ING Gets Ahead of the Curve with Operational Risk Solution

The Bank for International Settlements (BIS) defines operational risk as "the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events." In the past major operational-risk losses have involved the internal aspect -- a rogue trader, a technology glitch or a procedural mishap. But following the recentevents in New York and their ripple effects throughout the financial industry, external operational risk has become impossible to overlook. In addition, the regulatory aspect of operational risk is making headlines, as the recommendations of the New Basel Capital Accord would require capital charges for operational risk, as well as those already in place for market and credit risks.

Financial giant ING is taking a proactive approach to operational risk with the recent implementation of the OpVar product from OpVantage. The OpVar offering combines NetRisk's RiskOps software with PricewaterhouseCoopers' OpVar risk management methodology and database. The two risk management vendors have formed the OpVantage group to offer the combined OpVar product. Huib ter Haar, head of ING operational risk management, says that while actual operational risk losses and regulatory requirements were not the biggest drivers in purchasing the OpVar solution, the firm wanted to be ahead of the curve in measuring operational risk.

ING saw the OpVar database as the key to its operational risk strategy, as it is difficult for one firm to compile enough operational loss information internally. ING has been measuring operational risk exposures for the past few years through internal modeling. But ter Haar points out that the biggest issue for operational risk modeling is not the model itself, but the lack of incident data to calculate robust loss frequencies and severities. "To collect publicized incidents world-wide is quite an effort and it is not efficient if every institution is doing that on its own," he says.

ING uses the OpVantage system mainly to calculate operational risk capital at both the group and business level, says ter Haar, especially for the low frequency/high severity incidents that are valuable data points. "Although we hope not to observe them internally, we firmly believe that they should be included in a capital calculation," he says.

ING began its internal operational-risk capital modeling four years ago by building a proprietary database and spreadsheet models. "This was surely valuable in a prototyping phase," says ter Haar. "But then the moment comes that you start looking for a more structural solution." He adds that while ING considered other offerings, the collection and maintenance of the publicized incidents through the OpVantage database as well as the availability of alternative models proved very valuable in the selection process.

The OpVar database contains over 8,000 publicly reported operational risk losses from over 5,300 financial services firms. With the OpVar software, firms can display graphical analysis of the causes, effects, probabilities and severities of operational risk. ING is currently using the OpVantage system for modeling publicized incidents and is in the process of setting up the collection process for internal operational risk incidents worldwide with the aim to model them in OpVantage as well. ING has several decentralized operational risk management units, and has installed the OpVantage offering at its central Amsterdam location for overall operational risk calculations in the banking as well as insurance businesses.

While the firm's internal systems did not need to be changed to connect with the OpVantage software, some of the interfaces were customized. "As operational risk measurement is still in a developing phase, there is no standard way of recording operational risk incidents yet. So it is not surprising that these interfaces need to be tailor made," says ter Haar.

ING's ter Haar says that while the New York events did not have an impact on the firm's decision to implement operational risk technology, it is a reminder that severe operational risk incidents can and do happen. "When something terrible happens it is a natural behavior to focus on the specific danger imposed, but the risk was always there," he explains. "Of course we could in no way foresee that it would materialize in this awful way, but it reminds us that severe operational risk incidents will happen every now and then."