Financial institutions lost $7 billion dollars last year due to failed internal controls and other operational problems, according to an industry survey.
Some of the largest companies lose in excess of $100 million annually on operational risk, according to PricewaterhouseCoopers, in a survey it conducted for sponsors including Citibank, Deutsche Bank, and Credit Suisse First Boston.
"The cumulative effect of these losses is much greater than anyone ever imagined," said Michael Haubenstock, a partner in the accounting and consulting company. "Few institutions today really know what the costs of operational risk are."
Just this month, Chase Manhattan Corp. said a securities trader who had been disguising his losses cost the company $60 million.
John Wilmot, a managing director at Chase, defended the bank at a risk management conference in New York this week by saying it had recognized the potential for loss and had set aside reserves. "So we can't be doing everything wrong," he said.
The survey covered 55 commercial banks, investment banks, asset managers, and finance companies holding a combined $13 trillion of assets. It included 37 of the world's 100 largest financial companies, which are arguably at the cutting edge of operational risk management.
The survey posed 159 questions, and follow-up interviews were done with 20 of the participants. The results are expected to be released this month, but in an interview, Mr. Haubenstock provided the data on losses.
PricewaterhouseCoopers defined operational risk as "the risk of direct or indirect loss resulting from inadequate or failed internal processes, people, and systems, or from external events."
It has emerged as a key focus in many banks where other risks such as credit or market risk have been tamed. The goal: determining how large losses might be and how much capital is needed for protection.
Currently, the most commonly used operational risk measurement tool is self-assessment, or subjective evaluations by employees of the risks their business units face. Howard Stein, group risk manager for the Citibank unit of Citigroup Inc., acknowledged that this approach is "quite primitive."
"The fact that we focus so much on self-assessment shows that we are in an early stage of operational risk management," he said at the same New York conference.
Though 70% of the surveyed institutions said they rely on self-assessment tools, only 25% said they use what is known as a "loss-event data base."
The loss-event data base, regarded as one of the most potentially valuable tools in the field, is an extensive historical record of operational risk-related losses. It creates a factual basis for analysis of what has occurred and supplies quantitative evidence to support qualitative assessments.
Nearly half the institutions questioned said they plan to use such a data base.
Kate H.J. Leibfried, a director at PricewaterhouseCoopers, said loss-event data bases gain in predictive value over time and will probably be integrated with other tools.
For example, they could be used to back-test self-assessment programs to determine how accurate employees' subjective assessments were.
The survey was organized by Robert Morris Associates, the British Bankers' Association, and the International Swaps and Derivatives Association.
