| Risk Supervisory score view | • • | Considerations in relation to inherent risk Operational risk exposures are • limited to a few high-frequency/low-severity impact categories. The significance of the exposure to operational risk is • | Considerations adequate There is consistency the institution’s policy and overall strategy appetite. The organisational | in relation to management and controls between operational risk strategy and its and risk framework |
| There risk significant of is a low | | not shown compared peers. material/very by scenario with the low, analysis losses as of and | for with clear between operational clear separation | risk-takers responsibilities risk of tasks is and robust and a |
| prudential impact on the 1 institution considering the | • | The level of gross losses (before recoveries and including losses on operational credit portfolio risk) experienced caused by • | management functions. Operational includes all | and control relevant risk framework risks. |
| level of inherent risk and the management | • | by the institution in recent • years has been not material/very low or has decreased No significant from ICT a risk higher level. • | Operational monitoring systems are The control | risk measurement, and reporting appropriate. framework for |
| and controls. | • | exposures, simple/resilient/agile ICT • architecture and no material/very low ICT risks. The level of concentration risk towards third-party service • providers is low, with simple subcontracting chains. | operational ICT risk management controls are respect to out in DORA. Third-party framework effective, Considerations | risk is sound. and adequate with the requirements set risk management is sound and along with in relation to |
| Risk Supervisory score view | • • • | Considerations in relation to inherent risk The threat intensity that could result into major operational disruption (including ICT- • related incidents) of critical or important functions is low. Operational risk exposures are mainly in high-frequency/low-severity impact categories. The significance of the exposure to operational risk is low to medium, as shown by scenario analysis and compared | adequate appropriate arrangements. Effective continuity including continuity, recovery | management and controls contractual and sound business management, tested business response and plans. |
| There is a medium-low risk of significant prudential | • | with the losses of peers. The level of gross losses experienced by the institution in recent years has been low to medium, or is expected to increase from a lower historic | | |
| impact on the 2 institution considering the level of inherent risk and the management and controls. | • • • | level or decrease from a higher historic level. Low ICT risk exposures, moderately complex/partially constrained ICT architecture and low/medium ICT risks. The level of concentration risk towards third-party service providers is medium, with moderate subcontracting chains. The threat intensity that could result into major operational disruption (including ICT-related incidents) of critical or important functions is medium. | | |
| There medium-high risk significant of is a | • • | Operational extend frequency/high-severity categories. The significance to some risk low- of exposures the impact • | The institution’s policy overall appetite consistency and strategy | is strategy not operational sufficiently and between and risk its risk the |
| prudential impact on the 3 institution considering the level of inherent risk and the management | • | exposure to operational risk is medium to high, as shown by • scenario analysis and compared with the losses of peers. The level of gross losses • experienced by the institution in recent years has been medium to increase to high, from a or lower is expected • | developed The organisational for operational sufficiently Operational does not risks. Operational | or even inadequate. framework risk is not robust. risk framework include all relevant risk measurement, |
| and controls. | | historic level or decrease from a higher historic level. | monitoring systems are Considerations | and reporting inappropriate. in relation to |
| Risk Supervisory score view | • • • • • | Considerations in relation to inherent risk Indications of possible • significant ICT risk exposures, complex/rigid/fragmented ICT • architecture and medium/high ICT risks. The level of concentration risk towards third-party service • providers is high, with moderate to long/complex subcontracting chains. The threat intensity that could • result into major operational disruption (including ICT-related incidents) of critical or important functions is high. Operational risk exposures extend to all main categories. The significance of the exposure to operational risk is high and increasing, as shown by scenario analysis and | adequate The control operational ICT risk management controls are respect to out in DORA. Third-party framework along with contractual Inadequate management, unreliable/ineffective/incomple te business and recovery | management and controls framework for risk is tenuous. and not compliant with the requirements set risk management is incomplete/weak, inadequate arrangements. business continuity including continuity, response plans. |
| There is a high risk of | • | compared with the losses of peers. The level of gross losses | | |
| significant prudential impact on the institution 4 considering the level of inherent risk and the management and controls. | • • • | experienced by the institution over the last few years has been high, or risk has significantly increased. Multiple indications of significant ICT risk exposures, highly complex/fragile ICT architecture and high ICT risks. The level of concentration risk towards third-party service providers is very high/severe, with long/complex subcontracting chains. The threat intensity that could result into major operational disruption (including ICT-related incidents) of critical or important functions is very high/severe. | | |