(a)

that the institution's management body discusses and approves the governance of operational risk, the operational risk management process and the operational risk measurement system;

(b)

that the institution's management body clearly defines and determines the following on at least an annual basis:

(c)

that the institution's management body monitors the institution's compliance with the operational risk tolerance statement referred to in point (b) (ii) on a continuous basis;

(d)

that the institution applies an on-going operational risk management process to identify, assess and measure, monitor and report operational risk, including misconduct events, and is able to identify the staff responsible for the management of operational risk process;

(e)

that the information resulting from the process referred to in point (d) is transmitted to the relevant committees and executive bodies of the institution, and that the decisions arising from those committees are communicated to those responsible within the institution for the collection, control, monitoring and management of operational risk and to those responsible for managing activities that give rise to operational risk;

(f)

that the institution evaluates the effectiveness of its operational risk governance, operational risk management process and operational risk measurement system on at least an annual basis;

(g)

that the institution notifies the relevant competent authority of the findings of the evaluation referred to in point (f) on at least an annual basis.

(a)

the level of awareness, on behalf of the staff of the institution, of operational risk policies and procedures;

(b)

the institution's internal process for challenging the design and the effectiveness of the AMA framework.