Measuring Operational Risk Using Fuzzy Logic Modeling
Samir Shah | September 1, 2003
Fuzzy logic has been used for decades in the engineering sciences to embed expert input into computer models for a broad range of applications. This approach provides more information to help risk managers effectively manage operational risks than the current qualitative approaches for ranking risks.
This article is part of a series of articles on modeling operational risks. The introductory article in the series is Measuring and Managing Operational Risks (April 2002).
This article describes how fuzzy logic modeling techniques can be used to assess operational risks. In most cases, there is not enough reliable data to apply the statistical approaches that are commonly used for assessing market risks. There is a greater reliance on expert input rather than historical data to assess operational risks. Modeling techniques that can accommodate a combination of data and expert input are better suited for modeling operational risks. Fuzzy logic has been used for decades in the engineering sciences to embed expert input into computer models for a broad range of applications. It offers a promising alternative for measuring operational risks.
Many companies that are in the process of implementing ERM are assessing operational risks using qualitative methods. The approaches are typically some variation of creating a list of "Top 10" risks based on expert input. The "Top 10" lists are often developed at a low level in the organizational hierarchy (e.g., department, region, or business unit) and consolidated at various levels of the hierarchy to an ultimate corporate "Top 10" list. However, there is not enough information gathered for each risk for managers to assess the relative magnitude of the risks and their interaction across the enterprise. This makes it difficult for managers to decide how much to spend on managing each risk. There is also a possibility that major risks fall through the cracks simply because in isolation within a department, region, or business unit they are not deemed critical, when, in fact, their accumulation and interaction across the enterprise raises the potential of significant losses.
The approach described here is to apply fuzzy logic modeling to assess a risk on the "Top 10" list. The assessment provides a more thorough definition of each risk and its interaction with other risks than the current methods. This provides local risk managers a decision tool for managing risks within their organizational unit. It also allows corporate risk managers clearer information to more reliably distill local Top 10 lists to a corporate Top 10 list and appropriately allocate investment to manage each risk.
The following describes the steps undertaken when adding a new risk to the Top 10 list. These steps apply fuzzy logic techniques for developing a causal model that relates the risk to its key drivers or indicators. The causal model is then used to develop a distribution of losses based on expectations for the levels of its key drivers. Once the causal model is developed, updating the model for periodic reviews of the Top 10 list is relatively quick and simple.
| For clarification, each step in the process is described through an example for modeling market conduct risk. These illustrations are highlighted in yellow boxes immediately following the description of each step. |
Step 1—Specify Key Risk Indicators
For each Top 10 risk, several key risk indicators (KRIs) are specified. A KRI is an operational or financial variable that provides a reliable basis for estimating the loss corresponding to the risk. A KRI can be a specific causal variable or a proxy for the drivers of the loss attributed to a risk. Ideally, KRIs should be chosen that are regularly measured on an ongoing basis so that data can be easily gathered.
For market conduct risk, let's assume that the following KRIs were identified:
There may be other KRIs such as agent training, agent turnover and commission rates. Although there are no limits to the number of KRIs that can be used from a modeling perspective, for practical purposes however, two to four KRIs should be sufficient to capture the major drivers of each risk. |
Step 2—Calibrate Fuzzy Representation of KRIs and Loss Amount
The essential advantage offered by fuzzy logic techniques is the use of linguistic variables to represent KRIs and the loss amount corresponding to a risk. In this step, linguistic descriptors such as High, Low, Medium, Small, Large, for example, are assigned to a range of values for each KRI and the loss amount. Since these descriptors will form the basis for capturing expert input on the impact of KRIs on the loss amount, it is important to calibrate them to how they are commonly interpreted by the experts providing input. Referring to a variable as High, for example, should evoke the same understanding among the experts. The calibration may vary by region so that "High" employee turnover may mean different things in different regions.
Figure 1
The linguistic descriptors used to represent each of the KRIs and a plot of the fuzzy membership functions are shown below. The x-axis in each plot represents the range of possible values for the corresponding KRI. The y-axis represents the degree to which a value for the KRI is represented by the linguistic descriptor. For example, in the plot below of the membership function for agent years of experience, 5 years of experience is considered 'Low' with a membership of 33% and is also considered 'Medium' with a membership of 67%. The fact that 5 years of experience is considered both Low and Medium to varying degrees is a distinguishing feature of fuzzy logic, as opposed to binary logic which artificially imposes black-and-white constraints. The fuzzy representation more closely matches human cognition, thereby facilitating expert input and more reliably representing experts' understanding of underlying dynamics.
The same approach is used to calibrate the other two KRIs.
|
Key Risk Indicator |
Linguistic Variables/Descriptors |
|---|---|
|
Years of Experience |
Low, Medium, High |
|
Product Complexity |
Low, Medium, High |
|
Premium Growth Rate |
Poor, Average, High |
Similarly, the potential loss associated with market conduct risk is calibrated to fuzzy membership functions as follows:
Step 3—Specify Impact of KRIs on Loss Amount
Having specified the risk and its KRIs, the logical next step is to specify how the loss amount varies as a function of the KRIs. Experts provide fuzzy rules in the form of if … then statements that relate loss amounts to various levels of KRIs based on their knowledge and experience.
For market conduct risk, some examples of fuzzy rules are:
| Rule 1: | If | Product Complexity | is | High or |
| Years of Experience | is | Low, | ||
| Then | Loss Amount | is | High | |
| Rule 2: | If | Years of Experience | is | Low and |
| [Growth Rate | is | High or Negative], | ||
| Then | Loss Amount | is | Very High | |
| Rule 3: | ... |
Once the rules are specified, a graphical representation of the expected loss due to market conduct risk as a function of its KRIs is used to validate the fuzzy model. The following 3-D view shows expected loss as a function of Growth Rate and Product Complexity for example. Note that the risk is more sensitive to years of experience only as the product complexity increases.
The rules span all possible scenarios for combinations of KRI levels, thus completely mapping the input space of KRIs to the output space of risk loss amounts.
Step 4—Calculate Expected Loss Amount
Since the fuzzy rules cover all possible combinations of KRI levels, the estimated loss amount can be calculated for the current levels of each KRI. A fuzzy calculator applies the math based on the fuzzy rules to generate the expected loss.
If for market conduct risk, the current KRI levels are:
| Average Years of Experience | = | 6.3 |
| Product Complexity (1-10 scales) | = | 7 |
| Expected Growth Rate | = | 4.5% |
then the expected loss is $44 million.
This is calculated by applying the fuzzy rules using a software-based fuzzy calculator. The mathematical details are not shown in order to focus on the concepts and the process; however, they are based on the standard mathematics of fuzzy set theory widely used in the engineering sciences.
Step 5—Calculate Distribution of Losses
A probability distribution of expected losses next year can be derived by representing the KRIs as a probability distribution of their levels expected next year. Since the KRIs are typically operational or financial variables, an empirical distribution based on historical data can be developed for each KRI. To the extent that historical data is not representative, professional judgment is used to modify the distribution as appropriate. Applying the same fuzzy rules-based calculation produces a distribution of the expected losses that capture the uncertainty underlying the KRIs.
It's important to note that steps 1 through 3, involving identification of the KRIs, the calibration of the linguistic descriptors, and the specification of the fuzzy rules, are undertaken only when the risk is first added to the Top 10 list. On an ongoing basis, only the distribution of the KRIs needs to be specified to reflect changes in the forecast and uncertainty. The fuzzy rules should be reviewed and revised only if the interaction among the KRIs and their impact on the risk changes significantly. Although there are several steps involved in adding a new risk to the Top 10 list, the ongoing periodic review of the risk is simple and quick.
Conclusion
The fuzzy logic approach provides more information to help risk managers effectively manage operational risks than the current qualitative approaches for ranking risks. For one, risks are quantified based on a combination of historical data and expert input. Although the absolute measurement of each operational risk is not as reliable as the measurement of market risks, the relative levels of each risk provide useful information for determining the relative investment in managing each risk.
For companies implementing Enterprise Risk Management (ERM), risk assessment must also capture the portfolio effect. One of the biggest hurdles to implementing ERM is determining the correlation among risks. The fuzzy logic approach described here reflects the interaction among risks through the commonality of the underlying KRIs. To the extent that multiple risks have one or more KRIs in common, the approach explicitly recognizes the interaction among the risks. The correlation of risks is an output of the process rather than an input. Thus the fuzzy logic modeling works well within an ERM framework.
Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.
