June 2007 Capital Adequacy Extension © Copyright 2007, CCRO. All rights reserved. Page 39 of 92 • Operations: physical risk from production, delivery, and storage of energy commodities • External Factors: Legal, Regulatory, Political, and Environmental exposures may fall into either Operational or Operations categories. Measurement techniques utilized for risks within these categories will not normally be similar to techniques used in Market and Credit risks and will also differ from each other in approach. 4.6. Operational: Measurement of Internal Risks from People, Processes, and Systems For people, processes, and systems, capital allocated to the business units will normally be predicated on the potential significance of the operational loss due to a failure in that category. However, the actual capital allocated to that business unit can be based on the cost of oversight and controls implementated to mitigate that identified material risk. In other words, the materiality of the potential operational loss determines where the capital goes, and the cost of controls implementation determines how much capital to deploy. Nonetheless, one could either choose to spend on the operational processes to mitigate the potential for loss, or choose not to and reserve capital for the potential for loss. The cost of appropriate controls vs. the size of the loss is what determines whether to attempt to mitigate a potential loss or not. In other words, you want to spend a $1000 to prevent a million dollar loss, but not spend a million dollars to avoid losing $1000 every once in awhile. Because these operational risks are aspects that a company can control, there will not normally be any “unexpected loss” calculated for these risks and no additional capital cushion beyond what has been included in the internal controls and oversight budget.. Proceeding down that path could lead to the moral hazard of neglecting controls and oversight, relying instead on the capital reserve, in addition to tying up capital that could otherwise be deployed to mitigate risks associated with people, processes, or systems.11 Take for example fairly recent trader malfeasance events. The ultimate losses were in excess of any reasonable capability to absorb through capital reserves and in many cases resulted in bankruptcy. These types of risks reside not just with traders, but can happen anywhere within Finance, Treasury, or Accounting where individuals have authority over the movement of funds. Oversight and control is the optimal method to mitigate these risks, therefore the determination of the capital required to implement a robust internal control framework is the ultimate objective. In this case measurement is twofold. First, the operational loss event itself must be measured to determine significance. Second, the cost of implementing a control 11 ISDA. A New Capital Adequacy Framework: Comments on a Consultative Paper Issued by the Basel Committee on Banking Supervision in June 1999. February 2000.