on

c ial instituti
al finan sion pa
nel
in t er nation dis cus
in an rends’
ta ing risk ‘mega t
Big da erational M a na g
olution
s ho sts
percep
tions
p S g
se for o ment Ris k a ng in te;
The ca Aon k ing: Ch ifa upda
nage ba n ion ; F
risk ma Islami c
nipulat
s: M arket ma case
New king
gan hac
JPMor

e mask
hind th
Be
apers
e Pan ama P
ed from th
016 s learn
June 2 Lesson

Cover 54 FINAL.indd 1 15/06/2016 15:58

 016
June 2

07 24

04 EDITOR’S LETTER 24 MANAGING RISK IN AN

Let’s get one thing clear INTERNATIONAL FINANCIAL
Will transparency ever really prevail in global INSTITUTION
business, or is it simply an inevitable In a departure from our usual opinion column
operational risk, asks editor Carrie Cook. format, we asked a panel of IFI risk managers
to share their opinions on the differences in
05 NEWS ANALYSIS practices and risks between IFIs and
Analysis of the major risk-related news commercial banks.
stories of the past few weeks, including the
latest on the Fifa scandal, an update on the
30 AON RISK SOLUTIONS HOSTS
JPMorgan hacking case and more market ‘MEGA TRENDS’ DISCUSSION PANEL
manipulation. Carrie Cook reports from Aon Risk
Solutions’ recent panel event which brought
10 SPOTLIGHT together industry leaders to discuss
Behind the mask: lessons learned current and future trends on the risk
from the Panama Papers management agenda.
Bribery and corruption expert, Alexandra
Wrage, shares her views on what
34 DATA CLASSIFICATION
organisations can learn from the Panama Tax non-compliance or tax
34
Papers scandal and how we can move violations – clients and customers
towards greater transparency. In light of recent tax evasion scandals,
RiskBusiness’ Mike Finlay takes a look at its
REGULATORY UPDATE DON’T MISS OUT potential impact on firms.
16 ON RECEIVING
An update on recent regulatory
developments, including FINRA’s plans to THE NEXT ISSUE OF ISLAMIC FINANCE:
38
tackle culture issues and new foreign THE RISK UNIVERSE STRENGTHENING CORPORATE
exchange market rules. GOVERNANCE PRACTICES
MENA consultant Lina Tayara discusses the
18 BIG DATA AND FINANCIAL RISK: findings of the Orient Consulting Services
THE CASE FOR OPERATIONAL RISK Islamic Finance Survey.
MANAGEMENT
What does the future look like for
39 DEAR CEO
operational risk measurement and Every month, an anonymous senior
management as big data becomes an executive of a financial services firm writes a
increasingly important industry tool? letter to the CEO about concerns they have
Alfredo B. Roisenzvit reports. always wanted to raise.

June 2016 The Risk Universe 3

Contents June FINAL.indd 3 15/06/2016 13:59

 Risk expert Alfredo inancial risk management in
B. Roisenzvit shares general and operational risk
his thoughts on what management in particular, have
been based on the traditional
the future looks like
use of historical data for the
for operational risk construction of predictive and behavioural
measurement and models, to measure risk exposure and
management as big data calculate economic capital. According to
becomes an increasingly the Basel Committee, operational risk is the
important industry tool “risk of loss resulting from inadequate or
failed processes, people and systems, or
from external events”. The use of big data
is still quite novel in this field and there is
huge potential; although we can see how the
initial applications of big data have begun to
show some very interesting results, there is
surely more to come. In particular, the main
impediment for traditional operational risk
measurement can be overcome by the new
paradigm brought about by big data: lack
of information may no longer be an issue.
Furthermore, new modelling techniques
based on big data may show us a better way
to manage operational risk.
This article is divided into two sections.
Firstly, I will briefly review what the state of
the art is with regards to big data applications
for operational risk management. Following
Virtually all of the available literature agrees
big data applications are incipient in the field
of risk management, but at the same time,
they also agree that big data is the future
18 The Risk Universe June 2016
Data FINAL.indd 18
this, I will propose some novel applications
for big data, based on current literature
and research.
Though there are thousands of articles,
peer-reviewed papers and books on the
subject of operational risk measurement and
modelling, there is not extensive literature
on the application of big data to operational
risk. There is, however, a broader applicable
set of literature in the field of risk
management in general, where the key
aspects of operational risk are discussed and
evaluated. Most of the more current papers
are either industry surveys, or recollections
of business practices, typically undertaken
by commercial vendors, but not without
technical rigor. Surveys are useful for
gauging the application of big data tools
within the industry and technical papers
produced by vendors can help inform
projections of what the future may hold.
After more extensive research, I was also
able to find some peer-reviewed articles
in renowned journals that directly – or
sometimes indirectly – touch on the more
specific aspects of operational risk
modelling where big data can be used.
It is worth mentioning at this point that
virtually all of the available literature agrees
big data applications are incipient in the
field of risk management, but at the same
time, they also agree that big data is the
future of risk management and that it is
catching on at a remarkable speed. As we
can see in Figure 1, the span of its
15/06/2016 12:42
 Big data

FIGURE 1: BIG DATA OFFERS SIGNIFICANT OPPORTUNITIES application to the risk management field is
IN MOST RISK DOMAINS considerable. If we combine operational and
Impact of big data on risk management and decision-making compliance risk, which are by definition
affected by similar risk drivers, we have an
Risk Area Volume Velocity Variety Veracity even wider span.
Big data is a path many financial
Credit Risk institutions have already chosen. With
this in mind, the Economist Intelligence
Market Risk Unit surveyed 208 risk management and
compliance executives at retail banks (29%),
Operational Risk commercial banks (43%) and investment
banks (28%) in 55 countries on six
Compliance Risk continents about how and why they are
using big data. The results demonstrated
Asset-Liability Risk Management
growing numbers of bankers embracing the
Integrated Risk Management concept, but many “still face challenges in
applying the results to delivering superior ➔

June 2016 The Risk Universe 19

Data FINAL.indd 19 15/06/2016 12:43

 Big data

FIGURE 2: WHAT IS YOUR ORGANISATION USING NOW AND WHAT DO

YOU EXPECT IN THREE YEARS?
% of all respondents
Now In 3 years

Comprehensive data on the organisation’s

risk profile routinely provided to the board 81 15
and senior executives

Basic big data tools to integrate,

manipulate and access structured and 42 47
unstructured data

Advanced big data tools such as predictive

analytics and data visualization 41 44

Source: Economist Intelligence Unit survey, July, 2014.

FIGURE 3: WHICH OF THE FOLLOWING RISK MANAGEMENT

ACTIVITIES HAS BIG DATA BEEN MOST SUCCESSFUL?
% of all respondents using Big Data tools

Preventing credit card fraud 31

Guarding against loan defaults 26
Meeting liquidity requirements 24
Supporting compliance and reporting 9
Anticipating market trends 8

Source: Economist Intelligence Unit survey, July, 2014.

risk management performance”, according
to the survey report. In Figure 2 above, we
can ascertain how big data is predicted to
become much more representative in the
next three years – the survey was carried out
in 2014, so progress in this area is well
underway. Interestingly, the survey predicts
that by next year, roughly 90% of the
industry will be using big data tools as
predictive analytics and data visualisation
aids.
Figure 3 above shows the actual
implementation by respondents of big data
in risk management activities. The biggest
category, with one third of respondents, is
the prevention of credit card fraud; one of
the highest frequency operational risk events
historically tackled by banks of all sizes
and complexity. As we can see from the
responses, compliance is also present, in
line with my earlier point that they have
New data lake closely interrelated risk drivers.
The IBM Institute for Business Value, in
technologies conjunction with the Said Business School
have the benefit at the University of Oxford argues that
big data may be best understood as the
of collecting convergence of four dimensions, or “four
data from any Vs”: volume, variety, velocity and veracity.
According to IBM, “volume” refers to the
imaginable quantity of data, as big data is frequently
source; not only defined in terms of massive data sets, with
trading systems, metrics such as petabytes and zetabytes
commonly referenced; “variety” refers to the
email, social increasing diversity in the types and sources
media and of data requiring management and analysis;
“velocity” refers to the accelerating speed at
mobile data which data is being generated today and,
finally; “veracity” refers to the reliability
associated with particular data.
In line with this new logic of data
1. Veldhoen, A and De Prins, S: Applying
Big Data to Risk Management, Avantage
availability in its many dimensions,
Reply, (2014). Veldhoen1 has developed the interesting

20 The Risk Universe June 2016

Data FINAL.indd 20 15/06/2016 12:43


concept of ‘data lakes’ in the context of
operational risk management. This idea
refers to the movement from data
warehouses – which is usually the storage
of structured, processed data – to data
lakes, which usually contain unstructured,
raw data. New data lake technologies have
the benefit of collecting data from any
imaginable source; not only trading systems,
email, social media and mobile data, but
also HR systems, door swipe-card activity
and computer access log files. The result is a
fully comprehensive, integrated approach to
data analysis that can detect risks before
they become a real threat to an institution.
Many of these improvements are based on
the Hadoop Distributed File System (HDFS),
a data storage component that can store any
type of data – structured, semi-structured
and unstructured. All of these new protocols
allow for the usage of traditional structured
Data FINAL.indd 21
Big data
FIGURE 4: LOSS EVENTS LINKED TO OPERATIONAL RISK
Grupo Banco Financiero y de Ahorros/Bankia S.A.
Clients, products and business practices $29,550,413,100
Royal Bank of Scotland
Business disruption and system failures $133,300,000
MS&AD Insurance Group Holdings, Inc
Execution, delivery and process management $543,403,500
Bank of America
Employment practices and workplace safety $10,150,000
AIJ Investment Advisors
Internal fraud $1,500,000,000
Wegelin S.A.
Internal fraud $16,000,000
Itau Unibanco Holding S.A.
External fraud $62,217,687
SCOR Group
Damage to physical assets $182,656,600
Grupo Santander
Clients, products and business practices $892,235,400
Barclays plc
Clients, products and business practices $452,841,420
Source: IBM® Algo FIRST® for web edition
data along with new big data sources and
applications.
In summary, the use of big data allows us
to tackle what has been described by many
as the biggest challenge when it comes to
managing operational risk: data shortage.
As an interesting article published by The
Economist explains, “A large sample can
reveal rare events that don’t show up in
small data sets. When events occur
infrequently – credit card fraud, for instance,
occurs in perhaps five out of every 1,000
transactions – millions of transactions
become necessary to generate a usefully
Click here to view Big
Data as the Key to large sample of fraudulent ones”. Large
Better Risk Management events with low frequencies are another
challenge in the management of operational
Click here to view risk, because they are at the tail of the
Analytics: The distribution and become difficult to measure
real-world use of with statistical certainty. Figure 4 above
big data, IBM
shows a list of recent tail events from public ➔
June 2016 The Risk Universe 21
15/06/2016 12:43
 Big data

Datafication records of information.

As previously stated, perhaps the main
refers to the challenge faced by traditional operational
process of risk measurement and management is the
availability of meaningful data which has
digitalising data been collected and presented in the right
in a manner way. From a big data perspective, causation
is not necessarily the primary concern here;
that is fast, we are more interested in correlations and
automatic, inferences from associations that emerge
efficient and from the data. Sometimes we can observe
clustering from unsupervised segmentation,
cost effective which needs no causation in order to work as
and is a key a model and to provide valuable information
regarding, in this case, an operational risk
element of big driver, as opposed to the traditional
data analysis paradigm that we called ‘modelling’,
particularly of risk management. This new
paradigm brings much needed air into the
field of operational risk modelling, as it
counteracts the traditional problem of
data scarcity described above. Huge data
volumes from social media networks
will allow for decision tree models and
unsupervised clustering in the tackling of
the most utilised operational risk drivers endured, big data can offer alternatives to
related to behavioural measurements using modelling tools in the management of
leading to fraud – either in credit card operational risk, without the regulatory
operations, or for internal fraud practices. burden of the AMA models and all of their
Utilisation of employee-movement and complications – which ultimately led to their
THE AUTHOR
access patterns, either physical or virtual proposed elimination.
(computer system access), will allow What was once considered as the biggest
managers to find behavioural patterns for challenge for operational risk, being so vast
the common operational risk driver of and involving a huge number of drivers and,
internal errors in processing and controls, hence, lots of needed (yet unavailable)
which are known to explain huge operational information, can now be turned into an
losses in many of the bigger institutions. opportunity to take advantage of big data
For example, in one interesting case, the applications. For instance, the ‘datafication’
analysis of these types of patterns showed of huge lakes of data related to operational
the relationship between internal errors in risk drivers. Datafication refers to the
transaction processes with Friday-afternoon process of digitalising data in a manner
informal meetings where alcohol was that is fast, automatic, efficient and cost
Alfredo B. Roisenzvit is consumed by key processing employees, effective and is a key element of big data
executive director of before their shift was over. This analysis because it allows immense amounts
RiskBusiness Latin demonstrates how big data applications will of data to be ready for processing. An
America, a division of allow for use of huge amounts of data which example of this are text miners, where
RiskBusiness International, are not directly observed losses, but will computers analyse different strings of text
and was previously a nonetheless present actionable modelling or phrases, perhaps from tweets, or any
regulator with the Banco tools. This is particularly useful in light other social media platform. All of this data
Central de la República of the recent Basel Committee proposal is collected automatically by the system
Argentina or Central Bank to eliminate AMA Models, in favour of a according to pre-set parameters and turned
of Argentina. simple, more standardised approach. into meaningful data points. There are many
With all of the criticism capital models have other drivers of operational risk that can be

22 The Risk Universe June 2016

Data FINAL.indd 22 15/06/2016 12:43


explored via datafication and other big data
applications, without the need to register
each loss in the general ledger, or in another
specific registry.
With all of the enthusiasm that can be
anticipated with these profound changes, it
is inevitable that this huge paradigm change
will come accompanied by some drawbacks.
One argument from critics is that risk has
always been defined by regulators, very
specifically in the Basel Accord, to be about
actual measureable losses. To move away
from actual incurred and accounted-for
losses and start analysing risk drivers that
may have not turned into an actual loss, is a
topic for debate. Ultimately, proponents of
the traditional paradigm will say that capital
calculations and risk measurement are only
useful for the funding of unexpected losses.
Unexpected does not mean ‘surprising’ in
this context, but rather higher than the
expected value, or mean of the distribution.
For many decades, banking regulation has
been directed at regulatory capital and
moving away from that loss-oriented logic
would undermine the whole logic of risk
measurement. Furthermore, there are
literally thousands of papers, books and
Data FINAL.indd 23
Big data
articles that rely on this logic for measuring
and modelling financial risk. But this world
is changing as we watch. With the new
Basel proposals, capital regulations will
be standardised around loss, freeing the
modelling world so that it can begin to
advance in its objective of better estimating
operational risk exposure – and not its
capital requirements. Big data tools will be
vital in that new world.
Ultimately, the above two visions for
operational risk management and
measurement could coexist. The traditional
application of concrete and accounted
losses can be a factor of measurement for
certain drivers and regulatory requirements
for operational risk – and big data applications
could be another part of risk drivers.
However, the initial problem of scarce data
is valid; we still try to manage – and many
still try to model – operational risk with
similar tools used to model credit or market
risk and this approach continues to create
theoretical and statistical complications,
because the drivers and definition of
To move away operational risk are much broader than those
of credit or market risk.
from actual
We should therefore conclude that the
incurred and incorporation of more modern and ample
accounted-for toolkits, especially big data applications,
losses and start brings about an enhanced ability to measure
and model operational risk. This integrated
analysing risk logic should undoubtedly lead to a better
drivers that may risk management practice. The addition of
have not turned huge amounts of information can only be
interpreted as a positive contribution, in line
into an actual
with proven and documented measurement
loss, is a topic practices that bring about enhanced
for debate management tools and the greater potential
for more accurate results. Many authors
argue that operational risk management is
still a very young practice – for certain the
youngest required by the Basel Committee
Standards among Pillar 1 risks, only
introduced 10 years ago. A lot of progress
has been made, but the potential for
advancement is huge as we all continue
this rich learning process. The future will
bring a plethora of big data applications
for operational risk management and will
require a profound understanding of big data
frameworks and of the more specific drivers
of operational risk.
June 2016 The Risk Universe 23
15/06/2016 12:43