Modelling IT risk in banking industry : A study on how to calculate the aggregate loss distribution of IT risk

Sammanfattning: Background: Lack of internal data makes some operational risks hard to calculate with quantitative models. This is true for the IT risk or the risk that a bank will experience losses caused by IT System and Infrastructure failure. IT systems and infrastructure are getting more predominant and important in the banking industry which makes the IT risk even more important to quantify.  Purpose: The aim of this thesis is to find an appropriate way of modelling IT risk for the banking industry. The purpose is to test different models constructed according to the Loss Distribution Approach and observe which models work best at quantifying the IT risk for the banking industry. The reason to quantifying the IT risk using the Loss Distribution Approach for the whole industry is because individual banks do not have enough internal data to do so themselves. There is still a need for a quantitative understanding of this risk and an industry level quantification will help visualize the IT risk exposure banks face today.  Method: In order to find an appropriate way of modelling the IT risk in the banking industry, this paper tries different models constructed using the Loss Distribution Approach. These different models were categorized into two different methods referred to as Method one and Method two. Method one is the simple Loss Distribution Approach to modelling this IT risk and Method two twists this approach by modelling the severity distribution with a hybrid distribution.  Conclusion: In general terms, method two were found to be the best method to use for modelling the IT risk. Hybrid distribution models do a better job at estimating rare events with high severity and are, therefore, good models to use for quantifying the IT risk. A LDA model using Poisson as a frequency distribution and a Pareto tail and Log-logistic body as a severity distribution were the best model to use for modelling IT risk in the banking industry.