6.4. Assessment of operational risk

When assessing the operational risk management framework, competent authorities should evaluate inter alia the compliance of the institution with the legal acts published separately on the EBA website as referred to in paragraph 12.

Competent authorities should assess operational risk throughout all the business lines and operations of the institution, taking into account findings from the assessment of internal governance arrangements and institution-wide controls as specified in Title 5. In conducting this assessment, competent authorities should determine how operational risk may materialise, also considering the loss data set of the institution and potential impacts from other related risks (e.g. boundary credit-related and market-related operational risk).

Competent authorities should assess the materiality of operational risk arising from third-party service providers, including concentration (at entity and where relevant at group level) on one or more services provided by a single third-party service provider (directly or indirectly through subcontracting chains) or a limited number of third-party providers supporting institution’s critical or important functions, and whether these could affect the institution’s operational resilience, performance and risk management. When carrying out this assessment, competent authorities should take into account the extent to which the same third-party service providers are relied upon by other institutions, where such information is available to them.

When assessing operational risk, competent authorities should assess ICT risk, pursuant to DORA, and its potential impact on the institution’s critical or important functions, including any potential financial, reputational, regulatory and strategic impact to the institution.

Competent authorities should assess whether the institution has an adequate operational resilience approach to be able to withstand, adapt to and recover from disruptions when they materialise and whether this has been adequately and consistently aligned with the existing risk management framework, business continuity plans and third-party management.

When assessing operational risk, competent authorities should assess, if applicable, whether the institution’s policies and procedures identify, evaluate and manage appropriately the operational risks arising from crypto-assets activities and their supporting technology.

Competent authorities should assess reputational risk jointly with operational risk as it is inherently linked to operational risk events. However, the outcome of reputational risk assessment should not be reflected in the scoring of operational risk but, where relevant, should be considered as part of the BMA and/or the liquidity risk assessment, as its main effects can deteriorate investors’, depositors’ or interbank-market participants’ confidence to the institution.

Competent authorities should assess the impact of ESG risks on the inherent operational and reputational risks as well as the adequacy of the operational risk and reputational risk controls related to ESG risks, giving priority to environmental physical and transition risks. In particular, competent authorities should consider environmental risks and greenwashing risks when carrying out the assessment of legal risk and reputational risk.

6.4.2. Assessment of inherent operational risk

Competent authorities should develop a thorough understanding of the institution’s inherent operational risk exposures and evaluate the significance of the prudential impact of this risk for the institution as well as the impact on its ability to deliver critical or important functions through disruption.

To support this assessment, competent authorities should consider the own funds requirement for operational risk compared to the total own funds requirement, and where relevant the internal capital allocated for operational risk by the institution compared to the total internal capital. Moreover, competent authorities should leverage the knowledge gained from the assessment of other SREP elements (in particular from Title 4 and Title 5), from the comparison with peers, from any other supervisory activities including the input from the AML/CFT supervisors and market surveillance authorities and from other relevant information sources.

Competent authorities should consider at minimum key operational risk factors, potential disruptive scenarios, and where relevant, analyse them by business line, legal entity, geography, and event type category (subject to data availability) and benchmark the institution’s position against its peers. These factors should at least cover the institution’s main strategy for operational risk and operational risk appetite, business environment (including geographical presence, ICT operations, and distribution channels), recent significant corporate events (such as mergers, acquisitions, disposals and restructuring), ICT systems and other ICT-related aspects as per section 6.4.2.3, process changes, third-party arrangements, regulatory compliance issues, business ambitions and incentive schemes and other key operational risk drivers.

Nature and significance of operational risk exposures

Competent authorities should determine the nature of operational risk exposures by analysing exposures to the main sources and drivers of operational risk to form a forward-looking view on prospective operational risk. For this analysis, competent authorities:

• a. may consider the operating model, business lines, products, processes and geographies relevant to the institution, assessment of dependencies and operational risk exposures to primary risk drivers (e.g. processes, people, systems and external factors) and interactions of risk drivers, leveraging the institution’s self-risk assessment, peer analysis, data and public and/or consortium databases, if available and relevant;
• b. should consider both the frequency and the severity of the events to which the institution is exposed and distinguish those causing high-severity losses and those occurring with high frequencies. Based on this distinction, competent authorities should assess the trends of operational risk losses and their concentration; and
• c. should leverage scenario analyses and consider planned business operations and prospective operational risk analyses performed by the institution, where available, taking into account any corrective measures and mitigation actions already implemented and effective.

Following the identification and analysis of the major sources and drivers of operational risk, competent authorities should focus on those with the most material potential impact to the institution.

A primary source of information competent authorities should consider it is the institution’s loss and event data set as it can provide valuable insights on the evolution of the institution’s operational risk profile. Competent authorities should periodically assess the comprehensiveness, accuracy and quality of the loss data. Another source of information should be the institution’s records of all ICT-related incidents and significant cyber threats (as per Article 17(2) of DORA) and the identified sources of ICT risk (as per Article 8(2) of DORA).

Assessment of operational risk sub-categories

Competent authorities should focus the assessment of operational risk sub-categories to those which are considered material to the institution. Competent authorities should also apply their expert judgement to identify significant sub-categories, based on all available internal and external information sources. In conducting the assessment, competent authorities should always pay attention to the following aspects of operational risk⁴¹ :

• a. legal risk;
• b. model risk;
• c. ICT risk.

6.4.2.1. Legal risk

⁴¹ Please refer to Annex III for a non-exhaustive breakdown of operational risk sub-categories.

Competent authorities should consider the following when assessing the relevance and significance of the institution’s exposures to legal risk:

• a. mis-selling of products or services;
• b. conflicts of interest in conducting business;
• c. manipulation of benchmark interest rates, foreign exchange rates or any other financial instruments or indices;
• d. barriers to switching financial products during their lifetime and/or to switching financial service providers;
• e. automatic renewals of products or exit penalties; and/or
• f. customer complaints processing;
• g. violation of national and international rules and regulations (tax rules, internal fraud or internal theft, anti-money laundering rules, anti-terrorism rules and economic sanctions);
• h. ESG-related, in particular environment-related and greenwashing-related, litigation exposures.

Competent authorities should consider whether the institution may occur any expenses, fines, penalties or punitive damages from legal proceedings and the number and content of complaints. The outcomes of the Title 4 assessment should be also leveraged, along with scrutinising the incentive policies, to obtain high-level insights into sources of potential misconduct. In this context, competent authorities should also consider whether the institution has in place adequate and effective systems and processes to implement and comply with restrictive measures (e.g. sanctions), including assessing institution’s compliance with the EBA Guidelines on internal policies, procedures and controls⁴² .

⁴² EBA Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures (EBA/GL/2024/14)

However, the competent authority should apply a forward-looking approach, also considering the possible impact of regulatory developments and the activity of relevant authorities in respect of consumer protection and the supply of financial services in general.

6.4.2.2. Model risk

Under the operational risk, competent authorities should assess model risk, with specific regard to internal non-regulatory models (e.g. AI models, product pricing, setting and monitoring risk limits, ICAAP/ILAAP models, recovery options).

For the assessment of model risk, competent authorities should consider:

• a. to what extent and for which purposes the institution uses models to make decisions and the business significance of such decisions. Competent authorities should determine the business/activity for which the institution makes significant use of models and assess the potential impact of model risk through, amongst others, sensitivity and scenario analyses or stress testing; and
• b. the soundness of control mechanisms (in terms of methods, frequency, follow-up, etc.), including a model approval process, regular reviews performed and the institution’s level of awareness of model deficiencies or market and business developments.

When models are used for decision-making purposes (e.g. product pricing, AI models, evaluation of financial instruments, client profiling), competent authorities should assess whether there is a sound internal validation process and/or model-review process to identify and mitigate model risk (other than regulatory models).

When conducting the model risk assessment, competent authorities should consider the assessment of other risks to capital and risks to liquidity and funding, in particular with respect to the adequacy of methodologies used for measuring risk, pricing and evaluating assets and/or liabilities. The results of such an assessment should inform the findings on operational risk.

6.4.2.3. ICT risk - Assessment of inherent ICT risk

Identification of material ICT risks

In line with DORA, competent authorities should review the institution’s identification, classification and documentation of all ICT supported business functions, roles and responsibilities, the information assets⁴³ and ICT assets⁴⁴ supporting those functions, and their roles and dependencies in relation to ICT risk. This review should assist competent authorities to develop a thorough understanding of the institution’s inherent ICT risk exposures (ICT risk profile), identify its material inherent ICT risk and form an opinion on its prudential impact. For this purpose, competent authorities should consider at least the following, where relevant and applicable:

• a. report on the review of ICT risk management framework (as per Article 6(5) of DORA);
• b. sources of ICT risk, in particular the risk exposure to and from other financial entities, identified by the institution under Article 8(2) of DORA;
• c. major ICT-related incidents reported (as per Article 19(1) of DORA), including the trend of aggregated annual costs and losses caused by major ICT-related incidents (as per Article 11(10) of DORA);
• d. outcomes of the tests envisaged in the digital operational resilience testing programme (as per Article 24 of DORA)), including summary of the threat-led penetration testing (TLPT) findings and related remediation plans (as per Article 26(6) of DORA);
• e. register of information (as per Article 28(3) of DORA), including degree of concentration on ICT third-party service providers, including ICT intra-group providers, per type of ICT services and/or ICT systems;
• f. recommendations and opinions from the Lead Overseers (as per Article 40(3) and Article 42(7) of DORA) and related responses, reports and information from critical ICT third-party service providers (as per Article 35(1)(c), Article 42(1) and Article 48(2) of DORA);
• g. level of complexity of ICT systems and results of ICT risk assessment on legacy ICT systems (as per Article 8(7) of DORA);
• h. risk assessment on major changes (as per Article 8(3) of DORA);
• i. level of adoption and integration of innovative ICT solutions;
• j. locations, namely the regions or countries, of data centres and sensitive designated areas, including where contractual ICT services are provided by ICT third-party service providers, also covering data processing and storage location;
• k. any related material deficiencies or weaknesses identified under Title 5;
• l. ICT risk and controls self-assessments (if provided in the ICAAP information);
• m. ICT risk-related management information submitted to the institution’s management body;
• n. ICT-related internal and external audit findings;
• o. external threat environment, including threat and vulnerability intelligence.

Review of ICT systems and ICT services

⁴³ Article 3(6) of Regulation (EU) 2022/2554

⁴⁴ Article 3(7) of Regulation (EU) 2022/2554

Competent authorities should review the institution’s relevant documentation, methodology and processes, and form an opinion on whether the institution has appropriately identified the ICT systems and ICT services that support critical or important functions. For this purpose, competent authorities should consider:

• a. ICT systems supporting critical or important functions as well as the critical information assets and ICT assets identified by the institution (as per Article 8 of DORA);
• b. key processes dependent on ICT third-party service providers, including interconnections with ICT third-party service providers that support critical or important functions, identified by the institution (as per Article 8.5 of DORA).

Identification and mapping of material ICT risks to ICT systems and ICT services that support critical or importance functions

216.Following the review of the institution’s dependency on information assets and ICT assets, ICT risk profile, ICT systems and ICT services, competent authorities should form an opinion on the material ICT risks that can have a significant prudential impact on the institution’s ICT systems and services that support critical or important functions and a significant impact on its ability to operate under disruption. For this purpose, competent authorities should consider:

• a. financial loss, including potential customer compensation, legal and remediation costs, contractual damages, costs and lost revenue;
• b. potential for business disruption, considering (but not limited to) the criticality of the services affected, including institution’s transactions and operations (including third-party dependencies), the number of clients and/or financial counterparts and/or branches and employees potentially affected;
• c. potential data losses;
• d. potential reputational impact;
• e. potential regulatory impact, including the potential for public censure, fines or even variation of permissions;
• f. potential strategic impact on the institution;
• g. potential geographical spread.

Competent authorities should then map the identified material ICT risk into the ICT risk categories set out in Annex III. Institutions are expected to maintain their own categorisation rather than using the one set out in the Annex.

6.4.3. Assessment of operational risk management and control framework

Competent authorities should assess the framework and arrangements the institution has in place to manage and control operational risk taking into account the outcome of the analysis of the overall risk management and internal control framework addressed in Title 5, as this will influence the institution’s operational risk exposures. Regarding ML/TF risk, the competent authority should take into account the assessment provided by the AML/CFT supervisor.

Operational risk strategy and appetite

Competent authorities should assess whether the institution has a sound, clearly formulated and documented operational risk strategy and appetite level approved by the management body, which outlines the nature, types and levels of operational risk the institution is willing to assume. For this assessment, among other factors, competent authorities should take into account the role of the management body in setting, approving, implementing and reviewing the operational risk strategy and appetite (including ICT risk appetite and digital operational resilience strategy), the strategy’s sufficient coverage and appropriateness with respect to the nature and materiality of the institution’s operational risk profile.

Organisational and internal control framework

Competent authorities should assess the institution’s compliance with Article 323 of the Regulation (EU) No 575/2013. In this assessment, competent authorities should evaluate the soundness and effectiveness of the organisational framework and governance arrangements to enable effective operational risk management, measurement and control, with sufficient human and technical resources to carry out the required tasks. Competent authorities should take into account whether clear lines of responsibility are in place for the identification, evaluation, mitigation, monitoring and reporting of operational risk as well as adherence to the three lines of defence model.

Competent authorities should assess whether the institution has a strong control framework and sound safeguards to mitigate its operational risk, including appropriate policies and procedures, covering also residual risk, and whether these are consistent with the institution’s operational risk management appetite and strategy and cover all the key operations and processes. This includes, amongst others, the assessment of whether these policies and procedures are clearly formalised, communicated and applied consistently across the institution.

Competent authorities should also assess the functionality of the internal audit function in terms of adequacy, scope and frequency of internal audits on the operational risk management framework.

Business continuity, response and recovery

Competent authorities should assess the institution’s compliance with the (i) EBA Guidelines on Internal Governance in relation to the overall business continuity management and with the (ii) DORA in relation to the ICT business continuity policy and ICT response and recovery plans. In this regard, competent authorities should determine whether ICT business continuity policy and ICT response and recovery plans form an integral part of the institution’s overall business continuity policy and response and recovery plan.

Competent authorities should assess whether the institution has established effective business continuity management with tested business continuity, response and recovery plans covering at least its critical or important functions, including those contracted to third-party providers, and whether these consider a range of severe but plausible scenarios to which the institution may be vulnerable. Competent authorities should also assess whether the institution’s business continuity policy enables appropriate response and recovery measures to any type of incident.

Competent authorities should determine whether the institution’s business continuity management includes:

• a. Business Impact Analysis (BIA);
• b. appropriate recovery strategies incorporating key internal and external dependencies and clearly defined recovery priorities and resilience levels;
• c. comprehensive and flexible plans to deal with plausible disruptive scenarios, which are established based on the BIA and in coordination with internal and external stakeholders;
• d. plans that establish contingency strategies and response and recovery procedures;
• e. effective testing of the design and operational effectiveness of the plans;
• f. BCM awareness and training programmes;
• g. communications plans for informing management and all relevant stakeholders, and crisis-management documentation, measures and a crisis management function where applicable (as per Article 11(7) of DORA).

Competent authorities should assess whether the institution’s business continuity, response and recovery plans:

• a. establish roles and responsibilities, including clear guidance on potential succession, and set out the internal decision-making process along with definition of activation triggers;
• b. are reviewed to ensure contingency strategies remain consistent with current operations, risks and threats, resilience levels, and recovery objectives and priorities;
• c. prioritise business continuity actions using risk-based approach;
• d. are tested regularly to ensure that recovery objectives and timeframes can be met; and
• e. are inclusive of the testing of services provided by third-party service providers, where applicable;

Competent authorities should also assess whether testing results are documented and reported to the management body.

Assessment of ICT risk management framework

Competent authorities should assess the institution’s compliance with the DORA and the EBA Guidelines on Internal Governance in relation to the internal governance and organisation of the management of ICT risk. Competent authorities should form a view on whether the institution’s management body is held overall accountable for managing ICT risk and appropriately defines, approves and oversees the implementation of all ICT-related arrangements. Competent authorities should consider whether the members of the management body possess sufficient knowledge and skills to understand and assess ICT risk and its impact on the institution’s operations.

Competent authorities should assess how the roles and responsibilities for all ICT-related functions and the established governance arrangements are embedded and integrated in the institution’s internal control and governance framework to manage ICT risk. For this purpose, competent authorities should consider whether the institution has effectively assigned the responsibility for managing and overseeing ICT risk to an independent control function that has direct access and can report directly to the management body in its supervisory function, and assess whether the institution demonstrates:

• a. clear communication, allocation and integration of roles and responsibilities in all ICT-related functions, including ICT supported business functions, and processes;
• b. sufficient and appropriate budget to fulfil digital operational resilience in terms of all types of resources, including relevant awareness programmes, training, and ICT skills for all staff (as per Article 5(2)(g) of DORA);
• c. adequate follow-up and response by the management body on critical ICT audit findings and findings reported under Article 13(5) of DORA.

Competent authorities should develop a thorough understanding of the institution’s ICT risk management framework and assess whether the institution has in place sufficient and appropriate strategies, policies, procedures, ICT protocols and tools, including tolerance levels, to address effectively, efficiently and comprehensively the material ICT risk in line with DORA. For this purpose, competent authorities should consider, where applicable:

• a. appropriateness and effectiveness of institution’s ICT risk management policies⁴⁵ , processes and procedures, covering inter alia ICT third-party management, ICT-related incident detection and response, ICT assess management, encryption and cryptography, ICT operations security, network security, access control, and whether these have been approved by the management body and communicated to all relevant stakeholders (as per Article 14 of DORA);
• b. appropriateness of institution’s risk tolerance level of ICT risk and the impact tolerance for ICT disruptions (as per Article 6(8)(b) of DORA);
• c. appropriateness and implementation of the institution’s digital operational resilience strategy, including its alignment with the business strategy;
• d. consistency of the strategy on ICT third-party risk, including the ICT multi-vendor strategy, where available, with the overall business strategy and ICT risk management framework;
• e. residual risk from the institution’s identified risks in respect to contractual arrangements on the use of ICT services supporting critical or important functions;
• f. residual risk from the institution’s identified risks on ICT projects impacting critical or important functions reported to the management body, and also on ICT systems acquisitions, development and maintenance and ICT changes;
• g. soundness and comprehensiveness of digital operational resilience testing programme;
• h. trend and magnitude of major ICT-related incidents and findings reported to the management body as per Article 17(3)(e) and Article 13(5) of DORA;
• i. ICT risk controls specific for the identified material ICT risk;
• j. timely reporting of ICT risk management aspects to the management body and senior management;
• k. internal audit coverage and findings.

⁴⁵ In accordance with DORA, these should include at least the information security policy, backup policies, ICT asset management policy, encryption and cryptographic controls policy, cryptographic key management policy, ICT project management policy, acquisition, development, and maintenance of ICT systems policy, human resources policy, physical and environmental security policy, ICT-related incident management policy, policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers.

When assessing ICT risk management, competent authorities should pay particular attention to ICT third-party risk management, including the institution’s concentration level to ICT third-party service providers. For this purpose, competent authorities should ensure close cooperation with the Lead Overseers of critical ICT third-party providers (CTPPs), in accordance with the ESAs’ Joint Guidelines⁴⁶ , in case the institution under assessment receives ICT services from a CTPP. Competent authorities should also review the effectiveness of the dedicated role established by the institution, or the designated member of senior management, on the monitoring of ICT third-party arrangements.

⁴⁶ ESAs’ Joint Guidelines on the oversight cooperation and information exchange between the ESAs and the competent authorities under Regulation (EU) 2022/2554 (JC/2024/36).

Competent authorities should consider whether the internal audit function is effective and possesses sufficient knowledge, skills and expertise to audit institution’s ICT risk management framework, by reviewing whether:

• a. the ICT risk management framework is audited with the required quality, focus and frequency, and is commensurate to the ICT risk profile of the institution;
• b. the audit plan includes audits on the material ICT risks identified by the institution, including independent reviews of ICT response and recovery plans;
• c. critical ICT audit findings are timely verified and remediated, including reporting to the management body;
• d. ICT audit findings, including agreed actions, are formally followed up and progress reports periodically reviewed by the senior management and/or the audit committee.

6.4.4. Assessment of reputational risk

Competent authorities should assess the reputational risk to which the institution is exposed by leveraging the understanding gained from Title 4 to Title 6.2. Such an assessment should also focus on the overall reputational risk framework, ensuring the ability of the institution to effectively manage any reputation events. For this assessment, competent authorities should avoid double counting aspects already considered under the assessment of legal risk (section 6.4.2.1).

When assessing the relevance of reputational risk, competent authorities should consider the size of the institution as well as the nature, scale and complexity of their services, activities and operations (for example, listed equities or debts or participation in interbank markets).

Competent authorities should consider both internal and external factors or events that might give rise to reputational concerns, excluding events that result in legal proceedings. For Category 1 and Category 2 institutions, competent authorities should consider all the following indicators in their assessment:

• a. negative media/social media coverage and consumer-association initiatives that could deteriorate the public perception and reputation of the institution;
• b. the number of and changes in customer complaints or sudden loss of customers or investors;
• c. negative events relating to the institution’s peers that the public could associate with the whole financial sector or a group of institutions;
• d. the reputation of individuals involved in the management of the institution or with qualifying shareholdings;
• e. involvement or operation in sectors or jurisdictions highly exposed to ML/TF or with individuals associated with high risk from an ML/TF perspective;
• f. involvement or operation in sectors or jurisdictions and/or with counterparties highly exposed to material issues or public controversies related to ESG factors, including but not necessarily limited to environmental factors;
• g. the reputational impact of ICT-related incidents as recorded by the institution in accordance to the Commission Delegated Regulation (EU) 2024/1772⁴⁷ ;
• h. other ‘market’ indicators, if available (e.g. rating downgrades or changes in the share price throughout the year).

⁴⁷ Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents, C/2024/1519 (OJL, 2024/1772, 25.6.2024, ELI: http://data.europa.eu/eli/reg_del/2024/1772/oj).

Competent authorities should assess the significance of the institution’s reputational risk exposure and its interconnectedness with the other risks by leveraging the relevant risk assessments (including from other supervisory authorities) to identify any possible secondary effects in either direction.

In the context of the operational risk analysis, competent authorities should take into account the relevance and significance of the institution’s exposures to ML/TF risk from a prudential perspective under the scope of operational risk. In this respect, competent authorities should use the relevant input received from AML/CFT supervisors to supplement their findings from ongoing supervision and evaluate whether they give rise to prudential concerns related to ML/TF risk.

Competent authorities should bear in mind that any institution can be exposed to ML/TF risk regardless of the institution’s size or financial soundness. Therefore, sufficient attention should also be paid to institutions that are perceived to be financially sound and may have a good reputation given that these institutions might be specifically targeted for ML/TF purposes. Attention should also be paid to institutions that are very successful in attracting new customers/expanding market share – especially by using non-traditional distribution channels

• - since this could be related to weak customer due diligence controls at the onboarding phase.

Competent authorities should share relevant information on operational risk issues identified that can give rise to ML/TF risks, risks of non-implementation and evasion of targeted financial sanctions and concerns such as deficiencies in the institutions’ ICT system or internal control framework with AML/CFT supervisors.

Competent authorities should assess whether the institution has implemented adequate arrangements, strategies, processes and mechanisms to manage reputational risk. In particular, competent authorities should take into account whether:

• a. the institution has formalised policies and processes in place for the identification, management and monitoring of this risk, including a robust code of conduct, and whether these policies and processes are proportionate to its size and its relevance in the system;
• b. the institution addresses this risk in a precautionary manner, including putting in place appropriate metrics and monitoring tools, coverage of potential reputation issues in contingency plans, conducting relevant training and awareness sessions and leveraging lessons learned;
• c. the institution conducts stress testing or scenario analysis to assess any secondary effects of reputational risk (e.g. liquidity and funding costs, securitisation transactions, access to correspondent banking service);
• d. the institution acts to protect its brand through tools to monitor media/social media, protocols to address misinformation and adverse publicity as well as prompt communication campaigns;
• e. the institution considers the potential impact of its strategy and business plans, and more generally of its behaviour, on its reputation.

6.4.5. Operational resilience

Competent authorities should form a holistic view on the ability of the institution to deliver critical or important functions through disruption (level of operational resilience), an outcome that benefits from the effective management of operational risk, taking into account the institution’s size, business model and overall risk profile. For this purpose, competent authorities should leverage on their existing assessments on operational risk management, business continuity, change management capabilities, third-party services and the ICT upon which the institution relies to holistically evaluate whether these elements collectively support the institution’s operational resilience. Competent authorities should also consider whether the institution implements its risk management framework, business continuity plans, third-party management (already assessed in the context of DORA and EBA Guidelines issued pursuant to Article 74(3) of Directive 2013/36/EU on internal governance arrangements, processes and mechanisms) and recovery and resolution frameworks in a consistent and coordinated manner. Moreover, competent authorities should consider whether the institution has sufficiently mapped the internal and external interconnections and interdependencies that are needed to deliver its critical or important functions.

Competent authorities should consider the attention given by the management body and senior management on the institution’s ability to respond to and recover from disruptions under the assumption that failures will occur. For this purpose, competent authorities should consider whether:

• a. the management body takes an active role in establishing a broad understanding of the operational resilience approach across the institution and in monitoring the effectiveness of the institution’s operational resilience approach;
• b. timely reporting on the institution’s ongoing operational resilience is provided in support of the management body’s oversight, particularly when major identified deficiencies could affect the delivery of the institution’s critical or important functions.

6.4.6. Summary of findings, scoring and supervisory measures

Following the above assessment, competent authorities should form a view on the institution’s operational risk. This view should be reflected in a summary of findings, accompanied by a risk score based on the considerations specified in table 10. Where, based on the materiality of certain risk sub-categories, the competent authority decides to assess and score them

Table 10. Supervisory considerations for assigning an operational risk score

The table below presents a non-exhaustive list of supervisory measures that competent authorities may take in case of identified deficiencies in the institution’s operational risk management framework and operational resilience (taking into account the close interconnection of operational resilience and operational risk management). Competent authorities should decide on the type of the measure based on its effectiveness to the specific identified deficiency. Competent authorities may apply additional supervisory measures (including quantitative measures in accordance with Article 104(1)(a) of the Directive 2013/36/EU) or a combination of these with the ones listed in the table below, if these are deemed more appropriate to address the identified deficiencies. For breaches of DORA, the competent authorities should consider the applicable corrective and remedial measures provided in Article 50 of DORA.

Table 11. Potential and non-exhaustive list of supervisory measures stemming from the assessment of operational risk and operational resilience Potential supervisory measures for competent authorities in accordance with Article 104(1), points (b), (d), (e), (f), (j), (l), (m), and (n) of Directive 2013/36/EU and Article 50 of Regulation (EU) 2022/2554 – Competent authorities may require the institution to: A. involve the management body or its committees more actively in operational risk management decisions; B. improve operational risk measurement systems; C. strengthen controls on operational processes, including identification, monitoring, response and recovery; D. improve the operational governance framework; E. enhance operational risk reporting to the management body and senior management; F. develop and implement corrective action plans to address deficiencies; G. limit certain third-party arrangements, in particular for critical or important functions; H. enhance stress testing and scenario analysis of operational risk; I. implement stronger operational measures; J. enhance business continuity, response and recovery plans; K. enhance operational risk management related to ESG risks, in particular environmental risks, potentially based on one or several actions listed above.