I februari 2007 beslutade Finansinspektionen att implementera Basel II:s rekommendationer och regleringar som resulterade i införandet av ett kapitalkrav för operativ risk. Internmätningsmetoden är den mest sofistikerade metoden för att beräkna ett kapitalkrav och utgår ifrån faktiska operativa förluster och ämnar att, utifrån dessa, modellera de risker som uppstår i samband med den operativa verksamheten. För att Finansinspektionen ska godkänna en internmätningsmetod kräver de att den inkluderar både intern och extern förlustdata. Vid användande av extern förlustdata är det viktigt att inse att en extern förlust inte är direkt representativ för en annan bank än den där den inträffade. Banker försöker därför ta fram metoder för att kunna skala externa förluster i ett försök att göra dem representativa för sin egen verksamhet. Syftet med denna studie är att utveckla och testa en metod för skalning av extern förlustdata. Teorierna kring skalning bygger idag till stor del på att låta bankspecifika variabler så som omsättning, antal anställda och geografisk placering vara förklarande för storleken av förluster hos olika banker. Med linjär regression är förhoppningen att sedan förstå hur de olika förklarande variablerna påverkar en förlust och därigenom kunna skala förlusterna. Befintliga metoder bygger idag på att göra en regression över en hel databas. Vår metod bygger på att de förklarande variablerna kan få större inverkan och signifikans vid uppdelande av databasen i olika händelsekategorier innan regressionen utförs. För att utvärdera detta använder vi två metoder. Dels den befintliga metoden där regression används över en hel databas och dels vår metod där regression görs inom varje händelsekategori för förluster. Våra resultat visar att olika förklarande variabler har olika stor inverkan inom olika händelsekategorier och därför inte bör inkluderas i en generell modell för skalning. Efter skalning enligt den gamla metoden och vår nya metod är skillnaderna för medelvärdesförluster inom olika händelsekategorier stora. Vår slutsats är att den nya metoden på ett rimligare sätt kan modellera operativa förluster då den endast inkluderar signifikanta variabler för vardera händelsekategorin. Dock har den nya metoden problem med uttunning av datapunkter inom händelsekategorierna. Detta skulle kunna hanteras genom att kombinera metoden med scenarioanalys eller att falla tillbaka på den gamla metoden för de händelsekategorier som inte ger robusta resultat. / In February 2007 Finansinspektionen decided to implement the Basel II regulatory requirements resulting in a capital requirement for operational losses. The Advanced Measurement Approach (AMA) is the most sophisticated method for capital requirement calculations and it is based upon actual operational losses from which it models the risks associated with a bank’s possible operational errors. To get approval from Finansinspektionen to use an AMA method it is required to incorporate both internal and external loss data in the model. When using external data it is important to be aware of that an operational loss is only representative for the bank where it occurred. Based on this, banks are in need of methods to scale external losses to make them more representative for their own environments. The purpose of this paper is to develop and evaluate a method for scaling of external loss data. Today the theories of scaling are based upon the idea to let bank specific variables, such as revenue, number of employees and geographical region be explanatory for the size of operational losses within banks. With linear regression it is possible to estimate how much these explanatory variables effects a loss and then use the results to scale external losses. Today’s theories are designed and used to perform the regression over the whole dataset. Our method is based on the idea that the explanatory variables will have a greater impact and significance if the dataset is divided into different risk types before the regression is performed. To evaluate our approach we perform a test simulation on both the old method, where the regression is performed over the whole dataset and the new method where one regression is performed for each risk type. Our results show that different explanatory variables have different impact for different risk types and therefore should not always be included in an overall method for scaling. After scaling of the losses with both the old and our new method, we notice that the results for average loss size differ a lot within the different risk types. Our conclusion is that the new method is able to scale external losses in a more reasonable and accurate way since it only includes significant variables for each risk type. But, the new method has a problem with lacking of data points within the risk types. This could be handled by combining the method with scenario analysis or using the old method for the risk types that does not generate robust results.

[pt] O risco operacional, que é definido como a possibilidade de ocorrência de perdas resultantes de falha, deficiência ou inadequação de processos internos, pessoas e sistemas, ou de eventos externos, está presente em qualquer atividade de uma instituição, seja ela financeira ou não. Essas características tornam a gestão e a mensuração desse risco desafiadoras e completamente diferentes dos demais tipos de risco. Apesar de Basileia II, em 2004, ter proposto diretrizes para os modelos internos de risco operacional, que visam determinar a quantia de capital que deve ser reservada para fazer frente a esse risco, os modelos internos de risco operacional ainda não se desenvolveram como os modelos de risco de crédito e mercado. Esse fato levou o Comitê de Basileia a sinalizar a intenção de eliminar os modelos internos para mensuração do risco operacional recentemente, substituindo todas as abordagens atuais, inclusive os modelos internos por uma abordagem padronizada única, que considera as perdas internas das instituições financeiras. A ausência de bases de dados internas abrangentes e que contemplem todos os riscos operacionais aos quais uma instituição financeira está exposta criou a necessidade de utilizar outros elementos, como os dados de perdas externas e os cenários. No entanto, esses elementos são criticados pela subjetividade. Esta tese teve como objetivo demonstrar a utilização do elemento análise de cenários na metodologia Loss Distribution Approach (LDA) para cálculo do capital regulamentar referente ao risco operacional tendo como referência a experiência do Banco Nacional de Desenvolvimento Econômico e Social (BNDES) na integração da gestão do risco operacional com a mensuração do capital. A metodologia proposta possibilitou, dentre outros: (i) a mensuração do capital regulamentar considerando cenários factíveis; (ii) a identificação de cenários de cauda e de corpo da distribuição agregada de perdas, que não estão refletidos na base de dados internas de perdas; (iii) a identificação e mensuração dos riscos operacionais do BNDES de forma abrangente; (iv) a obtenção de informações que podem direcionar a gestão do risco no que se refere à identificação de riscos que devem ter o tratamento priorizado; (v) o desenvolvimento de uma cultura de riscos, tendo em vista o envolvimento de especialistas de diversas unidades; (vi) a utilização de uma metodologia compreensível a todos os especialistas de negócios, que são os que conhecem os riscos de suas atividades. / [en] Operational risk, which is defined as the possibility of losses resulting from failure, deficiency or inadequacy of internal processes, people and systems or from external events, is present in any activity of an institution, be it financial or not. These features make the management and measurement of this risk challenging and completely different from other types of risk. Although Basel II in 2004 has proposed guidelines for the internal models for operational risk, which aim to determine the amount of capital that must be set aside to cover this risk, operational risk internal models have not yet developed as credit risk and Market models. This has led the Basel Committee to signal the intention to eliminate internal models for measuring operational risk recently, replacing all current approaches, including internal models by a single standardized approach, which considers the internal losses of financial institutions. The absence of comprehensive internal databases that include all operational risks to which a financial institution is exposed has created the need to use other elements such as external data loss and scenarios. However, these elements are criticized for its subjectivity. This thesis aimed to demonstrate the use of the element scenario analysis in Loss Distribution Approach (LDA) methodology for calculating regulatory capital for operational risk with reference to the experience of the Brazilian Development Bank (BNDES) in the integration of operational risk management with the measurement of capital. The proposed methodology allowed, among others: (i) the measurement of regulatory capital considering feasible scenarios; (ii) identification of tail and body scenarios of the aggregate losses distributions, which are not reflected in the internal loss database; (iii) the identification and measurement of BNDES s operational risk in a comprehensive manner; (iv) obtaining information that can target the risk management as regards the identification of risks that should be prioritized treatment; (V) developing a risk culture in view of the involvement of experts from various units; (Vi) use a comprehensive approach to all business experts, who are the ones who know the risks of their activities.

Актуальность темы исследования заключается в совершенствовании системы управления рисками применительно к деятельности коммерческих банков и приобретает все большее значение в контексте коммерческой банковской деятельности, независимо от того, относятся ли эти риски активным кредитным операциями или рискам, связанным с платежами и расчетами, клиринговыми услугами, прочей банковской деятельностью. Цель исследования - состоит в разработке мероприятий по совершенствованию системы управления операционным риском коммерческого банка. Практическая значимость работы заключается в том, что предлагаемые меры по применению шкалы операционных нарушений и мероприятий по доработке процесса кредитования могут быть использованы ПАО «Синара банк» в своей практической деятельности. Эффективность рекомендаций - предложенные автором рекомендации по совершенствованию системы управления операционным риском позволят скорректировать. В результате мероприятий, планируемое снижение операционных нарушений в рамках последующего контроля, повышение компетенций операционных сотрудников Банка, оптимизация процесса кредитования, минимизировать время предоставления кредита в банке, на 20%. / Актуальность темы исследования заключается в совершенствовании системы управления рисками применительно к деятельности коммерческих банков и приобретает все большее значение в контексте коммерческой банковской деятельности, независимо от того, относятся ли эти риски активным кредитным операциями или рискам, связанным с платежами и расчетами, клиринговыми услугами, прочей банковской деятельностью. Цель исследования - состоит в разработке мероприятий по совершенствованию системы управления операционным риском коммерческого банка. Практическая значимость работы заключается в том, что предлагаемые меры по применению шкалы операционных нарушений и мероприятий по доработке процесса кредитования могут быть использованы ПАО «Синара банк» в своей практической деятельности. Эффективность рекомендаций - предложенные автором рекомендации по совершенствованию системы управления операционным риском позволят скорректировать. В результате мероприятий, планируемое снижение операционных нарушений в рамках последующего контроля, повышение компетенций операционных сотрудников Банка, оптимизация процесса кредитования, минимизировать время предоставления кредита в банке, на 20%.

No description available.

Abstract (english) Objectives The main objective of this work is to design methods and proceadures enhancing effectiveness and efficiency of IT audit in banks with the accent given to their use by the supervisory authorities. Another objective of the work (and an essential starting point at the same time) is a summary and assesment of methods and proceadures developed and implemented into the CNB practice with regard to banking supervision in the area of information systems. Objectives Achievement From the methodological point of view the esential starting point of the work was represented by above mentioned objectives that were used for elaboration of a set of questions. Questions enabled to set up the hypotheses. (Another more particular hypotheses were defined in order to design the particular solutions in chapter 5.) Futhermore, the critical factors (problems) were defined in the process of the questions analyses. Subsequently, the solutions were specified. The solutions confirmed the hypotheses which reflected the achievement of the objectives. Description, categorisation, analyses, screening, modelling, comparative analyses and sample testing were used to achieve the objectives. In particular, the solutions that were elaborated, making use of methods described above, enhance effectiveness and efficiency of IT audit in banks. Moreover, the CNB's proceadures and methods were introduced and assesed within the work. Scientific Contribution The work brings an evidence of correlation between the quality of IT audit in banks and their economical performance. With this regard the work contributes with original conclusions, benchmarks and proceadures that may be used by banks, supervisory authorities and IT auditors. These conclusions are achieved by description, categorisation, analyses, modelling and screening research highlighting the role of the rentability, the productivity, the risks, the inovations and the economical value of information. Furthermore, the IT audit and IT supervision in banks are specified. They are also compared and contrast to the other audit cathegories. The work presents important peaces of evidence regarding the role of IT audit in this context. This is made by description, cathegorisation and analyses. Another contribution represents proceadures and methods developed and implemented (to the large extend by author) in the field od IT banking supervision in the Czech Republic. This delivers valuable outputs for foreign supervision authorities, banks and auditors. The work lead to original solutions of critical factors. These solutions are to use by IT audit and IT supervision (and also in audit work generally). The solutions make use of ceartain atributes of Capability Maturity Model (CMM) and were elaborated in the proces of decsription, cathegorisation, screening research, comparative analyses, hypotheses seting and testing. The solutions enhances acuracy and objectiveness of assesment done by IT auditors. The solutions lead to better comparativeness of audit outputs on both national and international level, give better preconditions for risk assesment and capital adequacy evaluation within BASEL II and enhance the information value of audit ouptuts. The structure (content) of the work reflects the above mentioned articles that give a brief description of the main four parts (chapters) of the work.

This research sheds light on the nature of the role of the operational risk controller in the financial services industry. The focus is on understanding how operational risk controllers interact with different layers of the organisation and become influential with the business lines and senior management. Nine semi-structured interviews were conducted with operational risk controllers, and it was found that their work is becoming increasingly focused on managing people with a view to creating mutual understanding. To achieve this, operational risk controllers should work more as independent facilitators in their interactions with the first line and senior management, as engaged toolmakers when adapting and reconfiguring tools, and as non-financial risk controllers when attempting to enable business leaders to understand the magnitude of operational risks.

A aplicação de Redes Bayesianas como modelo causal em Risco Operacional e extremamente atrativa do ponto de vista do gerenciamento dos riscos e do calculo do capital regulatorio do primeiro pilar do Novo Acordo da Basileia. Com as Redes e possível obter uma estimativa do VAR operacional utilizando-se não somente os dados históricos de perdas, mas também variáveis explicativas e conhecimento especialista através da possibilidade de inclusão de informações subjetivas. / The application of Bayesian Networks as causal model in Operational Risk is very attractive from the point of view of risk management and the calculation of regulatory capital under the first pillar of the New Basel Accord. It is possible to obtain with the networks an estimate of operational VAR based not only on the historical loss data but also in explanatory variables and expert knowledge through the possibility of inclusion of subjective information.

A aplicação de Redes Bayesianas como modelo causal em Risco Operacional e extremamente atrativa do ponto de vista do gerenciamento dos riscos e do calculo do capital regulatorio do primeiro pilar do Novo Acordo da Basileia. Com as Redes e possível obter uma estimativa do VAR operacional utilizando-se não somente os dados históricos de perdas, mas também variáveis explicativas e conhecimento especialista através da possibilidade de inclusão de informações subjetivas. / The application of Bayesian Networks as causal model in Operational Risk is very attractive from the point of view of risk management and the calculation of regulatory capital under the first pillar of the New Basel Accord. It is possible to obtain with the networks an estimate of operational VAR based not only on the historical loss data but also in explanatory variables and expert knowledge through the possibility of inclusion of subjective information.

Examensarbetet använder generaliserade linjära modeller för att identifiera och analysera enhetsspecifika egenskaper som påverkar risken för operativa förluster. Företag exponeras sällan mot operativa förluster vilket gör att det finns lite information om dessa förluster. De generaliserade linjära modellerna använder statistiska metoder som gör det möjligt att analysera all tillgänglig interndata trots att den är begränsad. Dessutom möjliggör metoden att analysera frekvensen av förlusterna samt magnituden av förlusterna var för sig. Det är fördelaktigt att göra två separata analyser, oberoende av varandra, för att identifiera vilka enhetsspecifika egenskaper som påverkar förlustfrekvensen respektive förlustmagnituden. För att modellera frekvensen av förlusterna används en Poissonfördelning. För att modellera magnituden av förlusterna används en Tweediefördelning som baseras på en semiparametrisk fördelning. Frekvens- och magnitudmodellen kombineras till en gemensam modell för att analysera vad som påverkar den totala kostnaden för operativa förluster. Resultatet visar att enhetens region, inkomst per tjänstgjord timme, storlek, internbetyg och erfarenhet hos personalen påverkar kostnaden för operativa förluster. / The objective of this Master’s Thesis is to identify and analyze explanatory variables that affect operational losses. This is achieved by applying Generalized Linear Models and selecting a number of explanatory variables that are based on the company’s unit attributes. An operational loss is a rare event and as a result, there is a limited amount of internal data. Generalized Linear Models uses a range of statistical tools to give reliable estimates although the data is scarce.  By performing two separate and independent analyses, it is possible to identify and analyze various unit attributes and their impact of the loss frequency and loss severity. When modeling the loss frequency, a Poisson distribution is applied. When modeling the loss severity, a Tweedie distribution that is based on a semi-parametric distribution is applied. To analyze the total cost as a consequence of operational losses for a single unit with certain attributes, the frequency model and the severity model are combined to form one common model. The result from the analysis shows that the geographical location of the unit, the size of the unit, the income per working hour, the working experience of the employees and the internal rating of the unit are all attributes that affects the cost of operational losses.

Managerial and regulatory focus in the financial industryhas been intensified due to a number of extremely costly and highly publicized events. Whenfraudulent activities or any improper business practices are revealed it may damage the bank’sreputation. In the end this can have a big impact on anyone who is any kind of stakeholder.Reputational risk and by what mechanism reputational risk is adversely affecting stock pricesis therefore of great importance for stakeholders. This study aims at providing insights and abetter understanding of reputational risk. We examine the reputational damage in banksresulting from operational losses and analyze the stock market reaction across the bankingindustry. Research question: What is the effect of operational loss announcements from internalfraudulent activities on competitors in the banking industry? The results show a positive cross-bank reaction during the observed period oftime. Furthermore, the cross-bank reaction is stronger when a reputational damage isrecognized in the bank where the loss occurred. The results show a positive cross-bankreaction during the observed period of time. Furthermore, the cross-bank reaction is strongerwhen a reputational damage is recognized in the bank where the loss occurred.