a well-documented assessment and management system for operational risk which is closely integrated into day-to-day risk management processes, forms an integral part of the process of monitoring and controlling the institution’s operational risk profile, and for which clear responsibilities have been assigned; the assessment and management system for operational risk shall identify the institution’s exposures to operational risk and track relevant operational risk data, including material loss data;

an operational risk management function that is independent from the institution’s business and operational units;

a system of reporting to senior management that provides operational risk reports to relevant functions within the institution;

a system of regular monitoring and reporting of operational risk exposures and loss experience, and procedures for taking appropriate corrective actions;

routines for ensuring compliance, and policies for the treatment of non-compliance;

regular reviews of the institution’s operational risk assessment and management processes and systems, carried out by internal or external auditors that possess the necessary knowledge;

internal validation processes that operate in a sound and effective manner;

transparent and accessible data flows and processes associated with the institution’s operational risk assessment system.