The bank's strategy must define its tolerance for risk and lay out the Board's understanding of the specific characteristics of operational risk.