Measuring frequency and severity · RiskAtoms Academy

By the end you will be able to

1Fit a Poisson frequency and a lognormal severity to each event type's losses and compute the expected annual loss.
2Explain why one lognormal per type misses the large losses, and how a separate heavier tail fixes it.
3Build the loss distribution approach by simulation, read off the 99.9% one-year loss, and explain diversification across event types and sampling noise.
4Compute the Basel standardised approach (business indicator, BIC, loss component and ILM) on the same book and compare it with the model.

Why it matters

RiskAtoms Bank lost £24.1m a year to operational events over ten years. One year, 2018, cost £85.9m, because of a single redress provision. If the board asks how bad a really bad year could be, the average is no answer, and ten years of history cannot show a 1-in-1,000 year. A model of how often losses happen and how large they are can: on this book it says £430.4m, 18 times the expected loss.

Core explanation

Two questions, then a simulation

Illustrative dataRiskAtoms Bank plc's operational risk book

The same £67bn bank as Modules 3.5 and 3.6, reporting at 31 December 2025: ten years of internal loss events above £10,000 (2016 to 2025), an RCSA, ten key risk indicators, seven workshop scenarios, five important business services and five suppliers. Every event, person, supplier and figure is made up for teaching and seeded so it never changes; none is any bank's data. Every lesson in Module 3.7 uses this book, so the figures agree.

The fits use the book's 935 operational losses with a net loss above zero (credit-boundary events and near misses out). They ignore the £10,000 collection threshold, which biases the small-loss fit; the large-loss tail is pooled across types; and event types are independent in the simulation. Each of these is a stated simplification.

Splitting a year's operational loss into two questions is the heart of the loss distribution approach (LDA): how many losses (frequency), and how large is each (severity)? Fit each from the loss data, event type by event type, then put them back together by simulation, as Monte Carlo VaR did for the trading book (L3.2.11: Monte Carlo VaR).

Frequency: a Poisson count

If events arrive at random at a steady rate, the number in a year is Poisson (M-C05: The Poisson distribution), and its best estimate of λ is simply the average count. A Poisson count has variance equal to its mean, so the ratio of the two, the dispersion, checks the fit.

Event type	Counts a year	λ	Variance	Variance ÷ mean
IF Internal fraud	0–3	1.3	1.12	0.86
EF External fraud	26–49	35.3	48.01	1.36
EPWS Employment practices and workplace safety	2–10	5.1	5.66	1.11
CPBP Clients, products and business practices	8–15	11.7	5.57	0.48
DPA Damage to physical assets	1–5	2.6	1.60	0.62
BDSF Business disruption and system failures	2–8	5.1	4.99	0.98
EDPM Execution, delivery and process management	13–35	28.6	38.49	1.35
All types		89.7

Every ratio lies between 0.48 and 1.36. With ten years of counts that is close enough to 1: a Poisson is a fair first model. The sample variance uses n − 1.

Severity: why one lognormal fails

The natural first try is one lognormal per type (M-C07: The lognormal distribution), fitted by taking logs of the losses and using their mean and standard deviation as μ and σ. Multiply each type's fitted mean loss by its λ and add up:

Event type	Losses	Fitted median	Fitted mean	Sample mean	Implied a year	Observed a year
IF	13	£101,907	£471,378	£678,248	£0.61m	£0.88m
EF	353	£24,492	£34,262	£47,575	£1.21m	£1.68m
EPWS	51	£43,916	£81,231	£158,954	£0.41m	£0.81m
CPBP	117	£68,542	£200,817	£1,353,243	£2.35m	£15.83m
DPA	26	£10,806	£20,667	£36,403	£0.05m	£0.09m
BDSF	51	£50,474	£144,228	£488,640	£0.74m	£2.49m
EDPM	286	£23,224	£56,431	£79,096	£1.61m	£2.26m
Total					£7.0m	£24.1m

The model expects £7.0m a year against £24.1m observed. The fit is dominated by the hundreds of small losses: 86% of events are under £100,000. In conduct, the fitted mean loss is £200,817 against a sample mean of £1,353,243. A lognormal with σ = 1.47 and a median of £68,542 treats an £82m provision as a practically impossible draw, yet the bank booked one. Operational losses are heavier-tailed than a single lognormal allows (M-C08: Skewness and fat tails).

The book's fix is to split each type at £1m. The body, losses under £1m, gets its own Poisson-lognormal per type (88.5 events a year in all). The tail, losses of £1m or more, gets a per-type frequency (1.2 a year in all) and one lognormal fitted to all 12 large losses together: median £7.2m, σ = 1.29, mean £16.6m. The expected loss becomes £24.3m, in line with the data. Pooling has a price: every type now shares the same large-loss shape, which understates conduct and overstates, say, employment claims.

Aggregation: simulate the years

The annual loss is a sum of a random number of random losses (M-C11: Combining random variables). Its mean has a formula; its tail does not. So the book simulates: for each of 20,000 years, draw a Poisson count for each type's body and tail, draw that many losses, and add them up.

20,000 simulated years in bins of £5m. 151 years lost more than £200m and sit off the right edge.

The shape is the story of the module. The median year costs £11.1m; 72% of years cost less than the £24.3m expected, because a few catastrophic years pull the mean up. The 99.9% one-year loss, the 1-in-1,000-year loss, is £430.4m: the 21st largest of 20,000 years (M-C09: Quantiles). A normal distribution with the same mean and standard deviation (£41.6m) would put it at £152.9m.

Diversification across event types

Event type	Expected	99%	99.9%
IF Internal fraud	£3.32m	£61.9m	£186.4m
EF External fraud	£2.88m	£41.0m	£163.5m
EPWS Employment practices and workplace safety	£1.88m	£36.3m	£141.8m
CPBP Clients, products and business practices	£7.66m	£99.0m	£310.9m
DPA Damage to physical assets	£0.05m	£0.3m	£0.6m
BDSF Business disruption and system failures	£3.76m	£67.4m	£199.5m
EDPM Execution, delivery and process management	£4.76m	£66.1m	£182.3m
Sum of stand-alone figures			£1,185.0m

Each type's 1-in-1,000-year loss, added up, is £1,185m. The total's is £430.4m, 64% less, because independent types rarely have their worst year together. That diversification is an assumption, not a finding: a single cyber attack can be a fraud, an outage and a data breach at once. Note too how large the stand-alone figures for internal fraud and employment claims are: that is the pooled tail at work.

How sure is £430m?

The same model with four other random seeds gives £431.3m, £400.1m, £408.6m, £484.4m: anywhere from £400m to £484m. The expected loss barely moves. Only about 20 simulated years lie beyond the 99.9% point, so its estimate is noisy even with 20,000 years; the uncertainty in the fitted tail itself, from just 12 large losses, is larger still. Adding the seven workshop scenarios (L3.7.06: Scenario analysis) raises the expected loss to £36.5m and the 99.9% to £487.4m.

Sort itUp or down?

Each change is made to the book's model. Does the 99.9% one-year loss go up or down?

The workshop scenarios are added as extra sources of loss.
Event types are assumed to have their bad years together (perfect dependence).
The severity is changed back to one lognormal per type.
The pooled tail's σ is raised because external data shows larger losses at other banks.
A new fraud control halves the number of small card frauds (external fraud losses under £1m).

The formal version

Moments of a random sum. With $N$ independent of the $X_i$ , condition on $N$ (M-C11: Combining random variables):

\begin{aligned} E[S] &= E\big[E[S \mid N]\big] = E[N]\,E[X] = \lambda\,E[X] \\ \operatorname{Var}[S] &= E\big[\operatorname{Var}(S \mid N)\big] + \operatorname{Var}\big(E[S \mid N]\big) \\ &= E[N]\operatorname{Var}[X] + \operatorname{Var}[N]\,E[X]^2 \\ &= \lambda\big(\operatorname{Var}[X] + E[X]^2\big) = \lambda\,E[X^2] \\ E[X] &= e^{\mu + \sigma^2/2}, \qquad E[X^2] = e^{2\mu + 2\sigma^2} \end{aligned}

The Poisson's variance equals its mean λ, which makes the second line collapse. Sums over independent types and over body and tail just add. On the book, in £m:

\begin{aligned} E[S] &= \textstyle\sum_{\text{types}} \big(\lambda_{\text{body}}\,E[X_{\text{body}}] + \lambda_{\text{tail}}\,E[X_{\text{tail}}]\big) = \text{£}24.28\text{m} \\ \operatorname{Var}[S] &= \textstyle\sum_{\text{types}} \big(\lambda_{\text{body}}\,E[X_{\text{body}}^2] + \lambda_{\text{tail}}\,E[X_{\text{tail}}^2]\big) = 1{,}732 \\ \text{sd}[S] &= \text{£}41.6\text{m}, \qquad E[S] + 3.090 \times \text{sd}[S] = \text{£}152.9\text{m} \end{aligned}

Almost all of the variance comes from the tail: 1.2 × 1,442 = 1,731 of the 1,732. The normal estimate of the 99.9% is far below the simulated £430.4m: a skewed total has its quantiles far out, so the formula gives the mean and the simulation gives the tail.

The estimators. With yearly counts $n_1, \dots, n_T$ and losses $x_1, \dots, x_m$ , the maximum likelihood estimates are

\hat\lambda = \frac{1}{T}\sum_{t=1}^{T} n_t, \qquad \hat\mu = \frac{1}{m}\sum_{j=1}^{m} \ln x_j, \qquad \hat\sigma^2 = \frac{1}{m}\sum_{j=1}^{m} (\ln x_j - \hat\mu)^2

The lognormal's σ uses the divisor $m$ , as maximum likelihood does; the dispersion check above uses the sample variance with $n − 1$ . The 99.9% quantile of $n$ simulated years is the value at sorted position $\lceil 0.999\,n \rceil$ .

Try it

Switch the severity to one lognormal per type and watch the tail collapse. Then look at CPBP alone, add the scenarios, and rerun with other seeds to see how much the 99.9% moves when nothing about the model has changed. Each change of model or seed reruns 20,000 years.

Try itSimulate 20,000 years of losses

Severity model

Which losses

Workshop scenarios

Random seed

All seven Basel event types, independent of each other.

20,000 simulated years in bins of £5m. 151 years lost more than £200m and sit off the right edge.

Expected annual loss£24.3m

99.9% one-year loss£430.4m

99% one-year loss£178.4m

99.9% ÷ expected17.7×

Worst of the 20,000 years£2,146m

Sum of stand-alone 99.9%s (types)£1,185m

Observed in the book: £24.1m a year on average over 2016–2025. Types and scenarios are simulated as independent; the quantile is the book's sorted-position rule. Illustrative data, £ millions.

Worked example

From the loss data to a 1-in-1,000 year, then to capital

All figures from the book, £ millions unless stated.

The loss distribution approach on RiskAtoms Bank's book

Step 1 of 5

1
Frequency
Count losses by year and type. External fraud averages 35.3 a year, conduct 11.7, internal fraud 1.3: 89.7 a year in all, of which 88.5 under £1m and 1.2 of £1m or more.

The regulatory measure on the same book

Since 2023 the Basel standard has replaced models like this with one formula: a business indicator component that grows with size, scaled by an internal loss multiplier built from the bank's own ten-year losses.

The standardised approach for RiskAtoms Bank

Step 1 of 4

1
Business indicator
$\begin{aligned} \text{ILDC} &= \min(1{,}511.7,\ 2.25\% \times \text{interest-earning assets} = 1{,}440.75) + \text{dividends} = 1{,}454.75 \\ \text{BI} &= \text{ILDC} + \text{SC} + \text{FC} = 1{,}454.75 + 440.0 + 53.3 = \text{£}1{,}948.1\text{m} \end{aligned}$
Three-year averages. The 2.25% cap binds: the bank's net interest income is larger than the cap.

The formula gives £290.5m under Basel and £265.8m in the UK; the model's 1-in-1,000-year loss is £430.4m, 1.62 times the UK figure. They answer different questions. The formula is simple, comparable across banks and hard to game, and it barely responds to how a bank manages its risk. The model responds to everything, including choices such as the tail split, pooling and dependence that move it by hundreds of millions. Without the redress programme's two provisions, the Basel ILM would fall to 0.891: one event history decides whether the bank pays more or less than its BIC.

Regulatory lens

Under Basel II, published in 2004, the advanced measurement approaches let banks set operational risk capital with their own models, which had to reach the 99.9% one-year loss and draw on internal data, external data, scenarios and business environment and control factors. Many were loss distribution models like this one. The 2017 Basel III reforms replaced the advanced approaches, and the older simple approaches, with the single standardised approach in OPE25: capital = BIC × ILM, with RWA of 12.5 times capital. National supervisors may set the ILM to 1, and the PRA's Operational Risk Part does so from 1 January 2027, so a UK bank's Pillar 1 charge depends on its size alone, though it must still collect its loss data, and the PRA's disclosure templates still include a table of historical losses. Models like the LDA live on inside banks, for their own assessments of the capital they need. The detail of the business indicator, the buckets and the loss data standards is in M4.4: Counterparty, operational and large exposures.

Spark Atoms

Spark AtomMost years are better than average

72% of the simulated years cost less than the expected loss of £24.3m; the median year is only £11.1m. A heavy right tail drags the mean above the typical year, which is why an operational risk budget set at the average is beaten in most years and blown apart in a few.

Spark AtomOne loss, two answers

The single lognormal for conduct risk has a mean loss of £200,817; the losses it was fitted to average £1,353,243. In external fraud the gap is small (£34,262 against £47,575): 353 similar card and payment frauds are what a lognormal is good at. The failure is in the types where one event can be a thousand times the median.

Key takeaways

Frequency is Poisson with λ = the average count a year (89.7 events in all); the variance-to-mean ratio checks the fit.
One lognormal per type, fitted to the logs, follows the small losses and implies only £7.0m a year against £24.1m observed; a separate heavier tail above £1m restores £24.3m.
The annual loss is a random sum: E[S] = λE[X] and Var[S] = λE[X²] in closed form, but its tail needs simulation.
On the book the LDA gives an expected loss of £24.3m and a 99.9% one-year loss of £430.4m, 64% below the sum of the types' stand-alone figures if types are independent; other seeds give £400m to £484m.
The regulatory measure is the standardised approach: BIC £265.8m × ILM 1.093 = £290.5m under Basel, and £265.8m in the UK where the ILM is 1.

Reaction

Check what stuck

Question 1 · objective 1

Payment errors happen about 30 times a year, and each loss is lognormal with μ = 10 and σ = 1.2 (in pounds). What is the expected annual loss, in £m, to two decimal places?

£m

Question 2 · objective 2

One lognormal per event type, fitted to the logs of the losses, implies £7.0m a year of expected loss. The bank actually lost £24.1m a year. Why the gap?

AThe fit follows the hundreds of small losses, so it puts the few very large ones far out in a tail it rarely reachesBThe Poisson frequencies are too lowCThe losses should have been fitted gross, not netDTen years is too short to estimate the mean count

Question 3 · objective 3

A model simulates 20,000 years and sorts the annual losses. Using the rule that the 99.9% quantile is at sorted position ⌈0.999 × n⌉, counting from the smallest, which year is it counting from the largest (1 = the largest)?

Question 4 · objective 4

A UK bank has a business indicator of £1,500m. With the PRA's buckets (12% up to £880m, 15% from £880m to £26bn), what is its business indicator component, in £m?

£m

Question 5 · objective 3

The seven event types' stand-alone 99.9% losses add up to £1,185m; the 99.9% of their total is £430.4m. What does the gap rest on?

AThe assumption that the types are independent: their worst years rarely coincide in the simulationBA data error: quantiles always add upCThe scenarios, which are left out of the stand-alone figuresDThe ILM, which scales the total down

Glossary

Frequency: How many loss events happen in a year. Modelled here as a Poisson count with mean λ.
Severity: How large each loss is, given that it happens. Modelled here as a lognormal.
Dispersion ratio: Variance divided by mean of the yearly counts. A Poisson count has a ratio of 1; well above 1 means the counts are more clustered than Poisson.
Body and tail: The many small and medium losses, here those under £1m net, fitted with their own lognormal per event type. The few large losses, here £1m or more net. Too few to fit per type, so the book fits one lognormal to all twelve together.
Loss distribution approach (LDA): Loss distribution approach: model frequency and severity for each event type, simulate many years of total losses, and read off the expected loss and high quantiles.
Aggregate (annual) loss: The total loss in a year: the sum of a random number of random losses.
99.9% one-year loss: The 99.9% one-year loss: the annual loss exceeded in one year in a thousand. The Basel II internal-model approaches set capital at this level.
Diversification benefit: The saving from adding event types that do not all have bad years together: one minus the total's quantile divided by the sum of the stand-alone quantiles.
Business indicator (BI): Business indicator: a measure of a bank's size from its accounts, the sum of an interest, a services and a financial component, each averaged over three years.
Business indicator component (BIC): Business indicator component: the BI times marginal coefficients of 12%, 15% and 18% in three size buckets.
Loss component (LC): Loss component: 15 times the bank's average annual operational loss over the last ten years.
Internal loss multiplier (ILM): Internal loss multiplier: ln(e − 1 + (LC/BIC)^0.8). It is 1 when LC equals BIC, above 1 for a bank whose losses are high for its size. The UK sets it to 1.

Deep Dives & Origins

Deep Dives

P. V. Shevchenko and G. W. Peters, “Loss distribution approach for operational risk capital modelling under Basel II: combining different data sources for risk estimation”, 2013 (arXiv:1306.1882). Advanced.
PwC, Operational risk: a single standardised approach for all, January 2018: a short guide to the BI, BIC, LC and ILM. Intermediate.

Origins

Basel Committee on Banking Supervision, Basel Framework, OPE25 Standardised approach, version in force from 1 January 2023, BIS (OPE25.2–25.11).
Prudential Regulation Authority, PRA Rulebook: Operational Risk Part, from 1 January 2027 (5.8, 5.9, 7.1).
Basel Committee on Banking Supervision, Operational Risk: Supervisory Guidelines for the Advanced Measurement Approaches, BIS, June 2011, paragraphs 40–41 and 209–211.
P. V. Shevchenko and G. W. Peters, “Loss distribution approach for operational risk capital modelling under Basel II”, 2013, section 1 (the 99.9% one-year requirement).
PwC, Operational risk: a single standardised approach for all, January 2018 (ILM formula; the AMA replaced).

Watch this lesson

Video version

Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.