Search

The sampling and verification methodology is really just an application of conventional risk-assessment and quality control practices to mortgage lending and the mortgage securitization process. Looking back, a risk assessment that could have limited or even prevented the subprime mortgage crisis would have involved recognizing that bad subprime lending is a potentially catastrophic operational risk and that following the loan-quality inspection steps described in chapter 3 could have educated the market regarding the quality of the mortgages it was originating. Looking forward, a risk assessment that can limit or even prevent future lending crises involves recognizing that bad lending of any sort, performed on a large enough scale, is a potentially catastrophic operational risk.

In this chapter, we discuss the three pillars of operational risk management: capital allocation, transfer of operational risk through insurance, and proactive mitigation of operational risk through product inspection and quality control. Thorough operational risk management will generally involve all three pillars. While the first two pillars are fairly well understood and have been the subject of attention from the Basel Committee and other regulatory bodies, the third pillar is equally important though less familiar to those tasked with operational risk management. Regardless of which pillar an institution elects to rely on for operational risks in general or for a particular operational risk, the procedure to begin managing operational risk is the same.

At the beginning of this book, we defined operational risk as the risk of loss from inadequate or failed internal processes, people, and systems or from external events. While the Basel Committee on Bank Supervision developed this definition for financial institutions—banks in particular—the fact is that any institution with people, systems, and internal processes is exposed to operational risk. Because every institution has people, systems, and processes, every institution, including regulatory agencies, must contend with operational risk. Although regulatory agencies may suffer financial losses from some operational risks that lead to higher-than-expected budget expenditures, we are concerned here with the operational risks involving inadequate or failed internal processes or systems that could lead a regulatory agency to provide inadequate supervision of the institutions it regulates.

The working definition of “operational risk” among financial institutions is the risk of loss from inadequate or failed internal processes, people, and systems or from external events.1 Practically speaking, operational risk is the risk of loss from problems such as human error, system failures, and bad weather—to name a few of the many almost-inherent business complications that qualify as operational risks. Operational risk is just a relatively new term for some very old risks like fraud and embezzlement, and some newer risks like cybercrime and computer system failures.