CP10 (Full Document) - European Banking Authority

management and measurement methods and knowledge of the
processes of the institution.
484. The CRD does not specify how and where the internal validation of
the AMA measurement models should take place. Ideally, people
responsible for the validation (independent review) of a model should
not be the same as people responsible for its design (see paragraph
362 introducing a similar principle in the credit risk context).
However, on an exceptional or temporary basis, it can be acceptable
that the role of validation of the AMA measurement models is
undertaken in the same function as the one involved in designing,
developing and implementing the operational risk framework.
485. A rationale for assigning the two tasks to the same unit could be
found in the skills and experience of people who design, develop and
implement measurement models. Sometimes this makes them the
only ones able to validate the models. The coexistence of both tasks
in the same function should not be seen as an obstacle; any
potential lack of objectivity should be offset with rigorous controls
over the validation process administered by the Internal Audit
function.
486. Any attempt to specify where in the organisational structure of an
institution the ORMF should be located could be to some extent
counterproductive, for the following reasons:
· The activities of the ORMF could span multiple areas and business
units;
· Institutions will choose a structure that fits their management
and oversight frameworks.
487. Institutions generally have an operational risk central unit and some
operational risk staff in the local entities (units, businesses, etc.).
Where this is the case, the institution should ensure that the local
operational risk staff follows the guidelines set by the operational risk
central unit. There should be clear responsibilities and reporting
lines. The Internal Audit should perform specific examinations in
order to assess the ‘real’ degree of independence of the ORMF.
Internal Audit
488. The central role of Internal Audit’s review of the operational risk
management framework is to ensure the effectiveness of the
institution’s operational risk management processes and
measurement systems and to check compliance with the AMA
standards.
489. As part of its activities, Internal Audit should develop a programme
for reviewing the operational risk framework that covers all
significant activities – including outsourced activities – that expose
the institution to material operational risk. This programme should
be regularly updated with regard to:
Page 114 of 123