Linking Operational IT Failures to IT Control Weaknesses

Operational IT failures have significant negative effects on firms but little is known about their origins. Building on accounting research linking adverse operational events to SOX-disclosed control weaknesses (CWs) over financial reporting, we study the origins of IT failures in relation to IT-CWs. We use a sample of 212 operational IT failures where the confidentiality, integrity or availability of data assets and functional IT assets (hardware, networks, etc.) has been compromised. We find that IT failures are linked to a relatively small set of IT-CWs, where each IT failure type is linked to distinctly different IT-CWs. Moreover, IT failures more harmful to the firm are found to be associated with IT-CWs that are more sever and difficult to remediate

Estimation of operational value-at-risk in the presence of minimum collection threshold: An empirical study

The recently finalized Basel II Capital Accord requires banks to adopt a procedure to estimate the operational risk capital charge. Under the Advanced Measurement Approaches, that are currently mandated for all large internationally active US banks, require the use of historic operational loss data. Operational loss databases are typically subject to a minimum recording threshold of roughly $10,000. We demonstrate that ignoring such thresholds leads to biases in corresponding parameter estimates when the threshold is ignored. Using publicly available operational loss data, we analyze the effects of model misspecification on resulting expected loss, Value-at-Risk, and Conditional Value-at-Risk figures and show that underestimation of the regulatory capital is a consequence of such model error. The choice of an adequate loss distribution is conducted via in-sample goodness-of-fit procedures and backtesting, using both classical and robust methodologies. --

An Event Study Analysis of the Economic Impact of IT Operational Risk and its Subcategories

Organizations’ growing exposure to IT operational risk, or the risk of failures of operational IT systems, could translate into significant losses. Despite this, there are notable theoretical and empirical gaps in the literature on IT operational risk. We propose the “resource weaknesses” framework, which extends the resource-based theory of the firm, as a theoretical lens for investigating IT operational risk and its impacts. We also theorize about and empirically examine the impact differences of two categories of IT operational failures: ones resulting in the disclosure, misuse, or destruction of data assets, and ones resulting in the loss of availability or the mis-operation of functional IT assets responsible for the handling of data assets. Whereas the former, data-related failures have had some coverage in the literature, little is known about the latter, function-related failures. We apply an event study analysis with a well-balanced data set of IT operational failure events that occurred in U.S. financial service firms over a 25-year period. We find that function-related events have a substantially larger negative wealth effect than data-related events, and that firm characteristics such as firm size and growth potential greatly influence the degree of wealth effect. We conclude with important implications for practice and research

Modelling catastrophe claims with left-truncated severity distributions (extended version)

In this paper, we present a procedure for consistent estimation of the severity and frequency distributions based on incomplete insurance data and demonstrate that ignoring the thresholds leads to a serious underestimation of the ruin probabilities. The event frequency is modelled with a non-homogeneous Poisson process with a sinusoidal intensity rate function. The choice of an adequate loss distribution is conducted via the in-sample goodness-of-fit procedures and forecasting, using classical and robust methodologies. This is an extended version of the article: Chernobai et al. (2006) Modelling catastrophe claims with left-truncated severity distributions, Computational Statistics 21(3-4): 537-555.Natural Catastrophe, Property Insurance, Loss Distribution, Truncated Data, Ruin Probability

Modeling catastrophe claims with left-truncated severity distributions (extended version)

In this paper, we present a procedure for consistent estimation of the severity and frequency distributions based on incomplete insurance data and demonstrate that ignoring the thresholds leads to a serious underestimation of the ruin probabilities. The event frequency is modelled with a non-homogeneous Poisson process with a sinusoidal intensity rate function. The choice of an adequate loss distribution is conducted via the in-sample goodness-of-fit procedures and forecasting, using classical and robust methodologies.Natural catastrophe; Property insurance; Loss distribution; Truncated data; Ruin probability;

Estimation of operational value-at-risk in the presence of minimum collection threshold: An empirical study

61 page(s

Information asymmetry around operational risk announcements

Operational risk incidences are likely to increase the degree of information asymmetry between firms and investors. We analyze operational risk disclosures by US financial firms during 1995–2009 and their impact on different measures of information asymmetry in the firms’ equity markets. Effective spreads and the price impact of trades are shown to increase around the first announcements of such events and to revert after the announcement of their settlement. This is especially pronounced for internal fraud and business practices related events. Market makers respond to higher information risk around the first press cutting date by increasing the quoted depth to accommodate an increase in trading volumes. The degree of information asymmetry around operational risk events may be influenced by the bank’s risk management function and the bank’s governance structure. We indeed find that information asymmetry increases more strongly after events’ first announcements when firms have weaker governance structures—lower board independence ratios, lower equity incentives of executive directors, and lower levels of institutional ownership. In contrast, the firms’ risk management function has little to no impact on information asymmetry. We interpret this as evidence that the risk management function is primarily driven by regulatory compliance needs. The results of this study contribute to our understanding of information asymmetry around operational risk announcements. They help to shed light on the role that regulation and corporate governance can play in order to establish effective disclosure practices and to promote a liquid and transparent securities market

Modelling catastrophe claims with left-truncated severity distributions (extended version)

In this paper, we present a procedure for consistent estimation of the severity and frequency distributions based on incomplete insurance data and demonstrate that ignoring the thresholds leads to a serious underestimation of the ruin probabilities. The event frequency is modelled with a non-homogeneous Poisson process with a sinusoidal intensity rate function. The choice of an adequate loss distribution is conducted via the in-sample goodness-of-fit procedures and forecasting, using classical and robust methodologies. This is an extended version of the article: Chernobai et al. (2006) Modelling catastrophe claims with left-truncated severity distributions, Computational Statistics 21(3-4): 537-555

Modelling catastrophe claims with left-truncated severity distributions (extended version)

In this paper, we present a procedure for consistent estimation of the severity and frequency distributions based on incomplete insurance data and demonstrate that ignoring the thresholds leads to a serious underestimation of the ruin probabilities. The event frequency is modelled with a non-homogeneous Poisson process with a sinusoidal intensity rate function. The choice of an adequate loss distribution is conducted via the in-sample goodness-of-fit procedures and forecasting, using classical and robust methodologies. This is an extended version of the article: Chernobai et al. (2006) Modelling catastrophe claims with left-truncated severity distributions, Computational Statistics 21(3-4): 537-555

Operational risk : a guide basel II capital requirements, models, and analyssis

Topics covered include ; the main challenges that exist in modeling operation risk, the variety of approaches used to model operation losses and much mor