Risk management and control

How we measure risk

In principle, for risks that are quantifiable, we measure the potential loss at three levels – expected loss, statistical loss and stress loss.

Expected loss is the loss that is expected to arise on average in connection with an activity. It is an inherent cost of such activity and is budgeted and, where permitted by accounting standards, deducted directly from revenues.

Statistical loss (also known as “unexpected loss”) is an estimate of the amount by which actual loss can exceed expected loss over a specified time horizon, measured to a specified level of confidence (probability).

Stress loss is the loss that could arise from extreme events.

Our primary day-to-day quantitative controls govern normal periodic adverse results (statistical loss) and protect us from stress events. These are the limits we apply to individual risk types, to portfolios and sub-portfolios, and to specific concentrations of risk and individual exposures. The identification of stress events and scenarios to which we are vulnerable and an assessment of their potential impact, and in particular the danger of aggregated losses from a single event through concentrated exposures, is therefore a key component of the risk control process.

To complement these operating controls, we also monitor and constrain our aggregate risk exposure across all risk types and businesses, relative to our risk capacity. In this context, we define our risk exposure as the level of potential loss inherent in our business in the current economic cycle, across all business lines, and from all sources, including operational and business risks. It is measured against a severe, low probability but nevertheless plausible constellation of events. Our risk capacity is the level of risk we are capable of absorbing based on our earnings power, without unacceptable damage to our dividend paying ability, our strategic plans and, ultimately, our reputation and ongoing business viability. We refer to this measure as “Earnings-at-Risk”. It has been developed over the past three years and is now a core element of our risk management and control process.

Although measurement of risk is clearly important, quantification does not always tell the whole story, and not all risks are quantifiable. We therefore pay equal attention to “soft” risks, avoiding the temptation to ignore those that cannot be properly quantified. We also place great emphasis on qualitative controls and rigorous risk control processes to ensure that both quantifiable and unquantifiable risk is identified, assessed and reported.

Stress situations can arise from many sources and when extreme events occur, quantitative and qualitative risk assessments alone are not sufficient. The essential complements are a tried and tested process which can be invoked immediately in response to any crisis, and well prepared business continuity management processes and plans. We continue to develop and refine these processes as we learn from our own and others’ experience.