CP10 (Full Document) - European Banking Authority

· Approving proactive risk management strategies and policies;
· Approving the organisational structure of the control functions;
and
· Specifying levels of acceptable risk.
471. The management body (both supervisory and management
functions) is responsible for making formal decisions on the
implementation of the AMA approach. This includes the overall
approval of the project, the specification of goals, and the
appointment of the organisational structures responsible for
implementation. A time schedule of the necessary steps and an
estimation of related costs and benefits should be provided with the
project approval.
472. The management body (both supervisory and management
functions) should be actively involved, on an ongoing basis, in the
oversight of the control procedures and measurement systems
adopted by the operational risk management function and Internal
Audit, to ensure that they are adequate and that the overall
operational risk management and measurement processes and
systems remains effective over time.
473. The main goal of the management body (management function)
should be to ensure that all components of the operational risk
framework, including controls and mitigation, are functioning as
intended. The Management body (management function) should
have an extensive understanding of operational risk policies, and
should understand how operational risks affect the institution. The
management body (management function) should take responsibility
for ensuring that the operational risk inherent in new products,
activities, processes, and systems is adequately assessed before
they are introduced.
474. The tasks to be addressed by the management body (management
function) include:
· Ensuring the soundness of risk management processes;
· Informing the management body (supervisory function) – or a
designated committee thereof – of material changes or exceptions
from established policies that will materially impact the operations
and the operational risk profile of the institution;
· Identifying and assessing the main risk drivers, based on
information provided by the operational risk management
function;
· Defining the tasks of the risk management unit and evaluating
the adequacy of its professional skills;
· Monitoring and managing all sources of potential conflicts of
interest;
· Establishing effective communication channels in order to ensure
that all staff are aware of relevant policies and procedures;
Page 111 of 123