+Anness III – Sottokategoriji tar-riskju operazzjonali
---+categories (level 1) categories (level 2)
---+categories (level 1) categories (level 2)
|
Anness III – Sottokategoriji tar-riskju operazzjonali
It-tabella ta’ hawn taħt tippreżenta lista mhux eżawrjenti ta’ sottokategoriji għal riskju operazzjonali li l-awtoritajiet kompetenti għandhom jikkunsidraw meta jkun rilevanti. | Sottokategoriji ta’ riskju operazzjonali (livell 1) | Referenzi legali/Definizzjonijiet | Sottokategoriji ta’ riskju operazzjonali (livell 2) | Referenzi legali/Definizzjonijiet | | Riskju legali | L-Artikolu 4(1), il-punt (52a) tas-CRR | | | | Riskju tal-mudell | L-Artikolu 4(1), il-punt (52b) tas-CRR | Sottokategoriji ta’ | | | Sottokategoriji ta’ riskju operazzjonali (livell 1) | Referenzi legali/Definizzjonijiet | riskju operazzjonali (livell 2) Disponibbiltà u riskju ta’ kontinwità tal-ICT Riskju għas-sigurtà tal-ICT (inkluż dak ċibernetiku) | Referenzi legali/Definizzjonijiet Ir-riskju li l-prestazzjoni u d-disponibbiltà tas-sistemi, id-data jew is-servizzi tal-ICT jiġu affettwati ħażin, inkluż l-inkapaċità li s-servizzi tal-istituzzjoni jiġu rkuprati fil-ħin, minħabba falliment tal-komponenti tal-hardware jew tas-software tal-ICT; nuqqasijiet fil-ġestjoni tas-sistema tal-ICT; jew kwalunkwe avveniment ieħor Ir-riskju li aċċess mhux awtorizzat jew atti malizzjużi jew intenzjonati jikkompromettu s-sistemi, id-data jew is-servizzi tal-ICT irrispettivament minn jekk joriġinawx minn ġewwa jew minn barra l-istituzzjoni (eż. attakki ċibernetiċi) Ir-riskju li jirriżulta mill-inkapaċità tal-istituzzjoni biex | | Riskju tal-ICT | L-Artikolu 4(1), il-punt (52c) tas-CRR | Riskju ta’ bidla tal-ICT Riskju ta’ integrità tad-data tal-ICT Riskju minn partijiet terzi tal-ICT Sottokategoriji ta’ | timmaniġġja bidliet fis-sistemi tal-ICT jew fis-servizzi tal-ICT f’ħin xieraq u b’mod ikkontrollat Ir-riskju li d-data maħżuna u pproċessata mis-sistemi tal-ICT tkun mhux kompluta, mhux preċiża jew inkonsistenti bejn sistemi tal-ICT differenti u b’hekk tfixkel is-solidità jew il-kontinwità tas-servizzi u l-attivitajiet tal-istituzzjoni u potenzjalment twassal għal impatt operazzjonali, finanzjarju, legali jew reputazzjonali ir-riskju li jista’ jinħoloq għal istituzzjoni fir-rigward tal-użu tagħha tas-servizzi tal-ICT ipprovduti mill-fornituri terzi ta’ servizzi tal-ICT jew mis-sottokuntratturi ta’ dawn tal-aħħar, inkluż permezz ta’ arranġamenti ta’ esternalizzazzjoni (l-Artikolu 3(18) tad-DORA), inkluż ir-riskju ta’ konċentrazzjoni tal-ICT (l- | | Sottokategoriji ta’ riskju operazzjonali (livell 1) | Referenzi legali/Definizzjonijiet Ir-riskju li jista’ jirriżulta għal entità finanzjarja fir-rigward tal-użu ta’ funzjoni pprovduta minn fornituri terzi ta’ servizzi jew | riskju operazzjonali (livell 2) | Referenzi legali/Definizzjonijiet Artikolu 3(29) tad-DORA) kemm fuq fornituri terzi kritiċi u mhux kritiċi ta’ servizzi tal-ICT | | Riskju minn partijiet terzi | minn sottokuntratturi ta’ dawn tal-aħħar, inkluż l-għoti ta’ funzjoni jew l-appoġġ għal | | | | (mhux tal-ICT) | funzjoni, inkluż permezz ta’ arranġamenti ta’ esternalizzazzjoni (il-Linji Gwida tal-EBA li ġejjin dwar l-immaniġġjar sod tar-riskju minn partijiet terzi) | | |
Riskju ta’ kreditu (avvenimenti ta’ riskju operazzjonali relatati | mar-riskju ta’ kreditu | L-Artikolu 317(5) tas-CRR | | |
mhux ikkunsidrati fl-iskopertura ponderata għar-riskju ta’ kreditu) Riskju tas-suq (avvenimenti ta’ riskju | L-Artikolu 317(6) tas-CRR | | |
operazzjonali relatati mar-riskju tas-suq)
1. Ħarsa ġenerali
| Titlu |
Regolamentazzjoni |
|
categories (level 1) categories (level 2)
|
Legal risk Article 4(1), point (52a) of the CRR Model risk Article 4(1), point (52b) of the CRR | ICT risk Article 4(1), point (52c) of the CRR | ICT availability and continuity risk ICT security risk (including cyber) ICT change risk ICT data integrity risk | The risk that performance and availability of ICT systems, data or services are adversely impacted, including the inability to timely recover the institution’s services, due to a failure of ICT hardware or software components; weaknesses in ICT system management; or any other event The risk that unauthorised access or malicious or intentional acts compromise ICT systems, data or services irrespective of whether they originate from within or outside the institution (e.g. cyber-attacks) The risk arising from the inability of the institution to manage changes to ICT systems or ICT services in a timely and controlled manner The risk that data stored and processed by ICT systems are incomplete, inaccurate or inconsistent across different ICT systems impairing the soundness or continuity of the institution’s services and activities and potentially resulting in operational, financial, legal, or reputational impact | | Operational risk sub-Legal references/Definitions | Operational risk sub- | Legal references/Definitions |
|
|
categories (level 1) categories (level 2)
|
| ICT third-party risk | the risk that may arise for an institution in relation to its use of ICT services provided by ICT third-party service providers or by subcontractors of the latter, including through outsourcing arrangements (Article 3 (18) of DORA), including ICT concentration risk (Article 3 (29) of DORA) on both critical and non-critical ICT third-party services providers |
The risk that may arise for a financial entity in relation to the use of function provided by third-party service providers or by Third-party risk subcontractors of the latter, including the (non-ICT) provision of a function or the support to a function, including through outsourcing arrangements (upcoming EBA Guidelines on sound management of third-party risk) Credit risk (operational risk events related to credit risk not accounted Article 317 (5) of the CRR for in the risk-weighted exposure for credit risk) Market risk (operational risk events related to Article 317 (6) of the CRR market risk)
|
,
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Standards relatati
2. Rekwiżiti identifikati
3. Standards relatati
- EBA -
EN: Guidelines and other publications of the European Banking Authority (EBA), https://www.eba.europa.eu/. © European Banking Authority. Reproduction is authorised provided the source is acknowledged (EBA legal notice). Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by the EBA are authoritative.
DE: Leitlinien und weitere Veröffentlichungen der Europäischen Bankenaufsichtsbehörde (EBA), https://www.eba.europa.eu/. © European Banking Authority. Wiedergabe mit Quellenangabe gestattet (Rechtlicher Hinweis der EBA). In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die von der EBA veröffentlichten Fassungen.
|