Back Custom print Link Text Only Rich Text Print

  • Chapter RM-5 Chapter RM-5 Operational Risk

    • RM-5.1 RM-5.1 Operational Risk

      • RM-5.1.1

        Investment firm licensees must document their framework for the proactive management of operational risk. This policy must be approved and regularly reviewed by the Board of Directors of the licensee.

        Adopted: July 2007

      • RM-5.1.2

        Operational risk is the risk to the licensee of loss resulting from inadequate or failed internal processes, people and systems, or from external events. In identifying the types of operational risk losses that it may be exposed to, licensees should consider, for instance, the following:

        (a) The nature of a licensee's customers, products and activities, including sources of business, distribution mechanisms, and the complexity and volumes of transactions;
        (b) The design, implementation, and operation of the processes and systems used in the end-to-end operating cycle for a licensee's products and activities;
        (c) The risk culture and human resource management practices at a licensee; and
        (d) The business operating environment, including political, legal, socio-demographic, technological, and economic factors as well as the competitive environment and market structure.
        Adopted: July 2007

      • RM-5.1.3

        A licensee should recognise that it may face significant operational exposures from a product or activity that may not be material to its business strategy. A licensee should consider the appropriate level of detail at which risk identification is to take place, and may wish to manage the operational risks that it faces in risk categories that are appropriate to its organisational and legal structures.

        Adopted: July 2007

      • RM-5.1.4

        Investment firm licensees must consider the impact of operational risks on their financial resources and solvency.

        Adopted: July 2007

      • RM-5.1.5

        An investment firm licensee's operational risk policy must outline the licensee's strategy and objectives for operational risk management and the processes, including internal controls and risk management mechanisms that it intends to adopt to achieve these objectives.

        Adopted: July 2007

      • RM-5.1.6

        When assessing its operational risks, a licensee may be able to differentiate between expected and unexpected operational losses. A licensee should consider whether it is appropriate to adopt a more quantitative approach to the assessment of its expected operational losses, for example by defining tolerance, setting thresholds, and measuring and monitoring operational losses and exposures. In contrast, a licensee may wish to take a more qualitative approach to assessing its unexpected losses.

        Adopted: July 2007

      • RM-5.1.7

        Although a licensee may currently be unable to assess certain operational risks with a high degree of accuracy or consistency, it should, according to the nature, scale and complexity of its business, consider the use of more sophisticated qualitative and quantitative techniques as they become available.

        Adopted: July 2007

      • RM-5.1.8

        Investment firm licensees must establish mechanisms to ensure adequate internal controls are in place.

        Adopted: July 2007

      • RM-5.1.9

        For the purposes of RM-5.1.8, internal controls for investment firm licensees should include books and records requirements, appropriate organisation structure, segregation of duties, and related controls that are designed to safeguard entity and client assets.

        Adopted: July 2007

      • RM-5.1.10

        Investment firm licensees must establish mechanisms to verify that controls, once established, are being followed. The verification procedures must include internal audits, which must be independent of trading desks and the revenue side of the business.

        Adopted: July 2007

      • RM-5.1.11

        In establishing mechanisms and controls, the investment firm licensee should consider:

        (a) Corporate structure;
        (b) Delegation of authorities;
        (c) Outsourcing of functions;
        (d) Financial and human resources;
        (e) Risk management tools and processes;
        (f) Administrative systems and procedures;
        (g) Audit trail;
        (h) Nature and complexity of client service and fee arrangements;
        (i) Investment decision procedures;
        (j) Management information systems;
        (k) Compliance history and procedures;
        (l) Complaints by investors;
        (m) Regulatory actions; and
        (n) Follow up on regulatory actions and inspection observations.
        Adopted: July 2007

      • RM-5.1.12

        Investment firm licensee's business continuity planning, risk identification and reporting must cover reasonably foreseeable external events and their likely impact on the licensee and its business portfolio.

        Adopted: July 2007

      • RM-5.1.13

        Business continuity management includes policies, standards, and procedures for ensuring that specified operations can be maintained or recovered in a timely fashion in the event of a disruption. Its purpose is to minimise the operational, financial, legal, reputational and other material consequences arising from a disruption. Effective business continuity management concentrates on the impact, as opposed to the source, of the disruption, which affords financial industry participants and financial authorities greater flexibility to address a broad range of disruptions. At the same time, however, investment firm licensees cannot ignore the nature of risks to which they are exposed.

        Adopted: July 2007

      • Risk Monitoring and Controlling

        • RM-5.1.14

          When monitoring their operational risk, investment firm licensees must:

          (a) Report regularly to the relevant level of management its operational exposures, loss experience (including if possible cumulative losses), and authorised deviations from the investment firm licensee's operational risk policy;
          (b) Engage in exception-based escalation to management of:
          (i) Unauthorised deviations from the investment firm licensee's operational risk policy;
          (ii) Likely or actual breaches in predefined thresholds for operational exposures and losses, where set; and
          (iii) Significant increases in the investment firm licensee's exposure to operational risk or alterations to its operational risk profile.
          Adopted: July 2007

      • Record Keeping

        • RM-5.1.15

          Investment firm licensees must retain an appropriate record of their operational risk management activities.

          Adopted: July 2007

        • RM-5.1.16

          RM-5.1.15 may, for example, include records of:

          (a) The results of risk identification, measurement, and monitoring activities;
          (b) Actions taken to control identified risks;
          (c) Where relevant, any exposure thresholds that have been set for identified operational risks;
          (d) An assessment of the effectiveness of the risk control tools that are used; and
          (e) Actual operational risk losses or events against stated risk appetite or tolerance.
          Adopted: July 2007