Page | 1

Assignment
On
Operational Risk management framework
Subject
Operations Management in Banks
Submitted To:
Sir Khalid Sultan Anjum
Submitted By
Mohammad Younas
Roll No.
MBK-M-12-03
MBA (B&F) Morning
6thsemester

ALFALAH INSTITUTE OF BANKING AND FINANCE

BAHAUDDIN ZAKARIYA UNIVERSITY
MULTAN

Page | 2

Q No. 1:

Guidelines formulated by SBP

Apart from capturing monetary losses, non-monetary losses (loss of profit, opportunity costs etc), control
breaches and near-misses should also be recorded by the banks for their own risk management. All such
cases where the bank recovers the entire amount involved and does not suffer any loss may also be captured.
Near misses can play a useful part in conducting scenario analysis which adds future-looking dimension to
loss data. Near misses are also important for highlighting weaknesses and can help to determine whether the
loss was avoided because of experience, luck or controls.
Banks may also develop documented procedures for assessing the ongoing relevance of historical loss data.
For comparison purposes bank may use judgment overrides, scaling or other adjustments. For example,
inflationary impacts and scale adjustments for meaningful comparison with previous years losses.
Q No. 2:

Importance of ORM:

SBP has been encouraging banks to follow international best practices and instill sound risk management
and corporate governance culture. In this regard, SBP has been issuing instructions from time to time which
include the following main circulars:

Risk Management guidelines were issued vide BSD circular 7 of August 15, 2003 to provide broad
level guidance on various risks (including operational risk) faced by the banks.
Guidelines on Internal Controls were issued vide BSD Circular 7 of May 27, 2004, to ensure
existence of an effective internal control systems.
Business Continuity Planning guidelines were issued vide BSD circular 13 of September 4, 2004, in
which the banks were advised to develop effective contingency and security plan.
SBP Implementation of Basel II guidelines issued vide BSD circular 8 of June 27, 2006 which in
addition to credit and market risks also require banks to allocate capital for operational risk based on
prescribed approaches.

Operational risk has been defined as the risk of loss resulting from inadequate or failed internal processes,
people and system or from external events. It includes legal risk but exclude strategic and reputational risk1.
The definition attempts to categorize underlying causes of operational risk in a much broader prospective
i.e. people, processes, systems and external factors. However, the scope of operational risk does not include
following events (and resultant losses) as these are to be covered under Pillar 2 of Basel II accord.

Strategic Risk - senior managements business decisions in normal course of business which do not
violate any rule, regulation etc.
Reputational risk as it arises mainly due to occurrence of other risk events.

It is imperative that banks try to prevent frauds and reduce transaction errors by maintaining strong
emphasis on internal controls and develop their human resources. With ever changing business environment,
product complexity, diversification, increased quantum of electronic transactions and outsourcing; banks are
required to set up a mechanism for ongoing evaluation of their true operational riskiness according to their
size, sophistication, nature of operations and expected level of capital.
Operational risk is an evolving discipline and hence significant flexibility is available to banks in
developing operational risk measurement and management systems. Some of the banks have already
initiated collection of their operational risk loss data with a view to use the same for the assessment of

Page | 3

inherent and residual risks with possible extension towards measurement of risk based performance and
allocation of capital. Hence, to provide industry a minimum set of instructions for meeting the supervisory
expectation under Basel II requirements and to address some of the key challenges faced by the banks when
collecting internal operational losses, SBP has formulated these guidelines with the goal of promoting
consistency, completeness and accuracy in the collection of operational risk data which would form the
basis for risk analysis and control to be used.

Q No. 3:

Principles for Sound Management of Operational Risk

Operational risk is inherent in the banks activities and is an important element of enterprise wide risk
management system. In the past few years, significant progress has been made in the area of implementing
operational risk management framework and accordingly following main principles2 for the sound
management of operational risk have emerged. All banks are advised to follow these principles in their
approach to operational risk management.
The ultimate responsibility and accountability rests with the board of directors to ensure that a strong risk
management culture exists throughout the organization. The board can delegate this responsibility to senior
management with clear guidance and direction to inculcate a risk culture within the organization.
2.2. The bank should develop, implement and maintain Operational Risk Management Framework which
should be integrated into banks overall risk management processes. The framework should be documented,
duly approved by the board and at the minimum should:

Define the terms operational risk and operational loss.

Identify governance structure, reporting lines, responsibilities and accountabilities.
Describe various risk assessment tools and modus operandi on the effective use of these tools.
Describe the banks accepted operational risk appetite and tolerance levels, and thresholds limits for
inherent and residual risks with approved risk mitigation/ transfer strategies.
Define banks approach for establishing and monitoring thresholds/ exposure limits for inherent and
residual risk exposure.
Describe risk reporting mechanism and appropriate hierarchy level at which the reporting would be
escalated.
Provide common definition/ classification terminology to ensure consistency of risk identification,
exposure ratings and risk management objectives.
Describe process of independent review and assessment of operational risk by Audit or independent
qualified personnel.
Define process of updating the framework on an ongoing basis and whenever a material change in
the operational risk profile of the bank occurs.

The board of directors should establish, approve and periodically review the Framework and should oversee
senior management to ensure that the policies, processes and systems are implemented effectively at all
decision levels. The framework should be reinforced through a strong internal control environment with
clear lines of managements responsibility and accountability. The control environment should provide
appropriate independence/ separation of duties between operational risk management function, business
lines and support functions.
The Board is responsible to approve and review risk appetite3 and tolerance statement for operational risk
depending on nature, size, and complexity of business, current financial condition and the banks strategic

Page | 4

direction. The risk appetite and tolerance statement should capture the past and future aspects as part of their
risk management and capital assessments. The banks may express risk appetite in shape of loss data
thresholds, Risk Control Self Assessment remedial action prompts and Key Risk Indicators thresholds.
Moreover, with change of business and control environment, the board should regularly review the
appropriateness of threshold or limits for specific operational risks and an overall operational risk appetite
and tolerance.
Senior Management is responsible to develop governance structure with transparent, well defined and
consistent lines of responsibilities. The governance structure after approval from the board would be
implemented and senior management should ensure that policies, procedures and systems to manage
operational risk cover all material products, activities and processes in line with the established risk appetite
and tolerance. The role of management is to effectively communicate laid down procedures / guidelines
down the line and across various business lines to put in place a reasonable system for implementation of
policy.
Senior management should ensure the identification and assessment of the operational risk inherent in all
material products, activities, processes and systems to make sure the inherent risks and incentives are well
understood.
It is the responsibility of management that before the introduction/ launch of new products, activities,
processes and systems; there must be an approval system to adequately assess operational risk inherent in
these initiatives. The approval process at the minimum should ensure that the product/ activity added is in
line with the risk appetite/ tolerance level and adequate human, infrastructure and necessary controls are
available to carry out introduced activities.
For proactive management, senior management should implement a process to regularly monitor operational
risk profiles and material exposures to losses. The ongoing monitoring necessitates the establishment of an
effective and efficient reporting mechanism to the board, senior management and business lines. The
reporting at the minimum should contain breaches of tolerance limits, details of significant internal or
external operational risk events that can affect banks operational risk profile.
Banks should have a strong control environment that utilizes policies, processes and systems; appropriate
internal controls; and appropriate risk mitigation and/or transfer strategies.
Banks should have business resiliency and continuity plans in place to ensure an ability to operate on an
ongoing basis and limit losses in the event of severe business disruption.
For transparency and market discipline, banks are advised to properly disclose their approach of operational
risk management to its stakeholders.

Q No. 4:

For effective management of operational risk

For effective management of operational risk, each bank should establish an independent operational risk
management function. Banks need to ensure that the function has adequate and qualified human resource
with technical capacities to manage operational risk. Operational Risk Management function should be
designated with the following responsibilities;
I.
Developing and updating operational risk policy and ensuring that operational risk management is
carried out as per approved policy.

Page | 5

II.
III.
IV.
V.

Developing and maintaining operational risk framework to improve the way in which operational
risk is identified, assessed, controlled, mitigated, reported and monitored.
Communicate and coordinate with various risk management activities/ business lines and suggest
plans for minimizing risk and improving the internal controls.
Providing independent opinion to senior management and the board regarding products/ activities
that can significant alter operational risk profile of the bank.
Set up a system for consistent and comprehensive operational risk data gathering and to present their
findings to the business line managers, senior management & the board for review of banks
progress towards stated policies/ objectives.

Q No. 5:

Sound operational risk governance lines of defense

The sound operational risk governance practices rely mainly on three lines of defense. Therefore the
framework should also be based on the following lines:
I.
Business line management is the first line of defense against operational risk. Business line
management is responsible for identifying and managing risks in the products, activities, processes
and systems for which they are accountable. It is important that clearly documented and regularly
updated operating manuals are readily available to all the employees. Segregation of duties need to
be ensured. It is also necessary that operational staff must have necessary skills and training so that
they can fulfill their duties.
II.
A separate independent operational risk management function is the second line of defense and has
become a good practice. Independent operational risk management function would assist
management to understand and manage operational risk. The function should be responsible to assist
in establishing policies & standards and coordinate with various businesses/ risk management
activities. The function assesses, monitors, and reports operational risks as a whole, and ensures that
the management of operational risk in the bank is as per approved strategy/ policies.
III.
Independent validation and verification is the third line of defense in the governance structure. It
serves as a challenge function to the other two lines of defense. Internal audit or any independent
group of qualified staff may conduct these independent reviews. Since internal audit reports to the
board audit committee therefore audit function should also provide assurance to the board regarding
effectiveness of the operational risk management framework. Senior management should seriously
investigate the findings of audit to set up a risk culture in the bank.

Q No. 6:

Verification & Validation

The operational risk measurement system (ORMS) is a subset of an operational risk management
framework. The ORMS consists of the systems and data used to measure operational risk in order to
estimate the operational risk capital charge. The ORMS must be closely integrated into the day-today risk management processes.
Internal audit coverage should be adequate to independently validate and verify that the Framework
and ORMS has been implemented as intended and is functioning effectively. Internal audit coverage
should include opining on the overall appropriateness and adequacy of the Framework and the
associated governance processes across the bank. Internal audit should not simply be testing for
compliance with board approved policies and procedures, but should also be evaluating whether the
Framework meets organizational needs and supervisory expectations.
The validation activities conducted by internal audit provide opinion whether the capital held (or
estimated) is fulfilling internal and supervisory purposes. The validation activities are mostly
designed to provide opinion regarding the operational risk model working. However, at this stage
banks validation activities should ensure that ORMS used by the bank is robust and provide

Page | 6

assurance regarding integrity of input, process, assumptions (if any) and output. The work of internal
validation also covers qualitative aspects such as validation of data inputs, reporting, role of senior
management and methodology/ intended use of operational risk models etc.
The periodic verification activities can be conducted by the banks internal and/or external audit or other
independent parties. The verification ensures the following:
i.
Policies, processes, procedures and systems which comprises the banks operational risk
management framework including ORMS is conceptually sound, transparent and documented.
ii.
Business unit activities, the independent operational risk management function and governance
committees and structures are effective and appropriate.
iii.
The framework input and outputs are accurate, complete, credible, relevant, authorized and
accessible.
iv. Risk monitoring and management of the accuracy and soundness of all significant processes and
systems are effective.
v. Appropriate remedial measures are undertaken whenever deficiencies are identified.
vi.
Comparisons of RCSA, KRIs and scenario results with the actual loss experience (internal data or
external data) are done effectively.
vii.
Tests of controls determine whether these controls are designed to prevent or detect and correct
material deviations/ non-compliance with the policies/ procedures and operate effectively throughout
the period being reviewed.
viii.
Every significant activity of the bank, as well as subsidiaries of the bank, must be included.
ix.
Results from verification and validation work should be documented and distributed to appropriate
business lines management, internal audit, operational risk management function and appropriate
risk committees.
Bank staff ultimately responsible for the validated unit, they should also have an access and understanding
of these results.
i.
Reporting of verification and validation work should also include underlying processes to resolve
deficiencies and weaknesses, ensuring that corrective actions are implemented in a timely manner.
ii.
Internal audit should also evaluate managements response to significant findings.
iii.
Results of verification and validation reviews should be summarized and reported annually to the
banks board of directors and committee thereof. Confirmation by senior management entails review
and approval of the effectiveness of the banks operational risk management framework including
operational risk management system.
The verification and validation reporting should:
i.
Summarize the verification and validation work done; indicate any limitations in the scope of work
performed and details of deviations from the plan, if any.
ii.
Identify weakness and their potential consequences, including deviation from policy, procedures and
Basel (II & onward) requirements.
iii.
Establish a corrective action plan and s

Q No. 7:

Internal Loss Data

General Requirements:
I.

The collection and analysis of banks own loss data can provide vital information to management
and provide basis for operational risk management and mitigation. However, most of the banks do
not have documented history of operational losses. Therefore as a first step, banks need to set up a
system for consistent and comprehensive loss data gathering.

Page | 7

II.

III.

Banks internal loss data would mostly comprise of high frequency and low severity events with
very few large losses. Such a database may not be relevant for quantitative modeling. However by
studying trends of internal losses, banks can improve the efficiencies of its processes and internal
controls. Hence, banks need to assess the depth of their data collection which may be used for risk
management and/or risk quantification model.
The industry practices regarding risk modeling are in evolving stage, therefore the data collection
system should have the inbuilt flexibility to adapt to such changes.

The scope of operational risk management includes internal inadequacies, events triggered by external
causes and legal settlements. Banks should collect data for all losses pertaining to operational errors and
internal control failures etc., even if such losses are related to the credit or market risk areas. However,
banks should be able to tag their losses pertaining to market and credit risk by introducing a separate field in
the database from rest of the losses. This would facilitate banks in the implementation of advanced
approaches where these data points would be used separately for the modeling purposes.
I.

II.

III.

IV.

V.

VI.

The challenges banks are likely to face in building internal loss database would depend on the
processes of collection, level of automation and nature of losses. Event data capturing system should
be part of workflow and entire organization is expected to participate in operational risk event
collection & reporting.
Another likely challenge for banks in loss data collection would be to get the involvement of
employees. Banks will have to work on enhancing risk awareness and establishing a risk culture to
avoid incomplete or erroneous data reporting. The bank should have policies regarding consistent
recognition of operational losses and their reporting to internal loss data base. Further, to the extent
possible, banks may verify number of losses and amount with their General Ledger.
Banks internal loss data must be comprehensive enough to capture material losses by business lines.
The banks should have clear and consistent definitions for the collection of operational risk losses
and documented criteria by which losses are allocated to specific business lines and event types. The
adopted classification criteria should also contain methodology for classifying any new activity or
product to be introduced in the future, into one of these business lines.
Banks/ DFIs are required to set up approval procedure/ policy for identification, collection and
recording of losses in the centralized database. These procedures may provide guidance to any staff
unfamiliar with the data collection processes. The policy should clarify the roles and responsibilities
of operational risk management function and business line management regarding ongoing data
management.
To ensure consistency and accuracy of data collection, the input in the database should be checked
and approved by some approving/ counterchecking authority. Moreover, depending upon the nature
and severity of loss, bank should also establish a reporting mechanism to escalate the loss reporting
to relevant designated authority.
A bank is responsible for defining and justifying appropriate thresholds for each operational risk
class (e.g. business line (BL), event type (ET), combination of BL & ET, products etc.). Thresholds
need to be defined for data capturing and loss reporting so that management has the ability to
evaluate and react to operational risk events. The thresholds would depend on size of the
organization and business line. Losses below certain threshold (amount) may not be captured by the
banks because of cost involved. However, defining a threshold should not result in considerable loss
of data, therefore, it is recommended that (for internal operational risk management) initially all
losses above PKR 200,000 are captured and thresholds may be defined later on when sufficient data
points are available, however in no case the threshold would exceed PKR 200,000. SBP expects

Page | 8

banks to demonstrate that thresholds set are reasonable and does not have a material impact on the
overall risk estimates (capital charge requirements).
Data collection thresholds should capture all material losses in terms of their value. However,
determination of a threshold should be based on some research. Therefore a bank needs to verify, on
a periodic basis that its choice of threshold includes all material operational risk losses for risk
management purposes. For example, a bank may attempt to collect all below threshold items for a
given period and then reconcile them with accounting data to examine the effect of including these
losses in management action/ capital modeling.

VII.

Q No. 8:
1.

2.

3.

4.

5.

6.
7.

8.

Salient features of Key Risk Indicators (KRIs):

Key Risk Indicators (KRIs), are measurable indicators which can be termed as early warning
signals, provide information regarding increased current or potential level of operational risk
exposure to help institution measure and manage emerging risks by identifying risk symptoms.
The indicators ensure that the risk monitoring is focused on the key risks to which an institution
is exposed.
KRIs selection process starts by analyzing the already identified key risks as a result of RCSA
exercises, audit reports, industry environment and actual loss experiences. The analysis of past
events helps in the identification and finding of the intermediate event or root cause event which
led to the loss. Moreover, banks need to have firm understanding of their organizational
objectives and need to identify future risk events (based on scenario analysis) that may affect the
achievement of those objectives.
The goal of an effective KRI is to pin point the ultimate root cause of the risk event. The
indicator is designed to transmit meaningful and timely information to the management enabling
them to take corrective actions to evade potential operational losses before they happen or
become larger. Hence, effective indicators are closer to the root cause of event and provide more
time to management for proactive action6.
A single indicator may or may not adequately capture the trends of a key risk. Therefore, the
banks may analyze a collection of KRIs simultaneously for better understanding of the risk being
monitored.
The selected KRIs should contain the following characteristics;
Be effective in tracking an important risk.
Must have the predictive power to prevent a future loss i.e. leading KRIs are more desired.
Be practical and easy to collect i.e. measurable and quantifiable.
Track at least one aspect of risk profile i.e. risk cause, event, effect and control.
Can serve as a mean to express risk appetite.
KRIs can be specific and generic. Specific indicators relate to one or very few business units
while generic indicators are collected by many business units.
For collection of KRIs, the bank should establish;
Clear responsibilities defining persons to whom these indicators are assigned.
Standardized definitions for understanding of entire staff across the organization.
Key Risk Indicator alerts management if they go outside the established range. Therefore banks
may define acceptable ranges and in case of breach of threshold, actions to be taken by managers
to accept or mitigate the risk are to be recorded. Due to lack of historical data, the setting of
thresholds at initial stages is not possible; however, after one year of implementation, the banks
are expected to have enough data to define thresholds.

Page | 9

9.

Identification of KRIs is also not a onetime exercise as KRIs will change over time as
organizational risks and strategies change. Processes need to be established to reassess the value
of identified KRIs and to determine the need for new indicators. Bank should set up KRI
validation cycle on yearly basis in which thresholds may also be reviewed/ revisited.
Apart from bottom up method of identifying KRIs, top down approach can also be used whereby
top management, keeping in view the internal and external factors, identifies risk faced by the
entity.
Banks shall identify and monitor at least 15 risk indicators in each business line on an ongoing
basis. Senior management and the board of directors are expected to understand and remain
updated on most significant KRIs pertaining to the institutions top 10 risks. Accordingly, banks
should set thresholds for regular monitoring and reporting. At this stage, reporting of KRIs to
data depository is not being prescribed; however, SBP would review banks progress in this
regard.

10.

11.

Q No. 9:
I.

II.

III.

IV.

Reporting & Action Plans:

The purpose of operational risk data tools (loss data, RCSA & KRIs) is to find key risk factors and
drivers to develop understanding of the causes and consequences. The key drivers of operational risk
are people, processes, system and external dependencies7. Based on findings of data, bank should be
able to take appropriate corrective actions.
Banks internal reporting policies should include clearly defined escalation policy whereby losses
over certain thresholds, significant event, critical (present or potential) risk and control breaches are
immediately reported to senior management as per defined criteria. There should be regular and
timely reporting of losses to various level of management and to the board of directors.
Regarding the ongoing monitoring, banks should have procedures for taking appropriate actions on
losses being reported. Banks should record high level comments on significant losses and action
taken by respective level of management. These action plans once decided must be documented and
reviewed. The progress in this regard should also be included in ongoing reporting.
All banks/ DFIs are expected to set up operational risk data collection mechanism by December
2015. Moreover, it is expected that within next three years when sufficient loss data point are
available, the bank should be able to conduct an empirical analysis as to how their operational risk
varies with the expansion/ contraction of their operations.