external auditor must render an opinion as to whether the company's internal control process is effective, which is a relatively high standard. in addition, as part of its overall assessment of internal controls, the external auditor is expected to evaluate the effectiveness of the audit committee. if the audit committee is deemed to be ineffective, the external auditor is required to report that assessment to the company's board of directors. this new standard will certainly put more demands on external auditors and public companies alike. but this is the price to be paid for “ raising the bar ” to achieve greater reliability in corporate financial statements and to regain the confidence of the public and the trust of financial markets. risk management in the e - commerce environment let's now turn our focus to risk management in today's e - commerce environment. we know that an important component of risk management involves monitoring and managing environmental and external risks. this is an area in which business and operations risk are increasing. over the past few years, the global community has experienced a series of “ cyberincidents ” - primarily in the form of increasingly virulent viruses and worms, and some hacking incidents have involved company insiders. the extensive electric power outages experienced by a large section of the united states and parts of canada last august, along with collateral effects involving the telecommunication, transportation, and water sectors, further underscore the need for financial institutions to integrate the risk of a wide - scale disruption into their risk - management strategies. let me say at the outset that the financial sector has performed extraordinarily well in responding to these incidents. moreover, we are extremely proud that financial markets and participants have been able to meet these challenges and continue critical operations without any systemic effects or loss of confidence in our financial system. this is no accident. financial institutions have increasingly devoted resources to addressing operations risk, business continuity, security ( physical and cyber ), and information - sharing. i would like to highlight some of the key developments we have observed and discuss where our business - risk - management efforts should be focused. operations risk since the mid - 1990s, the concept of operations risk has received increasing attention in connection with the evolution of enterprise risk management. by “ operations risk ” i mean any risk that arises from inadequate or failed internal processes, people, or systems or from external events. examples of operations risk include employee fraud, failed information system conversions, missent wires, and weaknesses in security procedures for protecting assets and information. in february 2003

of the management silos within the corporation and make sure that the system of internal controls has no gaps and that the control framework is continually reviewed to keep up with corporate strategic initiatives, reorganizations, and process changes. when an auditor becomes part of the management process subject to internal audit review, the independent view is lost. i would also like to add that internal auditors are the eyes and ears of the audit committee around the organization. as the complexity of financial products and technology has grown, the financial services industry has increased its reliance on vendors and third - party service providers for a host of technological solutions. be mindful that these outsourcing arrangements may pose additional types of risks for the organization, such as security or data privacy risks. internal auditors should remain vigilant in identifying risks as the organization changes or new products are delivered to the marketplace. the u. s. public company accounting oversight board while we are discussing the importance of effective internal controls, let me point out that the public company accounting oversight board ( pcaob ) has recently approved auditing standard no. 2, an audit of internal control over financial reporting performed in conjunction with an audit of financial statements. 4 the new standard is clearly an improvement over the previous one. it highlights the benefits of strong internal controls over financial reporting and furthers the objectives of the sarbanes - oxley act. this standard requires external auditors of public companies to evaluate the a copy of the interagency policy statement, which was released on march 17, 2003, can be obtained at http : / / www. federalreserve. gov / boarddocs / press / bcreg / 2003 / 20030317 / default. htm. a copy of the auditing standard can be obtained at the pcaob web site at http : / / www. pcaobus. org / pcaob _ standards. asp. process that management uses to prepare the company's financial statements. external auditors must gather evidence regarding the design and operations effectiveness of the company's internal controls and determine whether evidence supports management's assessment of the effectiveness of the company's internal controls. while the new standard allows external auditors to use the work of others, including that performed by internal auditors, it emphasizes that external auditors must perform enough of the testing themselves so that their own work provides the principal evidence for making a determination regarding the company's controls. based on the work performed, the