gathered information, examiners can preliminarily assess it role in supporting fi business and prepare scope of examination. 2. onsite examination the next step is to conduct onsite examination at a financial institution. normally, it and financial or safety and soundness examinations are performed concurrently where their examination results are integrated together for an overall risk assessment. at this stage, examiners gather information through a variety of examination techniques such as interview, observation, review of documents to summarize the findings. 3. post examination after the findings, examiners will assess the risks of those findings and report on significant issues. the risks regarding it are assessed and assigned to it risk rating which is divided into three levels, high, medium, low with respect to the probability of occurrence and the degree of impact to a financial institution. for significantly high risk issues which indicate serious control weaknesses which then need an immediate correction, we could enforce the fi to take corrective action within a predetermined period of time. and, it is our duty to monitor compliance with such an enforcement action. this is a process of follow - up the risk assessment is performed not only when conducting it examination but also when considering new products and services'applications. currently, the products and services that need bot's it risk assessment prior to approval are internet banking and e - money. it risk assessment factors, at a minimum, include : security : the financial institutions have to prove that they have adequate security measures in place to ensure that information is protected against harm from threats leading to different types of vulnerabilities such as loss, inaccessibility, alteration or wrongful disclosure. risk management : risks of new products and services must be thoroughly considered by the financial institution. there should be a policy and procedure in place to manage the risks. internal control : the financial institutions should set up preventive, detective and corrective control mechanisms that may be built in the operating procedure or programmed in the system involving new product and service delivery. contingency plan : the financial institutions should formulate the contingency plan to carry on the business under unexpected events. staff development : the financial institutions should establish a staff development plan to enhance personnel capabilities to conduct new product and service operations. last topic of presentation is new challenges for bot supervision and ways to overcome. 5. new challenges for bot's it supervision and ways to overcome while the financial industry is moving fast with innovations and new developments, supervision needs to ensure the stability

framework is keeping up with demand from the financial community as well as with market innovation, international best / sound practice ; finally, to protect customer rights as well. it risk - based supervision helps ensure the safety and soundness as well as legal compliance of a fi. as already mentioned, it does not trigger new type of risks but brings in new dimensions to traditional banking risks. at this point, i would like to first give you the definitions of risks directly associated with it. may i begin with strategic risk. scope of it risk - based supervision : 1. strategic risk strategic risk arises from adverse business decisions or improper implementation of those decisions. use of technology can create strategic risk when management does not adequately plan for, manage, and monitor the performance of technology - related products, services, processes, and delivery channels. 2. operational risk operational risk is the risk in the areas of security, data confidentiality, data and system integrity, and outsourcing causing problems with product and service delivery. this type of risk often results from failure to establish adequate security measures, contingency plans, testing, and auditing standards. operational risk can increase when a financial institution hires outside service providers to design products, services, delivery channels, and processes that do not fit with the financial institution's systems or customer demands. deficiencies in system design, implementation, or maintenance of systems or equipment also tamper with data integrity. the it exposure usually does not limit to just these two risk types. improper it management and operation can lead to compliance risk and reputational risk. 3. compliance risk compliance risk is arises from violations of, or non - conformance with, laws, rules, regulations, or ethical standards. some new technologies raise unexpected compliance issues. for example, transactions conducted through the internet can also raise questions regarding jurisdictional authority over those transactions. cross border activities raise a number of concerns to supervisors on how to supervise banking businesses with no physical presence in the country, and also how to effectively manage risks involved in cross - border transactions. 4. reputational risk reputational risk arises whenever technology - based banking products, services, delivery channels, or processes generate adverse public opinion. for example, breaches of security and disruptions to the system's availability can damage financial institutions'reputation. also, system disruptions or doubts about the integrity of the system or data could result in a loss of confidence in electronic delivery channels as a whole, and can potentially affect other e - banking providers. it