CP10 (Full Document) - European Banking Authority

More documents

Recommendations

Info

credit risk that an institution wants to take on can be defined and controlled using a limit system, while it is difficult to set limits for operational risk (although it can be mitigated by insurance and/or internal controls). 467. Article 105(1) and (2) of the CRD provides that permission to calculate operational risk capital requirement using the AMA can be given only if the competent authority is satisfied that the institution meets the qualifying criteria in Annex X, Part 3. 468. In particular, with regard to internal governance matters, the following elements have to be taken into account: · Reporting: There must be a regular reporting on operational risk exposures and loss experience. The institution shall have procedures for taking appropriate corrective action. (Annex X, Part 3, Paragraph 4) · Operational risk management function: The institution must have an independent risk management function for operational risk. (Annex X, Part 3, Paragraph 3) · Internal Audit: The operational risk management processes and measurement systems shall be subject to regular reviews performed by internal and/or external auditors (Annex X, Part 3, Paragraph 6). Hierarchy of responsibility/level of decision 469. Sound internal governance requires that the decisionmaking process be clearly stated within each institution, in terms of hierarchy and level of responsibility. · The management body (both supervisory and management function) (see paragraphs 347 to 349 for the definitions of these terms) should be responsible for approving all material aspects of the overall operational risk framework. This includes all activities aimed at identifying, assessing and/or measuring, monitoring, controlling, and mitigating operational risk. · The management body (management function) should ensure that all components of the operational risk framework, including controls and mitigation, are functioning as intended · The operational risk management function designs, develops, implements, and executes risk management and measurement processes and systems; · The Internal Audit should provide an assessment of the overall adequacy of the operational risk framework, as well as of the operational risk management function. Management body and Senior Management 470. The management body (both supervisory and management function) should be responsible for approving all material aspects of the operational risk framework. This includes: Page 110 of 123
· Approving proactive risk management strategies and policies; · Approving the organisational structure of the control functions; and · Specifying levels of acceptable risk. 471. The management body (both supervisory and management functions) is responsible for making formal decisions on the implementation of the AMA approach. This includes the overall approval of the project, the specification of goals, and the appointment of the organisational structures responsible for implementation. A time schedule of the necessary steps and an estimation of related costs and benefits should be provided with the project approval. 472. The management body (both supervisory and management functions) should be actively involved, on an ongoing basis, in the oversight of the control procedures and measurement systems adopted by the operational risk management function and Internal Audit, to ensure that they are adequate and that the overall operational risk management and measurement processes and systems remains effective over time. 473. The main goal of the management body (management function) should be to ensure that all components of the operational risk framework, including controls and mitigation, are functioning as intended. The Management body (management function) should have an extensive understanding of operational risk policies, and should understand how operational risks affect the institution. The management body (management function) should take responsibility for ensuring that the operational risk inherent in new products, activities, processes, and systems is adequately assessed before they are introduced. 474. The tasks to be addressed by the management body (management function) include: · Ensuring the soundness of risk management processes; · Informing the management body (supervisory function) – or a designated committee thereof – of material changes or exceptions from established policies that will materially impact the operations and the operational risk profile of the institution; · Identifying and assessing the main risk drivers, based on information provided by the operational risk management function; · Defining the tasks of the risk management unit and evaluating the adequacy of its professional skills; · Monitoring and managing all sources of potential conflicts of interest; · Establishing effective communication channels in order to ensure that all staff are aware of relevant policies and procedures; Page 111 of 123
Page 1 and 2:
CEBS CP 10 11 July 2005 Guidelines
Page 3 and 4:
ANNEXES ...........................
Page 5 and 6:
to use these approaches. 6. The gui
Page 7 and 8:
IRB approach can be given only if t
Page 9 and 10:
approaches for regulatory purposes
Page 11 and 12:
purposes, when the group has submit
Page 13 and 14:
efficient running of the process, u
Page 15 and 16:
and/or 105 of the CRD, subject to t
Page 17 and 18:
58. Institutions intending to move
Page 19 and 20:
translated, supervisors will organi
Page 21 and 22:
76. The issues that supervisors are
Page 23 and 24:
holding company, the competent auth
Page 25 and 26:
· A new approval process shall not
Page 27 and 28:
· Institutions may not be ready to
Page 29 and 30:
2. Asking institutions to notify su
Page 31 and 32:
116. ‘Immaterial’ should refer
Page 33 and 34:
128. The EU Council has proposed th
Page 35 and 36:
should start with inputs, and those
Page 37 and 38:
to be only broadly compliant with t
Page 39 and 40:
institutions to be able to identify
Page 41 and 42:
differentiated if their loss rates
Page 43 and 44:
payments are originating from the s
Page 45 and 46:
any of its subsidiaries in full, wi
Page 47 and 48:
197. As a general rule, the rating
Page 49 and 50:
· Their discounting method results
Page 51 and 52:
grades. In this case, all of the re
Page 53 and 54:
of challenges, including choosing t
Page 55 and 56:
228. In principle, supervisors do n
Page 57 and 58:
prices on defaulted exposures, and
Page 59 and 60: LGD estimation, they have to be tak
Page 61 and 62: The exposure value for the followin
Page 63 and 64: investigating the potential drivers
Page 65 and 66: advisable in some circumstances not
Page 67 and 68: terms) the proof of consistency wit
Page 69 and 70: 302. The information used in credit
Page 71 and 72: exposures to obligors or facilities
Page 73 and 74: Pooled data sets for good predictiv
Page 75 and 76: inputs to the IRB approach. Supervi
Page 77 and 78: used to quantify the risk parameter
Page 79 and 80: years for the economy as a whole, a
Page 81 and 82: · Institutions must be able to bri
Page 83 and 84: Benchmarking the outputs of interna
Page 85 and 86: model, and the internal use of the
Page 87 and 88: systems” (Annex VII, Part 4, Para
Page 89 and 90: · Examining reports from Internal
Page 91 and 92: organisational point of view (e.g.,
Page 93 and 94: conclusions are wellfounded. Inte
Page 95 and 96: 401. The role played by the CRC fun
Page 97 and 98: subsidiary, or by different subsidi
Page 99 and 100: way of a formal notification). The
Page 101 and 102: · The rollout plan should have a
Page 103 and 104: Principles and examples 1. The purp
Page 105 and 106: etween systems, recording of data t
Page 107 and 108: · The definition of an appropriate
Page 109: incorporate forwardlooking elemen
Page 113 and 114: frequency and format of the interna
Page 115 and 116: · Development of internal processe
Page 117 and 118: · Understanding the extent and nat
Page 119 and 120: ‣ If not, inform the other superv
Page 121 and 122: the decision. ‣ Agree on the proc
show all

CP10 (Full Document) - European Banking Authority

Create successful ePaper yourself

Delete template?

Save as template?