures the bank's size via its income (interest, commissions). A high business volume, such as that resulting from the merger between UBS and Credit Suisse finalized in 2023, mechanically leads to an increase in the base capital requirement due to the systemic size of the new entity and the increased oversight from the regulator FINMA^[12].
• The Internal Loss Multiplier (ILM): this coefficient adjusts the capital according to the actual loss history. For example, a bank that has suffered massive legal litigation will see its ILM increase, forcing it to set aside more capital to cover potential future operational shocks^[10].

The objective is to eliminate model risk. By imposing predefined parameters, supervision becomes more uniform^[13]. However, authorities require banks to supplement this prescriptive approach with forward-looking scenarios as part of their internal capital adequacy assessment process (ICAAP)^[14].

The Loss Distribution Approach (LDA) is a statistical method used to estimate the total distribution of operational losses based on historical data. It separately models the frequency of events, often using Poisson or negative binomial distribution processes, and the severity of losses, generally fitted to heavy-tailed distributions such as Lognormal, Weibull, or Pareto laws^[6][15]. Monte Carlo simulation is then used to derive aggregated loss distributions and determine the capital requirement at a 99.9% percentile^[16].

This approach utilizes Extreme Value Theory (EVT) to model tail behavior, focusing on low-frequency but high-severity events. The use of mathematical copulas allows for the integration of dependency structures between different incident categories^[15]. Furthermore, the Bayesian approach enables the integration of expert judgment with empirical data to compensate for the lack of historical data^[17].

The implementation of LDA, however, requires a voluminous database, which constitutes a limitation for modeling rare events. A single extreme event can render statistical models obsolete. For example, the €4.9 billion loss suffered by Société Générale in 2008 (the Jérôme Kerviel affair) demonstrated the inability of history-based internal models to anticipate a loss of such magnitude, far exceeding all severity scenarios modeled up to that point^[18].

These weaknesses, particularly the assumption that the past foreshadows the future, led supervisory authorities to progressively replace these internal models with the SMA standardized approach^[19].

Since January 17, 2025, the European regulation DORA (Digital Operational Resilience Act) requires financial institutions to model scenarios of total interruption of critical services. These analyses are no longer based on past data but on plausible disruption situations. Scenario analysis based on expert judgment constitutes a qualitative approach to quantifying operational risk. Unlike strictly quantitative models such as LDA or SMA, this method is not limited solely to historical data. It relies on the knowledge of internal or external experts to evaluate the probability and potential impact of rare, emerging, or unprecedented events, such as major cyberattacks, failures of critical third-party providers, or systemic shocks^[20].

The methodology relies on reverse stress testing: the expert identifies the breaking point (the scenario that would render the bank insolvent or unable to operate) and works backward to quantify the probability of occurrence^[21]. These tests must cover a specific survival horizon, often set at 30 days for liquidity related to operational risks. Experts quantify these shocks via probability distributions with a confidence level aligned with Basel III requirements, namely 99.9%. This means the institution must be able to withstand an operational shock that statistically occurs only once every 1,000 years.^[7]

In practice, this approach is structured around workshops or individual interviews bringing together risk management professionals and business experts. Their empirical assessments are translated into probability-severity pairs, allowing for the generation of simulated loss distributions. This flexibility makes it possible to capture extreme risks that would elude purely statistical models^[5]. For example, the widespread implementation of Business Continuity Plans (BCP) during the 2020 health crisis illustrated the importance of these scenarios in maintaining essential services despite the lack of comparable historical data for a modern pandemic^[22].

The integration of these scenarios is a regulatory requirement within the framework of the Internal Capital Adequacy Assessment Process (ICAAP). It forms the foundation of stress tests and recovery plans. Supervisory authorities, such as the European Banking Authority (EBA) and the Bank of England, now require the rigorous quantification of these impact tolerances to ensure they align with the declared risk appetite^[23].

To refine these projections, these hybrid models combine qualitative judgments with mathematical tools, frequently using Monte Carlo simulation to evaluate various business configurations or the effectiveness of security investments^[24]. These analyses are employed to calibrate risk appetite, test interdependencies between failures, and assess the feasibility of continuity plans according to resilience frameworks (such as the PS6/21 policy statement in the United Kingdom)^[4].

Exposure-based methodologies were standardized by the ORX association, which brings together more than 115 global financial institutions, in its reference report from April 2023^[25]. These approaches link losses to identified productive resources.

Unlike traditional expert-based scenarios, the Exposure, Occurrence, Impact (XOI) model decomposes risk into observable and auditable variables^[26]:

• Exposure (X): it quantifies the volume of units at risk. For example, for a fraudulent transfer risk, exposure corresponds to the total number of transactions processed annually (e.g., 10 million SWIFT transfers).
• Occurrence (O): it expresses the probability of failure per unit. If the historical fraud rate is 0.001%, this frequency is adjusted based on the effectiveness of current anti-fraud controls.
• Impact (I): it defines the financial loss per affected unit—for example, an average cost of €15,000 per incident, including regulatory sanctions and remediation costs.

The estimated total loss is the product of these factors: Loss = X × O × I. To capture uncertainty, institutions use Monte Carlo simulation with a minimum of 100,000 iterations^[27]. This process generates a distribution curve where the 99.9% confidence point defines the economic capital required to cover an extreme "once-in-a-thousand-years" loss.

This method allows for the definition of very precise impact tolerances. For example, a bank may establish that an unavailability of its payment system exceeding 120 minutes would result in a capital loss exceeding its risk appetite, thereby triggering automatic investments in infrastructure redundancy^[4].

The following table summarizes how each approach is typically applied within an operational risk management framework^[28]:

SMA and LDA are primarily associated with capital calculation. SMA provides the regulatory capital requirement under Pillar 1, while LDA remains widely used by large institutions for their internal capital estimates (Pillar 2) due to its statistical structure that allows for modeling the entire loss distribution^[23].

Scenario analysis, for its part, is employed for forward-looking assessments, particularly ICAAP, risk appetite calibration, and supervisory stress testing. It enables the quantification of low-frequency, high-severity events that are imperfectly captured by historical data^[20].

At the same time, structured scenario methods (such as the XOI approach) and exposure-based models strengthen this forward-looking dimension by linking potential losses to their operational drivers—internal processes, information systems, or dependence on third-party providers^[26]. These approaches are integrated into operational resilience frameworks to evaluate tolerance thresholds and business recovery capabilities in the event of a major shock^[4].

For its part, the Risk and Control Self-Assessment (RCSA) process indirectly feeds quantitative models. By identifying major exposures and vulnerabilities in control systems at all levels of the organization, the RCSA provides the qualitative input data necessary for developing scenarios, calculating internal capital, and defining risk appetite. This process maps the control environment in which statistical models are subsequently applied^[29].

In practice, financial institutions never rely on a single tool but combine these different approaches in an integrated manner. This complementarity is required by supervisors to meet regulatory requirements, justify capital adequacy, and test the overall resilience of the institution against severe but plausible crisis scenarios^[28].

The evolution of operational risk quantification reflects a progressive convergence between regulatory simplification, model sophistication, and supervision that is now focused on resilience. Since the introduction of the Basel II framework, methodologies have transitioned from formulas based on volume indicators toward forward-looking approaches that integrate endogenous data and exogenous exposure vectors^[30].

Driven by digital transformation, the scope of quantification now integrates advanced cybersecurity metrics. Modeling is no longer limited to compensating for financial losses but extends to measuring the institution's survival capacity. This assessment relies on standardized performance indicators such as Recovery Time Objective (RTO) and Recovery Point Objective (RPO). In Europe, the DORA regulation institutionalizes this approach by mandating threat-led penetration testing to validate these tolerance thresholds.

The urgency of these measures is highlighted by the continuous increase in the average cost of a data breach in the global financial sector, which reached $5.9 million in 2023—a 15% increase compared to 2020^[31]. For example, the ransomware attack targeting the provider ION Trading in 2023 paralyzed the clearing activities of dozens of banks, illustrating the need to precisely quantify these technological interdependencies^[32].

At the same time, the operational risk taxonomy has formally integrated Third-Party Risk Management (TPRM). The massive outsourcing to cloud computing service providers now generates a major systemic concentration risk. Indeed, approximately 70% of Cloud computing services in the European financial sector are concentrated among three dominant providers: AWS, Microsoft Azure, and Google Cloud^[33]. To address this phenomenon, quantification increasingly relies on Graph theory to identify Single Points of Failure (SPoF) within outsourcing chains. Major incidents, such as the 2021 OVHcloud data center fire in Strasbourg, now serve as case studies for modeling data loss and estimating failover costs in the event of a critical provider's hardware failure^[34].

Additionally, climate and environmental risks are the subject of intense methodological developments aimed at translating climate shocks into tangible operational losses. Physical risk involves quantifying direct damage to banking infrastructure. For example, in 2023, natural disasters generated $380 billion in global economic losses, a significant portion of which was uninsured, thereby increasing the risk of net loss for exposed financial institutions^[35]. Concurrently, transition risk captures the increase in legal and non-compliance risks. This component notably includes fines and litigation related to greenwashing. The $25 million fine imposed by the SEC in 2022 on DWS, Deutsche Bank's asset management subsidiary, for misleading statements regarding its ESG criteria, marks the definitive entry of climate compliance into the quantitative calculation of operational risk^[36].

Ultimately, operational risk management models are evolving from a strictly retrospective and segmented approach toward a systemic and forward-looking analysis. This new architecture is no longer limited to calculating a simple regulatory capital requirement. It allows institutions to define rigorous impact tolerances, thereby ensuring the maintenance of critical functions even in the event of an extreme but plausible shock, in accordance with the operational resilience principles issued by the Basel Committee on Banking Supervision^[37].

The volume of financial data is growing exponentially. According to the research firm IDC, data generated by financial institutions recorded an average annual growth rate of 26% between 2018 and 2025^[38]. This proliferation of unstructured information (Big data) is transforming the quantification of operational risk. Institutions are massively deploying machine learning algorithms. These models ingest millions of transactions per second to identify weak signals. In the area of anti-money laundering (AML), the impact is significant. The integration of deep learning has allowed some institutions to reduce false positives in the detection of suspicious transactions by up to 60%^[39].

At the same time, behavioral analysis monitors the digital habits of employees. It detects anomalies in login patterns or access to sensitive data. This proactive monitoring aims to prevent massive internal fraud. Historically, the absence of these algorithmic safeguards allowed for major lapses, such as the unauthorized positions held by trader Kweku Adoboli, which cost UBS $2.3 billion in 2011^[40].

Historically, collecting loss events required tedious manual processing. Today, natural language processing (NLP) automates the analysis of written or vocal communications. Algorithms extract semantics from emails, instant messages, and customer complaints. They automatically categorize incidents according to regulatory taxonomy. This technology has become indispensable given the proliferation of alternative communication channels. Between 2021 and 2023, the SEC imposed more than $200 million in fines on Wall Street banks for the unmonitored use of applications like WhatsApp by their employees^[41]. The integration of NLP now makes it possible to ingest these massive flows to instantly detect transgressive vocabulary or systemic compliance failures^[42].

Furthermore, Graph theory is used to model complex technological interdependencies. Operational losses rarely occur in isolation. Algorithms reveal hidden correlations between various internal and external factors. They map software supply chains to anticipate contagion effects. The 2020 cyberattack on the software company SolarWinds perfectly illustrates this hyper-connectivity risk. The malicious infiltration of a single update from this IT provider compromised the networks of thousands of companies and government agencies worldwide^[43]. Network modeling helps anticipate these cascading vulnerabilities and evaluate a bank's global exposure to technology-driven systemic risk^[24].

However, the integration of these technologies introduces a major vulnerability: model risk. The opacity of certain predictive algorithms poses a regulatory challenge described as the "black box" effect. A poorly calibrated model can lead to colossal financial and reputational losses. In 2012, a faulty high-frequency trading algorithm caused Knight Capital to lose $440 million in just forty-five minutes^[44]

In addition, artificial intelligence algorithms can replicate discriminatory biases. In 2019, the credit-granting algorithm for the Apple Card, managed by Goldman Sachs, was investigated by New York regulators for alleged gender-based discrimination^[45]. To prevent such lapses, authorities require strict explainability of automated decisions, independent model validation, and the systematic maintenance of human oversight^[46]

Category:Financial risk Category:Risk management