Overview
OM-1.1.1
This chapter contains the requirements relating to operational risk management. It sets out the requirements for an appropriate risk management environment. Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems including internal frauds, or from external events including external frauds. This definition includes legal and Shari'a non-compliance risks, but excludes strategic and
reputational risk . Legal risk is the risk arising from the potential that unenforceable contracts, lawsuits or adverse judgments may disrupt or otherwise negatively affect the operations or financial condition of a bank. As legal risk is one type of operational risk, banks should ensure that all requirements included in this Module are also applied to the management of legal risks requirement.Added: January 2020OM-1.1.2
Operational risk is inherent in all types of bank activities, and can result in substantial losses. Sound operational risk governance, therefore, relies upon three lines of defence:
(a) Business line management;(b) An independent operational risk management unit; and(c) Internal Audit and functions that provide independent assurance.Added: January 2020OM-1.1.3
All new products and services must be reviewed for operational risks prior to their implementation. A bank's internal auditors play an important role in controlling operational risks and should include operational risk in the scope of internal audits.
Added: January 2020OM-1.1.4
Shari'a non-compliance is a unique risk for Islamic banks resulting from non-compliance with the rules and principles of Shari'a. It is crucial to identify the Shari'a non-compliance risk inherent in different kinds of Shari'a-compliant contracts, and to outline a set of variables that help to estimate the likelihood and severity of Shari'a non-compliance risk. Refer to Appendix B for Shari'a requirements on financing contracts.
Added: January 2020
