needs to be institutionalized. i believe these challenges can be overcome if banks adopt a systematic approach like the one prescribed by the basel committee. let me briefly talk about the spectrum of approaches offered by basel accord to calculate operational risk capital charge. under the two simple approaches ( i. e. basic indicator and standardized approaches ), gross income is used as a proxy for the scale of business operations. this suggests that banks with higher gross incomes are relatively bigger in size and have more operational risk exposure. however, it is often argued that gross income is not always a perfect proxy for operational risk since it may fluctuate with the business / economic cycle. nevertheless, in the absence of any other proxy, income is being used due to its simplicity, comparability and reduced capital arbitrage opportunity. another approach offered under basel ii is the advanced measurement approach ( ama ), wherein banks can develop their own internal assessment techniques. unfortunately, the quantitative techniques for measuring operational risk are evolving and there is no broad consensus on the modeling methodologies of operational risk. thus, it can be said that the quantitative approaches offered under basel accord are still in the process of refinement. however, this is all the more reason for banks to focus on qualitative requirements depending on the regulatory approach they intend to follow. in the past one decade, the awareness of operational risk has improved and resultantly the principles for sound management of operational risk have emerged. banks need to incorporate these internationally agreed principles while implementing any operational risk management framework. these principles mainly focus on the governance, risk management environment, role of supervisors and business resilience. bis central bankers ’ speeches i will now outline sbp ’ s expectation on the integrated components of the overall framework for managing operational risk across the enterprise. sound internal governance forms the foundation of an effective operational risk management framework. it is necessary that those at the top of the organization should take the lead in establishing a strong risk management culture. the board of directors needs to regularly review the framework and ensure that senior management is actively monitoring the effectiveness of risk management and controls. for this purpose, the board should establish a management structure based on clear lines of responsibility, accountability and reporting. the board should set the bank ’ s risk appetite through the approval of operational risk management policy. sbp expects that boards should seek periodic reports from management to the monitor the operational risk profile of the bank in a proactive manner. the role of senior management is to implement the operational risk management framework

as approved by the board. senior management must ensure that all its business activities are adequately staffed having necessary experience and technical skills. the remuneration policies should also be consistent with the approved risk appetite. managers should not be rewarded solely on the basis of profits, but audit findings and compliance status should also be considered while deciding bonuses and compensations. sound operational risk governance practices rely mainly on the following lines of defense : i. business line management is the first line of defense against operational risk. business line management is responsible for identifying and managing risks in the products, activities, processes and systems for which they are accountable. it is important that clearly documented and regularly updated operating manuals are readily available to all employees. segregation of duties needs to be ensured. it is also necessary that operational staff must have necessary skills and training so that they can fulfill their duties. ii. a separate independent operational risk management function is the second line of defense and has become a good practice. independent operational risk management function would assist management to understand and manage operational risk. the function should be responsible to assist in establishing policies & standards and coordinate with various businesses / risk management activities. the function assesses, monitors, and reports operational risks as a whole, and ensures that the management of operational risk in the bank is as per approved strategy / policies. iii. independent validation and verification is the third line of defense in the governance structure. it serves as a challenge function to the other two lines of defense. internal audit or any independent group of qualified staff may conduct these independent reviews. since internal audit reports to the board audit committee therefore the audit function should also provide assurance to the board regarding effectiveness of the operational risk management framework. senior management should seriously investigate the findings of audit to set up a risk culture in the bank. the next principles focus on risk management environment, it outlines the bank ’ s approach to the identification, assessment, monitoring, control and mitigation of risk. banks need to use various tools for proactive operational risk management. these tools include audit findings, analysis of internal and external loss data, risk control and self assessments, key risk indicators, scenario analysis, comparative analysis etc. i am pleased to know that lively discussions on these tools will follow in the coming sessions. sbp is cognizant of its responsibilities with regard to sound operational risk management frameworks in banks. sbp will continue to play its role in ensuring effectiveness of established frameworks in banks. we expect each bank to develop and continuously