on the quantitative aspects of validation. data issues are another critical challenge facing banks and involve both quality and quantity aspects. on the quality side, it appears that the awareness of data integrity generally remains low on the management agenda. some banks may still have the misconception that data management only requires an it system to keep the numbers, and does not require senior management attention. in fact senior management need to take the lead in improving data quality. apart from making available the necessary it infrastructure and resources, this includes establishing an appropriate data management program as well as policies, standards and control mechanisms, and from time to time, emphasising the importance of data quality to the relevant personnel. on the quantity side, since the notions of internal rating systems and the quantification of credit risks remain relatively new to the industry, some banks may have kept the relevant default and loss data only for recent years. insufficient data consequently becomes an obstacle to the implementation of the irb approach by banks, in particular that the data collected so far may not be long enough to cover a complete business cycle. as such, the stability of an irb system under different economic conditions cannot be meaningfully evaluated. the problem is especially consequential in asia, as economic fluctuations in the region have tended to be faster and greater in magnitude than those in more mature banking markets. the third challenge banks in asia may face in adopting the irb approach is the paucity of internal resources necessary for rating system development and validation. many banks have relied, or intend to rely, on external parties such as consulting firms and model vendors. employing third - party services can be beneficial in respect of areas like professional expertise, knowledge transfer, the utilisation of a more comprehensive data set and assuring independence in the validation process. however, over - reliance on external parties does carry certain risks. one example is that banks may not have the internal expertise to assess the quality of the rating systems delivered by model vendors. and it is not just the banks that face resource issues, it is the supervisors as well. in common with supervisors in the more developed markets, we face the challenge of limited internal resources and expertise with which to implement the irb approach. moreover, banks and supervisors are often competing between themselves for the relevant expertise. in addition, the support to supervisors in asia from external parties, such as academia, vendors, consulting firms and rating agencies, is more limited than in the developed markets. finally, both banks and supervisors face a very

susan schmidt bies : a supervisor ’ s perspective on enterprise risk management remarks by ms susan schmidt bies, member of the board of governors of the us federal reserve system, at the financial women ’ s association washington briefing, washington dc, 12 june 2006. * * * thank you for the invitation to speak here today. i am impressed by the range of interesting subjects covered in your program, and i hope that my remarks on enterprise risk management will be informative as well. today i will look at some recent cases in which we believe bankers and supervisors have learned some key lessons about enterprise risk management, or erm. these lessons demonstrate how good risk management increases business efficiency and profitability. naturally, what we've learned from the banking industry can be more broadly applied to other industries and sectors. indeed, one could argue that erm can improve management of many different types of entities, including government agencies and nonprofit organizations. but before i start discussing particular examples, i want to take a step back and give you my thoughts on erm generally. general thoughts on enterprise risk management the financial services industry continues to evolve to meet the challenges posed by emerging technologies and business processes, new financial instruments, the growing scale and scope of financial institutions, and changing regulatory frameworks. the federal reserve, as the supervisor of state member banks and bank and financial holding companies, has been working with other regulators and financial institutions to improve the effectiveness and relevance of regulation and supervision in this changing environment. the federal reserve has long emphasized the need for appropriate and strong internal controls in institutions we supervise, and we have taken a continuousimprovement approach to our risk - focused examinations. for many years, enterprise risk management across multiple organizational units within an entity has received increased scrutiny. in some cases, firms may be practicing good risk management on an exposure - by - exposure basis, but they may not be paying close enough attention to aggregation of exposures across the entire organization. rapid growth can place considerable pressure on, among other areas, an organization's management information systems, change - management controls, strategic planning, credit concentrations, and asset / liability management. an organization must also understand how its various business components, some of which can be quite sophisticated and complex, dynamically interact. a successful erm process can help an organization to meet many of these challenges. of course, enterprise risk management is a fairly broad topic that can mean different things to different people. for our purposes here today, i will define er