Emerging Practices for Capital Adequacy © Copyright 2003, CCRO. All rights reserved. 39 manner for them to be meaningful to capital adequacy. Methods to consider, and the limitations associated with each, can be categorized as qualitative or quantitative. The following two are qualitative methods: • Scorecard Approach - Can be used for operations and operational risk to identify risks, determine frequency and range of costs, and assesses the effectiveness of controls and mitigation techniques in place. This approach is subjective, but now that the SEC has mandated the COSO framework for Sarbanes Oxley 404 compliance, standards will be set. In particular, the Capability Maturity Model can be adapted to set standards for a scorecard approach and is already used by many audit firms. Additionally, a company may want to use CCRO Best Practices from earlier white papers as a qualitative assessment of where companies stand with regard to CCRO recommendations. Regardless of the scorecard criteria used, a scorecard approach can form the basis for continuous improvement processes for internal controls to mitigate operative risk. It can also reflect improvement in the risk-control environment in reducing the severity and frequency of future losses. • Scenario Planning - Is a blend of quantitative and qualitative methods, but still is a subjective approach. It assesses the losses that would occur under a variety of operational “stress” events in order to test preparedness for such events and to calculate possible losses (e.g., if phone lines go down). The following three are quantitative methods: • Advanced Measurement Approach - Uses historical data and statistics to derive expected losses and the distribution around them. Most important aspects of the risk event are frequency of occurrence, duration, and severity. Note that even when data is available it is difficult to scale. The operative risk capital charge is defined as:  = n i=1 i LGEi PEi EIi OREC * * * The gamma factor is determined to reflect the chosen percentile of the loss distribution, while the remainder of the terms provides the expected loss due to operational risk. EI is the exposure indicator, similar to the ones used in the standardized approach discussed below. PE is the probability of loss due to an event. LGE is the loss given the event. Additionally, it should be recognized that a correlation of one (1) is unlikely and will overstate the measure. • Internal and External Loss Databases - Internal loss databases and external collaborative loss databases could provide data essential for statistical models of operative risk. Note that not all information is suitable or recommended for collaborative loss databases, and the confidential nature of certain operational information should be recognized. • Joint Simulation – Uses the methods from the advanced measurement approach in conjunction with the methods used to calculate market, credit, and liquidity risks so that all four can be measured jointly under the same assumptions. While extremely difficult, there is limited movement toward this method.