For example, transactions conducted through the internet can also raise questions regarding jurisdictional authority over those transactions. Cross border activities raise a number of concerns to supervisors on how to supervise banking businesses with no physical presence in the country, and also how to effectively manage risks involved in cross-border transactions. 4. Reputational risk  Reputational risk arises whenever technology-based banking products, services, delivery channels, or processes generate adverse public opinion. For example, breaches of security and disruptions to the system's availability can damage financial institutions' reputation. Also, system disruptions or doubts about the integrity of the system or data could result in a loss of confidence in electronic delivery channels as a whole, and can potentially affect other e-banking providers. IT risk-based supervision focuses on strategic and operational risks. Strategic risk Supervisory objective In strategic risk supervision, supervisors have to ensure that Financial institutions have efficiently managed their IT resources and are prepared for the future development of core businesses. Supervisory areas Therefore, to achieve such objective, supervisors will assess risks that may arise in the following areas. Policy perspectives Since enterprise activities require information from IT to meet business objectives, effective IT strategic planning is mandatory. The strategic plan refers to how to utilize IT in an organization. IT must be aligned with and enable the enterprise to take full advantage of its information, thereby maximizing benefits, capitalizing on opportunities and gaining a competitive advantage. As such, IT policy, plan and procedure are the concentrated areas for supervisors to examine.

We believe that effective IT governance process will enable financial institutions to effectively utilize their technologies to meet business' expectations and to add value to their business. In that way, IT will truly help the organizations to improve competitive advantage, customer satisfaction, cost efficiency, and ability to grow and innovate the business. Eventually, it will help financial institutions to realize better return on investment in technology infrastructure. Independent audit and review A financial institution is required to have IT independent audit and review all IT related areas to ensure that the board and management emphasize IT as a key business driver. IT controls are evaluated and those having a material impact on financial processes are specially focused. The assessment of these controls should be conducted on a regular basis. In Thailand, we require financial institutions to perform IT audit at least once a year. In addition, we also require an independent assessment of internet security. Now, let's turn to operational risk. Operational risk Supervisory objective In operational risk supervision, supervisors have to ensure that financial institutions have adequate security measures, data integrity process and contingency plans in place. Supervisory areas The focal point when we evaluate operational risk regarding IT is to ensure a financial institution establish adequate control mechanisms in IT process and procedure. The control can be done either technically or manually, or both. Segregation of duties is an example of manual control which should be maintained especially for critical functions or processes to prevent fraud.