Basel Committee on Banking Supervision

Operational risk is inherent in all banking products, activities, processes and systems, and the effective management of operational risk is a fundamental element of a bank's risk management programme. Sound operational risk management is a reflection of the effectiveness of the board of directors and senior management in administering their portfolio of products, activities, processes and systems.

Although operational risk management and operational resilience address different goals, they are closely interconnected. An effective operational risk management system and a robust level of operational resilience work together to reduce the frequency and the impact of operational risk events.

The following terms are used throughout this chapter and have the meaning given below:

1. Operational risk: is defined in the capital framework as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.
2. Operational resilience: is defined as the ability of a bank to deliver critical operations through disruption. This ability enables a bank to identify and protect itself from threats and potential failures, respond and adapt to, as well as recover and learn from disruptive events in order to minimise their impact on the delivery of critical operations through disruption. In considering its operational resilience, a bank should assume that disruptions will occur, and take into account its overall risk appetite and tolerance for disruption.
3. Risk appetite: refers to the aggregate level and types of risk a bank is willing to assume, decided in advance and within its risk capacity, to achieve its strategic objectives and business plan.1
4. Risk tolerance: is the variation around the prescribed risk appetite that the bank is willing to tolerate.
5. Tolerance for disruption: in the context of operational resilience, refers to the level of disruption from any type of operational risk a bank is willing to accept given a range of severe but plausible scenarios.
6. Operational risk profiles: describe the operational risk exposures and control environment assessments of business units and consider the range of potential impacts that could arise from estimates of expected to severe losses. Profiles generally provide management and the board of directors with a representation of operational risk exposures at a level which supports their decision-making and oversight responsibilities.
7. Information and communication technology: refers to the underlying physical and logical design of information technology and communication systems, the individual hardware and software components, data, and the operating environments.
8. Business unit: broadly includes all associated support, corporate and/or shared service functions (eg Finance, Human Resources, and Operations and Technology). Risk Management and Internal Audit are not included unless otherwise specifically indicated.

Banks’ governance; risk management environment; information and communication technology; business continuity planning; and disclosure practices should not be viewed in isolation; rather, they are integrated components of the operational risk management framework (ORMF) and the overall risk management framework (including operational resilience) of the bank.

Sound internal governance forms the foundation of an effective ORMF. Governance of operational risk management has similarities but also differences relative to the management of credit or market risk. Banks' operational risk governance function should be fully integrated into their overall risk management governance structure.

Banks’ ORMF should adequately and proportionally apply the three lines of defence model to manage all operational risk subcategories, including ICT risk. These three lines of defence consist of: (i) business unit management; (ii) an independent corporate operational risk management function (CORF); and (iii) independent assurance.

Banks should ensure that each line of defence:

1. is adequately resourced in terms of budget, tools and staff;
2. has clearly defined roles and responsibilities;
3. is continuously and adequately trained;
4. promotes a sound risk management culture across the organisation; and
5. communicates with the other lines of defence to reinforce the ORMF.

If in one business unit there are functions of both the first and second line of defence, then banks should document and distinguish the responsibilities of such functions in the first and second line of defence, emphasising the independence of the second line of defence.

Banks should have a policy that defines clear roles and responsibilities in relevant business units. The responsibilities of an effective first line of defence in promoting a sound operational risk management culture should include:

1. identifying and assessing the materiality of operational risks inherent in their respective business units through the use of operational risk management tools;
2. establishing appropriate controls to mitigate inherent operational risks, and assessing the design and effectiveness of these controls through the use of the operational risk management tools;
3. reporting whether the business units lack adequate resources, tools and training to ensure identification and assessment of operational risks;
4. monitoring and reporting the business units' operational risk profiles, and ensuring their adherence to the established operational risk appetite and tolerance statement; and
5. reporting residual operational risks not mitigated by controls, including operational loss events, control deficiencies, process inadequacies, and non-compliance with operational risk tolerances.

The responsibilities of an effective second line of defence should include:

1. developing an independent view regarding business units' (i) identified material operational risks, (ii) design and effectiveness of key controls, and (iii) risk tolerance;
2. challenging the relevance and consistency of the business unit's implementation of the operational risk management tools, measurement activities and reporting systems, and providing evidence of this effective challenge;
3. developing and maintaining operational risk management and measurement policies, standards and guidelines;
4. reviewing and contributing to the monitoring and reporting of the operational risk profile; and
5. designing and providing operational risk training and instilling risk awareness.

The degree of independence of the CORF may differ among banks. At small banks, independence may be achieved through separation of duties and independent review of processes and functions. In larger banks, the CORF should have a reporting structure independent of the risk-generating business units and be responsible for the design, maintenance and ongoing development of the ORMF within the bank. The CORF typically engages relevant corporate control groups (eg Compliance, Legal, Finance and IT) to support its assessment of the operational risks and controls. Banks should have a policy which defines clear roles and responsibilities of the CORF, reflective of the size and complexity of the organisation.

An effective third line of defence should include:

1. reviewing the design and implementation of the operational risk management systems and associated governance processes through the first and second lines of defence (including the independence of the second line of defence);
2. reviewing validation processes to ensure they are independent and implemented in a manner consistent with established bank policies;
3. ensuring that the quantification systems used by the bank are sufficiently robust as (i) they provide assurance of the integrity of inputs, assumptions, processes and methodology and (ii) result in assessments of operational risk that credibly reflect the operational risk profile of the bank;
4. ensuring that business units' management promptly, accurately and adequately responds to the issues raised, and regularly reports to the board of directors or its relevant committees on pending and closed issues; and
5. opining on the overall appropriateness and adequacy of the ORMF and the associated governance processes across the bank. Beyond checking compliance with policies and procedures approved by the board of directors, the independent review should also assess whether the ORMF meets organisational needs and expectations (such as respect of the corporate risk appetite and tolerance, and adjustment of the framework to changing operating circumstances) and complies with statutory and legislative provisions, contractual arrangements, internal rules and ethical conduct.

Because operational risk management is evolving and the business environment is constantly changing, senior management should ensure that the ORMF's policies, processes and systems remain sufficiently robust to manage and ensure that operational losses are adequately addressed in a timely manner. Improvements in operational risk management depend heavily on senior management's willingness to be proactive and also act promptly and appropriately to address operational risk managers' concerns. Where appropriate, strategic and reputational risks should be considered by banks' operational risk management.

Supervisors should regularly assess banks' ORMF by evaluating banks' policies, processes and systems related to operational risk. Supervisors should ensure that there are appropriate mechanisms in place allowing them to remain apprised of banks' operational risk developments.

Supervisory evaluations of operational risk should include all areas described in these Principles. Where banks are part of a financial group, supervisors should ensure that there are processes in place to ensure that operational risk is managed in an appropriate and integrated manner across the group. In assessing banks' ORMF, cooperation and exchange of information with other supervisors, in accordance with established procedures, may be necessary.2 In certain circumstances, supervisors may choose to use external auditors in these assessment processes.3

Supervisors should take steps to ensure that banks address deficiencies identified through the supervisory review of banks' ORMF. Supervisors should use the tools most suited to the particular circumstances of banks and their operating environment. To ensure that supervisors receive current information on operational risk, supervisors may wish to establish reporting mechanisms directly with banks and external auditors (eg internal bank management reports on operational risk could be made routinely available to supervisors).

Supervisors should encourage banks' ongoing internal development efforts by monitoring, comparing and evaluating banks' recent improvements and plans for prospective developments.

The Committee believes that the Principles reflect good practices relevant to all banks. Nonetheless, it recommends that banks should take account of the nature, size, complexity and risk profile of their activities when implementing the Principles.

The board of directors should take the lead in establishing a strong risk management culture, implemented by senior management. The board of directors and senior management should establish a corporate culture guided by strong risk management, set standards and incentives for professional and responsible behaviour, and ensure that staff receives appropriate risk management and ethics training.

Banks with a strong culture of risk management and ethical business practices are less likely to experience damaging operational risk events and are better placed to effectively deal with those events that occur. The actions of the board of directors and senior management as well as the bank's risk management policies, processes and systems provide the foundation for a sound risk management culture.

The board of directors should establish a code of conduct or an ethics policy to address conduct risk. This code or policy should be applicable to both staff and board members, set clear expectations for integrity and ethical values of the highest standard, identify acceptable business practices, and prohibit conflicts of interest or the inappropriate provision of financial services (whether wilful or negligent). The code or policy should be regularly reviewed and approved by the board of directors and attested by employees; its implementation should be overseen by a senior ethics committee, or another board-level committee, and should be publicly available (eg on the bank's website). A separate code of conduct may be established for specific positions in the bank (eg treasury dealers, senior management).

Management should set clear expectations and accountabilities to ensure bank staff understands their roles and responsibilities for risk management, as well as their authority to act.

Senior management should ensure that an appropriate level of operational risk training is available at all levels throughout the organisation, such as heads of business units, heads of internal controls and senior managers. Training provided should reflect the seniority, role and responsibilities of the individuals for whom it is intended.

Strong and consistent board of directors and senior management support for operational risk management and ethical behaviour convincingly reinforces codes of conduct and ethics, compensation strategies, and training programmes.

Banks should develop, implement and maintain an operational risk management framework that is fully integrated into the bank's overall risk management processes. The ORMF adopted by an individual bank will depend on a range of factors, including the bank's nature, size, complexity and risk profile.

The board of directors and bank management should understand the nature and complexity of the risks inherent in the portfolio of bank products, services, activities, and systems, which is a fundamental premise of sound risk management. This is particularly important for operational risk, given operational risk is inherent in all business products, activities, processes and systems.

The components of the ORMF should be fully integrated into the overall risk management processes of the bank by the first line of defence, adequately reviewed and challenged by the second line of defence, and independently reviewed by the third line of defence. The ORMF should be embedded across all levels of the organisation including group and business units as well as new business initiatives' products, activities, processes and systems. In addition, results of the bank's operational risk assessment should be incorporated into the bank's overall business strategy development process.

The ORMF should be comprehensively and appropriately documented in board of directors approved policies and include definitions of operational risk and operational loss. Banks that do not adequately describe and classify operational risk and loss exposure may significantly reduce the effectiveness of their ORMF.

ORMF documentation should clearly:

1. identify the governance structures used to manage operational risk, including reporting lines and accountabilities, and the mandates and membership of the operational risk governance committees;
2. reference the relevant operational risk management policies and procedures;
3. describe the tools for risk and control identification and assessment and the role and responsibilities of the three lines of defence in using them;
4. describe the bank's accepted operational risk appetite and tolerance; the thresholds, material activity triggers or limits for inherent and residual risk; and the approved risk mitigation strategies and instruments;
5. describe the bank's approach to ensure controls are designed, implemented and operating effectively;
6. describe the bank's approach to establishing and monitoring thresholds or limits for inherent and residual risk exposure;
7. inventory risks and controls implemented by all business units (eg in a control library);
8. establish risk reporting and management information systems (MIS) producing timely, and accurate data;
9. provide for a common taxonomy of operational risk terms to ensure consistency of risk identification, exposure rating and risk management objectives across all business units.4 The taxonomy can distinguish operational risk exposures by event types, causes, materiality and business units where they occur; it can also flag those operational exposures that partially or entirely represent legal, conduct, model and ICT (including cyber) risks as well as exposures in the credit or market risk boundary;
10. provide for appropriate independent review and challenge of the outcomes of the risk management process; and
11. require the policies to be reviewed and revised as appropriate based on continued assessment of the quality of the control environment addressing internal and external environmental changes or whenever a material change in the operational risk profile of the bank occurs.

The board of directors should approve and periodically review the operational risk management framework, and ensure that senior management implements the policies, processes and systems of the operational risk management framework effectively at all decision levels.

The board of directors should:

1. establish a risk management culture and ensure that the bank has adequate processes for understanding the nature and scope of the operational risk inherent in the bank's current and planned strategies and activities;
2. ensure that the operational risk management processes are subject to comprehensive and dynamic oversight and are fully integrated into, or coordinated with, the overall framework for managing all risks across the enterprise;
3. provide senior management with clear guidance regarding the principles underlying the ORMF, and approve the corresponding policies developed by senior management to align with these principles;
4. regularly review and evaluate the effectiveness of, and approve the ORMF to ensure the bank has identified and is managing the operational risk arising from external market changes and other environmental factors, as well as those operational risks associated with new products, activities, processes or systems, including changes in risk profiles and priorities (eg changing business volumes);
5. ensure that the bank's ORMF is subject to effective independent review by a third line of defence (audit or other appropriately trained independent third parties from external sources); and
6. ensure that, as best practice evolves, management is availing themselves of these advances.

Strong internal controls are a critical aspect of operational risk management. The board of directors should establish clear lines of management responsibility and accountability for implementing a strong control environment. Controls should be regularly reviewed, monitored, and tested to ensure ongoing effectiveness. The control environment should provide appropriate independence/separation of duties between operational risk management functions, business units and support functions.

The board of directors should approve and periodically review a risk appetite and tolerance statement for operational risk that articulates the nature, types and levels of operational risk the bank is willing to assume.

The risk appetite and tolerance statement for operational risk should be developed under the authority of the board of directors and linked to the bank's short- and long-term strategic and financial plans. Considering the interests of the bank's customers and shareholders as well as regulatory requirements, an effective risk appetite and tolerance statement should:

1. be easy to communicate and therefore easy for all stakeholders to understand;
2. include key background information and assumptions that informed the bank's business plans at the time it was approved;
3. include statements that clearly articulate the motivations for taking on or avoiding certain types of risk, and establish boundaries or indicators (which may be quantitative or not) to enable monitoring of these risks;
4. ensure that the strategy and risk limits of business units and legal entities, as relevant, align with the bank-wide risk appetite statement; and
5. be forward-looking and, where applicable, subject to scenario and stress testing to ensure that the bank understands what events might push it outside its risk appetite and tolerance statement.

The board of directors should approve and regularly review the appropriateness of limits and the overall operational risk appetite and tolerance statement. This review should consider current and expected changes in the external environment (including the regulatory context across all jurisdictions where the institution provides services); ongoing or forthcoming material increases in business or activity volumes; the quality of the control environment; the effectiveness of risk management or mitigation strategies; loss experience; and the frequency, volume or nature of limit breaches. The board of directors should monitor management adherence to the risk appetite and tolerance statement and provide for timely detection and remediation of breaches.

Senior management should develop for approval by the board of directors a clear, effective and robust governance structure with well-defined, transparent and consistent lines of responsibility. Senior management is responsible for consistently implementing and maintaining throughout the organisation policies, processes and systems for managing operational risk in all of the bank's material products, activities, processes and systems consistent with the bank's risk appetite and tolerance statement.

Senior management is responsible for establishing and maintaining robust challenge mechanisms and effective issue resolution processes. These should include systems to report, track and, when necessary, escalate issues to ensure resolution. Banks should be able to demonstrate that the three-lines-of-defence approach is operating satisfactorily and to explain how the board of directors, independent audit committee of the board, and senior management ensure that this approach is implemented and operating in an appropriate manner.

Senior management should translate the ORMF approved by the board of directors into specific policies and procedures that can be implemented and verified within the different business units. Senior management should clearly assign authority, responsibility and reporting relationships to encourage and maintain accountability, and to ensure the necessary resources are available to manage operational risk in line with the bank's risk appetite and tolerance statement. Moreover, senior management should ensure that the management oversight process is appropriate for the risks inherent in a business unit's activity.

Senior management should ensure that staff responsible for managing operational risk coordinate and communicate effectively with staff responsible for managing credit, market, and other risks, as well as with those in the bank who are responsible for the procurement of external services such as insurance risk transfer and other third-party arrangements (including outsourcing). Failure to do so could result in significant gaps or overlaps in a bank's overall risk management programme.

The managers of the CORF should be of sufficient stature within the bank to perform their duties effectively, ideally evidenced by a title that is commensurate with other risk management functions such as credit, market and liquidity risk.

Senior management should ensure that bank activities are conducted by staff with the necessary experience, technical capabilities and access to resources. Staff responsible for monitoring and enforcing compliance with the institution's risk policy should have authority independent from the units they oversee.

When designing the operational risk governance structure, a bank should take the following into consideration:

1. Committee structure - Sound industry practice is for larger and more complex organisations with a central group function and separate business units to utilise a board-created enterprise-level risk committee for overseeing all risks, to which a management level operational risk committee reports. Depending on the nature, size and complexity of the bank, the enterprise-level risk committee may receive input from operational risk committees by country, business or functional area. Smaller and less complex organisations may utilise a flatter organisational structure that oversees operational risk directly within the board's risk management committee.
2. Committee composition - Sound industry practice is for operational risk committees (or the risk committee in smaller banks) to include members with a variety of expertise, which should cover expertise in business activities, financial activities, legal, technological and regulatory matters, and independent risk management.
3. Committee operation - Committee meetings should be held at appropriate frequencies with adequate time and resources to permit productive discussion and decision-making. Records of committee operations should be adequate to permit review and evaluation of committee effectiveness.

Senior management should ensure the comprehensive identification and assessment of the operational risk inherent in all material products, activities, processes and systems to make sure the inherent risks and incentives are well understood.

Risk identification and assessment are fundamental characteristics of an effective operational risk management system, and directly contribute to operational resilience capabilities. Effective risk identification considers both internal factors and external factors. Sound risk assessment allows the bank to better understand its risk profile and allocate risk management resources and strategies most effectively.

Examples of tools used for identifying and assessing operational risk include, but are not limited to, the following and may vary in sophistication depending on the analysis:

1. Event management - When banks experience an operational risk event, the process of identification, analysis, end-to-end management and reporting of the event follows a pre-determined set of protocols. A sound event management approach typically includes analysis of events to identify new operational risks, understanding the underlying causes and control weaknesses, and formulating an appropriate response to prevent recurrence of similar events. This information is an input to the self-assessment and, in particular, to the assessment of control effectiveness.
2. Operational risk event data - Banks often maintain a comprehensive operational risk event dataset that collects all material events experienced by the bank and serves as basis for operational risk assessments. The event dataset typically includes internal loss data, near misses, and, when feasible, external operational loss event data (as external data is informative of risks that are common across the industry). Event data is typically classified according to a taxonomy defined in the ORMF policies and consistently applied across the bank. Event data typically include the date of the event (occurrence date, discovery date and accounting date) and, in the case of loss events, financial impact. When other root cause information for events is available, ideally it can also be included in the operational risk dataset. When feasible, banks are encouraged to also seek to gather external operational risk event data and use this data in their internal analysis, as it is often informative of risks that are common across the industry.
3. Self-assessments - Banks often perform self-assessments of their operational risks and controls on various different levels. The assessments typically evaluate inherent risk (the risk before controls are considered), the effectiveness of the control environment, and residual risk (the risk exposure after controls are considered) and contain both quantitative and qualitative elements. The qualitative element reflects consideration of both the likelihood and consequence of the risk event in the bank's determination of its inherent and residual risk ratings. The assessments may utilise business process mapping to identify key steps in business processes, activities, and organisational functions, as well as the associated risks and areas of control weakness. The assessments contain sufficiently detailed information on the business environment, operational risks, underlying causes, controls and evaluation of control effectiveness to enable an independent reviewer to determine how the bank reached its ratings. A risk register can be maintained to collate this information to form a meaningful view of the overall effectiveness of controls and facilitate oversight by senior management, risk committees, and the board of directors.
4. Control monitoring and assurance framework - Incorporating an appropriate control monitoring and assurance framework facilitates a structured approach to the evaluation, review and ongoing monitoring and testing of key controls. The analysis of controls ensures these are suitably designed for the identified risks and operating effectively. The analysis should also consider the sufficiency of control coverage, including adequate prevention, detection and response strategies. The control monitoring and testing should be appropriate for the different operational risks and key controls across business areas.
5. Metrics - Using operational risk event data and risk and control assessments, banks often develop metrics to assess and monitor their operational risk exposure. These metrics may be simple indicators, such as event counts, or result from more sophisticated exposure models when appropriate. Metrics provide early warning information to monitor ongoing performance of the business and the control environment, and to report the operational risk profile. Effective metrics clearly link to the associated operational risks and controls. Monitoring metrics and related trends through time against agreed thresholds or limits provides valuable information for risk management and reporting purposes.
6. Scenario analysis - Scenario analysis is a method to identify, analyse and measure a range of scenarios, including low probability and high severity events, some of which could result in severe operational risk losses. Scenario analysis typically involves workshop meetings of subject matter experts including senior management, business management and senior operational risk staff and other functional areas such as compliance, human resources and IT risk management, to develop and analyse the drivers and range of consequences of potential events. Inputs to the scenario analysis would typically include relevant internal and external loss data, information from self-assessments, the control monitoring and assurance framework, forward-looking metrics, root-cause analyses and the process framework, where used. The scenario analysis process could be used to develop a range of consequences of potential events, including impact assessments for risk management purposes, supplementing other tools based on historical data or current risk assessments. It could also be integrated with disaster recovery and business continuity plans, for use within testing of operational resilience. Given the subjectivity of the scenario process, a robust governance framework and independent review are important to ensure the integrity and consistency of the process.
7. Benchmarking and comparative analysis - Benchmarking and comparative analysis are comparisons of the outcomes of different risk measurement and management tools deployed within the bank, as well as comparisons of metrics from the bank to other firms in the industry. Such comparisons can be performed to enhance understanding of the bank's operational risk profile. For example, comparing the frequency and severity of internal losses with self-assessments can help the bank determine whether its self-assessment processes are functioning effectively. Scenario data can be compared to internal and external loss data to gain a better understanding of the severity of the bank's exposure to potential risk events.

Banks should ensure that the operational risk assessment tools' outputs are:

1. based on accurate data, whose integrity is ensured by strong governance and robust verification and validation procedures;
2. adequately taken into account in the internal pricing and performance measurement mechanisms as well as for business opportunities assessments; and
3. subject to CORF-monitored action plans or remediation plans when necessary.

These operational risk assessment tools can also directly contribute to a bank's operational resilience approach, in particular event management, self-assessment and scenario analysis procedures, as they allow banks to identify and monitor threats and vulnerabilities to their critical operations. Banks should use the outputs of these tools to improve their operational resilience controls and procedures.

Senior management should ensure that the bank's change management process is comprehensive, appropriately resourced and adequately articulated between the relevant lines of defence.

In general, a bank's operational risk exposure evolves when a bank initiates change, such as engaging in new activities or developing new products or services; entering into unfamiliar markets or jurisdictions; implementing new or modifying business processes or technology systems; and/or engaging in businesses that are geographically distant from the head office. Change management should assess the evolution of associated risks across time, from inception to termination (eg throughout the full life cycle of a product).5

A bank should have policies and procedures defining the process for identifying, managing, challenging, approving and monitoring change on the basis of agreed objective criteria. Change implementation should be monitored by specific oversight controls. Change management policies and procedures should be subject to independent and regular review and update, and clearly allocate roles and responsibilities in accordance with the three-lines-of-defence model, in particular:

1. The first line of defence should perform operational risk and control assessments of new products, activities, processes and systems, including the identification and evaluation of the required change through the decision-making and planning phases to the implementation and post-implementation review.
2. The second line of defence (CORF) should challenge the operational risk and control assessments of first line of defence, as well as monitor the implementation of appropriate controls or remediation actions. CORF should cover all phases of this process. In addition, CORF should ensure that all relevant control groups (eg finance, compliance, legal, business, ICT, risk management) are involved as appropriate.

A bank should have policies and procedures for the review and approval of new products, activities, processes and systems. The review and approval process should consider:

1. Inherent risks - including legal, ICT and model risks - in the launch of new products, services, activities, and operations in unfamiliar markets, and in the implementation of new processes, people and systems (especially when outsourced).
2. Changes to the bank's operational risk profile, appetite and tolerance, including changes to the risk of existing products or activities.
3. The necessary controls, risk management processes, and risk mitigation strategies.
4. The residual risk.
5. Changes to relevant risk thresholds or limits.
6. The procedures and metrics to assess, monitor, and manage the risk of new products, services, activities, markets, jurisdictions, processes and systems.

The review and approval process should include ensuring that appropriate investment has been made for human resources and technology infrastructure before changes are introduced. Changes should be monitored, during and after their implementation, to identify any material differences to the expected operational risk profile and manage any unexpected risks.

Banks should maintain a central record of their products and services to the extent possible (including the outsourced ones) to facilitate the monitoring of changes.

Senior management should implement a process to regularly monitor operational risk profiles and material operational exposures. Appropriate reporting mechanisms should be in place at the board of directors, senior management, and business unit levels to support proactive management of operational risk.

A bank should ensure that its reports are comprehensive, accurate, consistent and actionable across business units and products. To this end, the first line of defence should ensure reporting on any residual operational risks, including operational risk events, control deficiencies, process inadequacies, and non-compliance with operational risk tolerances. Reports should be manageable in scope and volume by providing an outlook on the bank's operational risk profile and adherence to the operational risk appetite and tolerance statement; effective decision-making is impeded by both excessive amounts and paucity of data.

Reporting should be timely and a bank should be able to produce reports in both normal and stressed market conditions.6 The frequency of reporting should reflect the risks involved and the pace and nature of changes in the operating environment. The results of monitoring activities should be included in regular management and board reports, as should assessments of the ORMF performed by the internal/external audit and/or risk management functions. Reports generated by or for supervisory authorities should also be reported internally to senior management and the board of directors, where appropriate.

Operational risk reports should describe the operational risk profile of the bank by providing internal financial, operational, and compliance indicators, as well as external market or environmental information about events and conditions that are relevant to decision making. Operational risk reports should include:

1. Breaches of the bank's risk appetite and tolerance statement, as well as thresholds, limits or qualitative requirements.
2. A discussion and assessment of key and emerging risks.
3. Details of recent significant internal operational risk events and losses (including root cause analysis).
4. Relevant external events or regulatory changes and any potential impact on the bank.

Data capture and risk reporting processes should be analysed periodically with the goal of enhancing risk management performance as well as advancing risk management policies, procedures and practices.

Banks should have a strong control environment that utilises policies, processes and systems; appropriate internal controls; and appropriate risk mitigation and/or transfer strategies.

Internal controls should be designed to provide reasonable assurance that a bank will have efficient and effective operations; safeguard its assets; produce reliable financial reports; and comply with applicable laws and regulations. A sound internal control programme consists of four components that are integral to the risk management process: risk assessment, control activities, information and communication, and monitoring activities.

Control processes and procedures should include a system for ensuring compliance with policies, regulations and laws. Examples of principle elements of a policy compliance assessment are:

1. Top-level reviews of progress towards stated objectives.
2. Verification of compliance with management controls.
3. Review of the treatment and resolution of instances of non-compliance.
4. Evaluation of the required approvals and authorisations to ensure accountability to an appropriate level of management.
5. Tracking of reports for approved exceptions to thresholds or limits, management overrides and other deviations from policy, regulations and laws.

Controls processes and procedures should address how the bank ensures operational resilience is maintained in both normal circumstances and in the event of disruption, reflecting respective functions' due diligence, consistent with the bank's operational resilience approach.

An effective control environment also requires appropriate segregation of duties. Assignments that establish conflicting duties for individuals or a team, without dual controls (eg a process that uses two or more separate entities (usually persons) operating in concert to protect sensitive functions or information) or other countermeasures, may result in concealment of losses, errors or other inappropriate actions. Therefore, areas where conflicts of interest may arise should be identified, minimised, and be subject to careful independent monitoring and review.

In addition to segregation of duties and dual controls, banks should ensure that other traditional internal controls are in place, as appropriate, to address operational risk. Examples of these controls are:

1. Clearly established authorities and/or processes for approval.
2. Close monitoring of adherence to assigned risk thresholds or limits.
3. Safeguards for access to, and use of, bank assets and records.
4. Appropriateness of staffing level and training to maintain technical expertise.
5. Ongoing processes to identify business units or products where returns appear to be out of line with reasonable expectations (eg a supposedly low-risk, low-margin trading activity generating unusually high returns, which could be indicative of an internal control breach).
6. Regular verification and reconciliation of transactions and accounts.
7. Vacation policy that provides for officers and employees being absent from their duties for a period of not less than two consecutive weeks.

Effective use and sound implementation of technology can contribute to the control environment. For example, automated processes are less prone to error than manual processes. However, automated processes introduce risks that must be addressed through sound technology governance and infrastructure risk management programmes.

The use of technology related products, activities, processes and delivery channels exposes a bank to operational risk and the possibility of material financial loss. Consequently, a bank should have an integrated approach to identifying, measuring, monitoring and managing technology risks along the same precepts as operational risk management.

While recourse to entities such as, but not limited to, third-party service providers can help manage costs, provide expertise, expand product offerings, and improve services, it also introduces risks that management should address. The board of directors and senior management are responsible for understanding the operational risks associated with outsourcing arrangements and ensuring that effective risk management policies and practices are in place to manage the risk in outsourcing activities. Amongst others, the concentration of risk and the complexity of outsourcing should be considered. Third-party risk policies (as a part of the ORMF's policies) and risk management activities should encompass:

1. Procedures for determining whether and how activities can be outsourced.
2. Processes for conducting due diligence in the selection of potential service providers.
3. Sound structuring of the outsourcing arrangement, including ownership and confidentiality of data, as well as termination rights.
4. Programmes for managing and monitoring the risks associated with the outsourcing arrangement, including the financial condition of the service provider.
5. Establishment of an effective control environment at the bank and the service provider, that should include a register of outsourced activities and metrics and reporting to facilitate oversight of the service provider.
6. Development of viable contingency plans.
7. Execution of comprehensive contracts and/or service level agreements with a clear allocation of responsibilities between the outsourcing provider and the bank.
8. Banks' supervisory and resolution authorities' access to third parties.

In those circumstances where internal controls do not adequately address risk and exiting the risk is not a reasonable option, management can complement controls by seeking to transfer the risk to another party such as through insurance. The board of directors should determine the maximum loss exposure the bank is willing and has the financial capacity to assume, and should perform an annual review of the bank's risk and insurance management programme. While the specific insurance or risk transfer needs of a bank should be determined on an individual basis, many jurisdictions have regulatory requirements that must be considered.

Because risk transfer is an imperfect substitute for sound controls and risk management programmes, banks should view risk transfer tools as complementary to, rather than a replacement for, thorough internal operational risk control. Having mechanisms in place to quickly identify, recognise and rectify distinct operational risk errors - or specific legal risk exposure - can greatly reduce exposures. Careful consideration also needs to be given to the extent to which risk mitigation tools such as insurance truly reduce risk, transfer the risk to another business sector or area, or create a new risk (eg counterparty risk).

Banks should have unified classification, methodology, and procedures of operational risk management established by the CORF.

Banks should implement a robust ICT risk management programme in alignment with their operational risk management framework.

Effective ICT performance and security are paramount for a bank to conduct its business properly. The appropriate use and implementation of sound ICT risk management contributes to the effectiveness of the control environment and is fundamental to the achievement of a bank's strategic objectives. A bank's ICT risk assessment should ensure that its ICT fully supports and facilitates its operations. ICT risk management should reduce a bank's operational risk exposure to direct losses, legal claims, reputational damage, ICT disruption and misuse of technology in alignment with its risk appetite and tolerance statement.

ICT risk management includes:

1. ICT risk identification and assessment;
2. ICT risk mitigation measures consistent with the assessed risk level (eg cybersecurity, response and recovery programmes, ICT change management processes, ICT incident management processes, including relevant information transmission to users on a timely basis); and
3. monitoring of these mitigation measures (including regular tests).

To ensure data and systems' confidentiality, integrity and availability, the board of directors should regularly oversee the effectiveness of the bank's ICT risk management and senior management should routinely evaluate the design, implementation and effectiveness of the bank's ICT risk management. This requires regular alignment of the business, risk management and ICT strategies to be consistent with the bank's risk appetite and tolerance statement as well as with privacy and other applicable laws. Banks should continuously monitor its ICT and regularly report to senior management on ICT risks, controls and events.

ICT risk management together with complementing processes set by the banks should:

1. be reviewed on a regular basis for completeness against relevant industry standards and best practices as well as against evolving threats (eg cyber) and evolving or new technologies;
2. be regularly tested as part of a programme to identify gaps against stated risk tolerance objectives and facilitate improvement of the ICT risk identification, protection, detection and event management; and
3. make use of actionable intelligence to continuously enhance their situational awareness of vulnerabilities to ICT systems, networks and applications and facilitate effective decision making in risk or change management.

Banks should develop approaches to ICT readiness for stressed scenarios from disruptive external events, such as the need to facilitate the implementation of wide-scale remote-access, rapid deployment of physical assets and/or significant expansion of bandwidth to support remote user connections and customer data protection. Banks should ensure that:

1. appropriate risk mitigation strategies are developed for potential risks associated with a disruption or compromise of ICT systems, networks and applications. Banks should evaluate whether the risks, taken together with these strategies, fall within the bank's risk appetite and risk tolerance;
2. well-defined processes for the management of privileged users and application development are in place; and
3. regular updates are made to ICT including cybersecurity in order to maintain an appropriate security posture.

Banks should have business continuity plans in place to ensure their ability to operate on an ongoing basis and limit losses in the event of a severe business disruption. Business continuity plans should be linked to the bank's operational risk management framework.

Sound and effective governance of banks' business continuity policy requires:

1. regular review and approval by the board of directors;
2. the strong involvement of the senior management and business units leaders in its implementation;
3. the commitment of the first and second lines of defence to its design; and
4. regular review by the third line of defence.

Banks should prepare forward-looking business continuity plans (BCP) with scenario analyses associated with relevant impact assessments and recovery procedures:

1. A bank should ground its business continuity policy on scenario analyses of potential disruptions that identify and categorise critical business operations and key internal or external dependencies. In doing so, banks should cover all their business units as well as critical providers and major third parties (eg central banks, clearing house).
2. Each scenario should be subject to a quantitative and qualitative impact assessment or business impact analysis (BIA) with regards to its financial, operational, legal and reputational consequences.
3. Disruption scenarios should be subject to thresholds or limits (such as maximum tolerable outage) for the activation of a business continuity procedure. The procedure should address resumption aspects, set recovery time objectives (RTO) and recovery point objectives (RPO) as well as communication guidelines for informing management, employees, regulatory authorities, customers, suppliers, and - where appropriate - civil authorities.

A bank should periodically review its business continuity plans and policies to ensure that contingency strategies remain consistent with current operations, risks and threats. Training and awareness programmes should be customised based on specific roles to ensure that staff can effectively execute contingency plans. Business continuity procedures should be tested periodically to ensure that recovery and resumption objectives and timeframes can be met. Where possible, a bank should participate in business continuity testing with key service providers. Results of formal testing and review activities should be reported to senior management and the board of directors.

A bank's public disclosures should allow stakeholders to assess its approach to operational risk management and its operational risk exposure.

A bank's public disclosure of relevant operational risk management information can lead to transparency and the development of better industry practice through market discipline. The amount and type of disclosure should be commensurate with the size, risk profile and complexity of a bank's operations, and evolving industry practice.

Banks should disclose relevant operational risk exposure information to their stakeholders (including significant operational loss events), while not creating operational risk through this disclosure (eg description of unaddressed control vulnerabilities).28,29 A bank should disclose its ORMF in a manner that allows stakeholders to determine whether the bank identifies, assesses, monitors and controls/mitigates operational risk effectively.

Banks should have a formal disclosure policy that is subject to regular and independent review and approval by the senior management and the board of directors. The policy should address the bank's approach for determining what operational risk disclosures it will make and the internal controls over the disclosure process. In addition, banks should implement a process for assessing the appropriateness of their disclosures and disclosure policy.