1

 The objective of operational risk management is the same as for credit, market and liquidity risks that is to find out the extent of the financial institution’s operational risk exposure; to understand what drives it, to allocate capital against it and identify trends internally and externally that would help predicting it.  Failure to understand and manage operational risk, which is present in virtually all banking transactions and activities, may greatly increase the likelihood that some risks will go unrecognized and uncontrolled. 2

Corporate Governance Board of Directors to provide guidance, approve and periodically review bank’s OR management framework Senior management to translate framework into specific policies, processes and procedures consistently and comprehensively Establishment of independent OR management function Identification and Assessment Identification and Assessment OR identification based on process/activity maps, and loss data collection Development of forward-looking early warning indicators and self- assessments OR quantification, based on data sources and scenario analysis Validation and back-testing of results Control and Mitigation Internal control policies, processes, procedures and systems Incorporation in budgeting, strategy and business applications Evaluation of alternative risk mitigants Monitoring Systematic tracking of loss events, KRIs and CRSA scores Timely, accurate, relevant and periodic MIS and other (e.g. ‘heat map’) reporting Education and communication workshops, Forums etc. * Largely based on ‘Sound Practices for the Management and Supervision of Operational Risk’, Basel Committee on Banking Supervision (February 2003). 3

* Based on Basel Committee’s OR loss event classification 4

5

6

Three Pillars Minimum capital requirements Risk weighted assets Credit risk Standardized Approach Internal Ratings-based Approach Operational risk Basic Indicator Approach Standardized Approach Advanced Measurement Approaches Market risks Standardized Approach Models Approach Definition of capital Core Capital Supplementary Capital Supervisory review process Market discipline 7

The Advanced Measurement Approach is the most advanced of the three options. Under this approach, each firm calculates it own capital requirements, by developing and applying its own internal risk measurement system. As with the Standardized Approach, the firm must meet certain qualifying criteria, and the risk measurement system must be validated by the regulator before it will be allowed to take advantage of the AMA. In calculating operational risk capital charges, Basel II sets out three different methods which may be adopted. The Basic Indicator Approach is the simplest of the three approaches, and will be the default option for most firms. It applies a calculation based on the firm's income to determine its capital requirements. The Standardized Approach relies on calculations based on income, but with different percentages applying across different business lines. To be able to take advantage of the Standardized Approach, firms will have to meet certain qualifying criteria. 8

 Loss Data Collection Framework - Collection of Losses - Validity of Losses - Analysis of Losses - Tailored Insurance Policies - Risk Sensitive Control Framework  Risk and Control Mitigation Framework - Identification of Risk & Control - Mitigation of Control (i.e mitigating risk and hence reducing loss) 9

10