Risk Management Paper

risk_management_2.pdf

Home >Business & Finance homework help >Risk Management Paper

683

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES FROM AN ENTERPRISE PERSPECTIVE Nadine Gatzert Andreas Kolb

ABSTRACT Operational risk can substantially impact an insurer’s risk situation and is now increasingly in the focus of insurance companies, especially due to new European risk-based regulatory framework Solvency II. The aim of this arti- cle is to model and examine the effects of operational risk on fair premiums and solvency capital requirements under Solvency II. In particular, three dif- ferent approaches of deriving solvency capital requirements are analyzed: the Solvency II standard model, a partial internal model, and a full inter- nal model. This analysis is not only of relevance for Solvency II, but also regarding an insurer’s Own Risk and Solvency Assessment (ORSA) that is not only planned in Solvency II, but also by the NAIC in the United States. The analysis emphasizes that diversification plays a central role and that op- erational risk measurement and management is highly relevant for insurers and should be integrated in an enterprise risk management framework.

INTRODUCTION In the context of new risk-based capital requirements for banks and insurers imposed by Basel II/III and Solvency II, respectively, the discussion about operational risk intensified and especially large insurers are now confronted with the need to develop and implement adequate risk measurement and management instruments to deal with operational risk. In Solvency II, operational risk is defined analogously as in Basel II/III as “the risk of loss arising from inadequate or failed internal processes, personnel or systems, or from external events. Operational risk . . . shall include legal risks, and exclude risks arising from strategic decisions, as well as reputation risks” (see European Parliament and the Council, 2009, Article 13, No. 33, Article 101, No. 4).1 Operational risk is also of high relevance for the National Association of Insurance

Nadine Gatzert and Andreas Kolb are with the Department of Insurance Economics and Risk Management, Friedrich-Alexander-University (FAU) of Erlangen-Nürnberg, Nuremberg, Germany. The authors can be contacted via e-mail: [email protected] and andreas. [email protected], respectively. The authors wish to thank the anonymous referee as well as Rob Hoyt and Joan Schmit for valuable comments and suggestions on an earlier draft of this paper. 1See also Basel Committee (2004, p. 137). In Basel II/III, operational risk is categorized into the seven event types “internal fraud,” “external fraud,” “employment practices and

684 THE JOURNAL OF RISK AND INSURANCE

Commissioners (NAIC), where the potential inclusion of a specific charge for opera- tional risk within the U.S. system of risk-based capital for insurers is discussed (see Vaughan, 2009; PwC, 2012). Besides the new regulatory requirements, cases of high operational losses in the recent past also strongly emphasize the importance and considerable risk associated with operational loss events. One of the most mentioned events in this context is the bankruptcy of Barings Bank in 1995, which was followed by a $1.3 billion loss caused by its rogue head derivatives trader in Singapore.2 The potential impact of operational losses on an insurer’s risk situation is also stressed by figures regarding potential insurance fraud by policyholders, which in the German insurance market, for instance, is estimated to about €4 billion per year (see Hiebl, Roedenbeck, and Kiefer, 2012). In the third party liability insurance only, 25 percent of all claims are suspected to be fraudulent and for an average motor liability insur- ance company, losses due to fraud are estimated to €32.5 million per year (see Hiebl, Roedenbeck, and Kiefer, 2012).3 The magnitude of these operational loss events in the past strongly demonstrates the need for an adequate measurement and management of operational risks, which is also required according to the new framework Solvency II. The aim of this article is to model and quantify the effects of operational risk from an enterprise perspective by focusing on an insurer’s pricing and solvency capital re- quirements under Solvency II. We thereby compare the Solvency II standard formula with a partial and a full internal model.

A large part of the academic literature concerns the modeling of operational risk. Cruz (2002), McNeil, Frey, and Embrechts (2005), Gourier, Farkas, and Abbate (2009), and Shevchenko (2010), for instance, point out the importance of extreme value theory for calculating aggregate losses by using the loss distribution approach. Another part of the literature empirically analyzes operational loss data. Although most of these studies examine empirical data from the banking sector (see, e.g., Moscadelli, 2004; de Fontnouvelle et al., 2003; Dutta and Perry, 2006), Hess (2011b) also investigates opera- tional loss data for insurance companies. Several studies dealing with operational risk also assess the dependencies between the risk cells of banks, including, for example, Böcker and Klüppelberg (2008), Ebnöther et al. (2003), Frachot, Roncalli, and Salomon

workplace safety,” “clients, products, & business practice,” “damage to physical assets,” “busi- ness disruption & systems failures,” and “execution, delivery, & process management.” This categorization of operational risk is also suggested for insurers by the German Insurance Association (see GDV, 2007, p. 10). Note that in Basel II, operational risk was introduced as a third risk class in addition to market and credit risk (see Cummins, Wei, and Xie, 2011; Kamiya, Schmit, and Rosenberg, 2011), while in insurance, a more sophisticated risk clas- sification system would, for example, separately define financial risks (e.g., market, credit, etc.), policyholder insurance risk (e.g., property insurance, workers compensation insurance, health insurance, etc.), business risk (e.g., management, strategy, etc.), and operational risk (consistent with Basel II and Solvency II).

2Other examples of operational risk events include the NASDAQ odd-eighths pricing scandal in 1994 as well as the losses of Société Générale in 2008 and UBS in 2011, both due to rogue traders. Similar examples in the insurance sector include the Swiss Life investment scandal in 2002, the AIG Finite Reinsurance Accounting fraud in 2005, as well as the AIG credit default swap write-down in 2008.

3Another major issue is fraud in the context of commissions paid to agents. For example, the bankruptcy of the German MEG AG in 2009 caused irrecoverable losses for several insurance companies due to fraud in commissions (see Altenähr, 2010).

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 685

(2004), and Mittnik, Paterlini, and Yener (2011). Furthermore, Hess (2011a) examines the impact of the financial crisis on operational risk, while Cummins, Lewis, and Wei (2006) focus on the market value effects of operational loss events for U.S. banks and insurers, and spillover effects of operational risk events on banks and insurers are analyzed in Cummins, Wei, and Xie (2011). Different forms of insurance contracts for operational risk are analyzed in Peters, Byrnes, and Shevchenko (2011) for the case of banks.

In this article, we contribute to the literature by presenting a model for how to integrate operational risk from an enterprise perspective and, based on this, focus on the impact of operational risk on an insurer’s pricing and capital requirements under Solvency II. We thereby compare the Solvency II standard model with a full internal model using the risk sensitive loss distribution approach for operational risk and a partial internal model that only focuses on the operational value at risk (OpVaR), that is, without taking into account diversification effects. In the analysis, we also study the impact of dependencies between operational risk and the insurer’s loss distribution, among others, using the concept of copulas. The model is calibrated based on empirical data from the previous literature and the numerical analysis allows the identification of key characteristics that increase or decrease capital requirements above or below the static risk-based factor used for the Solvency II standard model. For insurers, these considerations are also of special relevance in the context of their Own Risk and Solvency Assessment (ORSA) as required by Solvency II’s Pillar 2 or the NAIC in the United States (see NAIC, 2011; Blanchard, 2012; Wicklund and Christopher, 2012).

One main finding is that diversification plays an important role in the quantification of operational risk and that insurers should closely monitor and manage operational risk. In particular, our results reveal that the capital requirements of the Solvency II standard model may severely underestimate operational risk. In contrast, a partial internal model that only focuses on the OpVaR, that is, without taking into account diversification effects, tends to overestimate the capital requirements for operational risk. In any case, operational risk measurement and management is highly relevant for insurers and should be integrated in an enterprise risk management to adequately control and steer an insurance company.

The remainder of the article is structured as follows. The “Model Framework” section includes the model framework of the insurer including operational risk, premium calculation, and risk measurement. The “Numerical Analysis” section presents the results of the numerical analyses. A discussion of further issues regarding measuring and managing operational risks is given in the “Implications and Further Consider- ations in Regard to Measuring and Managing Operational Risks” section, while the “Conclusion” concludes.

MODEL FRAMEWORK This section describes the model framework used to quantify the effects of operational risk on the insurer’s risk situation and solvency capital requirements. First, we specify how operational risk is modeled and illustrate the model of the insurance company. Next, fair contracts and the determination of premiums are presented, followed by a comparison of different ways of how to derive solvency capital requirements.

686 THE JOURNAL OF RISK AND INSURANCE

Modeling Operational Risk To model the operational risk of an insurer, the loss distribution approach (LDA) is used (see, e.g., Gourier, Farkas, and Abbate, 2009; Hess, 2011a), which implies that the total aggregate loss is given by

Zt = Nt∑

i =1 Xi , (1)

where Zt denotes the aggregate loss in the time interval [0, t], Nt the loss frequency in the same time period and Xi the loss severity of the ith event. Furthermore, the losses Xi are independently and identically distributed random variables and the loss frequencies and loss severities are assumed to be independent.4 The loss frequencies are modeled by a homogenous Poisson process with intensity λ > 0; that is, the distribution of the frequencies is given by

Pt (n) = P (Nt = n) = e−λt (λt)n

n! .

The severities of the claims in the upper tail of the loss distribution are described by means of extreme value theory (EVT). In previous operational risk models (see, e.g., Gourier, Farkas, and Abbate, 2009; Hess, 2011a), EVT is applied in the upper tail of the loss distribution as conventional distributions like the lognormal, exponential, or gamma distribution are not capable to reproduce the heavy tails of operational losses. As EVT focuses on the tail area of a distribution, it provides a possibility to approx- imate losses that exceed a high threshold u by the generalized Pareto distribution (GPD), which is given by

GPDξ ,β (y) =

⎧⎪⎪⎨ ⎪⎪⎩

1 − exp (

− y β

) , ξ = 0

1 − (

1 + ξ y β

)−1/ξ , ξ �= 0,

where β > 0, y ≥ 0 if ξ ≥ 0 and 0 ≤ y ≤ (–β/ξ ) if ξ < 0, y = x – u. The parameters ξ and β are called the shape and the scale, respectively, where ξ is the key parameter and determines the heavy-tailedness of the distribution.5 To model the loss severity

4The total operational risk of a bank or an insurer is then given by the aggregation of the depen- dent total aggregate losses (see Equation (1)) of all risk cells. To model the dependence between different operational risk cells the literature suggests splitting into models for frequency de- pendence and severity dependence. Hence, in this article only one risk cell is considered and for a single risk cell the assumption of independent frequencies and severities is satisfied (see, e.g., Böcker and Klüppelberg, 2008).

5In particular, three different cases can be distinguished: for ξ = 0, the GPD equals an exponen- tial distribution, whereas for ξ < 0, a short-tailed Pareto Type II distribution is obtained. In the case of ξ > 0, an ordinary Pareto distribution is induced and, therefore, the GPD is heavy-tailed. If the chosen threshold u is reasonably high, the theorem of Balkema and de Haan (1974) and

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 687

FIGURE 1 Balance Sheet of the Insurance Company at Time t = 0, 1

Assets Liabilities

At Et

St } = Lt

distribution F(x), we thus fix the threshold u at the qth percentile6 and construct a spliced distribution function, where the body of the distribution, that is, the losses below the threshold u, follows a lognormal distribution Flog, and the tail, that is, the losses over the threshold u, is modeled with the GPD, FGPD, that is, the loss severity distribution is given by

F (x) = {

Flog (x) · q , ∀x ≤ u 1 · q + FGPD (x − u) · (1 − q ) , ∀x > u.

On the basis of this relation, the distribution of the total aggregate loss Zt of Equation (1) in the time interval [0, t] can be modeled by

Gt (x) = P [Zt ≤ x] = ∞∑

n=0 P [Nt = n] P [Zt ≤ x|Nt = n]

= ∞∑

n=0 Pn (t) F

n∗ (x) , x ≥ 0, t ≥ 0,

where Fn∗(x) denotes the n-fold convolution of F(x).

Modeling the Insurance Company Figure 1 shows a balance sheet of the insurance company at time t, where At is the market value of the assets, St denotes the value of insurance claims, and Zt comprises the losses resulting from operational risk. The total value of liabilities is thus composed of St and Zt, and Et is the company’s equity, which is determined as the difference between assets and liabilities.

Pickands (1975) states that the GPD is the canonical distribution for modeling excess losses over the defined threshold u. Moreover, for most of the classical loss distributions, the excess distribution converges to the GPD when the threshold u is increased (see McNeil, Frey, and Embrechts, 2005, pp. 277–278), which means that the excess distribution over a high threshold u can be approximated by the GPD.

6The choice of the threshold u is a central aspect when modeling the spliced distribution function. On the one hand, it has to be high enough to fulfill the limit law condition. On the other hand, a sufficient number of observations must be ensured to properly estimate the upper tail of the distribution function (see, e.g., Gourier, Farkas, and Abbate, 2009).

688 THE JOURNAL OF RISK AND INSURANCE

TABLE 1 Overview of Different Assumptions Regarding Operational Risk With Respect to Pricing and Risk Measurement

Operational Risk Taken Into Operational Risk Taken Into Case No. i Account in Basic Pricing Account in Risk Measurement

1 (Setting without operational risk) No No 2 (Setting with operational risk) No Yes 3 (Setting with operational risk) Yes Yes

At time 0, the insurer receives premiums π S1 paid by the policyholders for insured losses at time t = 1, and an initial contribution by shareholders E0. Thus, the total initial capital sums up to

A0 = E0 + π S1 .

The initial capital is invested in the capital market, whereby a fraction γ is invested in high-risk assets, A0,high = γ ·A0, and the remaining part (1 – γ ) is invested in low-risk assets, A0,low = (1 – γ )·A0. Low-risk and high-risk assets are assumed to be lognormally distributed with mean E(A1,j) and standard deviation σ (A1,j), for j = low, high. Thus, the total value of the asset portfolio A1 at time t = 1 is given by

A1 = γ · A1,high + (1 − γ ) · A1,low.

The insurer becomes insolvent if assets are not sufficient to cover the liabilities, that is, if L1 > A1, as shareholders have limited liability. In this setting, operational risk will have an impact on the premium paid by policyholders for insured losses at time 1, as a higher default risk (caused by the presence of operational risk) would generally decrease the value of the insurance policy. Thus, to study the impact of operational risk on pricing and risk assessment, we compare three different cases as exhibited in Table 1.

First, we consider the setting without operational risk, that is, where operational risk is neither taken into account in pricing nor in the calculation of risk mea- sures (Case 1), that is, Z1 = 0. This serves as a reference case and allows an anal- ysis of how risk measures are wrongly assessed if operational risk is set to 0. In the second case, operational risk is considered in the calculation of risk measures, but it is not taken into account in basic pricing (Case 2). Third, operational risk is considered in pricing as well as in the calculation of risk measures (Case 3). We hereby assume that—in a world with operational risk—operational losses are covered first, as they occur before the insurer is able to pay out the policyholders’ claims. Thus, depending on the assumptions regarding operational risk laid out in Table 1 (Cases i = 1, 2, 3), one can distinguish between three cases (realizations) at time 1:

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 689

1. Ai 1

< S1 + Zi1, Ai1 ≥ Zi1: the insurer is insolvent; operational losses are paid out, but insured losses can only be covered partially or not at all,

2. Ai 1

< S1 + Zi1, Ai1 < Zi1: the insurer is insolvent; neither operational nor insured losses can be covered,

3. Ai 1

≥ S1 + Zi1: the insurer is solvent; operational and insured losses can be covered.

Hence, at time t = 1, the operational loss claims L Z,i 1

, policyholders’ claims L S,i 1

, and

the equity holders’ position E i 1 , for Cases i = 1, 2, 3, are given by

L Z,i 1

= min (

Ai1, Z i 1

) = Zi1 − max

( Zi1 − Ai1, 0

) ,

L S,i 1

= min (

Ai1 − L Z,i 1

, S1 )

= S1 − max (

S1 − (

Ai1 − L Z,i 1

) , 0

) , and

E i1 = max (

Ai1 − L S,i 1

− L Z,i 1

, 0 )

thus summing up to Ai 1 .

Fair Contracts and Determination of Premiums Valuation of equity holders’ and policyholders’ claims is conducted using the capital asset pricing model (CAPM) (see Gründl and Schmeiser, 2002). To ensure a fair sit- uation from the shareholders’ perspective, the value of equity holders’ claims must be equal to their initial contribution (depending on the assumptions regarding oper- ational risk, Cases i = 1, 2, 3), that is,

V0 (

E i1 )

= e−r f · [

E (

E i1 )

− η · cov (

E i1, rm )]

!= E0, (2)

where Vt(.) stands for the valuation approach used to determine the market value at time t (here by means of the CAPM), rm denotes the return of the market portfolio at time t = 1 and η stands for the market price of risk, such that η = (E (rm) − r f )/σ 2(rm), where rf denotes the risk-free interest rate. To ensure that Equation (2) holds, the policyholders’ premiums are adjusted accordingly. This is done in two steps. First,

the basic premium π S1,basic i is calculated by

π S1,basic i = V0

( L S,i

) = e−r f ·

[ E

( L S,i

) − η · cov

( L S,i

1 , rm

)] .

Second, the fair premium π S1 i is derived by adding a loading δ

S1 i ,

π S1 i = π

S1 ,basic

i · (

1 + δ S1i )

690 THE JOURNAL OF RISK AND INSURANCE

which is calibrated such that the situation is fair from the shareholders’ perspective; that is, Equation (2) is satisfied.7

Note that the use of an alternative paradigm for deriving the fair premium may actu- ally imply a higher (or lower) loading and thus also a larger difference between the cases with and without operational risk. According to the three-factor model by Froot (2007), for instance, an extension of the two-factor model proposed by Froot and Stein (1998), firms do not only take into account the systematic risk factor as in the CAPM in setting premiums, but additionally include a second factor that reflects the covari- ability of the product’s returns with the firm’s preexisting portfolio of nontradable risks (driven by the insurer’s and the customers’ aversion to insolvency risk), and a third factor that accounts for the covariance with firm-wide skewed risks. The latter takes into account that negatively skewed exposures are generally associated with higher costs and that they cause firms to conduct more aggressive reinsurance and hedging activities as well as make less aggressive and more diversified underwriting and investment decisions (Froot, 2007, p. 276). The extent of the difference in the loading when using the CAPM as compared to the Froot (2007) three-factor model would generally depend on the extent of the two additional factors that would also be driven by possible concentrations of operational risk on the balance sheet (e.g., large third-party distribution systems) as well as the correlation between operational risks and other assets or liabilities (e.g., financial guaranty underwriting). Hence, with increasing correlations and increasing risk concentrations of operational risks on the balance sheet, the fair loading would increase, which in turn would imply a reduced risk level for the insurer due to a higher premium income (given a sufficient demand by policyholders).

Solvency Capital Requirements (SCR) and Risk Measurement On the basis of the previously described model framework and the assumptions regarding operational risk, the solvency capital requirements (SCR) can be derived. Under Solvency II, the SCR are defined as the amount of capital needed at time t = 0 to meet future obligations for a required safety level α using the value at risk (VaR) with a confidence level of 99.5 percent (α = 0.5 percent) on the basis of the risk-bearing capital (RBC) at time t = 1 (see European Parliament and the Council, 2009, Article 101, No. 3). The RBC characterizes the available economic capital and is defined as the difference between the value of assets and liabilities,8

RBCi1 = Ai1 − L i1 = Ai1 − S1 − Zi1, and (3)

RBCi0 = V0 (

Ai1 )

− V0 (

L i1 )

= V0 (

Ai1 )

− V0 (

S1 + Zi1 )

7Note that if premiums are not adjusted, the shareholder value would decrease accordingly. In the present setting, it is thus assumed that shareholders have alternative investment opportu- nities in financial assets that do not involve operational risk. Hence, they would not agree to carry operational losses and require a respective adjustment of policyholders’ premiums (see also Doherty and Garven, 1986, for similar arguments regarding double taxation).

8Under Solvency II, the difference between assets and liabilities is also called the net asset value (NAV) instead of RBC (see EIOPA, 2010, pp. 91–92).

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 691

where i = 1, 2, 3 (see Table 1 for assumptions regarding operational risk). The solvency capital requirements are defined based on the VaR of the change of the RBC over one

period, where RBC i , j 1

of Equation (3) is discounted with the risk-free interest rate rf (see, e.g., Gatzert and Schmeiser, 2008), such that

SCRi = −VaRα (

e−r f · RBCi1 − RBCi0 )

, i = 1, 2, 3. (4)

As focus is laid on the impact of operational risk on an insurer’s solvency situation and solvency capital requirements, three approaches for deriving the solvency capital requirements are compared: (1) using the Solvency II standard model for operational risk (“SM”), (2) a partial internal model for operational risk (“PM”), or (3) a full internal model (“IM”) for deriving the total SCR.

First, we assume that the SCR for operational risk are calculated using the Solvency II standard model as laid out in QIS 5 (see EIOPA, 2010, p. 103). In this case, capital requirements for operational risk are given by 30 percent of the basic solvency capital requirements (BSCR), which are calculated without taking into account operational risk, that is, by setting Zi

1 = 0. Note that this does not affect the calculation of pre-

miums, which is still conducted according to the three cases defined in Table 1 (i.e., depending on whether operational risk is taken into account in pricing or not). The BSCRi is thus derived by9

BSCRi = −VaRα (

e−r f · RBCi1,SM − RBCi0,SM )

, (5)

where RBCi 1,SM

= Ai 1

− S1 and

RBCi0,SM = V0 (

RBCi1,SM

) = e−r f ·

[ E

( RBCi1,SM

) − η · cov

( RBCi1,SM, rm

)] .

The capital requirements for the operational risk SCRi SM,Op

, in Cases10 i = 2, 3 can then be calculated by multiplying the BSCRi of Equation (5) with the risk-based factor 0.3 prescribed in the Solvency II standard formula, such that11

SCRiSM,Op = 0.3 · BSCRi , i = 2, 3. (6)

9Note that operational risk itself is not modeled in the BSCR. 10In Case 1 (“without operational risk”) no additional solvency capital requirements for the

operational risk need to be calculated, that is, SCRi =1SM,Op = 0 and SCRi =1SM,total = BSCRi =1. Thus, solvency capital requirements in Case 1 are solely calculated with the Solvency II standard model; that is, neither the partial internal model nor the full internal model is used in this case.

11Under Solvency II, SCRSM,Op is definied by SCRSM,Op = min(0.3·BSCR,Op) + 0.25·Expul (see EIOPA, 2010, p. 103). In the present setting, this can be reduced to the formula stated in Equation (6) as Expul is equal to 0 due to consideration of a nonlife insurer, and as 0.3·BSCR ≥ min(0.3·BSCR,Op); that is, the real SCRSM,Op might even be smaller than the one we calculate. Thus, the derivation of SCRSM,Op may overestimate the actual one.

692 THE JOURNAL OF RISK AND INSURANCE

In Cases 2 and 3, the solvency capital requirements according to the standard model

SCRi SM,total

are thus given by

SCRi SM,total

= BSCRi + SCRiSM,Op, i = 1, 2, 3.

Second, we use a partial internal model that replaces the risk-based factor of 0.3 of the BSCR with the OpVaR. Here, capital requirements are calculated for operational risk only, without taking into account diversification effects (see, e.g., Böcker and Klüppelberg, 2005; Biagini and Ulmer, 2009). The OpVaR is given by the value at risk for a confidence level of 99.5 percent of the change in operational losses within one period, where Zi

1 is discounted with the risk-free interest rate rf , for i = 2, 3

(SCRi =1 PM,Op

= 0). Hence, the target capital for operational risk SCRi PM,Op

is derived

SCRiPM,Op = VaRα (

e−r f · Zi1 − Zi0 )

, i = 2, 3, (7)

with Zi 0

= V0(Zi1), i = 2, 3. Hence, the total solvency capital requirements SCRiPM,total are given by the sum of BSCRi (Equation (5)) and SCRi

PM,Op (Equation (7)),

SCRi PM,total

= BSCRi + SCRiPM,Op, i = 2, 3.

Third, we calculate the solvency capital requirements with a full internal model, thus also taking into account diversification benefits. The risk-bearing capital RBCi

1 at time

t = 1 is calculated as the difference between Ai 1

and L i 1 , consisting of insured losses

and operational losses, for i = 1, 2, 3. Afterward, the solvency capital requirements SCRi

IM,total are calculated as defined in Equation (4), such that12

SCRi IM,total

= −VaRα (

e−r f · RBCi1 − RBCi0 )

, i = 1, 2, 3. (8)

We further calculate the residual to obtain the implicit operational risk capital charges

SCRi IM,Op

by the difference between the SCRi IM,total

of Equation (8) and the BSCRi of

Equation (5), thus

SCRiIM,Op = SCRiIM,total − BSCRi , i = 1, 2, 3.

Table 2 summarizes the three approaches for deriving solvency capital requirements.

12Note that in Case 1 (“without operational risk”), SCRi =1IM,total = BSCRi =1.

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 693

TABLE 2 Overview of the Three Approaches for Deriving the SCRik,total and SCR

i k,Op (k = SM,

PM, IM) for Cases i = 1, 2, 3 (See Table 1)

Standard Model Partial Internal Model Full Internal Model (k = SM) (k = PM) (k = IM)

BSCRi −VaRα (e −r f · RBCi1,SM − RBCi0,SM) SCRik,total BSCR

i + SCRiSM,Op BSCRi + SCRiPM,Op −VaRα (e −r f · RBCi1 − RBCi0) SCRik,Op 0.3 · BSCRi VaRα (e −r f · Zi1 − Zi0) (SCRiIM,total − BSCRi )∗ ∗Residually derived.

In addition to the SCR, the shortfall probability (SP) is calculated, which is given by

SPi = P (

Ai1 < L i 1

) , i = 1, 2, 3.

NUMERICAL ANALYSIS This section presents numerical results with respect to operational risk measurement and management as well as the impact of operational risk on fair premiums, using empirical parameters from the previous literature. In addition, sensitivity analyses are conducted to identify key risk drivers.

Input Parameters The input parameters are summarized in Table 3. The expected value and the stan- dard deviation of the company’s loss are based on empirical data of a medium-sized German nonlife insurer as presented in Eling, Gatzert, and Schmeiser (2009). Fur- thermore, the expected values and standard deviations for high- and low-risk assets are based on data from representative indices (S&P 500, international government bond indices) following Gatzert and Kellner (2011). The parameters for the lognor- mal distribution of the operational losses as well as the parameter for the frequency of operational losses are also based on empirical data for U.S. insurance companies as presented in Hess (2011b). The parameters for scale and shape of the GPD as well as the quantile q (to determine the threshold u) are adapted from Gourier, Farkas, and Abbate (2009). Furthermore, due to the correlation between the size of opera- tional losses and the firm size, the simulated operational losses have to be adjusted by multiplying the operational losses at time t = 1 with the factor κ to ensure that the operational losses fit with the parameters of the insurance company. As we consider a medium-sized German insurance company in the present analyses, a factor κ of 0.30 is applied (see Selvaggi, 2009). In addition, a truncation point T is integrated that ensures that every single operational loss Xi has a minimum amount; that is, if an operational loss occurs in the time interval [0, t], its amount equals the maximum of the simulated operational loss and the truncation point T. The implementation of a truncation point is necessary due to the fact that in empirical databases (e.g.,

694 THE JOURNAL OF RISK AND INSURANCE

TABLE 3 Input Parameters for the Basic Simulation

Available equity capital at time t = 0 E0 €48 million Parameters for the lognormal distribution of the operational loss μZ1 , σZ1 1.52, 2.26 Scale of the GPD of the operational loss β 0.01 Shape of the GPD of the operational loss ξ 0.89 Quantile of the threshold u for the mixed lognormal GPD q 90% Frequency of operational losses λ 0.15 Truncation point T €0.1 million Adjustment factor of the operational losses κ 0.30 Expected value of the company loss E(S1) €110 million Standard deviation of the company loss σ (S1) €22 million Expected value of high-risk assets E(A1,high) 1.12 Standard deviation of high-risk assets σ (A1,high) 0.23 Expected value of low-risk assets E(A1,low) 1.06 Standard deviation of low-risk assets σ (A1,low) 0.07 Investment in high-risk assets γ 0.25 Expected value of the market portfolio E(rm) 0.08 Standard deviation of the market portfolio σ (rm) 0.04 Market price of risk η 37.50 Kendall’s tau for low-risk and high-risk investment ρτ (Ahigh,Alow) 0.20 Kendall’s tau for high-/low-risk assets and company losses ρτ (A1,S1) 0.10 Kendall’s tau for high-/low-risk assets and operational losses ρτ (Z1,A1) −0.27 Kendall’s tau for operational losses and company losses ρτ (Z1,S1) −0.05 Kendall’s tau for market portfolio and high-/low-risk assets ρτ (rm,A1) 0.20 Kendall’s tau for market portfolio and liabilities ρτ (rm,S1) −0.20 Kendall’s tau for market portfolio and operational losses ρτ (rm,Z1) −0.10 Risk-free interest rate rf 0.02

Algo OpData and SAS OpRisk Global Data), only operational losses over a certain threshold are considered.

When modeling insurance risks, it is important to account for dependence structures between the different processes (see, e.g., Gatzert and Kellner, 2011). Therefore, we explicitly model the dependence between high- and low-risk assets, between the losses resulting from operational risk and assets (high-risk and low-risk, respectively), between the losses resulting from operational risk and the losses resulting from the insurance policies (company losses), as well as between the company losses and the assets (high-risk and low-risk, respectively).13 We thereby apply the concept of

13Kahane and Nye (1975) and Cummins, Lin, and Phillips (2009), for example, show that the correlation parameter between company losses and assets in general depends on the specific insurance line and the investment activities and can either be positive or negative. In this analysis, the correlation between assets and company losses is set to a positive value (for both high- and low-risk assets), but should be empirically calibrated for each individual insurance company.

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 695

the Gauss copula (see McNeil, Frey, and Embrechts, 2005, p. 193).14 To calibrate the Gauss copula, Kendall’s rank correlation ρτ is used due to its invariance against nonlinear transformations. The parameter for the correlation between the high-risk assets (equity) and the losses resulting from operational risk is based on empirical data following Cummins, Lewis, and Wei (2006), where a significant negative stock price response to operational loss events in the U.S. insurance industry is revealed.15

We further assume that there is small negative correlation between the losses resulting from operational risk and the liabilities.16 The parameters for the correlation between the market portfolio and the different relevant risk factors are adopted from Gatzert, Schmeiser, and Toplek (2011). Numerical results are based on Monte Carlo simulation with 500,000 sample paths. In addition, latin hypercube sampling is used to improve the stability of the simulation (see Glasserman, 2010, pp. 236–243).17 The parameters were then subject to sensitivity analyses.

The Impact of Operational Risk on an Insurer’s Pricing, Shortfall Risk, and Solvency Capital Requirements We first consider the three possible cases laid out in Table 1, that is, “without op- erational risk” (Case 1), “with operational risk but not taken into account in basic pricing” (Case 2), and “with operational risk and taken into account in basic pricing” (Case 3). Case 1 serves as the reference case, which can be compared to the other cases to illustrate how an insurer’s risk level may be misestimated if operational risk is not taken into account. Table 4 displays the shortfall probabilities for basic premiums (Part (a)) as well as for fair premiums (Part (b)). When comparing Cases 1 and 2, if the insurer only requires the basic premium without additional loadings, one can observe that the shortfall probability strongly increases from 0.67 percent to 1.54 percent in the presence of operational risk. If operational risk is taken into account in pricing, the basic premium decreases due to a higher default option value,18 which in turn implies a further increase in the shortfall probability to 1.60 percent in Case 3.

14Alternatively, varying dependence structures (e.g., t-copula, Archimedean copula) and non- linear dependencies may be appropriate depending on the concrete setting, as they can have a substantial impact on results (see Ai and Wang, 2012).

15Their estimated correlation coefficient is used in this regard due to a lack of other available information and the correlation between low-risk assets and operational risk is set to the same value. Both numbers should, however, be subject to further empirical analysis, which holds for all correlations in regard to operational risk.

16Similar to the correlation between company losses and assets, the correlation between com- pany losses and operational risk depends on the individual situation of the insurance com- pany and on the aggregation of the different operational risk cells. In the following, this assumption will be subject to a specific sensitivity analysis to study the impact of different correlations between company losses and operational risk.

17We chose a sufficiently high number of sample paths and further implemented latin hypercube sampling to achieve low sample standard errors (e.g., for the basic simulation, the sample standard error of the risk-bearing capital amounts to 0.0341) and ensured that the results remain stable for different sets of random numbers.

18When operational risk is taken into account in basic pricing, the default option max(S1 − ( A1 − L Z1 ), 0) increases and, therefore, L S1 = S1 − max(S1 − ( A1 − L Z1 ), 0) is decreas- ing, which lowers the basic premium.

696 THE JOURNAL OF RISK AND INSURANCE

TABLE 4 Shortfall Probability for Basic and Fair Premiums for Different Assumptions Regarding the Consideration of Operational Risk in Pricing and Risk Measurement (See Table 1)

Case 1 Case 2 (With Case 3 (With (Without Operational Risk but Operational

Operational Not Taken into Account in Risk and Taken Into Risk) Basic Pricing) Account in Basic Pricing)

(a) Basic premium π S1 ,basic

Basic premium π S1 ,basic 117.55 117.55 116.77 Shortfall probability SP 0.67% 1.54% 1.60%

(b) Fair premium π S1 = π S1 ,basic · (1 + δS1 ) Fair loading δS1 –0.6% 0.9% 1.6% Fair premium π S1 116.86 118.63 118.63 Shortfall probability SP 0.70% 1.46% 1.46%

Part (b) in Table 4 displays the shortfall probability if a fair loading is added to the basic premiums that ensures that the situation is fair from the equity holders’ perspective (see Equation (2)). Operational risk is thereby always included in the calculation of the fair loading, but not necessarily in the basic premium. In the setting without operational risk (Case 1), the fair premium is considerably lower as compared to both cases with operational risk (Cases 2 and 3) and also lower than the basic premium. This also implies a slight increase in the shortfall probability from 0.67 percent to 0.70 percent. In the situation with operational risk (Cases 2 and 3), the fair premiums are equal due to the calibration of the fair loading even though the basic premiums differed, as shareholders require a risk-adequate compensation on their initial contribution and thereby account for operational risk. In line with this, the corresponding shortfall risk is equal as well (1.46 percent), which—due to the positive premium loading—is lower than in the case where the insurer only charges the basic premium (1.54 percent and 1.60 percent). Hence, if premiums are calculated fair from shareholders’ perspective, the policyholders are the first to cover the risk of operational losses.

We next study the impact of the assumptions regarding operational risk (Cases 1 to 3) on the insurer’s solvency capital requirements. In Table 5, the SCR are displayed for the basic premiums (Part (a)) and the fair premiums (Part (b)). In Case 1 (without operational risk), no risk charge for operational risk is required and, therefore, the total solvency capital requirements SCRtotal are equal to the BSCR and the three approaches for deriving the SCR coincide. In this Case 1, the SCR for the basic premium are about 51.53 and only slightly higher in case of the fair premium with 51.54 due to the higher shortfall risk (see Table 4).

In the presence of operational risk (Cases 2 and 3), SCR considerably increase for both fair and basic premiums. In Part (a) of Table 5 (basic premium) and Case 2, for instance, it can be seen that when fully accounting for imperfect correlations between risk factors as in the case of the full internal model, diversification benefits between operational risks, insurance risks, and market risks result in a considerable reduc- tion of the SCRtotal as compared to the case of the partial internal model, where no

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 697

TABLE 5 The Impact of Assumptions Regarding the Consideration of Operational Risk in Pricing on Solvency Capital Requirements, Given the Basic and Fair Premiums in Table 4

Case 2 (With Operational Case 3 (With Operational Risk but Not Taken Into Risk and Taken Into

Account in Basic Pricing) Account in Basic Pricing)

Case 1 Partial Full Partial Full (Without Standard Internal Internal Standard Internal Internal

Operational Risk) Model Model Model Model Model Model

(a) Basic premium π S1 ,basic

BSCR 51.53 51.53 51.53 (51.53) 51.54 51.54 (51.54) SCROp 0 15.46 76.06 27.40

∗ 15.46 76.06 27.42∗

SCRtotal 51.53 66.99 127.59 78.93 67.00 127.60 78.96

(b) Fair premium π S1 = π S1 ,basic · (1 + δS1 ) BSCR 51.54 51.55 51.55 (51.55) 51.55 51.55 (51.55) SCROp 0 15.47 76.06 27.43

∗ 15.47 76.06 27.43∗

SCRtotal 51.54 67.02 127.61 78.98 67.02 127.61 78.98

∗Residually derived as SCRIM,Op = SCRIM,total – BSCR.

diversification benefits are taken into account. In addition, diversification effects also imply that the SCRtotal is closer to the one of the standard model. This diversification benefit amounts to 38.1 percent in both Cases 2 and 3, as the SCRtotal is reduced from 127.59 to 78.93 in Case 2 and from 127.60 to 78.96 in Case 3, respectively.

In Part (b) of Table 5, solvency capital requirements are displayed for fair premiums and show very similar results as in the case of the basic premium in Part (a). In addition, when premiums are calculated fair from the shareholders’ perspective, the solvency capital requirements are equal in Cases 2 and 3 due to the fair calculation of the premium loading δ S1 (see Table 4). Thus, fair pricing (using a fair loading) or the consideration of operational risk in basic pricing (Case 3) does not considerably impact the SCR, which is mainly due to the low overall shortfall probabilities in the present setting.

However, this changes when looking at a setting with higher operational risk as shown in Figure 2, where the shortfall probabilities are displayed (right column) for basic premiums (upper left graph) and for fair premiums (lower left graph) for varying operational loss intensities λ. If the insurer does not impose a fair loading (upper row), the basic premium is decreasing in Case 3 for an increasing operational loss intensity λ as operational risk is considered in basic pricing, which increases the default risk and thus lowers the basic premium (see also Table 4). Therefore, the shortfall probability is increasing faster than in Case 2, where operational risk is not included in pricing, implying that the basic premium remains unchanged even if the operational loss intensity λ increases. Thus, if premiums are calculated without a fair loading (which accounts for operational risk), pricing assumptions regarding the basic premium can in fact substantially impact an insurer’s risk situation. In contrast, if premiums are calculated fair from the shareholders’

698 THE JOURNAL OF RISK AND INSURANCE

FIGURE 2 Premiums (Basic and Fair) and Corresponding Shortfall Probabilities for Different As- sumptions Regarding the Consideration of Operational Risk in Pricing (Cases 1–3; see Table 1) for Varying Operational Loss Intensities λ

Basic premiums for varying operational loss intensity λ

0.05 0.25 0.45 0.65 0.85 1.05 λ

100

105

110

115

120

125

130

Basic premium (Case 1) Basic premium (Case 2) Basic premium (Case 3)

Corresponding shortfall probabilities for basic premiums

0.05 0.25 0.45 0.65 0.85 1.05 λ

9% Shortfall probability (Case 1) Shortfall probability (Case 2) Shortfall probability (Case 3)

Fair premiums for varying operational loss intensity λ

0.05 0.25 0.45 0.65 0.85 1.05 λ

100

105

110

115

120

125

130

Fair premium (Case 1) Fair premium (Case 2) Fair premium (Case 3)

Corresponding shortfall probabilities for fair premiums

0.05 0.25 0.45 0.65 0.85 1.05 λ

9% Shortfall probability (Case 1) Shortfall probability (Case 2) Shortfall probability (Case 3)

Notes: Case 1 = without operational risk, Case 2 = with operational risk but not taken into account in basic pricing, Case 3 = with operational risk and taken into account in ba- sic pricing, basic premium π

S1 ,basic i = V0(L S,i1 ) = e −r f · [E (L S,i1 ) − η · cov(L S,i1 , rm)], fair premium

π S1 = π S1 ,basic · (1 + δS1 ).

perspective (bottom row), the premium loading adjusts the basic premium for the higher number of operational losses, such that the policyholders carry the higher op- erational risk. Hence, the fair premiums are increasing for higher loss intensities and are equal for Cases 2 and 3 (see also Table 4), thus also implying the same shortfall probability.

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 699

As solvency capital requirements do not considerably differ in Cases 2 and 3, we now only focus on Case 3, where operational risk is taken into account in basic pricing, and further assume that the insurer imposes a fair premium loading. Figure 3 exhibits results of a sensitivity analysis regarding the SCRtotal for varying relevant parameters, including the frequency λ of operational losses, the correlation between company losses and operational losses ρτ (Z1,S1), and the expected company losses E(S1).

In the upper left graph in Figure 3, the basic and the fair premiums are displayed for an increasing frequency λ (see also Figure 2), and the upper right graph shows the corresponding SCR for the standard model, the partial internal model, and the full internal model. Here, the BSCR is constant and equal for all three approaches, as operational risk is not taken into account when deriving the BSCR (see Equation (5)). This also implies that in case of the standard model, SCRSM,Op is constant as well due to the derivation by means of the risk-based factor (SCRSM,Op = 0.3 BSCR). Thus, the total SCR in case of the standard model does not change if the operational loss intensity is increasing.

Compared to the standard model, the SCR for operational risk derived by the partial internal model and the full internal model are increasing for an increasing opera- tional loss intensity λ, where SCRPM,Op is increasing faster than SCRIM,Op due to the nonconsideration of diversification benefits. Only for very low values of λ does the standard model require more capital for operational risk than the full internal model and thus generally appears to underestimate operational risk (depending on the individual firm’s operational risk). In contrast, the partial internal model tends to overestimate operational risk, since it does not account for diversification effects between risk factors.

In regard to the correlation between company losses and operational losses ρτ (Z1,S1) it can be seen from the second row in Figure 3 that for varying correlations, the basic premiums and the fair premiums are slightly decreasing. As in the first row of Figure 3, the BSCR and SCRSM,Op remain constant. Furthermore, the same holds true for the SCRPM,Op for operational risk derived by the partial internal model, since the calculation of the OpVaR does not account for dependencies between operational losses and company losses (see Equation (7)). The full internal model, in contrast, fully accounts for dependencies and diversification benefits, such that SCRIM,Op decreases for lower correlations ρτ (Z1, S1). When varying the expected company losses E(S1) (lower graph in Figure 3), the basic and fair premiums are increasing linearly for an increasing E(S1). In the lower right graph in Figure 3 it can be seen that the BSCR and the SCRSM,Op are also linearly increasing due to the increasing E(S1) and since the solvency capital requirements for the operational risk in the standard model are calculated by the factor 0.3 of the BSCR. In case of the partial internal model, SCRPM,Op remains constant as it is based on the OpVaR only, which does not depend on the company’s losses. When looking at the SCRIM,Op, we again observe that this is decreasing for an increasing E(S1) due to diversification effects, thus implying only a slight increase in the total solvency capital requirements.

Finally, we study the impact of the asset allocation on the fair premium, shortfall probability and SCR as displayed in Figure 4 by varying the fraction γ of high-risk assets. The results show that if γ is increasing, the fair premium and the shortfall

700 THE JOURNAL OF RISK AND INSURANCE

FIGURE 3 Fair Premiums and Corresponding SCR for Varying Parameters for Case 3 (With Op- erational Risk and Taken Into Account in Basic Pricing)

Premiums for varying operational loss intensity λ

0.05 0.25 0.45 0.65 0.85 1.05 λ

ρτ

100

105

110

115

120

125

130

0.05 0.25 0.45 0.65 0.85 1.05

S C R for varying operational loss intensity λ

100

200

300

400

500

Premiums for varying the correlation (Z1 ,S1 )

-0.3 -0.2 -0.1 0.0 0.1 0.2 (Z 1,S 1)

115

116

117

118

119

120

-0.3 -0.2 -0.1 0.05 0.15

S C R for varying the correlation (Z 1, S 1)

100

120

140

(Z 1, S 1)

Premiums for varying the mean of the company losses E (S 1)

55 77 99 121 143 165 E (S 1)

110

130

150

170

190

55 77 99 121 143 165

S C R for varying the mean of the company losses E (S 1)

100

120

140

160

180

E (S 1)

Basic premium Fair premium S C R S M ,O p SC R P M ,O p SC R I M, O p* BS C R

ρτ

ρτ ρτ

∗Residually derived as SCRIM,Op = SCRIM,total – BSCR.

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 701

FI G

U R E

4 Fa

ir Pr

em iu

m s,

Sh or

tfa ll

Pr ob

ab ili

tie s,

an d

C or

re sp

on di

ng SC

R O p

fo r

Va ry

in g

th e

Fr ac

tio n

γ of

H ig

h- Ri

sk A

ss et

s fo

r C

as e

3 (W

ith O

pe ra

tio na

lR is

k an

d Ta

ke n

In to

A cc

ou nt

in Ba

si c

Pr ic

in g)

F a

ir p

re m

iu m

s f

o r

va ry

in g t h e

f ra

c tio

n γ

o f

h ig

h -r

is k

a s s e

0 0

.1 0

.2 0

.3 0

.4 0

.5 0

.6 0

.7 0

.8 0

.9 1

1 1

1 2

S P

f o

r va

ry in

g t h e

f ra

c tio

n γ

o f

h ig

h -r

is k

a s s e

0 0

.1 0

.2 0

.3 0

.4 0

.5 0

.6 0

.7 0

.8 0

.9 1

0 %

1 %

2 %

3 %

4 %

S C

R O

p f

o r

va ry

in g t h e

f ra

c tio

o f

h ig

h -r

is k

a s s e

0 0

.1 0

.2 0

.3 0

.4 0

.5 0

.6 0

.7 0

.8 0

.9 1

01 0

2 0

3 0

4 0

5 0

6 0

7 0

8 0

F a

ir p

re m

iu m

S h o

rt fa

ll p ro

b a

b ili

ty S

C R

S M

,O p

S C

R P

M ,O

p S

C R

IM ,O

p *

∗ R e si

d u

a ll

y d

e ri

v e d

a s

S C

R IM

,O p

= S

C R

IM ,t

o ta

l −

B S

C R

702 THE JOURNAL OF RISK AND INSURANCE

probability increase. With respect to the SCROp, the right graph in Figure 4 illustrates that in case of the partial internal model, the SCRPM,Op is again constant as assets do not impact the OpVaR. In case of the standard model, SCRSM,Op stays almost constant until γ reaches about 0.6 and then increases, similar to the development of the shortfall probability. In comparison to this, SCRIM,Op is slightly increasing for a γ smaller than 0.6 and then decreasing if γ is higher than this value. Thus, the development of SCRIM,Op is opposed to the one observed in case of the Solvency II standard formula. Hence, these results again emphasize the diversification benefits that arise due to imperfect correlations between assets and operational risks. One can also observe that, as in Figure 3, the standard model may underestimate operational risk and that the partial internal model overestimates it due to the nonconsideration of diversification benefits, which are taken into account in case of the full internal model.

IMPLICATIONS AND FURTHER CONSIDERATIONS IN REGARD TO MEASURING AND MANAGING OPERATIONAL RISKS The previous analyses emphasized the importance of adequately taking into account operational risk when assessing an insurer’s risk and solvency situation, thereby us- ing an aggregate view of operational risk without distinguishing between different risk cells. Hence, in practice, two additional central aspects must be taken into ac- count. First, the total operational risk of an insurer is typically given by aggregating dependent losses of all risk cells. Therefore, frequency dependence and severity de- pendence between the different risk cells have to be considered when calculating the solvency capital requirements for the operational risk of an insurance company (see, e.g., Böcker and Klüppelberg, 2008). Hence, an accurate framework for modeling de- pendent risk cells for operational risk is indispensable. Furthermore, in the present setting, extreme value theory is used and, therefore, the GPD has to be estimated for independent and identically distributed losses. In addition, an adequate thresh- old must be chosen. This involves a trade-off between choosing a higher threshold (which improves the approximation of the excess distribution function) and choosing a lower threshold (which reduces the amount of data available for estimating the GPD, but in turn increases the standard errors of the GPD’s estimates) (see McNeil, 1999). Second, the model needs to be adequately calibrated, which requires sufficient loss data as the basis of risk measurement and risk management (see Kalhoff and Haas, 2004), which is also vital for an adequate estimation of the correlation structure among different risk cells (see Haas and Kaiser, 2004). Here, in principle two different sources of operational loss data are available, internal and external loss data. The cre- ation of an internal database over time thereby provides a more reliable assessment of an individual insurer’s operational loss events if the data set becomes sufficiently large. However, internal operational loss data is often limited as operational risk includes human errors and, thus, the willingness of employees to inform about oper- ational loss events will be one crucial success factor to create an internal database (see Kalhoff and Haas, 2004).19 Hence, the quantification of solvency capital requirements for operational risk remains a challenge for many insurers, also and especially due

19Even though large operational losses should typically be known by the management, the successful creation of an internal database depends on the cooperativeness of the employees to pass on the required information. According to Kalhoff and Haas (2004), a number of

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 703

to the small sample size of internal operational loss events, which is why external databases can be integrated to gather additional loss information and to obtain a more accurate picture of operational risk. External databases are either available from providers (e.g., Algo OpData and SAS OpRisk Global Data) or consortia of insurers,20

which must then be adapted to the size of the individual insurance company and the size of internal operational loss events (see Selvaggi, 2009). However, the occurrence of high severity operational loss events is often kept confidential. Therefore, loss data is typically biased toward low-severity losses, and the true frequency of operational loss events is underestimated due to unreported large losses.

Besides measuring operational risk, one major issue is its management, which in- cludes prevention and insurance. Methods of preventing operational losses mainly comprise the monitoring and optimization of processes as well as the initialization of training for the employees and business continuity management. However, these methods only influence the probability of operational losses, but not the magnitude of single operational loss events (see Auer, 2008, pp. 138–141). The amount of op- erational losses-–especially for risks with low frequency and high severity-–can be reduced by developing emergency plans, for instance. Furthermore, a variety of in- surance products against operational losses is available that are typically linked to the event type, as there is no coverage for operational risk in general. For example, insurance against natural hazards is available for the risk type “damage to physical assets,” fidelity insurance for “internal and external fraud,” errors and omissions insurance for “clients, products & business practice,” or loss of profits insurance for the event type “business disruption & system failures” (see Cruz, 2002, pp. 258–259; Auer, 2008, pp. 149–150). In addition, large industrial firms (e.g., ThyssenKrupp) have recently expressed the need for insurance against “cyber-attacks,” for example, sabo- tage of manufacturing facilities, which is currently not available and can be classified in the event types “external fraud” and “business disruption & system failures.” As an alternative to traditional reinsurance, operational risk can be mitigated by issuing insurance-linked securities such as cat bonds, or by means of insurance derivatives. However, at least under Basel II, these risk transfers are not accepted to reduce the solvency capital requirements (see Auer, 2008, p. 141). In addition, when transfer- ring operational risk, the recognition of insurance mitigation in the calculation of the solvency capital requirements under Basel II/III is limited to 20 percent of the total operational risk capital charge (see Basel Committee, 2004, p. 148), a rule that according to Hess (2009) may also be implemented in Solvency II.

Although taking preventive action and purchasing insurance against operational risk reduces the risk of monetary losses due to operational risk events,21 there is a considerable reputational risk associated with these events. In particular, although

companies in their study tried to motivate their employees to relay the required data through positive and negative incentive systems. However, this method still did not fully solve the problem of ensuring the transmission of information (see Kalhoff and Haas, 2004).

20For example, ORIC, which was launched by the Association of British Insurers in 2005 as a response to new regulations of the UK Financial Services Authority (FSA) and Solvency II.

21As the premium of insurance typically exceeds the expected operational losses, transferring risk through insurance generally does not reduce the expected losses, but it helps stabilize losses over time, thus reducing risk.

704 THE JOURNAL OF RISK AND INSURANCE

reputational risk is explicitly excluded in the definition of operational risk, the reputa- tion of an insurance company can be damaged as a consequence of operational losses (see de Fontnouvelle et al., 2006; Kamiya, Schmit, and Rosenberg, 2011). Results in a study by Fiordelisi, Soana, and Schwizer (2011), for example, indicate that substantial reputational losses follow after operational loss events and that the highest reputa- tional damage is caused by the operational risk type “fraud.” Moreover, Cummins, Lewis, and Wei (2006) show that after an operational loss event, the decrease in market value of banks and insurers is even higher than the pure operational loss amount. The studies of Gillet, Hübner, and Plunus (2010) and Perry and de Fontnouvelle (2005) also illustrate that at least for the event type “internal fraud,” the loss in market value is greater than the operational loss announced. Hence, especially for companies whose activities are based on trust such as banks and insurers, reputation is a key asset and, thus, prevention in regard to operational risk and especially with respect to fraud is vital (see Fiordelisi, Soana, and Schwizer, 2011). In addition, new insurance products that provide coverage for reputational losses are now offered in the market. For in- stance, insurance policies by Munich Re and Zurich cover profit setbacks caused by reputational damages up to €150 million, while Allianz developed a new product that covers the costs of communication in terms of press work, advertisement, and media monitoring, after a reputational loss event up to €10 million (see Höpner, 2012). Furthermore, as legal risks are included in the definition of operational risk under Solvency II, operational risk depends also on the country and the individual situation of the insurance company. Therefore, operational risk measurement and management should be integrated in an enterprise risk management framework that accounts for all relevant factors and dependencies as well as insurance and prevention, which can imply a positive impact on firm value (see Hoyt and Liebenberg, 2011).

CONCLUSION This article examined the impact of operational risk on fair premiums and solvency capital requirements under Solvency II. Three different approaches were used for the latter, including a full internal model and a partial internal model that only focuses on the OpVaR, that is, without taking into account diversification effects. These were compared to the Solvency II standard model that uses a risk-based factor to derive capital requirements for operational risk.

The results showed that the presence of operational risk in general does not consid- erably impact fair premiums (fair from the shareholders’ perspective) if the insurer’s safety level is sufficiently high. However, this observation changed for higher opera- tional loss intensities, where neglecting operational risk in pricing severely impacted an insurer’s shortfall risk if premiums were not calculated in a fair way.

Regarding solvency capital requirements, we found that the internal model consid- ered in this article led to similar results as the Solvency II standard formula as long as the operational loss intensity was not too high. This is a consequence of the diversi- fication benefits taken into account in case of the internal model that arise due to im- perfect correlations between operational risks, insurance risks, and market risks. For increasing operational loss intensities, however, the standard model clearly tended to underestimate risk as capital requirements are calculated based on the fixed factor 0.3 of the basic solvency capital requirements (which do not include operational risk).

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 705

Hence, both the standard model and the partial internal model are not able to reflect diversification benefits due to imperfect correlations between operational losses and insured losses. Although the solvency capital requirements derived by the Solvency II standard formula and the partial internal model thus remain constant for decreasing correlations between operational losses and insured losses, the SCR derived by the full internal model decreases due to an increasing diversification benefit. The same holds true when varying the expected company losses and the fraction invested in low-risk assets, which emphasizes the potential for diversification benefits that arise due to imperfect correlations between assets, company losses and operational risks.

Since diversification benefits are not taken into account in case of the partial internal model, which derives the OpVaR separately, solvency capital requirements are gener- ally overestimated in this case. One way to reduce monetary losses from operational risk is (re-)insurance, which, however, is only available for specific event types and not for operational risk in general. Furthermore, the integration of supplementary prevention methods in addition to reinsurance is vital to reduce the probability and magnitude of operational losses, as operational loss events can cause severe rep- utational damage, which can even worsen an insurer’s solvency situation beyond the operational loss amount and considerably reduce market values. Operational risk should thus be measured and managed in the context of a holistic enterprise risk management system with an internal risk-sensitive approach that accounts for dependencies between risk factors and additionally includes specific insurance and prevention programs. This is also relevant in the context of insurers’ Own Risk and Solvency Assessment (ORSA) as required according to Solvency II’s Pillar 2 and the NAIC in the United States. Among other aspects, future research could focus on an (empirical and theoretical) analysis of the impact of operational risk (e.g., concentra- tions on the balance sheet) and correlations between operational risks and the risk profile of other assets and/or liabilities on pricing, risk management, and capital budgeting decisions in general using, for example, a multifactor model as proposed by Froot (2007).

REFERENCES Ai, J., and T. Wang, 2012, Optimal Capital Budgeting and Risk Management With

Shared and Dependent Risks, Working Paper, University of Hawaii, Colorado State University.

Altenähr, V., 2010, Risiken im Vertrieb oft Unterschätzt, Versicherungswirtschaft, 14: 1034.

Auer, M., 2008, Operationelles Risikomanagement bei Finanzinstituten (Weinheim, Ger- many: Wiley-VCH Verlag GmbH & Co.).

Balkema, A. A., and L. de Haan, 1974, Residual Life Time at Great Age, Annals of Probability, 2(5): 792-804.

Basel Committee, 2004, International Convergence of Capital Measurement and Capital Standards: A Revised Framework, Basel, Switzerland. World Wide Web: http://www.bis.org/publ/ bcbs107.htm (accessed December 9, 2011).

Biagini, F., and S. Ulmer, 2009, Asymptotics for Operational Risk Quantified With Expected Shortfall, ASTIN Bulletin, 39(2): 735-752.

706 THE JOURNAL OF RISK AND INSURANCE

Blanchard, R., 2012, The Latest on ORSA, The Actuarial Review, 39(3): 29-31.

Böcker, K., and C. Klüppelberg, 2005, Operational VaR: A Closed-Form Solution, RISK Magazine, 18(12): 90-93.

Böcker, K., and C. Klüppelberg, 2008, Modelling and Measuring Multivariate Oper- ational Risk With Lévy Copulas, Journal of Operational Risk, 3(2): 3-28.

Cruz, M. G., 2002, Modeling, Measuring and Hedging Operational Risk (Chichester: John Wiley & Sons Ltd.).

Cummins, J. D., C. M. Lewis, and R. Wei, 2006, The Market Value Impact of Opera- tional Loss Events for US Banks and Insurers, Journal of Banking and Finance, 30(10): 2605-2634.

Cummins, J. D., Y. Lin, and R. D. Phillips, 2009, The Pricing of Financially Interme- diated Risks: Evidence From the Property-Liability Insurance Industry, Working Paper, Temple University, University of Nebraska, Georgia State University.

Cummins, J. D., R. Wei, and X. Xie, 2011, Financial Sector Integration and Information Spillovers: Effects of Operational Risk Events on U.S. Banks and Insurer, Working paper, Temple University, Philadelphia.

de Fontnouvelle, P., V. DeJesus-Rueff, J. Jordan, and E. Rosengren, 2003, Using Loss Data to Quantify Operational Risk, Working paper, Federal Reserve Bank of Boston, Boston, MA.

de Fontnouvelle, P., V. DeJesus-Rueff, J. Jordan, and E. Rosengren, 2006, Capital and Risk: New Evidence on Implications of Large Operational Losses, Journal of Money, Credit, and Banking, 38(7): 1819-1846.

Doherty, N. A., and J. R. Garven, 1986, Price Regulation in Property-Liability Insurance: A Contingent-Claims Approach, Journal of Finance, 41(5): 1031- 1050.

Dutta, K., and J. Perry, 2006, A Tale of Tails: An Empirical Analysis of Loss Distribution Models for Estimating Operational Risk Capital, Working paper, Federal Reserve Bank of Boston.

Ebnöther, S., P. Vanini, A. McNeil, and P. Antolinez-Fehr, 2003, Operational Risk: A Practitioner’s Point of View, Journal of Risk, 5(3): 1-16.

Eling, M., N. Gatzert, and H. Schmeiser, 2009, Minimum Standards for Investment Performance: A New Perspective on Non-Life Insurer Solvency, Insurance: Mathe- matics and Economics, 45(1): 113-122.

European Insurance and Occupational Pensions Authority (EIOPA), 2010, QIS5 Tech- nical Specifications, European Commission, Brussels.

European Parliament and the Council, 2009, Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the Taking-up and Pursuit of the Business of Insurance and Reinsurance (Solvency II).

Fiordelisi, F., M. G. Soana, and P. Schwizer, 2011, Reputational Losses and Operational Risk in Banking, Working paper, University of Rome III, Rome, Italy.

Frachot, A., T. Roncalli, and E. Salomon, 2004, The Correlation Problem in Operational Risk, Working paper, Groupe de Recherche Opérationelle, Group Risk Management, Crédit Agricole SA, France.

RISK MEASUREMENT AND MANAGEMENT OF OPERATIONAL RISK IN INSURANCE COMPANIES 707

Froot, K. A., 2007, Risk Management, Capital Budgeting, and Capital Structure Policy for Insurers and Reinsurers, Journal of Risk and Insurance, 74(2): 273-299.

Froot, K. A., and J. C. Stein, 1998, Risk Management, Capital Budgeting, and Cap- ital Structure Policy for Financial Institutions: An Integrated Approach, Journal of Financial Economics, 47(1998): 55-82.

Gatzert, N., and R. Kellner, 2011, The Influence of Non-Linear Dependencies on the Basis Risk of Industry Loss Warranties, Insurance: Mathematics and Economics, 49(1): 132-144.

Gatzert, N., and H. Schmeiser, 2008, Combining Fair Pricing and Capital Require- ments for Non-Life Insurance Companies, Journal of Banking & Finance, 32(12): 2589- 2596.

Gatzert, N., H. Schmeiser, and D. Toplek, 2011, An Analysis of Pricing and Basis Risk for Industry Loss Warranties, Zeitschrift für die gesamte Versicherungswissenschaft, 100(4): 517-537.

Gesamtverband der Deutschen Versicherungswirtschaft e. V. (GDV), 2007, Opera- tionale Risiken unter Solvency II aus Sicht der Deutschen Versicherungswirtschaft und Versicherungsaufsicht, Berlin.

Gillet, R, G. Hübner, and S. Plunus, 2010, Operational Risk and Reputation in the Financial Industry, Journal of Banking and Finance, 34(1): 224-235.

Glasserman, P., 2010, Monte Carlo Methods in Financial Engineering (New York: Springer Press New York Inc.).

Gourier, E., W. Farkas, and D. Abbate, 2009, Operational Risk Quantification Using Extreme Value Theory and Copulas: From Theory to Practice, Journal of Operational Risk, 4(3): 1-24.

Gründl, H., and H. Schmeiser, 2002, Pricing Double-Trigger Reinsurance Contracts: Financial Versus Actuarial Approach, Journal of Risk and Insurance, 69(4): 449-468.

Haas, M., and T. Kaiser, 2004, Tackling the Insufficiency of Loss Data for the Quantifi- cation of Operational Risk, in: M. Cruz, ed., Operational Risk Modelling and Analysis (London, England: Risk Books).

Hess, C., 2009, Quantifizierung Operationeller Risiken von Versicherungsun- ternehmen unter Verwendung des Loss Distribution Approach: Extremwerttheorie vs. G&H-Verteilung, Mannheim Working Paper Series on Risk Theory, Portfolio Management and Insurance 175.

Hess, C., 2011a, The Impact of the Financial Crisis on Operational Risk in the Financial Services Industry: Empirical Evidence, Journal of Operational Risk, 6(1): 23-35.

Hess, C., 2011b, Can the Single-Loss Approximation Method Compete With the Stan- dard Monte Carlo Simulation Technique? Journal of Operational Risk, 6(2): 31-43.

Hiebl, K., D. Roedenbeck, S. Kiefer, 2012, Kosten durch Aktives Betrugsmanagement Senken, Versicherungswirtschaft, 5: 356-358.

Höpner, A, 2012, Versichern gegen den Imageknacks. Handelsblatt Online. World Wide Web: http://www.handelsblatt.com (accessed October 16, 2012).

Hoyt, R. E., and A. P. Liebenberg, 2011, The Value of Enterprise Risk Management, Journal of Risk and Insurance, 78(4): 795-822.

708 THE JOURNAL OF RISK AND INSURANCE

Kahane, Y., and D. Nye, 1975, A Portfolio Approach to the Property-Liability Insurance Industry, Journal of Risk and Insurance, 42(4), 579-598.

Kalhoff, A., and M. Haas, 2004, Operational Risk—Management Based on the Current Loss Data Situation, in: M. Cruz, ed., Operational Risk Modelling and Analysis (London, England: Risk Books).

Kamiya, S., J. Schmit, and M. Rosenberg, 2011, Determinants of Insurers’ Reputational Risk From Actuarial Standpoint, Working paper, Nanyang Technological Univer- sity, University of Wisconsin-Madison.

McNeil, A., 1999, Extreme Value Theory for Risk Managers, Internal Modeling and CAD II, 93-113.

McNeil, A., R. Frey, and P. Embrechts, 2005, Quantitative Risk Management (Princeton, NJ: Princeton University Press).

Mittnik, S., S. Paterlini, and T. Yener, 2011, Operational-Risk Dependencies and the Determination of Risk Capital, Working paper, Center for Quantitative Risk Anal- ysis, Department of Statistics, University of Munich.

Moscadelli, M., 2004, The Modelling of Operational Risk: Experience With the Anal- ysis of the Data Collected by the Basel Committee, Temi di discussione (Economic Working Papers) 517, Bank of Italy, Economic Research Department.

National Association of Insurance Commissioners (NAIC), 2011, NAIC Own Risk and Solvency Assessment (ORSA) Guidance Manual. World Wide Web: http://www.naic.org (accessed September 10, 2012).

Perry, J., and P. de Fontnouvelle, 2005, Measuring Reputational Risk: The Market Reaction to Operational Loss Announcements, Working paper, Federal Reserve Bank of Boston, Boston, MA.

Peters, G. W., A. D. Byrnes, and P. V. Shevchenko, 2011, Impact of Insurance for Oper- ational Risk: Is It Worthwhile to Insure or be Insured for Severe Losses? Insurance: Mathematics and Economics, 48(2): 287-303.

Pickands, J., 1975, Statistical Inference Using Extreme Order Statistics, Annals of Statis- tics 3(1): 119-131.

PricewaterhouseCoopers (PwC), 2012, NAIC Meeting Notes: NAIC 2012 Summer National Meeting. World Wide Web: http://www.pwc.com/us/en/insurance (ac- cessed September 10, 2012).

Selvaggi, M., 2009, Analysing Operational Losses in Insurance: Evidence on the Need for Scaling From the ORIC R© Database, ABI Research Paper 16.

Shevchenko, P. V., 2010, Calculation of Aggregate Loss Distributions, Journal of Oper- ational Risk, 5(2): 3-40.

Vaughan, T. M., 2009, The Implications of Solvency II for U.S.: Insurance Regulation, Working paper, Networks Financial Institute Policy Brief No. 2009-PB-03, Indiana State University.

Wicklund, D., and G. Christopher, 2012, The New Rules of Risk: The NAIC Leans Toward Having Insurers Use Solvency II-Inspired ORSA Guidelines to Manage Capital, Best’s Review, 112(11): 65-67.

Copyright of Journal of Risk & Insurance is the property of Wiley-Blackwell and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.