being hotly debated. the efforts taken by crisil india, together with the slba, in this regard are commendable and i would like to see this initiative gather momentum to provide the platform for the improvement of risk management techniques by the banks in sri lanka which would, in turn, make them ready, if not in 2007, even later, to meet the challenges of basel ii. the transition to basel ii calls for a fundamental shift from the basic rudiments of risk management to sophisticated risk management techniques. the period of transition and the cost of transition has to be closely examined by the banking industry. considerable investment in information technology will have to be made to complete this transition. the strong platform of good risk management, therefore has first to be in place. therefore, the incentive that i can see from basel ii now is to commence the process to improve risk management especially operational risk by banks in sri lanka. as you may know basle ii requires specific capital to be allocated to operational risk, which is one of the main differences between basle i and basle ii. some internationally reputed banks have already allocated about 20 % of capital for operational risk. to effectively mitigate risks, banks need to have risk managers or risk management specialists. if you don ’ t have such specialists, you need to look for them or enhance the capacity of the existing staff to meet this need. sound risk management practices lead to cushions that are built in good times so as to be run down, up to a point, in bad times. provisions for loan losses dictated by prudence when profits are good, can always be written back when profits are low. it is that degree of caution in the exercise of judgements, in making estimates when there is an element of uncertainity, that makes prudence the most critical factor in risk management in banks. this is my message to you today and i wish this seminar every success.

the same goal and that there is little use in implementing these critical components in isolation. an integrated grc package should then be designed ensuring that it relates to the business model of the financial institution and also taking into consideration the fiduciary responsibilities of financial institutions. once each financial institution has designed its grc framework, it would be easy to roll it out to the entire financial industry through various formal and informal institutions, which coordinates among different segments of the financial services industry. in our context, the sri lanka bankers ’ association, the finance houses association, the leasing association etc., should be able to coordinate within and among their segments of the financial services industry in implementing grc in an integrated manner. 5. 1. 2 if one financial institution experiences problems today, given the interrelated transactions, it could lead to a systemic issue which will result in the entire system suffering. therefore, it is equally important to use peer pressure to get weak or prodigal institutions to comply with regulatory instructions and directives. so, it is everybody ’ s responsibility to ensure that outliers are brought on to the desired path. 5. 1. 3 clearly, training and consulting remain very important, especially to change the mindset to a more committed one. all stakeholders need to understand why grc should be implemented as a package and the benefits attached to it, from the point of view of the institution as well as its clients. 5. 2 leveraging on technology 5. 2. 1 technology is a critical factor, which facilitates efficiency and effectiveness in the grc processes. a real time risk, compliance and monitoring environment enables financial institutions to ensure that risks are being managed and disruptive events are being acted upon. therefore, technology integration across the financial institution would enable institutions to gain more timely and reliable regulatory compliance, more efficient use of it systems, and lower cost on development and maintenance of software applications. many organizations that apply grc best practices have understood that service - oriented architecture ( soa ) is more appropriate, as it would promote grc integration while securing the highest value that it can offer. soa is an architecture that provides it infrastructure which allows different applications to exchange databases and participate in business processes that are loosely coupled from the operating systems and programming languages underlying those applications. 5. 2. 2 soa is a design for linking business and computational resources that are available on demand to achieve the desired results to service consumers. under soa models, different applications / services can communicate with