The primary criteria of the AMA could be summarized as falling into three broad areas: first, the development of strong corporate operational risk governance and management structures - structures that include business line integration into a firm-wide process; second, the incorporation of qualitative factors such as control self-assessments into the overall capital measurement process; and finally, loss data quantification, which includes scenario analysis. Our review of those major U.S. banks that intend to adopt the AMA indicates they are clearly in various stages of preparation. However, most of these institutions already have in place, or are well along towards establishing, a corporate level operational risk management function, with firm-wide policies for managing and assessing this risk. Moreover, many firms already have in place good, and improving, firm-wide control self-assessment methodologies. Finally, an increasing number of banks are now turning their attention to collecting internal loss data in a consistent manner across the firm. Some have already been collecting such data for a year or two and some have been particularly effective at mining their existing historical loss experience for certain risk types. A few leading institutions have made real progress in pulling all this together - by piloting operational risk quantification methodologies that combine the quantitative and qualitative elements of the AMA into an overall economic capital assessment for operational risk.

Sixth, data collection and aggregation by regulatory agencies must be accompanied by a process for making the data available to as great a degree as possible to fellow regulators, other government entities, and the public. There will, of course, be a need to protect proprietary and supervisory information, particularly where specific firm-based data are at issue. But the presumption should be in favor of making information widely available. Finally, any data collection and analysis effort must be attentive to its international dimensions and must seek appropriate participation from regulators in other nations, especially those with major financial centers. Financial activities and risk exposures are increasingly globalized. A system without a common detailed taxonomy for securities and counterparties and comparable requirements for reporting across countries would make assembling a meaningful picture of the exposures of global institutions very difficult. Efforts to improve data collection are already under way in the European Union, by the Bank of England and the Financial Services Authority, and the European Central Bank, which has expressed support for developing a unified international system of taxonomy and reporting. The Financial Stability Board, at the request of the G-20, is initiating an international effort to develop a common reporting template and a process to share information on common exposures and linkages between systemically important global financial institutions. Barriers to effective data collection for analysis Legislation will be needed to improve the ability of regulatory agencies to collect the necessary data to support effective supervision and systemic risk monitoring.