+Annex III – Operational risk sub-categories
---+categories (level 1) categories (level 2)
---+categories (level 1) categories (level 2)
|
Annex III – Operational risk sub-categories
The table below presents a non-exhaustive list of sub-categories for operational risk that competent authorities should consider when relevant. Operational risk sub- Operational risk sub-Legal references/Definitions Legal references/Definitions
1. Panoramica
| Titolo |
Regolamentazione |
|
categories (level 1) categories (level 2)
|
Legal risk Article 4(1), point (52a) of the CRR Model risk Article 4(1), point (52b) of the CRR | ICT risk Article 4(1), point (52c) of the CRR | ICT availability and continuity risk ICT security risk (including cyber) ICT change risk ICT data integrity risk | The risk that performance and availability of ICT systems, data or services are adversely impacted, including the inability to timely recover the institution’s services, due to a failure of ICT hardware or software components; weaknesses in ICT system management; or any other event The risk that unauthorised access or malicious or intentional acts compromise ICT systems, data or services irrespective of whether they originate from within or outside the institution (e.g. cyber-attacks) The risk arising from the inability of the institution to manage changes to ICT systems or ICT services in a timely and controlled manner The risk that data stored and processed by ICT systems are incomplete, inaccurate or inconsistent across different ICT systems impairing the soundness or continuity of the institution’s services and activities and potentially resulting in operational, financial, legal, or reputational impact | | Operational risk sub-Legal references/Definitions | Operational risk sub- | Legal references/Definitions |
|
|
categories (level 1) categories (level 2)
|
| ICT third-party risk | the risk that may arise for an institution in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements (Article 3 (18) of DORA), including ICT concentration risk (Article 3 (29) of DORA) on both critical and non-critical ICT third-party services providers |
The risk that may arise for a financial entity in relation to the use of function provided by third-party service providers or by Third-party risk subcontractors of the latter, including the (non-ICT) provision of a function or the support to a function, including through outsourcing arrangements (upcoming EBA Guidelines on sound management of third-party risk) Credit risk (operational risk events related to credit risk not accounted Article 317 (5) of the CRR for in the risk-weighted exposure for credit risk) Market risk (operational risk events related to Article 317 (6) of the CRR market risk)
|
,
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Standard correlati
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Standard correlati
- EBA - Published by the European Banking Authority at https://www.eba.europa.eu/
|