Calculating Operational Risk Capital from an LDA

From an LDA to Annual Operational Risk Capital

A loss distribution approach (LDA) describes annual operational loss by modeling how many loss events occur and how severe each event is. Capital is then derived from the distribution of the annual aggregate, not from the severity of a single event or from the average loss alone. This tutorial is aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus.

The result depends on the confidence level and on the capital convention. A common convention defines unexpected-loss capital as Value at Risk (VaR) less expected loss. Other reporting frameworks may call the full VaR a capital measure. State which quantity is being reported, and do not mix a gross VaR with a net expected loss or vice versa.

Definition: Let $N$ be the number of operational loss events in one year, and let $X_1,X_2,\ldots$ be their severities. The gross annual aggregate loss is $S=\sum_{j=1}^{N}X_j$, with $S=0$ when $N=0$. At confidence level $\alpha$, $\operatorname{VaR}_{\alpha}(S)=\inf\{s:F_S(s)\geq\alpha\}$. Under the unexpected-loss convention, capital is $\operatorname{VaR}_{\alpha}(S)-E[S]$.

For a standard compound Poisson LDA, assume $N\sim\operatorname{Poisson}(\lambda)$, event severities are identically distributed with $E[X]$ finite, and the severities are independent of one another and of $N$. These assumptions describe the model; they are not automatic facts about operational losses. If frequency and severity are dependent, or the model uses another frequency distribution, the aggregate distribution must reflect that instead.

For a discrete aggregate distribution, VaR is the smallest loss amount whose cumulative probability reaches or exceeds $\alpha$. The distribution can jump over the confidence level, so VaR need not have exactly $\alpha$ probability at or below it. Calculate the cumulative probability at the candidate value and at the preceding possible value.

Expected Loss and the Aggregate Quantile

Under the stated independence assumptions, expected annual aggregate loss is frequency times mean severity. This is a useful check on the model, but it does not determine the tail quantile: different severity distributions can have the same mean and very different high-confidence VaR.

E[S]=E\!\left[E[S\mid N]\right] =E[N\,E[X]] =E[N]E[X] =\lambda E[X].

The justification is conditional expectation. Given $N=n$, the aggregate is the sum of $n$ independent severities, so $E[S\mid N=n]=nE[X]$. Averaging over the count gives $E[S]=E[N]E[X]$. If frequency and severity are dependent, this factorization need not hold.

For a severity distribution on a monetary lattice, an aggregate probability mass function can be calculated by a compound-distribution recursion; simulation is another method when the model is more complex. Whichever method is used, the capital calculation still requires the same steps: specify the aggregate model, obtain its cumulative distribution, locate the stated quantile, and apply the stated capital convention.

Worked Example: Fixed Severity and a Poisson Event Count

A hypothetical insurer models gross operational events with $N\sim\operatorname{Poisson}(2)$ per year. Every event produces a gross loss of $100,000. Calculate the 99% annual aggregate VaR, expected annual loss, and unexpected-loss capital. Use the infimum quantile definition.

Method and assumptions. The event count is Poisson with $\lambda=2$; severity is fixed at $100,000, so the assumptions about independent severities are satisfied trivially. If $N=k$, then $S=100{,}000k$. Thus the aggregate quantile is found by locating the Poisson count quantile.

The relevant count probabilities are $P(N=k)=e^{-2}2^k/k!$. Summing the probabilities gives $P(N\leq5)=0.9834$ and $P(N\leq6)=0.9955$, to four decimal places. Since $0.9834<0.99\leq0.9955$, the smallest count at which the cumulative probability reaches 99% is 6.

Therefore, $\operatorname{VaR}_{0.99}(S)=6\times\$100{,}000=\$600{,}000$. The expected annual loss is $E[S]=2\times\$100{,}000=\$200{,}000$, and unexpected-loss capital is $\$600{,}000-\$200{,}000=\$400{,}000$.

Check. At $500,000 the cumulative probability is only 0.9834, below 99%; at $600,000 it is 0.9955, above 99%. The quantile and capital are therefore consistent. The common mistake is to round the 99% count down to 5 or to use a single-event severity as the annual VaR.

Discrete Severity: Calculate the Aggregate, Then the Quantile

When severities can take several values, annual aggregate losses can occur at many amounts. The quantile is not generally the count quantile multiplied by an average severity: event counts and severities jointly determine the aggregate distribution. The following example calculates the required cumulative probabilities by enumerating the combinations that can fall below the candidate thresholds.

Worked Example: Two-Point Severity and a 95% VaR

A hypothetical technology firm uses a compound Poisson LDA. The annual event count is $N\sim\operatorname{Poisson}(0.5)$. Each event independently has severity $100,000 with probability 0.75 or $400,000 with probability 0.25. Find the 95% annual aggregate VaR, expected annual loss, and unexpected-loss capital. Report money in thousands of dollars.

Method and assumptions. Use the stated independent compound Poisson model. Work in thousands of dollars, so each severity is either 100 or 400. The first count probabilities are $P(N=0)=0.606531$, $P(N=1)=0.303265$, $P(N=2)=0.075816$, $P(N=3)=0.012636$, and $P(N=4)=0.001580$, rounded here to six decimals.

To calculate the cumulative probability through 300, include only combinations with aggregate loss at most 300: no events; one 100 loss; two 100 losses; or three 100 losses. Their probabilities are, respectively, $0.606531$, $0.303265(0.75)=0.227449$, $0.075816(0.75^2)=0.042647$, and $0.012636(0.75^3)=0.005331$. Their sum is $P(S\leq300)=0.881958$.

For aggregate loss at most 400, add the combinations that produce 400: one 400 loss, with probability $0.303265(0.25)=0.075816$, and four 100 losses, with probability $0.001580(0.75^4)=0.000500$. No count above four can produce a total of 400 or less, since every event costs at least 100. Thus $P(S\leq400)=0.881958+0.075816+0.000500=0.958274$.

Since $0.881958<0.95\leq0.958274$, $\operatorname{VaR}_{0.95}(S)=400$, or $400,000. Mean severity is $0.75(100)+0.25(400)=175$. Expected annual loss is $0.5(175)=87.5$, or $87,500. Unexpected-loss capital is $400-87.5=312.5$, or $312,500.

Check. The cumulative probability at 300 is below 95%, while at 400 it exceeds 95%. The calculation avoids the common error of multiplying a Poisson count quantile by the mean severity; that shortcut does not account for how severity values combine within the annual aggregate.

Net Capital Requires a Consistent Net Loss Model

If a specified mitigation or transfer reduces the insurer’s retained loss, define the net aggregate using that arrangement’s modeled payments and terms. Then calculate both the net VaR and the net expected loss from the resulting net aggregate distribution. A recovery should not be deducted from capital unless the model includes the relevant recovery amount and its applicable conditions.

In particular, a per-event recovery changes each retained severity before aggregation. This is different from subtracting a constant amount from annual VaR: the number of recoveries depends on the annual event count. The next example assumes a fixed, fully collectible recovery for every event and no annual recovery cap. Actual arrangements may have limits, exclusions, timing effects, or uncertainty that require a different model.

Worked Example: Per-Event Recovery and Net Unexpected-Loss Capital

Use the Poisson event frequency and gross severity from the first example: $N\sim\operatorname{Poisson}(2)$ and gross severity is $100,000 per event. A hypothetical contract pays $40,000 for every event, with no annual cap, exclusions, or collection uncertainty. Calculate gross and net 99% VaR, expected losses, and unexpected-loss capital.

Method and assumptions. The recovery is fixed per event, so retained severity is $\$100{,}000-\$40{,}000=\$60{,}000$. The event count distribution is unchanged. Its 99% quantile remains six events, as $P(N\leq5)=0.9834<0.99\leq P(N\leq6)=0.9955$.

Gross VaR is $6\times\$100{,}000=\$600{,}000$; gross expected loss is $2\times\$100{,}000=\$200{,}000$. Gross unexpected-loss capital is $\$600{,}000-\$200{,}000=\$400{,}000$.

Net VaR is $6\times\$60{,}000=\$360{,}000$; net expected loss is $2\times\$60{,}000=\$120{,}000$. Net unexpected-loss capital is $\$360{,}000-\$120{,}000=\$240{,}000$.

Check and common mistake. The expected recovery is $2\times\$40{,}000=\$80{,}000$, consistent with the difference between gross and net expected loss. Subtracting gross expected loss from net VaR would give $\$360{,}000-\$200{,}000=\$160{,}000$, which is wrong: the net VaR must be paired with net expected loss. Under the same convention, a full-VaR reporting measure would be $600,000 gross and $360,000 net, not the unexpected-loss amounts.

Exam Traps and Reporting Discipline

A capital result is meaningful only alongside its model basis. State the annual horizon, confidence level, whether the distribution is gross or net, and whether capital means full VaR or VaR less expected loss. For a discrete distribution, show the cumulative probability immediately below and at the selected quantile. These details make the result reproducible and reveal whether the correct tail point was selected.

Confusing expected loss with capital. $E[S]$ is the model’s average annual loss; it is not a high-confidence quantile.
Using a loss-count quantile as a dollar quantile. Convert the count to aggregate dollars only when the severity assumptions justify that conversion.
Ignoring discrete jumps. VaR is the smallest amount whose cumulative probability reaches the target, even if the cumulative probability exceeds it.
Mixing gross and net quantities. Net VaR and net expected loss must come from the same net loss definition.
Assuming mitigations are certain without saying so. Recovery terms, caps, exclusions, and collectibility affect modeled net loss and cannot be silently ignored.

Key takeaway: Specify the annual aggregate model, calculate its stated-confidence quantile, calculate expected loss on the same gross or net basis, and report explicitly whether capital is full VaR or VaR less expected loss.

Check Your Understanding

For each problem, identify the relevant annual aggregate quantile and keep the expected-loss and capital bases consistent.

A hypothetical LDA has $N\sim\operatorname{Poisson}(1)$ and fixed severity of $25,000 per event. At 95%, the Poisson cumulative probabilities are $P(N\leq2)=0.9197$ and $P(N\leq3)=0.9810$. Find VaR, expected loss, and unexpected-loss capital. (Answer: VaR $75,000; expected loss $25,000; capital $50,000.)
A hypothetical annual loss is $500,000 for each event, with $N\sim\operatorname{Poisson}(0.2)$. At 99%, $P(N\leq1)=0.9825$ and $P(N\leq2)=0.9989$. Find VaR, expected loss, and unexpected-loss capital. (Answer: VaR $1,000,000; expected loss $100,000; capital $900,000.)
A hypothetical control failure occurs at most once per year, with probability 0.08. If it occurs, the loss is $200,000; otherwise loss is zero. Find the 99% VaR, expected loss, and unexpected-loss capital. (Answer: VaR $200,000; expected loss $16,000; capital $184,000.)
A hypothetical LDA has $N\sim\operatorname{Poisson}(1.5)$, gross severity $40,000 per event, and a fully collectible $10,000 recovery per event with no cap. At 95%, the Poisson cumulative probabilities are $P(N\leq3)=0.9344$ and $P(N\leq4)=0.9810$. Find net VaR, net expected loss, and net unexpected-loss capital. (Answer: net VaR $120,000; net expected loss $45,000; net capital $75,000.)

What You'll Learn