Internal Audit does not participate in management decisions, and our General Auditor reports to the Chair of the Audit and Risk Subcommittee of the Bank’s Board of Directors. In addition to defining clear and comprehensive risk management roles and responsibilities using the three lines of defense model, the Bank’s risk framework establishes governance, escalation, and reporting processes around risk exposures, risk decisions, and risk events. A  2  BIS central bankers’ speeches  strong governance regime provides assurance to stakeholders (Management Committee, the President, and the Board) who delegate risk-taking authority to the business lines. From first-line businesses and support functions, risk information flows to the second line, and then to the Risk Subcommittee of our Bank’s Management Committee. The Risk Subcommittee discusses significant emerging and existing risks, provides perspectives on managing and mitigating risks, and supports Management Committee review and decision making. The Audit and Risk Subcommittee of the Bank’s Board of Directors and the Board of Directors itself are at the top of the governance chain, although there are limitations on their roles with respect to supervisory and monetary policy issues. 3 Operational risk management The Bank’s operational risk approach sits within, and is shaped by the Bank’s overall risk framework. Roles and responsibilities as well as escalation and reporting follow the general structure I previously described. At this point, though, I can drill down into operational risk specifics.

That included starting a Bank-wide Operational Risk Committee (a predecessor to the Risk Subcommittee) led by the First Vice President, establishing the risk event reporting and risk control self-assessment processes, and creating the Centralized Operational Risk Function (then located in the Bank’s Corporate Group). Later developments included instituting new Bank-wide control policies reflecting a deeper understanding of sources of operational risk. For example, the Bank established policies to govern end-user developed automation tools and the management of contingent workers. The past several years have been characterized by a focus on integration of the Bank’s risk management program. As part of a review of the Bank’s governance, the Risk Subcommittee of the Management Committee was established with a broad risk management mandate spanning financial, operational, and compliance risk. The Bank also enhanced the coordination of risk management, resource allocation, and strategic planning through linkages between the Risk Subcommittee and our planning and resources committee. Most indicative of this trend was the establishment in 2015 of the Risk Group’s Enterprise Risk Management Function which is responsible for providing an integrated view across all of the Bank’s risks. In thinking about areas for future improvement, I ask myself: How can we accelerate organizational learning from our mistakes? Does our analysis of risks and risk events sufficiently reveal organizational and structural issues that contribute to the risk? How can I further create a positive risk culture that encourages reporting and escalating of risk issues?