Risk classification

There have been many different attempts to classify risks, from the simple to the extremely complex. At the simple end of the spectrum is the basic breakdown of banking risk into credit risk, market risk and operational risk. More complex classification systems are intended for use as the basis of Enterprise Risk Management or other comprehensive risk management exercises.

The rationale for attempting to classify risks is that in order to manage your risks effectively you have to know what they are, and a risk classification system is necessary in order to do this. It can provide a basis for both identification and control, two essential parts of the risk management process.

A comprehensive risk classification system can provide an overall framework for risk identification: simply go through each risk, one by one, and work out where and how it can arise in your organisation. Sometimes there are problems of definition, in that it is not clear exactly how to classify a particular risk that you identify, but having a comprehensive system helps to ensure that you don't double count any risks.

Control and mitigation can also be helped because risks that are classified in the same way are often susceptible to similar control and mitigation techniques.

Resources

Report of the IAA's Working Party on Solvency

The International Actuarial Association produced a report for the International Association of Insurance Supervisors on insurance company solvency. The approach the working party took was to identify the types of of risks to which insurers are subject, and the approaches used to model those risks. The report contains a classification of insurance company risks, an overview of the risk assessment process in insurance companies, and more detailed consideration of some individual risk types. It is available at www.actuaries.org/CTTEES_INSREG/Documents/Solvency_Report_EN.pdf.

Building the new regulator: Progress report 2

The Financial Services Authority have issued a series of reports outlining their new risk-based regulatory framework. This report, issued in February 2002, describes their risk-based operating framework and what it means for the firms that they regulate. In particular, it includes (as Appendix B) a probability assessment matrix that provides the risk classification system that they use. Note that the FSA is interested only in risks to their statutory objectives, and that these may not be the same as, for example, risks to shareholder value. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress2.pdf.

Report on Enterprise Risk Management

The Casualty Actuarial Society presents a process for ERM. The primary purpose of the report is to consider the role of actuaries in risk management, but it gives a useful general overview too. It includes a risk classification meant for general use, rather than limited to a specific industry. The report is available from the CAS site at http://casact.org/research/erm/.

Risk Management in Banking, Second Edition

By Joël Bessis. The word comprehensive doesn't begin to describe this book as far as a quantitative view of risk in banking is concerned. However, as its title suggests, it doesn't discuss risk management outside banking at all. It has a full treatment of credit risk, including a useful overview chapter on credit risk models and many chapters on different aspects of modelling both standalone risk and portfolio risk. It hardly mentions operational risk. Visit its page at Amazon.

Risk Management, by Michel Crouhy, Dan Galai, Robert Mark

This is another book written primarily from a banking viewpoint. It has a whole chapter on risk management in nonbank corporations, and mentions the issues in some of the other chapters. Its treatment of credit risk covers credit rating systems, and distinguishes several different measurement approaches. It has a chapter on operational risk. This book emphasises the need for risk management systems. Visit its page at Amazon.