the frequency and severity of operational surprises and losses, • identifying and managing multiple and cross - enterprise risks, • proactively seizing on the opportunities presented to the entity, and • improving the effectiveness of the entity's capital deployment. some of you are probably familiar with the erm framework published over a year ago by the committee of sponsoring organizations of the treadway commission, or coso. the coso framework provides a useful way to look at erm and helps generate further discussion. in the coso framework, erm consists of eight interrelated components derived from the way management runs an enterprise and integrated with the management process : ( 1 ) internal environment, ( 2 ) objective setting, ( 3 ) event identification, ( 4 ) risk assessment, ( 5 ) risk response, ( 6 ) control activities, ( 7 ) information and communication, and ( 8 ) monitoring. each of these is described in more detail in the coso literature. notably, the coso framework states explicitly that, while its components will not function identically within every entity, its principles should apply to all sizes of institutions. small and mid - size entities, for example, may choose to apply the framework in a less formal and less structured way and scale it to their own needs - as long as quality is maintained. this underscores the message from bank supervisors that good risk management is expected of every institution, regardless of size or sophistication. naturally, there will still be some tension between what supervisors expect and what bankers do, but we hope that supervisory expectations for risk management are becoming more and more aligned with the way that bankers run their businesses. and as most of you know, running a smaller or less complex bank presents different types of challenges and requires a risk management framework appropriately tailored to the institution. for example, smaller organizations often face a challenge of ensuring independent review of processes and decisions since officers and staff members often have multiple responsibilities that can present conflicts of interest. having made some general points, i would now like to discuss a few recent examples from banking that highlight the importance of erm. with the benefit of hindsight, the financial regulators and the industry have been trying to distill the lessons learned from these recently identified weaknesses in risk management and internal control in the financial services sector. compliance risk one area in which erm provides tangible value is compliance risk. this type of risk may arise when an organization fails to comply with the laws, regulations, or codes of conduct that are

applicable to its business activities and functions. the federal reserve expects banking organizations to have in place an infrastructure that can identify, monitor, and effectively control the compliance risks that they face. needless to say, the infrastructure should be commensurate with the nature of the organization's compliance risk. for a large complex banking organization, dealing with compliance risk can be particularly challenging unless it has a well - developed risk management program. on the other hand, smaller organizations with limited staffs face a challenge in keeping up to date with changing regulations. to create appropriate compliance - risk controls, organizations should first understand compliance risk across the entire entity. understandably, this can be a daunting task, but i think most would agree that an effective risk assessment is critical. managers should be expected to evaluate the risks and controls within their scope of authority at least annually. an enterprise - wide compliance - risk management program should be dynamic and proactive. it should assess evolving risks when new business lines or activities are added, when existing activities and processes are altered, or when there are regulatory changes. the process should include an assessment of how those changes may affect the level and nature of risk exposures, and whether mitigating controls are effective in limiting exposures to targeted levels. to avoid having a program that operates on autopilot, an organization must continuously reassess its risks and controls and communicate with all employees who are part of the compliance process. if compliance is seen as a one - off project, an organization faces the risk that its compliance program will not keep up with the changes in its services or customer mix. the board of directors needs to ensure the organization has a top - to - bottom compliance culture that is well communicated by senior management so that all staff members understand their compliance responsibilities. clear lines of communication and authority help to avoid conflicts of interest. compliance - risk management can be more difficult for management to integrate into an organization's regular business processes because it often reflects mandates set out by legislation or regulation that the organization itself does not view as key to its success. for example, bankers understand how vital credit - risk management and interest - rate risk management are to their organizations, because they reduce the volatility of earnings and limit losses. however, regulations enacted for broader societal purposes can be viewed as an expensive mandate. for example, the patriot act requires significant reporting of transactions to the government, and many in the banking industry have expressed frustration about the burden associated with such reporting.