Scenario analysis in the BNDES experience: integrating operational risk management with the measurement of capital

Internal operational risk models have not yet been established as a methodology for calculating regulatory capital. ese models, which must be integrated with operational risk management, have been criticized for the subjectivity of some of their fundamental elements. e purpose of this paper is to demonstrate the use of the “scenario analysis” element in the Loss Distribution Approach (LDA) methodology for calculating regulatory capital relative to operational risk, based on the experience of the Brazilian Development Bank (BNDES) in integrating operational risk management with the measurement of capital. e proposed methodology, which applied the Delphi technique through questionnaires, enabled: (i) the measurement of regulatory capital considering feasible scenarios; (ii) the identi cation of tail and body scenarios for the aggregate distribution of losses, which are not re ected in the internal loss database; (iii) the identi cation and comprehensive measurement of BNDES’s operational risks; (iv) the obtainment of information that can guide risk management with regard to identifying risks that must be given prioritized treatment; (v) the development of a risk culture, with a view to involving specialists from di erent units; and (vi) the use of a methodology that can be understood by all business experts, who are the ones that are aware of the risks of their activities.


INTRODUCTION
e speci cities of the nancial system characterize it as one of the sectors that is most associated with risks. e intermediation of resources between investors and borrowers means that the commitment to the nancial equilibrium of these institutions a ects thousands of individuals and companies, as well as the local nancial system and even the international one when the operations of an institution go beyond the local nancial market.
is propagator e ect is associated with systemic risk, de ned by the Bank for International Settlements (BCBS, 1994) as the risk of one participant's non-ful llment of its contractual obligations a ecting others in the ful llment of theirs. is risk can create a chain reaction of greater nancial di culties. Given the importance of the nancial sector and the risks that are involved in it, in 1988 the BIS, an international nancial organization in which 60 supervisors from countries around the world participate, published the Capital Accord (Basel I) (Basel Committee on Banking Supervision -BCBS, 1988), which proposed guidelines for capital requirements in banks in order to address possible credit risk losses. In 1993, the risk market was incorporated into Basel I. Finally, in 2004, the Second Capital Accord (Basel II) was established, incorporating operational risk.
Given the concern about these risks, minimum capital requirements were de ned for nancial institutions (reference equity). In the case of Brazilian nancial institutions, in December 2017 the reference equity should represent at least 9.25% of risk-weighted assets, which are composed of amounts related to credit, market, and operational risks.
Operational risk is defined as the possibility of occurrence of losses resulting from failure, de ciency, or inadequacy of internal processes, people, and systems, or of external events (Banco Central do Brasil -BC, 2006) and is present in any of an institution's activities, whether nancial or not, given that failures can occur in any process. Such scope makes managing and measuring this risk challenging.
Despite Basel II proposing guidelines for internal operational risk models in 2004, these models have not yet been established as a methodology for calculating capital. In Brazil, no nancial institution uses internal operational risk models to calculate regulatory capital. e non-consolidation of internal operational risk models can be explained by the following factors: (i) the search for totally objective models that are consistent with the subjectivity inherent to operational risk; (ii) the existing gap between the theoretical methodologies and the reality of managing this risk in nancial institutions; and (iii) the challenge of forming a database of comprehensive losses.
According to Wahlstrom (2009), in order to achieve the aims of management and operational control on a dayto-day basis, the assumptions that support risk measuring models need to describe the reality, otherwise they fail because they do not guide decision-making. e author also suggests that studies that satisfy purely academic demands should focus on practice and start discussions together with users and players to nd solutions to real problems.
The gap between the theoretical methodologies and the reality of nancial institutions, in turn, can be explained by the inexistence of research that applies these methodologies to real situations, given that the information about losses from operations risk is treated as con dential information due to the possibility of it compromising the image of these institutions.
The methodology that has been used most for calculating capital related to operational risk is the loss distribution approach (LDA). As required by Basel II, this methodology considers four elements: internal data on losses, external data on losses, scenario analysis, and indicators related to the business environment and to internal controls (Business Environment and Internal Control Factors -BEICFs). e aim of this study is to demonstrate the use of the scenario analysis element in the LDA methodology to calculate regulatory capital related to operational risk as an integrated element of risk management and capital measurement, using the experience of the Brazilian Development Bank (BNDES) in managing operational risk.

LITERATURE REVIEW
e minimum regulatory capital amount related to operational risk should be constituted to absorb severe losses resulting from operational risk events that can compromise the continuity of nancial institutions.
Via Circular Letter n. 3,640/2013 (BC, 2013a), the BC de ned standardized approaches (RWA OPAD ) for calculating this amount. The advanced measurement approach -AMA, based on internal models at the institution, was defined via Circular Letter n. 3,647/2013 (BC, 2013b), which despite having established the minimum requirements for using the AMA approach for calculating the amount related to operational risk (RWA OAMA ), did not specify the methodology that should be used.
e Basel Committee (BCBS, 2004) de nes the four minimum elements of the AMA approach:  e "data on internal losses" element refers to the losses occurring at the institution and is an essential pre-requisite for the development and functioning of a reliable system for measuring operational risk;  The "data on external losses" element refers to the operational losses occurring at other nancial institutions and should be mainly used when there are reasons to believe that the institution is exposed to infrequent, but potentially severe losses;  e "scenario analysis" element, derived from the opinion of experts, should be used to evaluate the institution's exposure to high severity events. is element adds a future vision that is not given by the data on internal and external losses elements; and  e "key factors of the business environment and internal controls" element should re ect the change in operational risk pro le. ese factors will give the risk assessments a forward-looking view, recognizing both improvements and deteriorations in the risk pro le in a more immediate way. Rodriguez, Domínguez, and Marín (2009) state that the LDA methodology is the most sensible for use in internal models for measuring operational risk. Arbeláez and Ceballos (2010) claim that the LDA methodology is the most widely used within the scope of the AMA approach.
In this section, the general guidelines for the LDA methodology and the scenario analysis element will be presented, given the aim of this study: to propose a methodology that integrates the scenario analysis element with the LDA methodology for calculating the minimum capital required to cover operational risk.

LDA Methodology
According to Cruz, Peters, and Shevchenko (2015), the LDA methodology is based on the annual modeling of the frequency N and severity X1, X2, …, X n of the operational risk events of each cell in the matrix of risk of losses classi ed by business line [de ned by the BC in Article 4 of Circular Letter 3,640/2013(BC, 2013a and by the Basel Committee in Annex 8 of Basel II] and by type of operational risk event [de ned by the National Monetary Council in Article 32 of Resolution 4,557/2017(BC, 2017]. So, the annual loss for each risk cell is calculated by aggregating the severities for a one-year time horizon (Z(j)) and the total loss in a particular year is obtained by the sum of all the cells in the risk matrix (Z).
where N is the number of loss events, X is the value of the loss per event, and j is each cell in the loss matrix classi ed by business line and type of operational risk event.
As basic steps of the LDA methodology, Fontnouvelle, Dejesus-Rue , Jordan, and Rosengren (2006), and Frachot, Moudoulaud, and Roncalli (2003) indicate: (i) estimation of severity; (ii) estimation of frequency; (iii) computation of capital via the aggregate distribution of losses obtained based on the frequency and severity distributions using the Monte Carlo simulation or another equivalent technique. e severity estimation covers selecting the theoretical distribution that best adjusts to the loss values (empirical distribution). According to Cruz et al. (2015), it is possible to use one distribution to model the body and another to model the tail. is occurs because the data on losses from operational risk present fat tails. us, one single distribution is not always enough to represent the empirical data. e frequency estimation covers selecting the discrete theoretical distribution that best adjusts to the annual number of events.
A er estimating the parameters of the theoretical distributions, it is necessary to select the distribution that will be considered in the model. Cruz et al. (2015) indicate that the selection can occur via: (i) qualitative diagnostic, such as Q-Q plots and P-P plots; (ii) tail diagnostic, used to evaluate more adequate distributions for fat severity distribution tails, such as mean excess (ME) 1 2 plots and Hill plots; (iii) Akaike information criteria; and (iv) goodness-of-t (GOF) tests, such as Kolmogorov-Smirnov (KS), chi-square, Cramer-von-Mises (CVM), and Anderson-Darling (AD). e aim of these tests is to indicate which theoretical distributions best adjust to the empirical distribution.
After calibrating the frequency and severity distributions, the capital computation is carried out a er the convolution of the theoretical distributions selected. e most widely used methods for convolution of distributions in internal operational risk models are: simulation, such as the Monte Carlo simulation, and methods that are considered exact, such as the Panjer resource (2006) and fast Fourier transform (FFT). e regulatory capital is de ned as the value at risk (VaR) related to the 99.9 percentile of the aggregate distribution, which is the percentile of the annual distribution of losses Z for the next year (OpVar).

Scenario Analysis
e Basel Committee and the BC do not establish the way to use the scenario analysis element and there is also no consensus in the literature regarding the best way to use this element, which is considered very subjective in various studies presented on this topic. Ergashev (2012) de nes scenarios as hypothetical operational risk events at an institution or as is widely known in the nancial literature, inherent risks. ey can thus be useful for prospective adjustments in the frequency and severity of historical events for anticipating changes in the institution's risk pro le.
In order to elaborate this study, a review was carried out of how previous studies have addressed the scenario analysis element within the scope of the LDA methodology. e methodologies used in these studies are summarized below.
For Frachot et al. (2003), scenario analysis expresses the perception of experts and experienced managers regarding the risk of their activities. is perception would not be re ected in the historical data on losses and should be connected with the frequency and severity estimates. As a methodology for using scenario analysis in the LDA methodology, the authors indicated restricting parameters of the frequency and severity distributions. e authors did not present any methodology for de ning the scenarios. McConnell and Davies (2006) proposed the use of the Bow-Tie diagram, a technique used to analyze aviation company safety and generate operational risk scenarios, which aims to answer two fundamental questions regarding the frequency and severity of the scenarios. According to the authors, the Bow-Tie diagram makes assumptions, carries out analyses, explains conclusions related to risk management, and requires an additional step, which is the estimation of the numerical outputs for use in the scenarios in the AMA models. However, this additional step was not shown in the study. Alderweireld, Garcia, and Léonard (2006) de ned a scenario analysis quanti cation -SAQ technique with the following main objectives: (i) constructing a questionnaire that was understood by all operational risk managers; and (ii) transforming the questionnaire into an accurate capital element. e questionnaires had four questions related to the frequency of losses and to the average value. e distribution of frequency considered was the Poission one and the severity distribution was de ned for distributions with two parameters ( rst two moments) de ned in accordance with the average. According to the authors, the methodology presented enabled the construction of the distribution of losses perceived by the experts, even by those that had no knowledge of statistics. However, the authors did not suggest any way of combining these scenarios with the other elements of the LDA methodology.
In addition, Steinho and Baule (2006) argued that if the experts are directly asked what type of distribution is appropriate for a particular category of risk, their answer is not normally useful since when faced with this question they are being pressured to think about an unfamiliar statistical dimension. e argument used by Steinho and Baule (2006) is that this way of determining scenarios, besides not being popular in the banking industry, is normally incomprehensible for the experts. In this context, the authors proposed a methodology for de ning scenarios using questionnaires with questions related to the severity and frequency of events. For the authors, the scenarios obtained could be directly transformed into parametric distributions or used as expert estimates to form a "virtual" database. In the didactic example presented by the authors, as the scenarios and data on internal losses were adjusted by the same severity distribution, it was possible to re ect the two elements in the distribution parameters. Aue and Kalkbrener (2007) presented the quantitative aspects of the LDA model of Deutsche Bank. The fundamental structure of the model was conceived to meet the requirements of Basel II. e scenario analysis element was used to supplement the data on internal losses with the aim of modeling the severity distribution (direct input).  Folpmers (2008) implemented the LDA methodology using the opinion of experts. e Poisson distribution parameters were used to model the frequency and the triangular distribution parameters were used to model the severity. For the author, these two distributions were chosen because they use parameters that can be easily interpreted: the annual average of the number of events, in the Poisson case, and maximum, average, and minimum loss, in the triangular case, which would enable an e ective process for extracting expert knowledge.
Pontes (2009) cites some methods for someway attaching the opinion of experts to the model: (i) fuzzy logic; (ii) Bayensian inference; (iii) dynamic systems; and (iv) parameter estimation by experts. A er analyzing these techniques, which make the use of historical data and expert judgments feasible, the author applied the LDA methodology to a non-nancial company, using a method in which the experts infer frequency and severity distribution parameters. Guegan and Hassani (2011) proposed a methodology for experts to define scenarios to create a synthetic database. e experts de ned generalized extreme value (GEV) distribution parameters for each cell in the Basel matrix and for di erent levels of granularity. e authors compared the nancial institution's capital value using the proposed methodology and the LDA methodology (data on internal losses). With this, they showed that the capital value is higher for the scenario de nition methodology than for the LDA methodology.
Also with regards to applying the scenario de nition method, Rippel and Teply (2011) presented a methodology for combining internal losses with the scenario analysis that used the worst case of loss de ned for one scenario in particular and the average loss given by a probability of loss distribution de ned for a scenario. In both approaches, the values of the scenarios were added to the records on historical losses to determine the frequency and severity distribution parameters.
Momen, Kimiagari, and Noorbakhsh (2012) applied the LDA method in a commercial bank. In this case, the scenario analysis element was used as a direct input; that is, the scenario values were used together with the internal data for frequency and severity modeling. For the authors, this type of methodology for de ning scenarios is much better understood by managers and adds the bene t of expert opinion to the capital measurement.
However, Ergashev (2012) quanti ed scenarios with the frequency estimate that represented the worst case in a time interval and with the severity estimate that represented the lowest value of the severity interval de ned by the experts. e author compared the severity distribution adjusted to the data on internal losses with the scenarios and adjusted the corresponding quantiles of the distribution when the scenarios were not compatible with the distribution. Shevchenko and Peters (2013) indicated that scenarios can be used both in managing operational risk and in the LDA methodology. According to them, the elicitation of experts is a challenge, given that many managers and employees may not have knowledge regarding statistics and probability theory, which can lead to a misleading result and poor understanding. e study did not present any methodology for de ning scenarios.
Hassani and Renaudin (2013) proposed a methodology for combining the internal and external data elements and scenarios obtained in workshops, using the Bayensian approach. However, the study did not present any methodology for de ning scenarios nor was there any application in a real case. Karam (2014) applied the LDA methodology by combining internal data on losses with the scenarios using Bayensian networks. e study also did not present any methodology for de ning scenarios. e author draws attention to the fact that the capital requirement is highly in uenced by these estimates. is study is similar to the one from Lambrigger, Shevc Henko, and Wuthrich (2007).
Despite not having presented any proposed methodology for de ning scenarios, Ames, Schuermann, and Scott (2015) argued that the scenarios should be more important for the internal operational risk models, given that they are a formal mechanism for incorporating the opinion of experts into the models. e authors indicated that the use of this element aims to increase and not reduce the capital, which is highly sensitive to this element. Finally, the authors indicated that the subjectivity of the scenarios can be used to obtain a reward in exchange for a lower regulatory capital. Dutta and Babbel (2014) proposed the change of measure (COM) approach, which combines scenario analysis with data on internal losses and enables the impact of each scenario on the capital value to be evaluated. Via the proposed model, the scenarios are de ned in workshops by experts, who de ne estimates for the severity and for the frequency of the scenarios in a period equivalent to that of the internal losses database. e frequency and severity distribution parameters of the data on internal losses are adjusted to re ect the probability of the scenarios. e authors applied the methodology using 16 scenarios in a nancial institution whose name was not revealed.
Scenario analysis in the BNDES experience: integrating operational risk management with the measurement of capital It is observed that these studies present some characteristics that do not favor the application of these methodologies in a real case because:  they are totally theoretical (Alderweireld et al., 2006;Ergashev, 2012;Ergashev, Blei & Abdymomunov, 2015;Frachot et al., 2003;Hassani & Renaudin, 2013;Karam, 2014;Lambrigger et al., 2007;Mc Connell & Davies, 2006;Shevchenko & Peters, 2013;Steinho & Baule, 2006). e studies do not show real di culties that can be faced by nancial institutions. e con dentiality with which the information on operational risk is treated may explain why applications of real cases are rare in theoretical studies.  the proposed methodologies require statistical knowledge that may not be common to all the experts that de ne the scenarios (Frachot et al., 2003;Guegan & Hassani, 2011;Hassani & Renaudin, 2013;Karam, 2014;Lambrigger et al., 2007;Pontes, 2009;Schevchenko & Peters, 2013), for example: adjustments in parameters of the frequency and severity distributions.  the studies were applied one-o , such as: Dutta and Babbel (2014), Folpmers (2008), and Rippel and Teply (2011).
is study contributes to the topic by proposing a methodology that is easily understood by business unit experts in order to obtain scenarios. To propose the methodology, some assumptions were extracted from the studies chosen, such as: (i) the use of distributions with easily understood parameters, such as the Poisson distribution and triangular distribution (Folpmers, 2008); (ii) the use of information such as direct input in the LDA methodology (Aue & Kalkbrener, 2007;Momen et al., 2012).

METHODOLOGY
Based on the literature review and on the observations derived from the experiences of BNDES in operational risk management, the model shown in this study was structured as indicated in Figure 1. e model aims to de ne the scenarios by measuring the operational risk events identi ed by the units. e risk measurement is made by the experts and compared until there is a consensus in relation to the measurement.
A er de ning the scenarios, as in the stages indicated in Table 1, a synthetic database was formed, which together with the internal data on losses (direct input), was used to measure the capital within the scope of the LDA methodology. In the rst stage of the methodology, the units should report operational risk events that in their view have already occurred or may occur in their processes. e report should occur in a non-structured or zero round way with open questions to guarantee that the events are indicated freely (extraction of scenarios using a bottom-up approach). To facilitate this re ection, the units could have access to di erent information, such as data on external losses, indicators related to the business environment etc.
In the second step of the methodology, a survey of opinion was carried out regarding how comfortable the potential experts feel in relation to the most widely used methodologies for measuring the scenarios, given their knowledge of statistics and probability theory. e survey was motivated by some studies, such as the one from Schevchenko et al. (2013), who indicated that the elicitation of experts is a challenge given that many managers and employees may not have knowledge of statistics and probability theory, which could lead the research to a misleading and poorly understood result.
In the third and fourth steps of the methodology, the events reported in the rst were measured by the experts. e measurements were compared so that the experts could indicate whether they would alter measurements a er having knowledge regarding the measurements carried out by the other experts.
After the measurement, the scenarios formed a synthetic database of losses that was used together with the data on internal losses to calculate the capital, in accordance with the steps indicated by Cruz et al. (2015).

Application of the Methodology
BNDES is a federal public company controlled entirely by the Union and that was created in 1952. Its main objective is to provide long term nancing, to address the de ciency of private sources of this type of nancing, and to invest in di erent segments of the Brazilian economy. e application of this study at BNDES occurred as a result of the institution's interest in developing an internal model for operational risk, and the bank gave us permission to use its information as long as con dential company information was properly protected.

First stage -Applying the methodology for
identifying the scenarios -First round of the questionnaire. A er presentations were carried out to each one of the 24 areas of BNDES with regards to lling in the questionnaire and about the concepts of operational risk, the questionnaires were applied. Each department lled in the questionnaire, indicating the occurred and potential events, as well as their e ects and the mitigation measures.
The areas of BNDES reported 321 occurred and potential loss events. Of these, 98 were excluded from the model for the following reasons: (i) events that are already captured for recording in the database on losses and re ected in the internal losses; (ii) events that can interrupt the activities of BNDES because they have a speci c methodology for measuring nancial impact, which includes other impacts besides possible losses, but not frequency. us, 223 were sent for measurement in the second round of the questionnaire.
Given the secrecy with which this information is treated by BNDES, the events indicated cannot be detailed in this study.

Survey of opinion to de ne the measurement
methodology. e survey, carried out in September 2015, was sent to 524 employees with the position of trust of head of department and manager, which are the positions of the potential experts who would measure the events. Of these, 170 employees answered the survey.
The results analysis indicated that most of the respondents (73%) claimed not to have advanced knowledge of statistics and probability. In relation to the methodologies presented, 68% considered that they were able to estimate how many times an event had occurred or could occur in a particular time period, 53% did not consider that they were able to estimate the minimum, average, and maximum loss values, and 60% did not consider that they were able to estimate probability distribution parameters. Finally, between the two methodologies presented, 79% considered that they were able to estimate the number of times that an event could occur with the minimum, average, and maximum loss values that the probability distribution parameters could estimate.
In light of the results of the survey and with the aim of mitigating the possibility of misleading results, the methodology selected for application in this study was measurement of the number of times that an event can occur in a particular time period and the minimum, average, and maximum loss values.

Application of the methodology for identifying
the scenarios -Second round. e questionnaires from this round were sent in November 2015 to each expert indicated by the areas via email. Two hundred thirty-nine experts took part in this round. e following time interval options were given to the experts to estimate the frequency of the events: ve, ten, or een years, so that it was possible to adapt the frequency of the events to the ve-year internal losses database used.
With the aim of facilitating the measurement of the severity of the events, the areas could use some internal references. For example, if the risk associated with the event could mean the resources released in a credit operation were not recovered, the areas could use their credit operations as a reference. e highest value credit operation would be equivalent to the maximum loss that the event could cause, the average value credit operation would be the average loss, and the lowest value credit operation would be the minimum loss. ese internal references for de ning the severity of the scenarios were called internal business indicators (IBIs).
Of the 223 events measured in this round:  77 were excluded for these main reasons: (i) they may cause a judicial process that would require a speci c methodology to consider jurisprudence, districts, and other information; (ii) they might not cause a loss a er a more detailed evaluation by the experts; and (iii) they should have been analyzed by a di erent area from the one that indicated the risk (the severity measurement could not be carried out by the same area that indicated the risk, for example, when the loss related to the inavailability of systems can only be measured by the areas that use the systems and not by an area such as Information Technology.  70 were measured in non-compliance with the proposed methodology, despite the instructions given, and with this they were excluded. ese cases contemplated: (i) measurements with indications that they were carried out together, despite the instructions given; (ii) risks measured by only one expert due to the others being on vacation or a business trip; and (iii) measurements considered complementary in the cases in which the scope of measurement was di erent, such as a aw in the credit operation documentation, in which the experts are assigned to di erent management units, and consequently with di erent operations portfolios.
A er the exclusions, 76 events remained to compare the measurements in the third round.

Applying the methodology to identify the scenarios -3 rd round.
A er the experts measured the scenarios, all the measurements carried out for the same scenario were sent to them, without identifying the others, for them to indicate whether they agreed or whether they would change the measurements from the second round.
Of the 76 events whose measurements were compared in the third round:  23 were excluded in the third round for the same reasons as the events excluded in the second round; and  seven were measured in non-compliance with the proposed methodology, despite the instructions given, and with this they were excluded. A er the exclusions, 46 events remained to use as scenarios within the scope of the LDA methodology.
In the cases in which the experts did not reach a consensus (divergent measurements), the measurements whose fundamentals were presented were considered. Some experts presented arguments contesting other measurements.
Finally, of the 46 events that remained to compare the measurements in the third round, 10 were measured via IBIs and 36 via the indication of maximum, average, and minimum losses.

Limitations of the Method
Since a case study is concerned, the generalizations of this study should be made with caution, given that the study was carried out at an institution that, like others, has its own characteristics and structure.
In the application of the questionnaires, it is possible that, intentionally or not, the areas did not report events or even underestimated losses (Ames et al., 2015). It is recommended that in other applications of this methodology comparisons are carried out between the database of losses and other questionnaires, or even with the internal controls and auditing report, in order to reduce the chances of some events not being considered.
Finally, there is no way to guarantee that the experts really carried out the measurements individually with the desired independence.

PRESENTATION AND ANALYSIS OF THE RESULTS
In this section the results of applying the proposed methodology are presented along with the analysis of these results.
From this section onwards, the measurements of the events used to form the synthetic database of losses will be considered to calculate the operational risk capital. ese scenarios consider risks existing in the institution that are not re ected in the internal losses database.

Constitution of the Synthetic Database of Losses
A er de ning the number of measurements to be considered, a database of synthetic losses was created with the scenarios measured in conformity with the proposed methodology, in accordance with the following criteria: (i) being constituted for a period of ve years (the same period as the database of internal losses used in this study); (ii) considering the frequency of each measurement based on the number of records created, for example: if the scenario can occur once for a veyear period, only one record related to the scenario was created; (iii) also considering only one record for an event occurring in a period greater than ve years (this procedure is considered to be conservative, given that the scenario could materialize only a er ve years); and (iv) considering the averages of the triangular distributions to de ne the values of the losses. e use of random values for these distributions would lead to instability in the databases with each simulation carried out. Table 2 indicates some descriptive statistics from the database of synthetic losses.

Application of the LDA Model -Internal Losses
Taking the rst four steps de ned by Frachot et al. (2003) for application of the LDA model as a reference, in this section the minimum capital required values (OpVaR) using the LDA methodology will be presented, considering only the internal losses occurring in the last ve years (Model 1) and the internal losses plus the scenarios measured in accordance with the proposed methodology (Model 2). e OpVision was the system used to calculate the capital via the LDA methodology.

Severity estimation.
e tail and the body of the severity distribution were modeled separately. To model them, the OpVision calculated the parameters of the following continuous distributions: burr, empirical, generalized extreme value (GEV), gamma, inverse Gaussian, G and H, linear, lognormal, heavy tailed lognormal, gamma mixture, lognormal-gamma mixture, lognormal mixture, and generalized Pareto and Weibull. A er calculating the parameters, the system orders the distributions into descending order of the minimum p-value between the KS and AD tests, indicating: (i) a green sign when the lowest p-value from the KS and AD tests is higher than 0.01; (ii) a yellow sign when the lowest p-value from the KS and AD tests is between 0.001 and 0.01; (iii) a red sign when the lowest p-value from the KS and AD tests is less than 0.001.
As none of the distributions presented a p-value higher than 0.01, the empirical distribution was selected to model the body of the distributions of the two models.
To model the tail of the distributions of the two models, nine parameters were calculated. In the case of Model 1, the lognormal mixture was the only distribution that presented p-values higher than 0.01 in all of the tests; for this reason it was selected. With regards to Model 2, despite the lognormal mixture distribution having presented a minimum p-value higher than 0.01 for the tail of the distribution, the empirical distribution was used to model the whole distribution, as will also be indicated in section 4.2.3.

Frequency estimation.
To estimate the distribution that best ts the frequency of the distributions of the two models, the OpVision calculated the parameters for the discrete distributions: empirical, negative binomial, Poisson, and Cox process. All the theoretical distributions presented p-values lower than 0.001. For this reason, the empirical distribution was used in the two models.

Computing the capital and con dence interval.
e value of the OpVar of Model 1, obtained via the Monte Carlo simulation with the determination of a relative error of 1% at most, was R$ 219,688,403.00. is value represents the 99.9% percentile of the aggregate distribution of the losses. e relative error of 1% indicates that, in the capital computation, the percentile of the distribution of losses was correctly calculated with a margin of error of 1% at most. e value of the OpVar of Model 2, obtained via the Monte Carlo simulation with the determination of a relative error of 1% at most, was R$ 3,084,486,612.00, which represents the 99.9% percentile of the aggregate distribution of the losses. e tail and the body of the severity distribution of Model 2 were not modeled separately, despite the lognormal mixture distribution having presented a minimum p-value higher than 0.01 for the tail of the distribution, because it did not present a realistic value.

Backtesting
e aim of the backtesting was to compare the results of the models with the data on internal losses with the aim of verifying the performance of the OpVar calculation.
Given that a ve-year database was considered and the minimum period of the database for calculating the capital de ned by the BC is three years (BC, 2013a), it was possible to carry out the backtesting considering three and four year periods. Table 3 summarizes the results found. e scenarios were determined for a period of ve years, with year 1 being the most recent and having the highest number of records in value and quantity, and year 5 being the oldest. To carry out the three-year backtesting (2011 to 2013), years 4 and 5 were eliminated from the scenarios. To carry out the four-year backtesting (2011 to 2014), year 5 was eliminated from the scenarios. us, the years with the lowest number of records were eliminated in order to keep the highest number of scenarios. For this reason (keeping the highest value scenarios and reducing the time window), the OpVar of the three-year backtesting is higher than that of the four-year one.
In both cases, the OpVar values were much higher than the net losses occurring in 2014 and 2015, which cannot be disclosed for con dentiality reasons. us, the OpVar values calculated using the proposed methodology would be su cient to face the occurred losses.

Comparison of the OpVar with the Minimum Capital Required by the Basic Indicator Approach (BIA)
The BIA was defi ned by the BC via Circular Letter 3,640/2013 (BC, 2013a) as one of the standardized approaches for calculating the minimum capital related to the operational risk of Brazilian fi nancial institutions.
Scenario analysis in the BNDES experience: integrating operational risk management with the measurement of capital This is the approach that is currently used by BNDES for calculating capital.
To sum up, with the BIA approach the capital value is equal to 15% of the gross income from the fi nancial intermediation, ignoring provisions. The higher the gross income from the fi nancial intermediation, the higher the capital value. This is the main reason for criticizing the standardized approaches. Figure 2 compares the minimum capital values required for BNDES's operational risk via the BIA approach (base date December/2015) and via the LDA methodology, using only the data on internal losses (Model 1) and using the data on internal losses and the scenarios measured in accordance with the methodology proposed in this study (Model 2). e capital value derived from Model 1 is much lower than the capital value derived from using the BIA approach; however, it is su cient to cover BNDES's historical net operational losses, which cannot be disclosed due to the secrecy with which the institution classi es this information.
The capital value derived from Model 2 reflects operational risk events that have not occurred but that could occur in the view of the areas of BNDES and their experts. e capital should be enough to cover these risks, even though they have not materialized. e fact that Figure 2 indicates that the capital value derived from the proposed methodology is close to the capital value derived from the BIA methodology is a mere coincidence, since the capital value derived via the BIA approach is simply a function of the gross income from BNDES's nancial intermediation in recent years.

CONCLUSION
e internal models for calculating the regulatory capital requirement related to operational risk were not developed with the credit and market risk models. is can be attributed to the characteristics of operational risk, which do not depend on one contract or on one investment to materialize. For this reason, besides severity, frequency (occurring or not) is a variable to be considered in these models.
The absence of extensive internal databases that contemplate all the risks to which a nancial institution is exposed created the need to use other elements, such as data on external losses and scenarios, to overcome this de ciency. However, these elements are criticized because of their subjectivity.  In addition, the regulators demand that these models are integrated into risk management. Obtaining an extensive database and knowledge of the risks to which an institution is exposed require e ective risk management.
us, the aim of this study was to show how the scenario analysis element can be used in order to integrate operational risk management with the measurement of capital.
e proposed methodology enabled the following results: (i) the use of a methodology that is understood by the experts from the di erent areas, who are the ones that know the risks of their activities, and which did not require knowledge of statistics and probability theory, which impedes de ning and measuring the scenarios; (ii) the measurement of regulatory capital considering feasible scenarios to which BNDES is exposed (adjusted to its reality), attending to the regulators regarding the use of the scenario analysis element; (iii) the identi cation of scenarios not only from the tail, but also from the body of the aggregate distribution of losses, which are not re ected in the database of losses; and (vi) the obtainment of information that can guide risk management with regards to identifying risks that should receive prioritized treatment.
In terms of advantages in relation to previous studies, this study: (i) used a methodology for the comprehensive analysis of scenarios in the institution; (ii) presented, in a practical and direct way, how to de ne and measure the scenarios, as well as using them to calculate capital; (iii) used real data to demonstrate the methodology, which is rare in studies related to operational risk because of the company secrecy involving such information. Many studies address the problem without, however, presenting any practical application of a methodology.
Finally, de ning and evaluating scenarios provides an important ow of information on risk management (Scenario-based AMA Working Group, 2003) among the units, which develops the institution's risk culture.
us, the proposed methodology has contributed to the development of a risk culture.
Regarding the external validity, the proposed method can be applied in any institution, given that it requires basic knowledge about statistics and probability theory from the experts. However, it is possible that the fact that BNDES is a public company with a low employee turnover means that the experts carry out the activities for enough time for them to have broad knowledge of the risks involved in their execution.
Despite all the bene ts of implementing the proposed method, it requires a considerable amount of time from the experts and especially from the operational risk management unit, which consolidates all the information and supports all those involved. is represents a relevant cost in relation to the standardized approaches.
In addition, the use of internal models will probably not lead to capital savings since these models contemplate robust estimates of expected and unexpected losses, which are not considered in the standardized approaches.
It is important to highlight that successive applications of this methodology will result in the experts being more mature in relation to operational risk and will consequently increase the quality and precision of the measurements carried out.
Some improvements can be implemented in future applications, such as a single measurement of risks that can occur in various units. As a suggestion for future studies, the proposed methodology could be used to carry out stress tests, if a percentile of the distribution is de ned to establish the severity of the scenario instead of the average of the triangular distribution, for example.
Finally, the Basel Committee reported the replacement of all current standardized approaches and of the internal models for measuring operational risk, from 2022, by a single standardized model that uses internal losses for measuring capital: standardized measurement approach (SMA) (Basel Committe on Banking Supervision -BCBS, 2017). Despite the SMA reducing some weaknesses of the current standardized approaches and considering the database of internal losses, this methodology determines the capital value with reference to the past (occurred losses). It does not re ect potential risks (scenarios) and the risk pro le of institutions. Maintaining the internal models at the same time as the SMA approach would be a way of enabling the comparison between the institutions' capitals and continuing to incentivize the search for a robust internal model for measuring operational risk.