OM-8.2.36
A bank must have policies and procedures that address the process for review and approval of new products, activities, processes and systems. The review and approval process should consider:
(a) Inherent risks in the new product, service, or activity;
(b) Changes to the bank's operational risk profile and appetite and tolerance, including the risk of existing products or activities;
(c) The necessary controls, risk management processes, and risk mitigation strategies;
(d) The residual risk;
(e) Changes to relevant risk thresholds or limits; and
(f) The procedures and metrics to measure, monitor, and manage the risk of the new product or activity.
Added: October 2012