12. Operational risk management and operational resilience

An issuer of ARTs should have an adequate operational risk management framework and operational resilience framework. This includes effective policies and processes to:

• a. identify, assess, evaluate, monitor, report and mitigate operational risk on a timely basis; and
• b. identify and protect themselves from threats and potential failures, respond and adapt to, as well as recover and learn from, disruptive events to minimise their impact on delivering critical or important functions¹⁶ .

¹⁶ BCBS Principles for Operational Resilience, March 2021, https://www.bis.org/bcbs/publ/d516.pdf

An issuer of ARTs management body should, as part of the risk management framework, approve strategies, policies and processes for the management of operational risk and operational resilience, including the risk appetite for operational risk framework and the risk tolerance for disruption of critical or important functions¹⁷ . Those strategies, policies and processes should be periodically reviewed and updated as appropriate.

¹⁷ Tolerance for disruption is the level of disruption from any type of operational risk an issuer is willing to accept given a range of severe but plausible scenarios.

The management body ensures that these policies and processes are implemented effectively, fully integrated into the issuer of ARTs ’ overall risk management framework, including the risk in relation of the use of third-party entities, and effectively communicated to relevant staff.

An issuer of ARTs should clearly assign the responsibilities for the assessment and management system for operational risk and operational resilience.

An issuer of ARTs should identify its exposures to operational risk, track relevant operational risk data, including material loss data, and perform scenario-analysis.

Issuer of ARTs should identify its critical operations, consistently with its operational resilience approach, and map the people, technology, processes, data, facilities, third-parties, including intragroup entities, and the interconnections and interdependencies among them that are necessary for the delivery of critical or important functions in a business-as-usual situation and through disruption.

The operational risk and operational resilience management framework should be subject to regular reviews performed by internal or external auditors that possess the knowledge necessary to carry out such reviews. The operational risk management framework and the operational resilience framework should be structured with sufficient and adequate human and technical resources. The issuer of ARTs ’ operational risk assessment system and operational resilience framework should be fully integrated into the risk management framework of the issuer.

A system of reporting to management body that provides for adequate operational risk and operational resilience reports from relevant functions within the issuer of ARTs should be implemented. The issuer of ARTs should have in place procedures for taking appropriate actions without delay, as relevant.

The issuer of ARTs should identify and assess the operational risk inherent to the issuer of ARTs activities, processes and systems to make sure the inherent risks are well understood.

Considering Title I on the application of the principle of proportionality, issuer of ARTs should identify, analyse and measure a range of scenarios, including low probability and high severity events, some of which could result in severe operational risk losses. Inputs to the scenario analysis include relevant internal and external loss data, information from self-assessments, expert opinion, the internal control framework, forward-looking metrics, root-cause analyses and the process framework, as appropriate. The scenario analysis process should be used to develop a range of consequences of potential events, including impact assessments for risk management purposes, supplementing other tools based on historical data or current risk assessments.

Considering Title I, issuers of ARTs may use qualitative risk assessment approaches, while issuers of significant ARTs should have a more sophisticated approach, including, where available, the use of internal and external loss data to inform the scenario analysis.