OM-1.2 OM-1.2 Developing an Appropriate Risk Management Environment
OM-1.2.1
Licensee's management must implement policies and procedures to manage risks arising out of alicensee's activities. Thelicensee must maintain written policies and procedures that identify the risk tolerances approved by the Board of Directors and must clearly delineate lines of authority and responsibility for managing the risks.Licensees' employees and credit officers in particular must be fully aware of all policies and procedures that relate to their specific duties.January 2014OM-1.2.2
The board of directors must take the lead in establishing a strong risk management culture. The board of directors and senior management must establish a corporate culture that is guided by strong risk management and that supports and provides appropriate standards and incentives for professional and responsible behaviour. In this regard, it is the responsibility of the board of directors to ensure that a strong operational risk management culture exists throughout the whole organisation.
January 2014OM-1.2.3
The operational risk management function must be functionally independent of the risk generating business lines and will be responsible for the design, maintenance and ongoing development of the operational risk framework within the
licensee .January 2014OM-1.2.4
For the purpose of Paragraph OM-1.2.3, 'functionally independent' means that the risk management function cannot report hierarchically and/or functionally to any person or function that is directly responsible for risk generation.
January 2014OM-1.2.5
The operational risk management function should include the operational risk measurement and reporting processes, risk committees and responsibility for board reporting. A key function of the operational risk management function is to challenge the business lines' inputs to, and outputs from, the
licensee's risk management, risk measurement and reporting systems. The operational risk management function should have a sufficient number of personnel skilled in the management of operational risk to effectively address its many responsibilities.January 2014OM-1.2.6
Both the board and
senior management are responsible for creating an organisational culture that places high priority on effective operational risk management and adherence to sound operating controls. Operational risk management is most effective where alicensee's culture emphasises high standards of ethical behaviour at all levels of thelicensee . The board andsenior management should promote an organisational culture which establishes through both actions and words the expectations of integrity for all employees in conducting the business of thelicensee .January 2014The Board of Directors
OM-1.2.7
The board of directors must establish, approve and periodically review the
framework . The board of directors must oversee senior management to ensure that the policies, processes and systems are implemented effectively at all decision levels.January 2014OM-1.2.8
The board of directors must:
(a) Establish a management culture, and supporting processes, to understand the nature and scope of the operational risk inherent in the licensee's strategies and activities, and develop comprehensive, dynamic oversight and control environments that are fully integrated into or coordinated with the overall framework for managing all risks across the enterprise;(b) Provide senior management with clear guidance and direction regarding the principles underlying the framework and approve the corresponding policies developed by senior management;(c) Regularly review the framework to ensure that thelicensee has identified and is managing the operational risk arising from external market changes and other environmental factors, as well as those operational risks associated with new products, activities, processes or systems, including changes in risk profiles and priorities (e.g. changing business volumes);(d) Ensure that thelicensee's framework is subject to effective independent review by audit or other appropriately trained parties such as the compliance function; and(e) Ensure that as best practice evolves, management is availing themselves of these advances.January 2014OM-1.2.9
Strong internal controls are a critical aspect of operational risk management, and the board of directors must establish clear lines of management responsibility and accountability for implementing a strong control environment. The control environment must provide appropriate independence/separation of duties between operational risk management functions, business lines and support functions
January 2014The Role of Committees
OM-1.2.10
A
licensee's governance structure should be commensurate with the nature, size, complexity and risk profile of its activities. When designing the operational risk governance structure, alicensee must take the following into consideration:(a) Committee structure;(b) Committee composition; and(c) Committee operation.January 2014OM-1.2.11
Sound industry practice for larger and more complex organisations with a central group function and separate business units is to utilise a board-created enterprise level risk committee for overseeing all risks, to which a management level operational risk committee reports. Depending on the nature, size and complexity of the
licensee , the enterprise level risk committee may receive input from operational risk committees by country, business or functional area. Smaller and less complex organisations may utilise a flatter organisational structure that oversees operational risk directly within the board's risk management committee.January 2014OM-1.2.12
Sound industry practice is for operational risk committees (or the risk committee in smaller
licensees ) to include a combination of members with expertise in business activities and financial, as well as independent risk managementJanuary 2014Risk Appetite and Tolerance
OM-1.2.13
The board of directors must approve and review a risk appetite and tolerance statement for operational risk that articulates the nature, types and levels of operational risk that the
licensee is willing to assume.January 2014OM-1.2.14
When approving and reviewing the risk appetite and tolerance statement, the board of directors must consider all relevant risks, the
licensee's level of risk aversion, its current financial condition and thelicensee's strategic direction. The board of directors must approve appropriate thresholds or limits for specific operational risks, and an overall operational risk appetite and tolerance.January 2014OM-1.2.15
The risk appetite and tolerance statement should encapsulate the various operational risk appetites within a
licensee and ensure that they are consistent.January 2014OM-1.2.16
The board of directors must regularly review the appropriateness of limits and the overall operational risk appetite and tolerance statement. This review must consider changes in the external environment, material increases in business or activity volumes, the quality of the control environment, the effectiveness of risk management or mitigation strategies, loss experience, and the frequency, volume or nature of limit breaches. The board must monitor management adherence to the risk appetite and tolerance statement and provide for timely detection and remediation of breaches.
January 2014OM-1.2.17
The
licensee must ensure that the internal pricing and performance measurement mechanisms appropriately take into account operational risk. Where operational risk is not considered, risk-taking incentives might not be appropriately aligned with the risk appetite and tolerance.January 2014Ethics Policy
OM-1.2.18
The board of directors must establish a code of conduct or an ethics policy that sets clear expectations for integrity and ethical values of the highest standard and identify acceptable business practices and prohibited conflicts (See Section HC-2.2).
January 2014OM-1.2.19
Clear expectations and accountabilities ensure that staff understand their roles and responsibilities for risk, as well as their authority to act. Strong and consistent senior management support for risk management and ethical behaviour convincingly reinforces codes of conduct and ethics, compensation strategies, and training programmes.
January 2014Compensation Policies
OM-1.2.20
Compensation policies must be aligned to the licensee's statement of risk appetite and tolerance, long-term strategic direction, financial goals and overall safety and soundness. They must also appropriately balance risk and reward.
January 2014Operational Risk Training
OM-1.2.21
Senior management should ensure that an appropriate level of operational risk training is available at all levels throughout the organisation. Training that is provided should reflect the seniority, role and responsibilities of the individuals for whom it is intended.
January 2014Risk Management Framework
OM-1.2.22
Licensees must develop, implement and maintain a framework that is fully integrated into the licensee's overall risk management processes.January 2014OM-1.2.23
The framework for operational risk management chosen by an individual licensee will depend on a range of factors, including its nature, size, complexity and risk profile.
January 2014OM-1.2.24
The board is responsible for establishing a management structure capable of implementing the
licensee's operational risk management framework. Since a significant aspect of managing operational risk relates to the establishment of strong internal controls, it is particularly important that the board establishes clear lines of management responsibility, accountability and reporting. In addition, there should be separation of responsibilities and reporting lines between operational risk control functions, business lines and support functions in order to avoid conflicts of interest. The framework should also articulate the key processes thelicensee needs to have in place to manage operational risk.January 2014OM-1.2.25
The framework must be comprehensively and appropriately documented in board of directors approved policies and must include definitions of operational risk and operational loss.
January 2014OM-1.2.26
Licensees that do not adequately describe and classify operational risk and loss exposure may significantly reduce the effectiveness of their framework.January 2014OM-1.2.27
Framework documentation must clearly:
(a) Identify the governance structures used to manage operational risk, including reporting lines and accountabilities;(b) Describe the risk assessment tools and how they are used;(c) Describe thelicensee's accepted operational risk appetite and tolerance, as well as thresholds or limits for inherent and residual risk, and approved risk mitigation strategies and instruments;(d) Describe thelicensee's approach to establishing and monitoring thresholds or limits for inherent and residual risk exposure;(e) Establish risk reporting and Management Information Systems (MIS);(f) Provide for a common taxonomy of operational risk terms to ensure consistency of risk identification, exposure rating and risk management objectives;(g) Provide for appropriate independent review and assessment of operational risk; and(h) Require the policies to be reviewed whenever a material change in the operational risk profile of thelicensee occurs, and revised as appropriate.January 2014OM-1.2.28
The board should review the framework regularly to ensure that the
licensee is managing the operational risks arising from external market changes and other environmental factors, as well as those operational risks associated with new products, activities or systems. This review process should also aim to assess industry best practice in operational risk management appropriate for thelicensee's activities, systems and processes. If necessary, the board should ensure that the operational risk management framework is revised in light of this analysis, so that material operational risks are captured within the framework.January 2014Independent Review of Operational Risk
OM-1.2.29
The board of directors must ensure that the
licensee's operational risk management framework is subject to effective and comprehensive independent review.January 2014OM-1.2.30
The independent review functions are the internal audit and compliance functions and the staff occupying these functions must be competent and appropriately trained and not be involved in the development, implementation and operation of the operational risk
framework. January 2014OM-1.2.31
With reference to Paragraph OM-1.2.30, internal audit and compliance should not be involved with the setting of risk appetite or risk tolerance. Internal audit should be reviewing the robustness of the process of how these limits are set and why and how they are adjusted in response to changing circumstances. More details on the internal audit function and the role of the audit committee are included in Chapter HC-3.
January 2014OM-1.2.32
An independent review consists of the verification of the framework on a periodic basis and is typically performed by the licensee's internal and/or external audit, but may involve other suitably qualified independent parties from external sources. Verification activities test the effectiveness of the overall framework, consistent with policies approved by the board of directors, and also test validation processes to ensure that they are independent and implemented in a manner consistent with established policies of the licensee.
January 2014OM-1.2.33
Licensees should have in place adequate internal audit coverage to verify that operating policies and procedures have been implemented effectively. The board (either directly or indirectly through its audit committee) should ensure that the scope and frequency of the audit programme is appropriate to the risk exposures. Audit should periodically validate that thelicensee's operational risk management framework is being implemented effectively across thelicensee .January 2014Senior Management
OM-1.2.34
The responsibilities of the
senior management of thelicensee must include:(a) Developing for approval by the board of directors a clear, effective and robust governance structure with well defined, transparent and consistent lines of responsibility;(b) Implementing the operational risk strategy approved by the Board of Directors;(c) Ensuring that the strategy is implemented consistently throughout the whole organisation;(d) Ensuring that all levels of staff understand their responsibilities with respect to operational risk management;(e) Developing, maintaining and implementing policies, processes and procedures for managing operational risk in all of thelicensee's products, activities, processes and systems consistent with the risk appetite and tolerance;(f) Developing succession plans for senior staff; and(g) Developing business continuity plans for thelicensee .January 2014OM-1.2.35
Senior management is responsible for establishing and maintaining robust challenge mechanisms and effective issue-resolution processes. These must include systems to report, track and, when necessary, escalate issues to ensure resolution.
Licensees must be able to demonstrate that the three lines of defence approach is operating satisfactorily and to explain how the board and senior management ensure that this approach is implemented and operating in an appropriate and acceptable manner.January 2014OM-1.2.36
Senior management must translate the operational risk strategy established by the board of directors into an operational risk management framework that refers to specific policies, processes and procedures that can be implemented and verified within the different business units.
January 2014OM-1.2.37
While each level of management is responsible for the appropriateness and effectiveness of policies, processes, procedures and controls within its purview,
senior management should clearly assign authority, responsibility and reporting relationships to encourage and maintain this accountability.January 2014OM-1.2.38
Senior management must ensure that the necessary resources are available to manage operational risk effectively. Moreover,
senior management must assess the appropriateness of the management oversight process in light of the risks inherent in a business unit's activity.January 2014OM-1.2.39
Senior management should ensure that thelicensee's activities are conducted by qualified staff with the necessary experience, technical capabilities and access to resources. Staff responsible for monitoring and enforcing compliance with the institution's risk policy should have authority independent from the units they oversee.January 2014OM-1.2.40
Senior management must ensure that staff responsible for managing operational risk coordinate and communicate effectively with staff responsible for managing credit, market, and other risks, as well as with those in thelicensee who are responsible for the procurement of external services such as insurance purchasing and outsourcing agreements. Failure to do so could result in significant gaps or overlaps in alicensee's overall risk management programme.January 2014OM-1.2.41
The managers of the corporate operational risk management function should be of sufficient stature within the
licensee to perform their duties effectively, ideally evidenced by title commensurate with other risk management functions such as credit, market and liquidity risk.January 2014OM-1.2.42
Particular attention should be given to the quality of documentation controls and to transaction-handling practices. Policies, processes and procedures related to advanced technologies supporting high transactions volumes, in particular, should be well documented and disseminated to all relevant personnel.
January 2014Management Information System
OM-1.2.43
The management information system of an organisation plays a key role in establishing and maintaining an effective operational risk management framework.
January 2014OM-1.2.44
Communication flow serves the purpose of establishing a consistent operational risk management culture across the
licensee . Reporting flow enables:(a)Senior management to monitor the effectiveness of the risk management system for operational risk; and(b) The Board of Directors to overseesenior management performance.January 2014
