Leptokurtic operations: Shunning Certain Risk

With the recent Virginia Tech shooting, I was reminded this week of the difficulties policy makers face in comprehending risk. In particular, executives and politicians alike tend to fear certain risk and end up structuring policies that trade off manageable "expected risk" for the mostly unmanageable, statistically difficult world of outlier uncertainty events. This choice unfortunately distorts the probability model of the risk environment and trades out often normal distributions with what are known as leptokurtic models.

Consider VT's recent change in policy that banned the legal concealed carrying of handguns by individuals confirmed by the State of Virginia to be free from felony convictions, mental disability, and other disqualifying conditions. The VT administration held a mostly irrational fear (when measured from national statistical data of crimes committed by legal concealed carry handgun owners, which is conclusively nearly zero) that a permitted concealed carry individual would commit a violent crime in an act of uncontrolled rage. By enacting policy which prohibited this improbable event, VT administration narrowed the probability of such events, at the unfortunate expense of significantly fattening the risk tails. With a mostly undefended campus (and certainly given a lack of deterrence), they chose to make a highly catastrophic outlier event much more certain. A campus lacking any capacity to defend itself in real-time is an environment ripe for out-of-control outlier events.

Such policy behavior is most unfortunate and exceptionally irresponsible. While catastrophic risk is impossibly difficult to quantify with precise certainty, expected risk usually yields to risk management techniques we possess. VT's experience is a lesson corporate executives and risk managers could certainly learn from as well.

From a policy perspective, it's valuable to examine operational policies and procedures for indications that they're inducing leptokurtosis. Is certain risk (which can and should be managed through insurance, reduction, transfer, etc.) instead being avoided or shunned, causing participants in the process to distort information or engage in activities that transfer the expected risk to outlier categories?

Leptokurtic Model
Orange = Standard Distribution
Yellow = Leptokurtic Distribution

Image source: www.trade-ideas.com

A good example of this dynamic is in the handling of capital technology assets past the conclusion of their underlying depreciation schedule and/or capital lease interval. Normally, the forecasted financial life of the asset should provide a reasonable indication of the low-risk lifetime. Not only is such equipment in a new state within engineered MTBF (mean-time between failure) and usually supported by insurance or vendor replacement provisions, but it is recent enough to have current internal expertise and documentation. A loss of the equipment during this period is well protected by risk mitigation measures in place at various levels.

Once an asset has been fully depreciated, management experiences an increase in profitability from its operation, at the expense of increased catastrophic/outlier risk. This is where our normal distribution gets narrower and taller at the center, while developing alarming fat tails at the outliers. Replacement parts become rare, personnel familiar with the configuration and operation of the system depart, and documentation disappears. Normal vendor support for the antiquated technology asset also disappears. While the center of the risk model rises with the gains realized from lower-cost operation of the asset, leptokurtic fat-tails grow. When the inevitable system failure occurs, recovery is nearly impossible. Configurations are lost, internal and vendor knowledge absent and companies are often left with very few options for recovery. Occasionally, some firms don't survive the experience.

The best solution for leptokurtic operational risk may be no different than practices accepted in credit and market risk: incur certain risk daily to keep risk models normal. As the certain expense of an insurance policy represents in a sense a real, certain loss every month for the policy holder, operational risk environments should seek similar policy counterparts. Operate only current technology assets under depreciation and schedule their replacement at the conclusion of depreciation. Specify certain lifespans of applications and kill legacy system with regularity. Force the company to bear the expense to keep the risk distribution mostly normal so that traditional risk management controls can be effective. Absent this recurring culling effort and known expense, catastrophic risk is certain to develop.

Operational Risk Faultlines

One of the more interesting phenomenon in operational risk is why managers experience such abnormally high levels of catastrophic risk when compared to credit and market risk environments. A potential answer may lie in the choice of risk outcomes managers make in the design and operation of their programs. Experience from credit and market risk suggests that when we refuse to recognize every day risk which allows it to be reconciled daily, we force it to hide, only to emerge when it reaches catastrophic levels.

In credit risk, accountants and auditors would quickly jump on firms that extend commercial credit but fail to establish, forecast and maintain a reserve allowance for bad debt. No level of rationalization about the firm's exceptional credit screening process would convince a prudent accountant to ignore reserve requirements. Instead, managers use historical or probability models in accounting for expected risk, allowing the firm to experience the daily feedback from current lending practices. Through this process, risk is forced into the budgeted "expected loss" category, materially driving down the alternate and default "unexpected loss" category where catastrophic demons reside. Feedback is daily and risk appetites appropriately adjusted.

Likewise, market risk managers have equally mature practices in forecasting recurring risk. Value-at-Risk or Capital-at-Risk models, portfolio loss reserves and other methods anticipate a certain level of loss from expected risk. Derivatives markets, intentionally structured to administer risk, often use daily settlement methods so that a day's gains or losses are immediately felt. Instead of deferring the realization of gains and losses to the end of a contract term, which attracts liquidity and default risk into the equation, winners and losers in these markets settle daily and risk levels are moderate but balanced. Risk is rarely allowed to stray too far from the expected loss category, and the demons of unexpected loss are again kept at bay. Again, feedback is provided on a near-daily basis, allowing the organization to appropriately adjust its appetite for risk.

Operational risk, on the other hand, is rarely permitted to reconcile daily. Rather than maintaining an expectation of budgeted loss, managers set unrealistic "zero fault" expectations. Systems are pronounced to have "five nines" (99.999%) uptime, change processes are put in place that apply punitive, often professionally terminal consequences for technical administrators who recognize a risky condition, creating an atmosphere where participants in the system are encouraged to ignore risk or worse yet, cover up minor risk manifestations. Game theorists would find these outcomes unsurprising, yet many operations environments are littered with these risk landmines.

The result is that normal risk is shuffled aside and hidden. Feedback is prevented, or worse yet, prohibited by organizational policy. In this state, catastrophic cousins are invited in, as the risk demon demands settlement in full, with obscenely compounded interest for his absence. Worse yet, operational environments tend to be rich with risk collinearity opportunities, as system failures tend to experience amplification due to homogeneous operating systems, hardware platforms and administrative personnel. A failure in risk mitigation to one system, such as an e-commerce webserver, bypasses most prevention-oriented defenses and permits a complete compromise to the environment to occur.

What's the solution to reducing operational risk conditions favorable to catastrophic consequence? John Milton, the well-know author of "Paradise Lost" and other works wrote the significant essay "Areopagitica" addressing the importance of allowing a free press, in which the concept of an open "grappling of truth and falsehood" is encouraged. Applied to risk management treatments, we see Milton's prescription present in credit risk management, where individual accounts are periodically evaluated and forecasted for default treatment. Derivatives markets (in most cases) are forced to grapple daily, with gains and losses applied before one's position becomes too extreme.

Operational risk requires this same treatment in order to reduce the opportunity for catastrophic loss, but can only occur in environments where the organization encourages the forecasting of expected loss. Loss must be recognized as a probabilitistic reality, rather than a culturally prohibited outcome. Absent recognition as a recurring expected loss, risk's demons will find their expression in unexpected catastrophic outcomes.

As the FuzzyNumbers blog evolves, I'll share ideas about the practical treatment of operational
risk that converts risk from unexpected to forecasted (and moderated) states.