activities are in place. involve subject matter experts and operations people to ensure the shared ownership of the system. if the business process change is owned by the operating staff, then the change management and implementation would be smooth. external experts can be associated to bring in rich experience. brain storming by combination of business and it teams with internal and external experts would add significant value while designing new systems. it risk management it may be pertinent to mention that 70 % of the operation risk in banking sector arises from it risk. as per basel guidelines banks are required to maintain additional capital for operational risk and there are incentives to those who manage it by implementing advanced measurement approach ( ama ). how many banks have moved towards ama approach model for operational risk? very few, if at all. does this not point to inadequacy of it risk management frame work in banks? good it process control would substantially reduce operational risk ( if put in practice ) and therefore, the risk management of it resources themselves are the key for low operational risks. it risk management is the integral part of it governance. bis central bankers ’ speeches the critical elements of it risk relate to, safety and security, availability, performance and compliance. what are the issues that need to be taken note of by the banks? the it systems of the banks are often web enabled. this leads to better customer service and new delivery channel and the same time exposes the banks to greater risks. various studies reveal that the incidence of malicious attacks are increasing and the nature of attacks are very dynamic and getting sophisticated. are all the employees educated about it security threats? whether all employees are aware of information security policy of the bank? do we periodically check the it security incidence reporting and review the is policy? if so how frequently? the types and numbers of security threats range from ip spoofing to denial of service attacks ( dos, trojan horses, spams to malwares, etc and are mind boggling. social hacking adds another dimension to this threat. the awareness of various attacks and putting in place proper it infrastructure to protect the it resources are very critical for ensuring business continuity. so, implementation of data center and dr systems are to be integrated with the overall bcp of the bank to ensure the availability of the business in extreme situations. it resource management let me flag some concerns. do we put in place policies to review at board level to monitor utilisation of infrastructure procured at a huge cost? do we put in control measures

the financial system was typically very high : for example, recapitalisation of banks had cost 55 per cent of gdp in argentina, 42 per cent in thailand, 35 per cent in korea and 10 per cent in turkey. there were high indirect costs of lost opportunities and slow economic growth in addition ( mckinsey & co., 2005 ). it is therefore particularly noteworthy that india could pursue its process of financial deregulation and opening of the economy without suffering financial crises during this turbulent period in world financial markets. the cost of recapitalisation of public sector banks at less than 1 per cent of gdp is therefore low in comparison. whereas we can be legitimately gratified with this performance record, we now need to focus on the new issues that need to be addressed for the next phase of financial development. that current annual gdp growth of around 8 per cent can be achieved in india at an about 30 per cent rate of gross domestic investment suggests that the economy is functioning quite efficiently. we need to ensure that we maintain this level of efficiency and attempt to improve on it further. as the indian economy continues on such a growth path and attempts to accelerate it, new demands are being placed on the financial system. growth challenges for the financial sector higher sustained growth is contributing to the movement of large numbers of households into ever higher income categories, and hence higher consumption categories, along with enhanced demand for financial savings opportunities. in rural areas in particular, there also appears to be increasing diversification of productive opportunities. thus, the banking system has to extend itself and innovate to respond to these new demands for both consumption and production purposes. this is particularly important since banking penetration is still low in india : there are only about 10 - 12 atms in india per million population, as compared with over 50 in china, 170 in thailand, and 500 in korea. moreover, the deposit to gdp ratio or the loans / gdp ratio is also low compared to other asian countries ( mckinsey & co., 2005 ). on the production side, industrial expansion has accelerated ; merchandise trade growth is high ; and there are vast demands for infrastructure investment, from the public sector, private sector and through public private partnerships. furthermore, it is the service sector that has exhibited consistently high growth rates : the hospitality industry, shopping malls, entertainment industry, medical facilities, and the like, are all expanding fast. thus a great degree of diversification is taking place in the economy and the banking system has to