High frequency and low severity risks, for example the risks of fraud losses for a credit card issuer, may have high expected losses, but low unexpected losses. In other words, we can generally expect these losses to stay within a small expected and known range. The capital requirement will be the worst case losses at a given confidence level less expected losses, and in such cases this can be expected to be low.
On the other hand, medium severity medium frequency risks, such as the risks of unexpectedlegal claims, 'fat-finger' trading errors, will have low expected losses but a high level of unexpected losses. Thus the capital requirement for such risks will be high.
It is also worthwhile mentioning high severity and low frequency risks - for examplea rogue trader circumventing all controls and bringing the bank down, or a terrorist strike or natural disaster creating other losses - will probably have zero expected losses & high unexpected losses but only at very high levels of confidence. In other words, operational risk capital is unlikely to provide for such events and these would lie in the part of the tail that is not covered by most levels of confidence when calculating operational risk capital.
Note that risk capital is required for only unexpected losses as expected losses are to be borne by P&L reserves. Therefore the operational risk capital requirements for a low severity high frequency risk is likely to be low when compared to other risks that are lower frequency but higher severity.
Thus Choice 'c' is the correct answer.
