Exhibit A

Risk Management Framework

1

Effective Date:

Approval: Board of Directors

I. PURPOSE

This Risk Management Framework (“Framework”) describes how The Options Clearing 

Corporation (“OCC”) manages risk while providing efficient and effective clearing and settlement 

services to the markets it serves. This Framework explains how OCC’s governance model and 

three lines of defense facilitate risk management. Additionally, this Framework addresses 

OCC’s ability to employ recovery tools and facilitate an orderly wind-down. 

II. OCC RISK UNIVERSE

OCC plans for the possibility that events will occur and affect the delivery of its critical services. 

As a clearing house, OCC manages the risks it faces to serve the market in an efficient and 

effective manner. OCC has grouped risks that potentially impact clearing and settlement 

services into the risk categories below. 

Financial Risk is the risk that OCC is unable to maintain sufficient financial resources to cover 

its exposures under normal and stressed conditions.

Operational Risk is the risk of loss resulting from inadequate or failed internal processes, 

systems, and people, or from external events.

Information Technology and Security Risk is the risk that OCC is unable to maintain 

technology capabilities or services to support its operations, and the risk that OCC is unable to 

detect, defend against, and respond to security threats and incidents.

Legal and Regulatory Risk is the risk of loss that results from a lack of awareness, 

misunderstanding or unexpected application of the laws and regulations that apply to OCC’s 

business, products, services, and relationships.

General Business Risk is the risk of potential impairment to OCC’s financial position resulting 

from a decline in revenues or an increase in expenses.

OCC identifies, manages and reports on these risks through the three lines of defense model, 

outlined below. In accordance with the Corporate Risk Management Policy, these risk 

categories are broken down to risk sub-categories and risk statements, which comprise the 

universe of the risks that OCC manages to maintain effective clearing and settlement 

operations.

III. GOVERNANCE

OCC’s Board of Directors (“Board”) oversees the management of the risks that arise in or are 

borne by OCC. OCC’s governance structure includes the Board, Board committees, 

Management Committee, working groups, and employees.
Risk Management Framework

2

A. Board of Directors and Board Committees

The Board is responsible for advising and overseeing management. Pursuant to the OCC Board 

of Directors Charter and Corporate Governance Principles, the Chief Risk Officer presents a 

review of this Framework to the Board for approval at least annually. 

The Board may delegate the oversight of specific risks to Board committees. The Board may 

form or disband committees, including subcommittees to manage specific risks, as it from time 

to time deems appropriate, and may delegate authority to one or more designated members of 

such committees. The responsibilities of Board committees with regard to managing risks are 

outlined in committee charters.

B. Management Committee and Working Groups

OCC’s Management Committee supports the management and conduct of its business in 

accordance with policy directives from the Board. The Management Committee includes 

officers1responsible for ensuring that its actions and decisions are consistent with OCC’s 

mission, Code of Conduct, Rules and By-Laws, policies, procedures, and general principles of 

sound corporate governance. The Chief Risk Officer is a member of the Management 

Committee and reports to the Risk Committee of the Board (“Risk Committee”). The 

Management Committee may form and delegate authority to subcommittees and working 

groups of employees to conduct certain of its activities. Subcommittees and working groups are 

responsible for reporting and escalating information as appropriate.

C. Employees

OCC considers risk management during employee recruitment, development, training, and 

succession planning. OCC recruits and retains personnel with appropriate risk management 

knowledge, skills, and competencies. OCC also identifies successors for designated officers 

based on knowledge and experience. OCC provides internal and external development 

opportunities including required training related to risk, compliance, security, conflicts of interest, 

escalation of concerns, and the OCC Code of Conduct. OCC provides outlets for employees to 

anonymously report concerns that are reviewed by Compliance, Human Resources, and Legal.

IV. OCC RISK MANAGEMENT

OCC employs a three lines of defense model. The model clearly assigns ownership and 

accountability and enhances communication for expectations around risk management 

throughout the organization. The first line of defense maintains policies, procedures, processes,

and controls established for day-to-day risk management. The second line of defense evaluates 

and provides challenge to the first line by executing critical analysis to identify process

limitations and recommending risk treatments, including, but not limited to changes to relevant 

policies, procedures, processes, systems, and controls. Lastly, the third line of defense is an 

1 The Management Committee may include, but is not limited to the following officers: Executive Chairman, Chief 

Executive Officer, Chief Operating Officer, Chief Financial Risk Officer, Chief External Relations Officer, Chief Risk 

Officer, Chief Audit Executive, Chief Compliance Officer, Chief Financial Officer, Chief Human Resources Officer, 

Chief Information Officer, Chief Security Officer, Chief Legal Officer and General Counsel, Chief Clearing and 

Settlement Services Officer, and Chief Regulatory Counsel.
Risk Management Framework

3

internal audit function that reviews and provides objective assurance to the first and second 

lines. OCC employees report to members of the Management Committee. Consistent with the 

OCC Employee Code of Conduct, employees are expected to escalate risk information through 

their reporting line or to other members of management. Risks identified at OCC are reported to 

the Management Committee and Board consistent with relevant charters and policies. 

A. First Line of Defense

The risk inherent in OCC’s clearing and settlement services is managed by the first line of 

defense, which is responsible for owning and managing risks by maintaining policies, 

procedures, processes, systems, and controls. The first line of defense is comprised of OCC’s 

operational business units, including Financial Risk Management (“FRM”), Business Operations, 

Information Technology, and Corporate Finance, and also includes corporate functions such as 

human resources and project management. The first line of defense is also accountable for 

maintaining internal controls, control self-testing, and implementing corrective action to address 

control deficiencies. The first line of defense maintains policies and associated procedures that 

detail the processes and controls implemented across business units which are used to execute 

risk management related to the clearing and settlement services detailed below. 

a. Membership Standards

Membership standards are established by the Board and risk managed by Business Operations,

FRM and Information Technology in accordance with the Third-Party Risk Management 

Framework. OCC has risk-based clearing membership standards to manage the risks arising 

from Clearing Members. These requirements include applicable registrations, net capital 

requirements, creditworthiness, adequate operational capabilities, and maintaining qualified 

personnel. The Risk Committee reviews these standards to ensure OCC provides fair and open 

access to clearing and settlement services. Clearing Members that fail to meet the membership 

standards face potential consequences up to and including suspension.

b. Credit

OCC’s credit risk is managed by Business Operations, FRM, and Corporate Finance. OCC is 

exposed to credit risk based on its role as guarantor of cleared contracts. OCC has credit risk 

related to Clearing Members and manages this exposure by collecting margin and Clearing 

Fund resources based on a Clearing Member’s risk profile. OCC also faces credit risk from 

other financial institutions that facilitate payment, clearing, and settlement activities (e.g., 

clearing banks, custodians, and linked financial market utilities). FRM monitors its credit risk 

related to Clearing Members and financial institutions consistent with the Third-Party Risk 

Management Framework. FRM analyzes the creditworthiness of each financial institution, in 

addition to other information that could impact the financial institution’s ability to facilitate 

payment, clearing, and settlement services.

c. Clearing Fund

OCC’s Clearing Fund is managed by FRM and Business Operations. OCC maintains a Clearing 

Fund comprised of high-quality liquid assets to cover its credit risk exposure from Clearing 

Members in accordance with OCC’s confidential Clearing Fund Methodology Policy and 

Chapter X of OCC’s Rules. FRM uses stress tests to project the Clearing Fund size necessary 
Risk Management Framework

4

to maintain prefunded financial resources to cover losses arising from the default of the two 

Clearing Member Groups that would potentially cause the largest aggregate credit exposure to 

OCC in extreme but plausible market conditions. FRM also uses stress test results to determine 

the sufficiency of the Clearing Fund size and determine whether to issue calls for additional 

collateral or perform an intra-month Clearing Fund resizing. FRM reviews the adequacy of its 

Clearing Fund methodology through sensitivity analysis and an analysis of its parameters and 

assumptions. FRM reports the results of Clearing Fund reviews to the Board.

d. Margin

OCC’s margin is managed by FRM and Business Operations. FRM utilizes a risk-based margin 

methodology to calculate Clearing Member margin requirements in accordance with OCC’s 

confidential Margin Policy and Chapter VI of OCC’s Rules. FRM calculates margin daily for 

Clearing Member accounts. Intra-day margin calls may also be made for accounts incurring 

significant losses. FRM reviews the adequacy of its margin methodology through sensitivity 

analysis, backtests, and an analysis of its parameters and assumptions. FRM reports the results 

of margin reviews to the Board.

e. Collateral

OCC’s collateral risk is managed by Business Operations, Corporate Finance, and FRM in 

accordance with OCC’s confidential Collateral Risk Management Policy and OCC Rules 604 

and 1002. OCC requires its Clearing Members to deposit collateral as margin and Clearing 

Fund. OCC limits acceptable assets to those with low credit, market, and liquidity risks, and 

employs other risk mitigation tools, including collateral concentration limits. FRM applies riskbased haircuts and Business Operations revalues collateral daily to ensure margin and Clearing 

Fund requirements are met.

f. Liquidity

OCC’s liquidity risk is managed by FRM and Corporate Finance. OCC manages its liquidity risk 

in accordance with its confidential Liquidity Risk Management Framework by maintaining a 

reliable and diverse set of committed resources and liquidity providers, establishing a contingent 

funding plan to collect additional resources, and performing stress testing that covers a wide 

range of scenarios that include the default of the Clearing Member Group that would generate 

the largest aggregate liquidity obligation in extreme but plausible market conditions. FRM also 

tests the sufficiency of its resources by forecasting daily settlement under normal and stressed 

market conditions and compares these results to the liquid resources maintained. FRM reports 

the results of these reviews to the Board.

g. Settlement

OCC’s settlement risk is managed by Business Operations in accordance with Chapters V and 

IX of OCC’s Rules. OCC uses approved clearing banks to facilitate settlements on at least a 

daily basis. OCC issues instructions to clearing banks to debit or credit the account of a 

Clearing Member, and correspondingly debit or credit OCC’s account, with a specific dollar 

amount by a specified time. Settlement finality occurs when a clearing bank confirms the 

settlement instruction or is silent past the applicable deadline.
Risk Management Framework

5

h. Custody and Investment 

OCC’s custody and investment risk is managed by Corporate Finance, Business Operations, 

and FRM in accordance with OCC Rules 604 and 1002(b). OCC holds its own and its Clearing 

Members’ assets at approved settlement and custodian banks, as well as through linkages with

other financial market utilities. OCC requires settlement and custodian banks to meet minimum 

financial and operational requirements. OCC complies with applicable customer protection and 

segregation requirements for the handling of customer funds. OCC maintains working capital

and non-invested Clearing Member cash in accounts that minimize delays in access to funds. 

OCC maintains accounts at the Federal Reserve to hold custody funds. OCC invests in 

instruments with minimal credit, market, and liquidity risks. 

i. Default Management

OCC’s default management risk is managed by FRM in accordance with OCC’s confidential 

Default Management Policy and Chapter XI of OCC’s Rules. In the event of a Clearing Member 

default, OCC takes timely action to contain losses and liquidity pressures and continue to meet 

its obligations. OCC closes open positions in an orderly manner, which may include performing 

auctions, utilizing liquidation agents, or applying hedges. Margin and Clearing Fund deposits of 

the defaulting Clearing Member are used to offset these losses, followed by other financial 

resources. OCC performs default testing with the participation of designated Clearing Members 

and other stakeholders to evaluate its processes and systems, including close-out processes.

j. General Business

OCC’s general business risk is managed by Corporate Finance, Information Technology, 

Business Operations and Financial Risk Management. Corporate Finance performs financial 

planning and analysis, reviews operating budgets and fee structures, and reviews business 

performance. OCC maintains liquid net assets funded by equity sufficient to cover potential 

general business losses and comply with financial resource requirements in accordance with its 

confidential Capital Management Policy. Furthermore, Information Technology reviews OCC’s

ability to maintain its critical services under a range of scenarios, including adverse market 

conditions. Business Operations and Financial Risk Management also perform assessments to

determine if potential new business opportunities fit within OCC’s models and risk management 

systems.

k. Technology

OCC’s technology risk is managed by Information Technology. OCC uses technology solutions 

to manage risk and facilitate clearing and settlement by utilizing systems that have adequate 

levels of availability, security, resiliency, integrity, and adequate, scalable capacity based on 

their criticality. Information Technology manages technology risk by utilizing a structured 

technology delivery approach that provides for consistency and establishes responsibilities and 

requirements. Information Technology monitors and evaluates technology performance based 

on service levels related to data integrity, system availability, data timeliness and data quality to 

manage technology risk. To achieve these service levels, Information Technology manages 

OCC’s efforts across technology incidents, changes, configurations, system capacity, and 

evaluates system recoverability through disaster recovery testing.
Risk Management Framework

6

l. Legal

OCC’s legal risk is managed through efforts across OCC that are advised by Legal. OCC 

manages its legal risk by establishing, implementing and enforcing written documents, including 

Rules and By-Laws, policies, and legal agreements, that are reasonably designed to provide a 

well-founded, clear, transparent, and enforceable legal basis for each aspect of OCC’s activities 

in all relevant jurisdictions and comply with applicable legal and regulatory requirements. In 

order to manage legal risk across OCC, employees are required to consult with Legal on legal 

and regulatory matters, including but not limited to interpretation of laws and regulations 

applicable to OCC, including OCC’s Rules and By-Laws, legal claims against OCC, government 

or regulatory requests or inspections, and matters that may be the subject of a regulatory filing.

B. Second Line of Defense

OCC’s second line of defense includes it compliance, corporate risk, third-party risk, model risk 

management, security, and business continuity functions. The second line has no operational 

authority or responsibility for the first line to prevent conflicts of interest. The second line 

provides objective analysis to identify potential enhancements and improvements to first line 

processes to help ensure compliance with applicable laws and regulations and prudent risk 

management. Second line management reports to Board committees and has the authority to 

escalate information to the first line, Management Committee, and Board. Additionally, second 

line management provides reports to the Board at least quarterly at its scheduled meetings. 

a. Compliance

Compliance oversees OCC’s management of compliance risk and adherence to applicable rules 

and regulations, policies, procedures, processes, controls, and standards of conduct. 

Compliance manages compliance risk by establishing processes to prevent, detect, respond to, 

and report on compliance risk. Compliance supports and assesses the management of 

compliance risk through advising, monitoring, reporting, testing, and training activities and 

maintains mechanisms for reporting unethical or fraudulent behavior or misconduct.

b. Corporate Risk

Corporate Risk Management evaluates enterprise risk by identifying, measuring, monitoring, 

managing, reporting, and escalating risks to inform decision-making in accordance with the

Corporate Risk Management Policy. Corporate Risk Management evaluates enterprise risk to 

provide an understanding of inherent and residual risks as compared against Board-approved 

levels.

c. Third-Party Risk

Third-Party Risk Management evaluates risks posed to OCC by third parties by identifying,

measuring, monitoring, managing, reporting, and escalating risks as described in the ThirdParty Risk Management Framework. Third-Party Risk Management aggregates information 

about the risks presented by third parties based on their relationships to OCC.
Risk Management Framework

7

d. Model Risk Management

Model Risk Management performs independent model validation, evaluates model parameters 

and assumptions, assesses mitigating factors, and provides effective and independent 

challenge throughout OCC’s model lifecycle in accordance with its confidential Model Risk 

Management Policy. Models are governed and independently assessed and certified to 

determine adequate performance. This includes model testing and performance monitoring

(e.g., backtesting, sensitivity analysis).

e. Security

Security manages information, physical, and personnel security risk to safeguard the 

confidentiality, integrity, and availability of corporate information systems and data assets

implemented and maintained by Information Technology. Security employs a risk-based 

methodology and controls to manage information governance, system resiliency, and cyber 

security. In addition, Security maintains policies and procedures that require appropriate 

protective controls and event detection via security monitoring. Security evaluates its processes 

and controls through internal and external testing, scanning for threats and vulnerabilities, and 

benchmarking against industry standards.

IT risk assessments (“ITRA”) shall be conducted by Security prior to the procurement, 

development, installation and operation of IT services and systems. An ITRA shall be triggered 

by certain events that may change IT risks at OCC, including but not limited to: (i) evaluation of 

a new system or technology, (ii) procurement of a new system or technology, (iii) changes in 

OCC business processes that impact current services and systems, (iv) the emergence of new 

threats that subvert existing controls and that require a new technology mitigation, and (v) 

periodic reviews. 

f. Business Continuity

Business Continuity maintains a business continuity program that establishes OCC’s plan for 

maintaining backup and recovery capabilities that are sufficiently resilient and geographically 

diverse to address both internal and external events that could impact OCC’s operations.

C. Third Line of Defense

OCC’s third line of defense consists of Internal Audit. Internal Audit is independent and reports

directly to the Audit Committee of the Board (“Audit Committee”) to ensure this independence; 

the Audit Committee oversees the activities performed by Internal Audit in accordance with the 

Audit Committee Charter. Internal Audit has no responsibility for first- or second-line functions. 

Internal Audit designs, implements, and maintains an audit program that provides the 

Management Committee and Audit Committee independent and objective assurance related to 

the quality of OCC’s risk management, governance, compliance, controls, and business 

processes in accordance with the confidential Internal Audit Policy. Internal Audit issues 

independent reports to the first and second line as well as the Audit Committee and Board.
Risk Management Framework

8

V. RECOVERY AND ORDERLY WIND-DOWN PLAN

In the event of extreme financial, operational, or general business stress, Corporate Risk 

Management maintains a confidential Recovery and Orderly Wind-Down Plan which details the 

departments responsible for executing the plan. OCC employs a set of recovery tools in the 

event of severe financial, operational, or general business stress, to continue to provide critical 

clearing and settlement services. Should OCC’s recovery efforts be unsuccessful or if, based on 

facts and circumstances, it is determined that its recovery tools would be insufficient, OCC has 

a wind-down plan that provides for the orderly resolution of the firm.

VI. RISK ACCEPTANCES AND DEVIATIONS

Risk acceptances, including exceptions to OCC’s risk management frameworks and policies, 

shall be escalated to Corporate Risk Management in accordance with the Corporate Risk 

Management Policy. Deviations from OCC’s risk management frameworks and policies shall be 

escalated to Compliance in accordance with the Policy Governance Policy.