Using Bayesian networks to model the operational risk to information technology infrastructure in financial institutions

This paper describes the use of Bayesian networks (BNs) to model the operational risk to information technology (IT) infrastructure in financial and other institutions. We describe a methodology for modeling financial losses that might result from operational risk scenarios involving data centers and operational locations, applications and systems, processes, and ultimately IT supported customer-facing services. We focus on modeling the causes and effects of unexpected loss events using a Bayesian network model of the IT infrastructure combined with assessments of the severity of impact of these events in terms of the Value at Risk (VaR) for the organization. We use a state-of-the-art Bayesian network tool to simulate an example analysis of the model. The work also illustrates how ideas commonly used to measure risk in other industries, especially the Aviation and Nuclear sectors, readily translate to operational risk in finance.