Normally, IT and Financial or Safety and Soundness examinations are performed concurrently where their examination results are integrated together for an overall risk assessment. At this stage, examiners gather information through a variety of examination techniques such as interview, observation, review of documents to summarize the findings. 3. Post examination  After the findings, examiners will assess the risks of those findings and report on significant issues. The risks regarding IT are assessed and assigned to IT risk rating which is divided into three levels, high, medium, low with respect to the probability of occurrence and the degree of impact to a financial institution. For significantly high risk issues which indicate serious control weaknesses which then need an immediate correction, we could enforce the FI to take corrective action within a predetermined period of time. And, it is our duty to monitor compliance with such an enforcement action. This is a process of follow-up The risk assessment is performed not only when conducting IT examination but also when considering new products and services' applications. Currently, the products and services that need BOT's IT risk assessment prior to approval are internet banking and e-money. IT Risk Assessment Factors, at a minimum, include: Security: The financial institutions have to prove that they have adequate security measures in place to ensure that information is protected against harm from threats leading to different types of vulnerabilities such as loss, inaccessibility, alteration or wrongful disclosure. Risk management: Risks of new products and services must be thoroughly considered by the financial institution.

Chart 8: Accounting for intangibles reduces the missing-investment puzzle  Note: The orange line shows the investment puzzle using industry-level data, and the shaded area around it is the 95% confidence intervals. The line shows the estimated year fixed effects from an industry-level regression of investment rates on the wedge, including industry fixed effects, and standard errors clustered at the industry level. See Appendix B to Bailey et al. (2022) for full details. The blue line shows the same statistic from the regressions in which both investment rates and the wedge are adjusted to include intangibles. See Appendix A.2 to Bailey et al. (2022) for a discussion of the adjustment. Source: ONS, KLEMS, Jordà et al. (2017) Macrohistory Database and authors' calculations. The remaining puzzle is mostly concentrated immediately after the global financial crisis, and so it is possible this is not driven by structural factors, but rather the lingering impact of the global financial crisis, for example related to the sluggish demand recovery or financial frictions. [22] While the results suggest an important role for intangibles in explaining the missing-investment puzzle, a few notes of caution are in order. It could be that certain drivers of investment, such as financial frictions, are captured more accurately only at more granular level, such as in firm-level data. Moreover, there could be large non-linearities related to the nature of the global financial crisis that cannot be captured by the simple regression framework used above.