LO 42.3: Describe the challenges that can arise through the use of external data.

LO 42.3: Describe the challenges that can arise through the use of external data.
Many firms operational risk systems not only include ORX and FIRST data but are also supplemented with information from the firms own research and relevant industry news and journals. However, as we noted previously about the various differences between ORX and FIRST, the databases must be viewed with caution, as there are several challenges with using external data.
For example, external data derived from the media is subject to reporting bias. This is because it is up to the press to decide which events to cover, and the preference is for illegal and dramatic acts. For instance, consider that a large internal trading fraud might get press coverage, while a systems outage might get none. We should also consider that a major gain is less likely to be reported by the media than a major loss. .Another barrier to determining whether an event is relevant is that some external events may be ignored because they are
2018 Kaplan, Inc.
Page 65
Topic 42 Cross Reference to GARP Assigned Reading – Girling, Chapter 8
perceived as types of events that could not happen here. Finally, the use of benchmark data may be a concern because there is a chance that comparisons may not be accurate due to different interpretations of the underlying database definitions.
One of the best ways to use external data is not to spot exact events to be avoided but rather to determine the types of errors and control failings that could cause similar losses. External data may have direct relevance despite differences in the details. For example, the Societe Generale event led many firms to overhaul their fraud controls.
External data can serve a valuable role in operational risk management if its limitations are acknowledged. Databases can provide valuable lessons about risk management and highlight trends in the industry. While internal and external databases only tell us about what has already gone wrong, the data can be used to implement controls to mitigate the chances of similar events repeating, and they provide valuable inputs into the operational risk framework. Loss data is also useful for self-assessment, scenario analysis, and key risk indicators (KRIs) that indicate loss trends and weaknesses in controls.
S o c i e t e G e n e r a l e O p e r a t i o n a l L o s s E v e n t