1

Exhibit C
Risk Management Framework Policy 

2

Annual Review and Approval: Board of Directors

Version Effective Date: 11/26/2021

Scope: Firm-wide

I. PURPOSE

The purpose of the Risk Management Framework Policy (“RMF” or “Policy”) is to describe 

The Options Clearing Corporation’s (“OCC’s”) framework for comprehensive risk 

management, including OCC’s framework to identify, measure, monitor and manage all risks 

faced by OCC in the provision of clearing, settlement and risk management services.1

Section II.A. establishes the context for OCC’s risk management framework. Section II.B.

outlines OCC’s risk management philosophy. Section II.C. describes OCC’s Risk Appetite 

Framework and use of Risk Tolerances. Section II.D. describes the governance 

arrangements that implement risk management. Section II.E. outlines OCC’s identification 

of Key Risks. Section II.F. describes OCC’s program for enterprise-wide risk management, 

including the three lines of defense structure and OCC’s approach to risk monitoring, 

assessment and reporting. Section II.G describes control activities. 

II. POLICY DETAIL

A. Context for Risk Management Framework

OCC is the world's largest equity derivatives clearing organization. As the foundation for 

secure markets, OCC delivers world-class risk management, clearing and settlement 

services to the listed options, financial and commodity futures, security futures and 

securities lending markets. 

OCC serves a critical role in the financial markets as a central counterparty (“CCP”), 

guaranteeing that the obligations of the contracts it clears are fulfilled. OCC operates its 

business as an industry utility and receives the majority of its revenue from clearing fees 

charged to its members. 

In 2012, the Financial Stability Oversight Council designated OCC as a Systemically 

Important Financial Market Utility (“SIFMU”). OCC received this designation because it is a 

1 OCC’s framework is based primarily on the Committee of Sponsoring Organizations of the Treadway Commission 

and the International Organization for Standardization’s 31000 principles for integrated risk management. The 

framework also incorporates guidance from the Financial Stability Board on risk appetite and risk tolerance, the 

Basel Committee on Banking Supervision principles for operational risk management, and the Committee on 

Payments and Market Infrastructures and International Organization of Securities Commissions Principles for 

Financial Market Infrastructures.
Risk Management Framework Policy 

3

critical node in the financial markets as the sole provider of clearance, settlement and risk 

management services for U.S. listed options. As a SIFMU, OCC recognizes its role in 

promoting financial stability for market participants, investors and the global economy. 

OCC operates under the jurisdiction of the Securities and Exchange Commission (“SEC”) and 

the Commodity Futures Trading Commission (“CFTC”). As a covered clearing agency2 under 

SEC jurisdiction, OCC clears options and security futures on a number of underlying financial 

assets, including common stocks and stock indexes, as well as securities lending 

transactions. As a registered derivatives clearing organization (“DCO”)

3 under CFTC 

jurisdiction, OCC offers clearing and settlement services for transactions in futures and 

options on futures. As a designated SIFMU,4 OCC also operates under the prudential 

supervision of the Board of Governors of the Federal Reserve System (“Federal Reserve 

Board”).

B. Risk Management Philosophy

OCC shall be mindful of the public interest and its obligation to promote financial stability, 

reduce the potential for systemic contagion, and support the smooth functioning of the U.S. 

financial markets. As a CCP, financial risks for the markets OCC serves are concentrated at 

OCC for all transactions it clears. As a result of this concentration, OCC’s primary objective 

shall be to ensure that the financial risks that it takes on as a CCP, which primarily relate to 

the risk that a Clearing Member will default on its obligations to OCC, are managed 

according to applicable regulations and international standards for systemically important 

financial market infrastructures. 

In its role as a CCP, every aspect of OCC’s daily operations is devoted to providing CCP 

services, whether managing financial risk exposure, managing the operational risks that 

arise from the underlying provision of core clearing and settlement services, or managing 

the business risks in the options ecosystem. The majority of these risks shall be managed 

within a low risk appetite, meaning that daily operations, which are guided by policies, 

procedures and controls, reflect significant attention to ensuring that financial exposures 

and service disruptions are rare and within acceptable limits. 

C. Risk Appetite Framework and Tolerance

C.1 Risk Appetite 

OCC’s Risk Appetite Framework (“RAF”) is a critical component of this Policy and shall be 

used to set the overall approach at the enterprise level for managing risks in an effective 

and integrated fashion across OCC. The RAF shall establish types of Key Risks OCC faces in 

2 As defined by 17 CFR 240.17Ad-22(a)(5).

3 As defined in 17 CFR Part 39.

4 As provided for in Title VIII of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010.
Risk Management Framework Policy 

4

accordance with OCC’s requirements as a SIFMU, covered clearing agency and DCO, and in 

accordance with OCC’s strategic objectives.5 Key Risks shall be approved by OCC’s Board of 

Directors (“Board”). The level of risk OCC is willing and able to assume shall be contained in 

Risk Appetite Statements, which OCC shall complete for each of its Key Risks. Risk Appetite 

Statements shall be set annually by each department associated with a Key Risk in 

cooperation with the Enterprise Risk Management department (“ERM”) according to the 

Enterprise Risk Management Governance Procedure.

The purpose of a Risk Appetite Statement shall be to express OCC’s view on the level of risk 

OCC is willing to accept for a Key Risk related to the provision of CCP services. Risk Appetite

Statements shall be qualitative indications of risk appetite that set the tone for OCC’s 

approach to risk-taking, and shall be indicative of the level of resources or effort OCC puts 

forth to prevent or mitigate the impact of a Key Risk. 

C.1.a Risk Appetite Statement Definitions6

Risk Appetite Statements shall fall in one of four categories: (i) no appetite, (ii) low 

appetite, (iii) moderate appetite, and (iv) high appetite, as defined below: 

i. No appetite: OCC is unwilling to deliberately accept any level of risk for a Key Risk in

this category. 

ii. Low appetite: OCC devotes significant resources to managing risk, but may choose 

to accept certain risks that do not materially impact core clearing and settlement 

because the level of resources that OCC would be required to put forth to mitigate 

the risks would be impractical.

iii. Moderate appetite: OCC is willing to engage in certain activities that may bring 

longer-term efficiencies or result in new business opportunities even though the 

activities or new businesses may pose new risks to OCC.

iv. High appetite: OCC is willing to implement a new high-risk process or business 

opportunity. It is unlikely OCC would apply this level of appetite to a Key Risk absent 

a compelling, urgent business need. 

The Board shall annually review and have ultimately authority for approving the Risk 

Appetite Statements in connection with each Key Risk upon recommendation of the 

Management Committee.

5 The Appendix to this Policy contains the Key Risks that by design align to the risks faced by systemically 

important CCPs outlined in international standards, the definitions of such Key Risks and related sub-categories.

6 Risk Appetite Statements apply to Residual Risk, which is the level of risk exposure posed to a process or activity 

after the application of controls or other risk-mitigating factors. 
Risk Management Framework Policy 

5

C.2 Risk Tolerances 

Risk Tolerances shall represent the application of risk appetite to specific sub-categories or 

aspects of Key Risks. OCC shall use Risk Tolerances to set acceptable levels of risks 

(described further below), as approved by the Board. Risk Tolerances may be stated in 

either quantitative or qualitative terms, depending on the nature of the risk. The Board shall 

evaluate Risk Tolerances at least annually, and more frequently if necessary as a result of 

changes to products, processes, market conventions or other changes to Key Risks. 

Each OCC department shall establish Risk Tolerances at least annually for sub-categories of 

Key Risks that are within their relevant domains of responsibility. Each department shall be 

responsible for managing applicable risks within established tolerance levels. ERM staff shall 

monitor Risk Tolerances through quantitative metrics, where applicable, and compile such 

monitoring in a report that the Chief Risk Officer shall present to the Management 

Committee and Board (or a committee thereof) at least quarterly. The Enterprise Risk 

Management Governance Procedure provides more detail on the processes for establishing 

and managing Risk Tolerances, including assignments of various OCC departments to Risk 

Tolerances.

D. Risk Management Governance

OCC’s risk management governance shall follow a hierarchical structure that begins with the 

Board, which has ultimate authority for maintaining a sound risk management framework. 

The structure shall include the Board, Board committees, Management Committee and 

various working groups established by the Management Committee.

D.1 Board of Directors

The Board shall perform an oversight role to ensure that OCC is managed and operated in a 

manner consistent with the discharge of OCC’s regulatory responsibilities as a SIFMU, 

covered clearing agency and DCO providing clearance and settlement services. The Board 

shall have ultimate oversight responsibility for ensuring OCC has governance arrangements 

that, among other things, prioritize the safety and efficiency of OCC through a clear, 

documented risk management framework. The Board shall oversee risk management 

policies, procedures and systems designed to identify, measure, monitor and manage risks 

consistent within the Risk Appetite Statements and Risk Tolerances approved by the Board. 

Consistent with the Board Charter, the Board shall also oversee and approve OCC’s 

Recovery and Orderly Wind-Down Plan. 

The responsibilities of Board committees with regard to managing Key Risks shall be 

outlined in their respective committee charters. 

D.2 Management Committee 

The Management Committee shall be responsible for annually reviewing and approving this 

Policy and any changes to Risk Appetite Statements and Risk Tolerances and recommending 
Risk Management Framework Policy 

6

further approval thereof to the Board. The Management Committee shall also review reports 

related to metrics for assessing Risk Tolerances to determine whether Key Risks are 

behaving within established tolerances and take or recommend action as needed to return 

Key Risks to their appropriate levels. The Management Committee shall escalate exceptions 

to Risk Tolerances and Risk Appetite Statements to the relevant Board committee and/or 

other issues related to Key Risks as outlined in the policies named in the Appendix to this 

Policy as applicable for managing OCC’s Key Risks. Each such policy shall establish 

escalation protocol for the applicable Key Risks. 

D.3 Risk Working Groups

The Management Committee may establish working groups to assist the Management 

Committee in its management of Key Risks identified in this Policy. Such working groups

shall establish procedures governing their administration, including composition, authority, 

functions and responsibilities. Such procedures shall also include escalation protocols for risk 

issues that are identified by or brought to the working groups, which shall be consistent 

with escalation obligations established in this Policy, the Management Committee Charter, 

the Board Charter, Board Committee Charters, and applicable policies and procedures. 

E. Identification of Key Risks

OCC’s risk management shall begin with identifying risks that could affect OCC’s ability to 

perform services as expected. These risks are described in internationally-recognized 

standards for CCP risk management and codified in various regulatory requirements to 

which OCC is subject. In forming its views on Key Risks, OCC shall consider direct financial 

and operational risks that may prevent the OCC’s uninterrupted provision of CCP services, 

and also consider risks that may harm OCC’s reputation and undermine the perception of 

OCC as a foundation of secure financial markets. In addition, OCC shall identify the risks it 

faces from third parties, such as custodians and settlement banks, that are critical to the 

design and operation of OCC’s infrastructure and risk management. 

OCC’s Key Risks shall be defined and managed as follows:

E.1 Financial Risk 

Financial risk shall encompass: credit risk, liquidity risk, investment risk and model risk. 

OCC shall manage financial risk through the following:

E.1.a Credit Risk Management Framework

Credit risk is the risk that a counterparty will be unable to meet its obligations when due or 

the risk that OCC will not maintain sufficient financial resources to cover its credit 

exposures. OCC’s credit risk management framework shall encompass policies and 

procedures for: (i) maintaining sufficient prefunded resources in the form of margin and 

clearing fund according to the Margin Policy and Clearing Fund Methodology Policy, 

respectively; (ii) accepting collateral from participants that is low risk and high quality 
Risk Management Framework Policy 

7

according to the Collateral Risk Management Policy; (iii) monitoring the creditworthiness 

and operational reliability of all counterparties including participants, custodians, settlement 

banks and liquidity providers, and linked financial market utilities (“FMUs”) according to the 

Third-Party Risk Management Framework; and (iv) maintaining a waterfall of resources to 

be used in the event of participant default and a process for replenishing resources 

according to the Default Management Policy. 

E.1.b Liquidity Risk Management Framework

Liquidity risk is the risk that OCC will not maintain sufficient liquid resources to meet its

same day and, where appropriate, intraday and multiday settlement of payment obligations. 

OCC’s liquidity risk framework shall encompass policies and procedures for sizing liquidity 

resources to cover liquidity needs in the event of the default of the largest Clearing Member 

Group, forecasting daily settlements needs under normal market conditions, maintaining 

liquid resources in the form of cash and committed facilities, maintaining a contingency 

funding plan, and periodically reviewing the size of liquidity resources according to the 

Liquidity Risk Management Framework. The framework shall also include policies and 

procedures for maintaining liquidity resources at creditworthy custodians and monitoring the 

financial and operational performance of financial institutions and committed liquidity 

facilities according to the Third-Party Risk Management Framework and investing liquidity 

resources in safe overnight investments or at a Federal Reserve Bank according to the Cash 

and Investment Management Policy.

E.1.c Investment Risk 

Investment risk is the risk that OCC will incur losses on overnight investments of margin 

and/or clearing fund assets. OCC shall maintain an account at a Federal Reserve Bank, 

which OCC views as bearing no investment risk, and shall invest funds not held at the 

Federal Reserve Bank in high quality liquid assets according to the Cash and Investment 

Management Policy. 

E.1.d Model Risk 

Model risk is the potential for adverse consequences from decisions based on incorrect or 

misused model outputs. Model risk shall be managed through OCC’s model development 

program, independent model validation, and governance arrangements for the approval of 

new models or models with material changes, according to the Model Risk Management 

Policy. 

E.2 Operational Risk 

Operational risk is the risk that deficiencies in internal controls, processes, and information 

systems; human error or misconduct; external events or intrusions result in disruptions of 

OCC’s CCP services. Operational risk covers some risks related to information technology 

(“IT”), such as data security and operational reliability, as well as non-IT risks such as 

process management and third party risk management. To reflect the importance of IT risks 
Risk Management Framework Policy 

8

and the impact that an IT deficiency would have on OCC’s critical services, OCC categorizes 

IT risk as a separate Key Risk, discussed below. 

Operational risk is inherent in every aspect of OCC’s daily operations and services and can 

manifest in multiple ways through errors in financial reporting, poor process management, 

inadequate physical asset security, human error or misconduct, internal or external fraud, 

third parties (including linked third parties) that do not perform in accordance with 

contractual or operational agreements, or poor business continuity planning. 

OCC shall manage operational risks through the following:

E.2.a Enterprise Project Management Program

The Enterprise Project Management Program shall provide initial assessments of projects 

originating from the Corporate Planning department and management of project execution 

to ensure that proper oversight exists during the initiation, planning, execution and delivery 

of OCC enterprise projects, according to the Annual Planning Policy. 

E.2.b Business Continuity Program

OCC’s Business Continuity Program (“BCP”) shall support continuance of critical services in 

the unlikely event of catastrophic loss of both infrastructure and staff at OCC locations in 

Illinois or Texas, according to the Incident Response and Recovery Policy. The program shall 

include a Crisis Management Plan, which outlines OCC’s processes for decision-making in 

crisis or emergency circumstances. 

E.2.c Third-Party Monitoring Program

OCC’s critical clearing, settlement, and risk management services are dependent on 

contractual relationships and operational arrangements with key third parties, including 

settlement banks, linked FMUs and exchanges, and critical vendors. OCC shall manage the 

risks posed by these interdependencies through a comprehensive third-party risk 

management program, which includes requirements for onboarding and ongoing monitoring 

of these entities. OCC conducts monitoring of these entities in several areas of the 

organization, including National Operations, Collateral Services, Credit Risk, Finance and 

ERM. The third-party monitoring program is outlined in the Third-Party Risk Management 

Framework. Policies that govern the risk management of third parties include the Third 

Party Risk Management Framework, the Trade and Position Processing Policy, and the

Annual Planning Policy. 

E.2.d Human Resources and Compliance Training Policies

OCC shall provide internal training and permit employees to attend external training classes 

in order to improve their professional and technical skills. The Human Resources department 

shall provide training and development for all OCC staff for the purpose of providing staff 

tools to develop and maintain the necessary knowledge and skills to perform their jobs. The 
Risk Management Framework Policy 

9

Compliance Department shall conduct training on the Code of Conduct. A description of 

these programs is contained in Organizational and Employee Assistance Procedure. 

E.3 Operational Risk – Information Technology

Information technology risk is the risk that inadequate levels of system functionality, 

confidentiality, integrity, availability, capacity or resiliency for systems that support core 

clearing, settlement or risk management services, or other critical business functions results 

in disruptions in OCC services. 

Information technology risk is a form of operational risk. As noted above, because 

technology is a large and critical component of operational risk at OCC, to which significant 

resources are devoted, OCC identifies IT risk as a separate Key Risk. OCC is subject to SEC 

Regulation Systems Compliance and Integrity (“Reg SCI”), and OCC’s policies and 

procedures for managing IT risks shall be designed to be compliant with Reg SCI.

OCC shall manage IT operational risks through the following:

E.3.a Quality Standards Program

OCC’s quality standards shall be targets set annually by the Quality Standards Working 

Group that establish performance standards for systems operations. The standards shall be 

grouped by three categories: (i) data integrity, (ii) system availability and (iii) data 

timeliness. The quality standard program, including a description of how targets are 

established and monitored, is outlined in the Quality Standards Procedure. 

E.3.b Cybersecurity Program

OCC’s cybersecurity program shall be based on the industry-standard National Institute of 

Standards and Technology cybersecurity framework, which includes policies, procedures, 

software tools and controls to protect and monitor OCC’s critical services and respond to 

threats to assure critical services are operating within expected timeframes, according to 

the Information Security policies and procedures. 

E.3.c System Functionality and Capacity – Critical Reg SCI Systems

OCC shall classify technology systems in accordance with Reg SCI. OCC shall conduct 

system monitoring, incident management, change management, configuration 

management, media protection, maintenance, delivery processes and capacity testing in 

accordance with Reg SCI criticality designations and the IT Operational Risk Management 

Policy. 

E.4 Legal Risk
Risk Management Framework Policy 

10

Legal risk is the risk that OCC does not have a well-founded, clear, transparent and 

enforceable legal basis for the material aspects of its clearing, settlement and risk 

management services. OCC shall manage legal risk through the following: 

E.4.a Regulatory Compliance

As a self-regulatory organization, OCC’s rules and policies establish the legal basis for the 

material aspects of its clearing, settlement and risk management services. OCC shall 

maintain rules that are compliant with Delaware state law, and policies and procedures that 

are reasonably designed to comply with applicable regulations related to OCC’s 

requirements as a SIFMU, covered clearing agency and DCO, according to the Compliance 

Risk Policy, Legal Services Policy and Regulatory Change Identification Procedure. 

E.4.b Contracts

In addition to rules, policies and procedures, OCC shall maintain legal agreements that 

establish counterparty obligations regarding the material aspects of its clearing, settlement 

and risk management services, including, but not limited to: settlement finality, vendor 

performance, exchange performance, the settlement of certain physically-settled stock 

options and single stock futures, and cross-margining obligations, in accordance with the 

Material Agreements Policy. 

E.5 General Business Risk 

General business risk is the risk of any potential impairment of OCC’s financial condition (as 

a business concern) owing to declines in revenue or growth in expenses, resulting in 

expenses exceeding revenues and a loss that must be charged against capital. These risks 

arise from OCC’s administration and operation as a business enterprise, and are not related 

to a Clearing Member default or failure of a counterparty to perform its obligations to OCC, 

as described in Section E.1 above. OCC shall manage general business risk as follows.

E.5.a Capital Management Policy

OCC shall maintain a Capital Management Policy detailing the principles used to determine, 

monitor and manage OCC’s capital levels such that OCC maintains sufficient liquid net 

assets funded by equity (“LNAFBE”) to cover potential general business losses and continue 

operations and services as a going concern if losses materialize under a a range of 

scenarios, including adverse market conditions. The Capital Management Policy shall provide 

that OCC shall set a Target Capital Requirement at a level sufficient to maintain LNAFBE at 

least equal to the greater of: (x) six months of OCC’s current operating expenses, (y) the 

amount determined by the Board to be sufficient to ensure a recovery or orderly wind-down 

orf critical operations and services, and (z) the amount determined by the Board to be 

sufficient for OCC to continue operations and services as a going concern if general business 

losses materialize. The Capital Management Policy shall provide that the resources held to 

meet the Target Capital Requirement shall be separate from OCC’s resources to cover 

participant defaults and liquidity shortalls and shall be of high quality and sufficiently liquid 
Risk Management Framework Policy 

11

to allow OCC to meet its current and projected expenses under a range of scenarios, 

including adverse market conditions. In addition, the Capital Management Policy shall 

include a plan to replenish OCC’s capital in the event losses unrelated to a Clearing Member 

default cause OCC’s sharholders’ equity to fall close to or below the Target Capital 

Requirement. 

E.5.b Corporate Planning and Budgeting

To maintain stable revenues and expenses, OCC shall conduct corporate strategic planning, 

business planning, budgeting, project management and new business development in 

accordance with the the Annual Planning Policy. 

E.5.c Reputational Risk 

Events that negatively impact OCC’s reputation have the potential to negatively impact 

business results. Events that negatively impact reputation can arise from many sources 

including employee wrongdoing, operational disruptions and regulatory sanctions. To 

mitigate against employee wrongdoing, OCC employees shall abide by OCC’s Code of 

Conduct. 

F. Risk Management Practice

F.1 Three Lines of Defense

To maintain a robust risk management framework, OCC shall employ a "three lines of 

defense” model. The purpose of this model shall be to allow OCC to manage risks with 

clarity of ownership and accountability, and to provide for independent evaluation of the 

effectiveness of risk management activities. 

The first line of defense shall be comprised of OCC’s operational business units, including 

financial risk management, operations, technology, legal, and corporate functions such as

human resources, finance, accounting, and project management. The first line of defense 

shall be responsible and accountable for owning and managing risks, which means 

maintaining policies, procedures, processes and controls that manage relevant risks. The 

first line of defense shall also own and be accountable for maintaining internal controls, 

control self-testing and implementing corrective action to address control deficiencies. 

The first line of defense shall be supported and monitored by the second line of defense, 

which shall consist of ERM, the Model Validation Group, Security Services and Compliance. 

The second line of defense is an oversight function and shall design, implement, and 

maintain an enterprise-wide risk management and compliance program and tools to assess 

and manage risk and compliance at the enterprise level. The second line of defense shall 

work with the first line of defense to assess risk and advise the first line on the development 

of policies, procedures, processes and controls. The second line of defense shall report to 

the Management Committee and Board (or committee thereof) on the first line of defense's 

effectiveness in managing risk and compliance and an assessment of whether OCC’s
Risk Management Framework Policy 

12

services are being delivered within Risk Appetite Statements and Risk Tolerances as 

established in accordance with Section C above.

The third line of defense shall consist of the Internal Audit department (“Internal Audit”). 

Internal Audit, which reports directly to the Audit Committee of the Board, shall be

accountable for designing, implementing and maintaining a comprehensive audit program 

that provides the Management Committee and Audit Committee of the Board an

independent and objective assurance that the quality of OCC’s risk management and 

compliance meets OCC’s Risk Appetite Statements and Risk Tolerances, as established in 

accordance with Section C above, and business imperatives. Internal Audit shall maintain a 

diverse and skilled team of professionals with a variety of business, technology and audit 

skills, and shall perform all of its activities in compliance with the Institute of Internal 

Auditors' standards found in the International Professional Practices Framework and 

according to the Internal Audit Policy.

F.2 Risk Assessment

OCC shall conduct the risk identification and assessment programs described below to 

identify, measure and monitor current and emerging risks at OCC. Findings or 

recommendations that result from the assessments, as well as the frequency of such 

assessments, shall be documented, monitored and escalated through the appropriate 

governance according to applicable procedures. 

F.2.a. Enterprise Risk Assessment and Scenario Analysis Program 

The Enterprise Risk Assessment (“ERA”), conducted by the first line of defense in 

conjunction with ERM, shall be OCC’s comprehensive foundational assessment program, and 

shall analyze Inherent Risk, quality of risk management and Residual Risk of the subcategories of Key Risks (provided in the Appendix to this Policy). ERM shall use analysis of 

Residual Risk in conjunction with metrics related to Risk Tolerances to develop a risk profile 

and determine whether a Key Risk is within its risk appetite in accordance with Section C 

above. ERM’s analysis of Residual Risk shall also provide the Management Committee and 

Board (or committee thereof) information on quantity of risk in a certain functional area or 

business area, and provide a mechanism to prioritize risk mitigation activities. The ERA 

program is described in the Enterprise Risk Assessment Procedure. 

OCC shall employ the Scenario Analysis Program, an industry-standard method of 

identifying operational risks that may not be otherwise captured by the ERA program. ERM, 

in cooperation with the first line of defense, shall design simulations of potential business 

disruptions, and business unit staff shall use such simulations to identify risks that may not 

have been previously uncovered or identify weaknesses in current controls. ERM shall 

include potential risks identified through the Scenario Analysis Program in its analysis of, 

and reporting on, the quantity of risk within a certain Key Risk and whether the Key Risk is 
Risk Management Framework Policy 

13

within its risk appetite. The Scenario Analysis Program is described in the Scenario Analysis 

Procedure. 

F.2.b. IT Risk Assessments

IT risk assessments (“ITRA”) shall be conducted by Security Services prior to the 

procurement, development, installation and operation of IT services and systems. An ITRA 

shall be triggered by certain events that may change IT risks at OCC, including but not 

limited to: (i) evaluation of a new system or technology, (ii) procurement of a new system 

or technology, (iii) changes in OCC business processes that impact current services and 

systems, (iv) the emergence of new threats that subvert existing controls and that require a

new technology mitigation, and (v) periodic reviews. The ITRA process, including roles and 

responsibilities for monitoring and review, is described in the Cyber Risk Assessment 

Procedure. 

F.2.c Compliance Risk Assessment 

OCC’s Compliance Risk Assessment program is performed by the Compliance Department 

and shall be used to identify and measure risks that OCC faces regarding regulatory 

compliance in accordance with the Compliance Risk Assessment Procedure. The program 

shall also provide the Compliance Department a basis for prioritizing testing and training 

activities. 

F.3 Risk Reporting

ERM shall complete a review and reporting process, as described below, that provides the 

Management Committee and Board (or committee thereof) with the information necessary 

to fulfill their obligations for risk management and oversight of risk management activities, 

respectively. Risk reporting shall assist the Management Committee and Board (or 

committee thereof) in understanding the most significant risks OCC faces from a process 

perspective and determining whether Risk Tolerances are being managed in accordance with 

Risk Appetite Statements. On at least a quarterly basis, ERM shall publish a risk report with 

a summary analysis of risk appetite and risk profile that includes, but is not limited to: (i) 

analysis of Residual Risks from the ERA program, (ii) reporting on Risk Tolerances and (iii) 

recommendations for prioritization of risk mitigation activities. 

The processes for determining whether a risk is within appetite and for escalation in the 

event of a tolerance breach are described in the Enterprise Risk Assessment Procedure.

G. Control Activities

The Compliance Department shall maintain an inventory of all business processes and 

associated controls in a database used by OCC to manage Enterprise Governance, Risk and 

Compliance. OCC shall also use a Control Writing Guide to assist staff throughout OCC to 

document their control activities in a consistent way. 
Risk Management Framework Policy 

14

No less than annually, the Compliance Department shall conduct training to assist staff in 

understanding their respective responsibilities in implementing OCC’s risk and control 

environment. 

III. POLICY EXCEPTIONS

Any request for an exception to this Policy must be made in writing to a member of the 

Office of the Executive Chairman, who is then responsible for reviewing the exception 

request and providing a decision in writing to the person requesting the exception. The 

Chief Risk Officer, Chief Compliance Officer or Chief Audit Executive may also request an 

exception to the Policy to the Board or delegated Board committee. All requests for 

exceptions and their dispositions shall be reported to the Board or relevant Board committee 

no later than its next regularly scheduled meeting, in a format approved by the Chair of the 

Board or Board committee.

IV. POLICY VIOLATIONS

Violations of this Policy must be reported to OCC’s Chief Compliance Officer, or, if the 

violation involves the Compliance Department, to the head of Chief Audit Executive or a 

member of the Office of the Executive Chairman.

V. DEFINITIONS

Capitalized terms used herein and not defined below shall have the meaning set forth in 

OCC’s By-Laws and Rules.

Inherent Risk: The absolute level of risk exposure posed by a process or activity prior to 

the application of controls or other risk-mitigating factors. 

Key Risk: Risk that is related to the foundational aspects of CCP clearing, settlement, and 

risk management services. 

Residual Risk: The level of risk exposure posed to a process or activity after the 

application of controls or other risk-mitigating factors. 

Risk Appetite Statement: A statement that expresses OCC’s judgment, for each of OCC’s

Key Risks, regarding the level of risk OCC is willing to accept related to the provision of CCP 

services.

Risk Tolerance: The application of risk appetite to a specific sub-category or aspect of a 

Key Risk, typically in quantitative form, used to set an acceptable levels of risk.
15

APPENDIX: OCC’S KEY RISKS WITH CCA, PFMI AND REG SCI MAPPING

Key Risk Sub-category Definition Relevant Policy

Financial – risk that 

a counterparty will be 

unable to meet its 

obligations when due, 

the risk that OCC will 

not maintain 

sufficient financial 

resources to cover 

exposures, the risk 

that OCC will not 

meet payment 

obligations when due, 

the risk that OCC will 

incur losses on 

overnight 

investments, and the 

risk that financial 

models are 

inaccurate

Credit 

(P4, P5, P6, P13, P16)

17Ad-22(e)(4),(e)(5), 

(e)(6),(e)(13)

Risk that a counterparty will be unable to meet its 

obligations when due or that OCC will not maintain 

sufficient financial resources to cover credit exposures

Clearing Fund 

Methodology Policy

Collateral Risk 

Management Policy

Third-Party Risk 

Management

Framework

Default Management 

Policy

Margin Policy

Liquidity

(P7)

17Ad-22(e)(7)

Risk that OCC will not maintain sufficient liquid 

resources to meet its same day and, where 

appropriate, intraday and multiday settlement of 

payment obligations

Liquidity Risk 

Management

Framework

Cash and Investment 

Management Policy

Third-Party Risk 

Management

Framework 

Investment

(P 16)

17Ad-22(e)(16)

Risk of losses on overnight investments Cash and Investment 

Management Policy
Risk Management Framework Policy 

Key Risk Sub-category Definition Relevant Policy

Model 

(P2, P4, P6)

(Supervisory Letter SR 

11-7)

The potential for adverse consequences from decisions 

based on incorrect or misused model outputs. 

Model Risk 

Management Policy 

Operational – risk 

that deficiencies in 

internal controls, 

processes, 

information systems; 

human error or 

misconduct; external 

events or intrusions 

result in disruptions 

of OCC’s CCP services

17Ad22(e)(17)

17Ad22(e)(20)

Financial Reporting & 

Control

(P17)

Risk that material inaccuracies in financial reporting as 

a result of lack of internal controls results in providing 

inaccurate financial data to key stakeholders

Department Policies, 

Procedures, Handbooks

Process Management, 

Execution & Delivery

(P17)

Risk that inadequate process and control management 

negatively impact effective daily operations, resulting

in poor operational performance and policy/procedure 

deviations

Physical Asset 

Security

(P17)

Risk of harm, damage, or loss to OCC property, 

equipment, or personnel, resulting in operational 

disruption, financial losses, or legal liability

Human Capital

(P17)

Risk that employees are not sufficient, qualified or welltrained, resulting in errors, control failures, or fraud
Risk Management Framework Policy 

Key Risk Sub-category Definition Relevant Policy

Business Continuity

(P17)

Risk that OCC is unable to recover critical services 

following a disruption

Incident Response and 

Recovery Policy

Fraud 

(P17)

Risk that an employee or external party commits fraud, 

resulting in financial loss to OCC

Code of Conduct

Third-Party 

Performance

(P20, P17)

Risk that OCC will experience service disruptions due to 

operational issues with critical vendors, exchanges, or 

other FMUs

Third-Party Risk 

Management 

Framework

Operational Risk –

Information 

Technology - risk 

that inadequate 

levels of system 

functionality, 

confidentiality, 

integrity, availability, 

capacity, or resiliency 

for systems that 

support core clearing, 

settlement, or risk 

management services 

Functionality & 

Delivery 

(SCI Rule 1001a) 

(P17)

(SCI Rule 1000, Rule 

1001a) (P17)

Risk that defects in system change management 

processes, whether related to system upgrades or 

expansions, cause operational disruptions

IT Operational Risk 

Management Policy

Confidentiality 

(SCI Rule 1001a) 

(P17)

Risk that OCC confidential information is disclosed to 

unauthorized parties

Information Security 

Policies

Integrity 

(SCI Rule 1001a) 

(P17)

Risk that OCC data or systems are accessed, modified, 

or otherwise tampered with by unauthorized parties

Information Security 

Policies
Risk Management Framework Policy 

Key Risk Sub-category Definition Relevant Policy

or critical business 

functions results in 

disruptions in OCC 

services

17Ad-22(e)(17)

Availability (System & 

Data) (SCI Rule 

1001a) (P17)

Risk that OCC stakeholders are unable to access 

information when needed

IT Operational Risk 

Management Policy

Capacity 

(SCI Rule 1001a) 

(P17)

Risk that OCC will experience an increase in trade 

volume that reduces critical or SCI systems’ processing 

capacity below acceptable standards

IT Operational Risk 

Management Policy

Resiliency 

(SCI Rule 1001a, Rule 

1002, Rule 1004) 

(P17)

Risk that an event causes critical or SCI system 

disruptions beyond OCC’s recovery time standard 

IT Operational Risk 

Management Policy

Legal – risk that 

OCC does not have a 

well-founded, clear, 

transparent, and 

enforceable legal 

basis for the material 

aspects of its 

Regulatory 

Compliance

(P1)

The risk that OCC’s by-laws, rules, policies and 

procedures do not provide for a well-founded, clear, 

transparent, and enforceable legal basis for each 

aspect of its activities in all relevant jurisdictions

Legal Services Policy

Compliance Risk Policy

Regulatory Change 

Identification 

Procedure
Risk Management Framework Policy 

Key Risk Sub-category Definition Relevant Policy

clearing, settlement, 

and risk management 

services

17Ad22-(e)(1)

Rights, interests, 

enforceability

(P1)

The risk that OCC’s and members’ rights to collateral, 

netting arrangements, settlement finality, or novation 

rights are not clearly established or that rules and 

contracts are not enforceable 

Material Agreements 

Policy

General Business -

risk of any potential 

impairment of OCC’s 

financial condition (as 

a business concern) 

owing to declines in 

its revenue or growth 

in its expenses, 

resulting in expenses 

exceeding revenues 

and a loss that must 

be charged against 

capital. These risks 

arise from OCC’s 

administration and 

operation as a 

business enterprise. 

They are not related 

Business strategy

(P15)

The risk that OCC does not properly manage business 

strategy, resulting in decline in revenue or increase in 

expenses

Annual Planning Policy 

Going concern assets

(P15)

The risk that OCC does not maintain sufficient high 

quality liquid assets to remain a going concern after 

business losses

Capital Management 

Policy

Capital replenishment

(P 15)

The risk that OCC does not have a plan to raise 

additional capital if levels fall below a required amount

Capital Management 

Policy

Reputation

(P15)

The risk that OCC’s reputation is damaged as a result 

of operational failure, businesses losses, or any other 

reason, resulting in loss of business and/or regulatory 

scrutiny

Code of Conduct

Governance 

(P15)

The risk that OCC does not have proper governance in 

place of all aspects of OCC services, resulting in 

Department Policies
Risk Management Framework Policy 

Key Risk Sub-category Definition Relevant Policy

to participant default

17Ad-22(e)(15)

business losses from any source