selling financial instruments for customers ; and other business lines that generate revenue by charging customers transaction and account processing fees. these activities generate little balance - sheet exposure, but they present the potential for large losses if the complex systems and financial deals associated with them are not managed in a sound manner. operational risks are also becoming more important in the large, complex financial institution as more technology and automated processes are used in all areas of operations. when banks used manual processes, errors were confined to the limited area where the employee worked. but in a modern technology setting, factors such as breakdowns in controls, errors in software code, and processing stream interruptions can have enterprisewide effects on the performance of the organization. recent history provides us with ample evidence that operational risk can be significant. large financial institutions have reported operational losses from breakdowns in operating controls that, in some cases, have exceeded their credit - or market - related losses. in the area of legal risk, for example, many institutions have learned that failing to identify and promptly correct problems can result in losses that significantly exceed management's initial expectations. over the past decade, large financial institutions have experienced more than 100 operational loss events in excess of $ 100 million each ; some of these individual operational losses, resulting from fraud, rogue trading, and settlements stemming from questionable business practices, have exceeded $ 1 billion. an effective operational - risk management framework, therefore, is essential for identifying and managing operational risks. as you know, analysts at the main rating agencies are placing increasing importance on operational risk when they assess a bank's credit ratings. we believe effective operational - risk management has both quantitative and qualitative components and that reliance on solely quantitative or solely qualitative approaches is no longer appropriate. what remains critically important is how these approaches are combined in the implementation of an effective process for identifying, measuring, managing, and controlling operational risk throughout an organization. effective operational - risk measurement tools enable the executive management at the largest banking organizations to make better risk - and - return decisions, thereby enhancing the return on their institution's capital investments. by considering operational risk as part of their assessment of capital requirements and true profitability, corporate decisionmakers can better decide which business lines to invest in or shut down. the organization further benefits when operational - risk measurement is integrated with the management processes of individual business units, because this helps communicate risk - management issues to the business lines. the allocation of operational - risk capital to these units provides them with a financial incentive

some truly innovative thinking about ways to integrate operational - risk measurement into the broader framework of operational - risk management. i would like to offer some specific observations on a couple of key challenges relating to operationalrisk quantification. first, with respect to operational - loss data, basel ii banks face the challenge of establishing credible operational - loss databases that they can use in determining their regulatory capital requirement for operational risk. the advanced approaches under basel ii create a link between regulatory capital and risk management. banks using an ama for operational risk will be required to adopt more - formal, quantitative risk - measurement and risk - management procedures and processes. for example, basel ii establishes standards for data collection and the systematic use of the information collected. these standards are consistent with broader supervisory expectations that high - quality risk management at large complex organizations depends on credible data - - and not just for basel ii. data are needed for all models and risk measures used in financial services, including credit - scoring models, market - based measures such as kmv, and value - at - risk and other economic capital models. the emphasis in basel ii on improved data standards, therefore, should not be interpreted solely as a requirement to determine regulatory capital standards but rather as a foundation for risk - management practices that will strengthen the value of the banking franchise. as i mentioned earlier, regulators view capital from the perspective of ensuring safety and soundness in the financial system. but individual financial institutions generally focus on capital, in particular economic capital, as a means for evaluating the profitability of their activities, defining their risk appetite, and setting risk limits. although the goals differ, there are important linkages between firms'efforts to quantify operational - risk capital for regulatory capital purposes and for strategic decisionmaking. to the extent the operational - loss data considered in banks'internal economic capital models appropriately reflect the banks'risk exposures, banks should be able to leverage their economic capital data collection efforts to measure their operational - risk exposure under an ama. this leverage is also consistent with the basel ii objective of better aligning regulatory capital with banks'internal economic capital. the second challenge i wanted to touch on is banks'integration of insurance in their processes for quantifying operational risk. as many of you are aware, basel ii contains a provision whereby banks using an advanced measurement approach for operational risk could adjust their calculated operational - risk exposure to reflect reductions due to operational - risk mitigants, such as insurance, subject to certain limitations. according to the