August 2006
Discussions on Further Advancing Operational Risk Management (2)Summary of Discussions of the "Study Group for the Advancement of
Operational Risk Management"
I. Introduction
In June, the Study Group for the Advancement of Operational Risk Management(hereinafter referred to as the Group) published information on the five sessions held
to that time. 1 The Group was inaugurated in November 2005 and comprises
experienced practitioners of operational risk management. The Center for Advanced
Financial Technology of the Bank of Japan's Financial Systems and Bank
Examination Department serves as the Group's Secretariat (see Appendix formembers' list). Since its establishment, the Group has identified points at issue withrespect to further advancing operational risk management, and debated possible
approaches for dealing with them. This paper resumes where the last publishedpaper left off, providing a summary of the discussions from the sixth through theeighth (and final) sessions.
As in the preceding paper, this paper does not intend to draw conclusions for each of
the issues discussed. It simply presents issues and discussions concerning theadvancement of operational risk management. Opinions here are those of members
and do not necessarily represent those of the organization each member belongs to.
II. Discussions at the Sixth Session (held on April 20, 2006)
A. Maintaining data (internal loss data) concerning operational risk
1. Potential Issues(1) Scope of operational risk and loss assessment methods
The scopes of market and credit risk are relatively clear because they are based ontransactions traditionally handled by specific risk control sections. However, thescope of operational risk is not necessarily as clear for two reasons: (1) all businesslines are exposed to it, and (2) maintaining data for quantification purposes has ashort history. For this reason, while some banks classify an event into operationalrisk, other banks classify the same event into other risk categories such as credit,
market or strategic risk, rather than operational risk. Moreover, there are problems
concerning methods for assessing the amount of losses when operational risk loss
events occur, such as inconsistencies of loss-measuring methods due to a variety ofrelated transactions and the lack of consensus arising from the fact that operationalrisk management itself has a short history.
1

Discussions on Further Advancing Operational Risk Management (1) were disclosed externally on
June 12, 2006 in Japanese and on August 16, 2006 in English (see below for the respective URLs).
Japanese: http://www.boj.or.jp/type/release/zuiji_new/fsc0606a.pdf
English: http://www.boj.or.jp/en/type/release/zuiji_new/fsc0608c.pdf

1(2) Risk factors and causality
In the case of operational risk, it is difficult to narrow down the factors causing suchrisk to materialize, and quite often it only materializes when several causes occur
simultaneously. When maintaining loss data, therefore, difficulties arise in (1)judging whether specific losses (such as indirect losses or losses damaging to third
parties, mentioned below) arise from operational risk or not; and (2) handling loss
events spanning multiple business lines and event types, etc.
Moreover, while indicators exist to show the probability that market risk or credit
risk may arise before losses actually occur (trends in risk factors or internal ratings
in market transactions, etc.), there are no known indicators that could be decisive inforecasting losses arising from operational risk in the near future. Currently, banks
are discussing the collection of near-miss data 2 and methods for addressing risk
quantification of BEICF (Business Environment & Internal Control Factors), such as
KRI (Key Risk Indicators) and CSA (Control Self-Assessment). As yet, however, noconsensus has been reached on methods for appropriately identifying heightenedrisk before losses actually occur (i.e., what sort of data should be used and how).
2. Participants’ Views
In addition to focusing on the continuity of risk management, banks must clarify
classification standards for risk categories in order to prevent suspicions ofregulatory arbitrage from arising.

2

While the definition of a near miss is not yet properly established, one possible example is an errorthat did not develop into a loss because it was discovered and corrected at a certain stage of atransaction. Depending on the definition of losses in such cases, the scope of events that might beclassified as near misses could narrow considerably (for example, if the personnel costs for
subsequent responses to certain clerical errors were recognized as losses, the scope of "mistakes thatare not accompanied by losses" would become extremely narrow).

2

Classification standards for risk categories (examples)(1)
Creditrisk(2)Marketrisk(3)Strategicrisk(4)
Settlementrisk-- Under Basel II, overlapping events between credit risk and operationalrisk should be quantified as credit risk. However, any serious events
that are treated as credit risk events for quantification purposes should
also be identified as operational risk events if they assume some
operational risk characteristics.
-- Since the credit risk management function does not for management
purposes distinguish damage to credit caused by clerical errors fromdamage to credit caused by general materializations of credit risk,
there are cases where the operational risk control function is
responsible for qualitative controls such as measures to prevent therecurrence of clerical errors pertaining to credit operations. In suchcases, a possible conservative approach is to identify and quantify
overlapping events not only as credit risks but also as operationalrisks.
-- Losses arising from market operations, etc., should be treated as
operational risk if the causes of the losses are operational risk.
-- There are cases where losses are only treated as arising fromoperational risk if the trading rules are contravened; for example,
position limits are breached.
-- Strategic risk falls outside the purview of Pillar I of Basel II (excluded
from risk quantification), but the demarcation line between strategicand operational risk is not always clear. Against this background,
there are cases where losses are treated as arising from operationalrisk when there are flaws in strategic judgment procedures or in theinformation providing the basis for such judgments behind each losscase.
-- Among the accidents occurring in payment and settlement of business,some have been treated as traditional risk related to manual operations
or settlement risk events, even when they were fundamentally credit
risk events. In this connection, if loss events are not necessarily
subject to credit risk management from a regulatory capital viewpoint(including trading book risk management), it is possible to consider
managing them as operational risk and making them the objects ofquantification.

Further, in cases where loss events are treated not as arising from other risk
categories but as from operational risk, it is necessary to clarify the matters statedbelow.
a. Scope of loss recognition
Other than direct losses, there are cases where so-called indirect losses andreputation losses are widely recognized.

3

Scope of loss recognition (examples)(1) Indirect loss,
opportunity loss,
opportunity cost(2)Reputational
losses(3) Profits arisingfrom operationalrisk events(4) Quick
RecoveryConcrete details-- System-related repair costs,
customer accountrestoration costs, litigationrelated costs, payments toexternal consultants andvendors, etc., personnel
overtime payments,
research expenses,
transportation expenses,
reduction or remission ofcommissions
receivable/loan interest,
opportunity costs fromsuspension of business.
-- Revenue reductions due todecline in reputation.
-- Profits posted during ex
post facto processing oftrading errors.
-- Remittance error recoveredon the same day that theevent occurs.

4

Examples of treatment(a) Opportunity costs are collected,
limited to cases where there isa clear link to causal events.
(b) Opportunity costs andreputational losses are notcollected because it is difficult
to identify the amounts
objectively and it is not
required under Basel II.

-- Identified as risk events, but
not used in quantification.
(a) For remittance errors occurringin inter-bank operations, only
those amounts that could not
be recovered on the same daythat the events occur are
recognized as gross losses.
However, errors occurring incustomer remittances arerecognized across the board as
gross losses regardless ofwhether they are recovered on
the same day that the eventsoccur.
(b) Where remittance errors occur,amounts that cannot berecovered on the same day thatthe events occur are recognizedacross the board as gross losses
irrespective of whether theyarise in inter-bank operations
or not.

(5) So-called"timing losses"-- Overestimations ofearnings arising fromaccounting errors,
excessive collections ofcommissions, etc.

-- Recognized as losses in cases
where they are treated as
miscellaneous losses insubsequent accounting periods
and the excessive profit posted
is refunded. However, they are
not recognized as losses whenthe excessive profit posted isrefunded during the current
accounting period.

There are two aspects to threshold values (minimum values) in the cases where loss
data are collected–threshold values from the data collection perspective, andthreshold values for the data used in risk quantification. Both should be set after
taking into consideration the operational risk management situation at each bank.3
The lower the threshold setting is, the easier it is to identify and quantify risk moreaccurately, but data collection costs increase. In practice, there are some cases where
financial institutions set higher threshold values for risk quantification purposes thanfor data collection purposes, and cases where they set lower threshold values for
specific sections than for the threshold values common to the entire bank in order to
use the collected data for internal controls.
In view of the small number of internal loss data samples and other factors, it isuseful to collect so-called near-miss data on the broadest possible scale and to usethem in scenario analyses, etc. irrespective of whether they are used in quantifying
operational risk. In fact, there are cases where financial institutions collect near-missdata from certain operations and use them in qualitative risk management. However,
it is difficult to collect comprehensive near-miss data for the whole bank.
b. Timing of losses
One particularly problematic point at issue is when to recognize the amount ofcompensation from lost lawsuits, etc. as losses. In this connection, many institutions
recognize losses at the point when allowances are made for them in financial
accounting. When large amounts of compensation are forecast, however, there arecases where they are reflected in operational risk quantification prior to financial
accounting procedures by reflecting the expected compensation value in scenario
analysis data.
c. Handling loss events across business lines, etc.

3

How threshold values are set may affect risk quantification results (especially Expected Loss, EL).
How to set threshold values is not a big issue for Japanese banks because many of them set relatively
low threshold values, but it is an important issue internationally.

5

The treatment of loss events that span risk classes such as business lines or event
types4 can be discussed in the same vein as the dependencies discussed at the Third
Session and thus may greatly affect quantification results.
Moreover, it may be better to aggregate loss events, among which we also find somecommonality in causality or linkage in cases where they belong to the same risk
classes. Judging the commonality or linkage of causality referred to here will
inevitably be somewhat subjective. For this reason, it is probably necessary (1) todetermine certain standards, for example, the cases that are likely to occur
simultaneously with a high probability should be combined, to enumerate methods
for evaluating typical cases; and (2) to record the details and grounds for individual
decisions.
Concrete examples of losses spanning business lines, etc.
(1) Losses
spanning multiple
times, locations(2) Losses
spanning event
types(3) Losses
spanning business
lines-- The same earthquake damages multiple branches.
-- Typhoons cross the Japanese Archipelago over a period of aweek, damaging branches in various locations.
-- The same criminal uses various tricks to misappropriate thedeposits of multiple customers.
-- Multiple faults occur in the same computer system on different
business days, but when the origins are investigated, it isrecognized that the causality is the same.
-- Earthquakes damage branches (damage to physical assets), andbusiness is suspended for five days.
-- Exploiting lax supervision during work to restore services, anemployee embezzles cash (internal fraud) or an outside criminal
commits theft (external fraud).
-- Earthquakes damage the head office building (accommodating
multiple businesses).
-- A bank's overall operations are seriously delayed by a major
fault in its accounting systems, generating losses for all the
bank's internal business lines from damages to customers andrepayments of commissions, etc.

d. Methods for assessing losses
Using the accounting amount (book value) is one way of assessing loss amounts, butwith respect to damage to physical assets, there are cases where institutions ascertain
the replacement cost (market value), compare it with the book value, and use theamount closer to the actual loss.
4

Possible treatments of losses spanning risk classes include (1) regarding them as a
specific risk class (with the largest loss amount, etc.), and (2) quantifying risk for eachrisk class without bias, then making necessary adjustments while taking into
consideration the impact of dependencies when aggregating overall operational risk forthe financial institution as a whole.
6III. Discussions at the Seventh Session (held on May 26, 2006)
A. Maintaining data (external data) concerning operational risk
1. Potential Issues
The basic issue when using external data is whether it is appropriate to apply
examples from other organizations to one's own organization. Other points at issue
include the quality of external data, mapping external data (to risk classes), andinformation management and internal controls at data consortia.
2. Participants’ Views
It is possible to use external data for benchmarking analyses, scenario analyses, andsupplementing internal data when quantifying operational risk. Such usage allows
banks to check whether incidents and accidents arising at other organizations may
occur in their own organization, and to introduce some counter-measures.
If reliable external data exist, the need to use them as benchmarks will probably beconsiderable. Using the various parameters of external data is also likely to allow theuse of parametric quantification methods as well as nonparametric quantification
methods. For this reason, one can assume there is a definite need for public
institutions and industry associations, etc. to collect data and publish statistics.
Currently, participation in data consortia is progressing slowly because of concerns
about the reliability of data and the risk of information leaks. In general, use of
external data is confined to gathering information through newspaper clippings andthe like, and using it as reference information in drawing up scenarios.
B. Maintaining data concerning operational risk (validating internal loss data)
1. Potential Issues
Validation systems should be maintained to ensure the quality of internal loss data(comprehensiveness and accuracy), but in practice there is not yet sufficientconvergence with regard to concrete validation methods.
2. Participants’ Views
Possible methods for validating internal loss data include: (1) checking against
accounting figures; (2) validating consistency with qualitative data (statements inclerical malpractice reports, complaint handling records, and anomalous transaction
management records, etc.); and (3) comparisons and consistency checks of internal
loss data among sections. Other possible measures include incorporating a validation
mechanism into loss reporting systems, and the validation of these validation
systems themselves using CSA and internal audits.

7

In general, these validations are conducted by the risk management section,
supplemented by the internal auditors.
C. Internal controls concerning operational risk and their application in
management
a. Managerial involvement
1. Potential Issues
There are unlikely to be any objections to the argument that management (defined inthis paper as officers ranging from sectional managers up to board members) areresponsible for, and need to play a leadership role in, advancing operational risk
management. However, this does not mean that sufficient convergence has beenreached on a de facto practical standard approach to the specific functions to be
fulfilled by each management rank, or the extent to which they should understandmethods to advance operational risk management.
Specifically, the points at issue are the extent to which management should
understand details of advanced methodologies (risk quantification models, scenario
analyses, CSA), and outputs based thereon, and the extent of managerial
involvement (both of which differ according to job rank). Of course, the nature ofany such involvement will probably differ according to the size of the financial
institution as well as the scope and complexity of its business.
2. Participants’ Views
Bearing management policies and the risk situation in mind, it is necessary for
individual financial institutions to clarify the extent to which each management rank(board of directors, CEO, executive officers, sectional managers) should understandthe types of advanced methodologies, and get involved in maintaining them.
Requirements pertaining to understanding and involvement may differ according toindividual financial institutions and management ranking.
Among the items that management should check at this time are: (1) whether theoperational risk assessment framework or results of risk evaluations are consistent
with management policies, business models, and the current state and outlook ofinternal and external environments; and (2) whether the basic policy for operationalrisk management, priority measures on the risk management policy, and theallocation of operational risk capital are consistent with the matters stated in (1), thebank's overall risk capital situation, or the allocation of management resources.

8

Items required for managerial understanding of and involvement inadvancement methodologies (examples)
Quantific
ation
modelsScenario
analysis

CSA-- Quantification results-- Important matters for understanding quantification results<Examples> Elements having a major impact on quantification results, and theextent to which they cause quantification results to fluctuate.
-- Major characteristics of models<Examples> Methods of using the so-called "four elements" (internal loss
data, external loss data, scenario analyses, BEICFs), types of distribution,
reasons for selecting types of distribution, and methods for estimating
distribution.
-- Key scenario content-- Results of scenario analyses, procedures<Examples> Scenario lists (scenario summaries, items that reveal frequency
and severity), and procedures (methods for drawing up scenarios, verifiers,
approaches to validation).
-- Overviews of CSA results, assessment results<Examples> Risk distributions that provide an overall view of the total
financial institution.
-- CSA procedures<Examples> Assessment results, implementation systems (implementation
procedures, implementation units), validation systems (content of validation,sections in charge of validation, etc.).

IV. Discussions at the Eighth Session (held on June 14, 2006)
A. Internal controls concerning operational risk and their application in
management (continued)b. How to establish a system that provides effective challenges to operationalrisk management
1. Potential Issues
Although the system and methodologies of effective challenges for advanced
operational risk management do not differ from those for other risk categories, theshort history of advancing operational risk management poses difficulties in theform of a dearth of common understanding and accumulated skills. In particular,
there are problems with: (i) details and methods of challenging the various kinds ofadvancement methodologies; (ii) documentation; (iii) the functions required of
middle offices;5 and (iv) the functions required of internal audits.
2. Participants’ Views(i) Details and methods of challenging the various kinds of advancement
methodologies
5

In this paper, this refers to sections (supervisory sections) that fulfill an operational risk control
function, and subsections that fulfill a role in supplementing these operational risk control functions.
For details, please refer to "Discussions at the Eighth Session" below.

9

It is thought to be particularly necessary to challenge technical elements andelements that depend heavily on subjective judgments.
Details and methods of challenging the various kinds of advancement
methodologies (examples)

Quantific
ation
modelsScenario
analyses,
CSA

Internal challenges(Self challenges by eachsection)-- Use back-testing(comparisons withinternal and external
loss events).6-- Use external
consultants to
supplement internal
challenges.
-- Internal section
challenges on theprocess of approving
scenario analysis ,etc.

Loss data -- Confirm amounts andcollection
details of loss events
when collecting data.

External challenges(Challenges by other sectionsin the bank)-- Validate theappropriateness andcomprehensiveness ofassessments throughhorizontal comparisons
between sections.
-- Validate using external
consultants to supplement
external challenges.
-- Compare with internal loss
events.
-- Validate compliance withdata collection rules(gross/net losses rule, etc.).
-- Validate
comprehensiveness andintegrity of data throughhorizontal comparisons
between sections.
-- Confirm consistency withfinancial accounting
figures.

Internal audits-- Validate themodel'svalidation
system.
-- Validate themodel itself.
-- Use external
auditors.
-- Validate
assessment
system.
-- Validate
assessment
contents.

-- Validate thedatacollection
method andsystem.
-- Validate theintegrity andcomprehensi
veness ofthe data.

(ii) Documentation
Documenting the details of methods for advancing operational management requires
enormous costs, particularly when completing the initial documents and constantly
6

While there are limitations based on the amount of data, it should be possible to some extent tovalidate the appropriateness of extremely unrealistic hypotheses, etc., using internal and external loss
data as a reference.

10

updating them. However, documentation has several advantages: (1) it enhances theability to explain the state of internal controls to interested parties inside and outside
the bank; (2) it allows knowledge to be shared within the bank; and (3) it enhances
the proper business processes. Since the outputs from advancement methodologies(risk quantification results, etc.) tend to be more and more important to businessjudgments, suitable documentation becomes all the more necessary in terms of its
accountability.
With regard to documentation contents, it is important that management board
members understand and approve the key points at issue according to their official
responsibilities, and those independent third parties such as internal auditors validate
them.
Documentation should refer to matters that may not be easily observable but have asubstantial impact on quantification results (such as prerequisites for quantification),or matters that depend greatly on scenario analyses and other subjective judgments.
Documentation items (examples)
Quantific
ation
modelsScenario
analysis
CSA
Data

Specific matters-- Matters that are generally deemed important
where quantification models are concerned, suchas confidence intervals or the Monte Carlosimulation technique.
-- The distribution type selection process-- Details and results of validation-- Details and results of sensitivity analyses-- Methods for estimating parameters-- Methods for classifying loss events into risk
quantification units-- Methods for dealing with dependencies between
data in different units-- Analytical procedures-- Standards for estimating loss frequencies andseverity-- Assessment procedures-- Assessment standards-- Standards for recognizing and identifying losses-- Gross loss or net loss, single loss or multiple
losses, timing of recognition, methods forassessing amounts, threshold values, etc.
-- Classification standards for risk quantificationunits-- Methods for dealing with dependencies (dataaggregation methods, etc.)

11

Caveats-- It is important to
prepare easily
understandable
documentation
concerning theimpact according
to differences inprerequisites andadoption methods
on quantification
results.
-- Where standards
are difficult to
describe inwriting, provide
sufficient
examples toenable sections
within the bank todeal with them ina consistent way.

(iii) Functions required of middle offices
In order to raise the level of operational risk management for the entire institution
and reduce gaps in risk management among sections, it is effective to establish a
section responsible for firm-wide operational risk management with the types offunctions described below. In such cases, the middle office is normally made up of
the sections (control sections) that control and oversee the risk in a firm-wide
manner, and sections (subsections) that control specific types of operational risks.
Whether or not to establish an independent middle office section depends on
circumstances at each bank, but even if such a section is not established, it isprobably necessary to implement cross-functional controls by establishing a crossdivisional committee to deal with operational risk management.
Possible middle office functions are as follows.
(a) Control section(1)
The control section plans the operational risk management framework for theentire institution. To do this, it:── develops methods for recognizing and identifying operational risk (concrete
details and responsible sections of CSA, risk quantification, KRI and
validation methods, etc.);── drafts risk control policies, which specify how risks should be controlled andwhich sections should be responsible; and── formulates plans pertaining to operational risk management from the overall
perspective of the bank after considering managerial intentions andinstructions, the state of advancement of risk management methods at otherbanks, changes in the risk environment affecting the industry, the situation in
front-line operations, and cost effectiveness.
(2)

The control section collects and analyzes information on incidents, accidents,
computer system malfunctions, clerical errors arising in each section, theresults of KRI, CSA and operational risk quantification, and reports to the
management with special attention to risk that should be closely watched andproposals for policies to deal with it. To do this, it:── is responsible for establishing the proper reporting infrastructure including thedesign of report formats and reporting systems, and also standardizing
reporting levels;── checks consistency in quality of reports or assessments of individual sections
or sub-risk categories (computer system risk, clerical risk, compliance,
tangible asset risk, etc.); and12── reports to senior management, preparing concise materials so that managers
can easily grasp the main points and features.
(b) Subsections(1) Subsections establish and examine the processes and procedures (P&P)
pertaining to operational risk, such as in-house guidelines on operations, for all
branches and sections. Examples of guidelines are as follows.
── The writing styles used for regulations pertaining to individual sections andoperations should be standardized as much as possible except in cases where
the use of different descriptions due to business characteristics can berationally justified.
── Within the area governed by a single policy, the descriptions and concepts
used in higher- and lower-level rules should be examined so that there are nodiscrepancies between them (e.g., check for consistency among individual
rules pertaining to information security policies, information security standards,
and information security management).
(2)

Subsections request reports from each front-line section and/or carry out onsite inspections, and provide evaluations and guidance according to theoperational risk management situation at each section based on the above
outcomes.

── From the perspective of a risk management expert, assessments should be
conducted to ascertain whether there are any problems in internal controls at
the front line, or whether the operational risk management framework isfunctioning effectively, and appropriate guidance should be given on how
operations may be improved.
── At the same time, materials should be collected for planning measuresdesigned to improve risk management throughout the entire bank.
This type of middle office must (1) not be directly involved with customer sales orback-office operations (payment and settlement business, management of cash andsecurities, and systems development and operations); and (2) report directly to theboard.
The middle office must independently implement CSA, etc., to assess the risks
inherent in its own operations, and oversee the outcomes of other sections.
(iv) Functions required of internal audits(a) Relationship between CSA and internal audits
With regard to the results of CSA and other risk assessments carried out by frontline sections, the middle office must validate assessments by front-line sections,13

while the internal auditors must carry out checks from the perspective of the internal
auditors' validation of the effectiveness (or accuracy) of the system framework.
Moreover, CSA results may be used for assessing risk with a view to drafting
internal audit plans, but in such cases internal auditors must use other information
for assessing risk and not depend exclusively on CSA results.
(b) Knowledge and experience that the internal auditors should possess
The internal auditors of financial institutions may not necessarily have accumulated
enough knowledge on the matters discussed so far by this group (especially
technical matters related to operational risk quantification models). In view of thefact that (1) operational risk quantification is becoming an increasingly important
tool for risk management, and (2) middle offices tend to be responsible for risk
quantification processes and there are usually no other entities but internal audits,which can validate this process within the bank, it is quite important that banks
allocate personnel with knowledge and experience of the technical side ofquantification.
Against this background, one possible option is to utilize external resources forsome auditing functions with a view to compensating for insufficient knowledge andexperience.
── Even in this case, however, the internal auditor must continue to bear final
responsibility for internal audit functions. When utilizing external resources,
therefore, the financial institution must ensure that it has the capability to (1)adequately assess the expertise, knowledge and experience of the external
entity when making its selection, and (2) understand and assess the output of
the external entity (external audit results, etc.) and, where necessary,
supplement it, as well as conduct the discussions required for that purpose withthe external entity.
B. Application of advancement methodologies in management
1. Potential Issues
It is important to increase third parties’ confidence in the banks’ adopting
advancement methodologies by demonstrating the actual use of outputs of thesemethodologies for business judgments (so-called "use tests").
The introduction of Basel II has led banks to advance operational risk management,
and has sometimes resulted in a situation where the introduction of advancement
methodologies has moved ahead while their application in management has lagged.
Partially reflecting these situations, it is apparent that the parties concerned have notyet reached a common understanding of the extent to which they are expected to use
advancement methodologies in management.

14

2. Participants’ Views
Possible examples of applications of advancement methodologies in management
are shown in the following table.
Operational strategies and business -- Secure an appropriate capital buffer
management-- Offer incentives for improving risk
management(performance evaluation and its linkage withremuneration)-- Identify priority business promotion sectors,
restructuring sectors
Daily management and risk-- Identify the operational risk profile (section
controls
units)-- Identify the operational risk profile(subdivided business lines)-- Prioritize risk management-- Set price commissions, etc.
-- Set risk limits-- Plan insurance
Report as business information
Utilize in internal audits<Inquiries>
Secretariat of the Study Group on the Advancement of
Operational Risk Management(c/o Center for Advanced Financial Technology
Financial Systems and Bank Examination Department,
Bank of Japan)
Mr. Tsuyoshi Oyama(03-3277-3078)
Mr. Takashi Arai
(03-3277-2005)
Mr. Tsuyoshi Nagafuji(03-3277-2987)

15

Attachment
List of Study Group Members
Mitsubishi–UFJ Financial Group
Corporate Risk Management DivisionCorporate Risk Management DivisionCorporate Risk Management Division
Bank of Tokyo–Mitsubishi UFJ
Corporate Risk Management DivisionCorporate Risk Management Division
Mitsubishi UFJ Trust and Banking Corporation
Corporate Risk Management Division
Sumitomo Mitsui Banking Corporation
Operational Risk Management Department
Operational Risk Management Department
Operational Risk Management Department
Risk Management Department

Kenji Fujii
Fumiaki Hibi
Shunji Hayashi
Katsutoshi Edamura
Takayuki Kobayashi
Keisuke Nakagiri
Toshio Mano
Kazuhiro Iga
Fumiteru Ueno
Ken'ichi Yamazaki

Mizuho Financial Group
Risk Management Division
Risk Management Division
Risk Management Division
Risk Management Division
Mizuho Corporate Bank
Risk Management Division
Mizuho Bank
Risk Management Division

Kazuhiro Mizoguchi

Bank of Japan
Center for Advanced Financial Technology
Center for Advanced Financial Technology
Center for Advanced Financial Technology
Center for Advanced Financial Technology
Examination of Computer System Risk Section
Center for Advanced Financial Technology
Center for Advanced Financial Technology

Tsuyoshi Oyama
Takashi Arai
Tsuyoshi Nagafuji
Nobuyasu Obata
Atsutoshi Mori
Tomonori Kimata
Seiya Hikuma

Observing members
Financial Services Agency
Planning and Coordination Bureau (Supervisory Bureau)
Planning and Coordination Bureau
Supervisory Bureau
Supervisory Bureau
Supervisory Bureau

Shunsuke Shirakawa
Shin'ichiro Shimizu
Yasuhiro Matsuda
Takaaki Kobayashi
Satoshi Morinaga

Hiroshi Kakunaka
Noboru Yamada
Koji Shiiba
Takuya Mizuno
Jun Matsuda

16