##bilities that could cause an adverse impact in the future. the risk and control self - assessment process establishes a methodology for business areas to periodically assess their operational risks and ensure that appropriate mitigation is in place for key business processes. importantly, the central operational risk area is responsible for synthesizing the outputs of these two processes, along with follow - up discussions with business areas, to identify significant bank - wide residual operational risks. we have found it useful to view operational risk through the lens of processes, risks, and controls. we have defined a comprehensive set of processes to characterize the bank ’ s primary services and transactions. along with that, we have articulated a standardized set of risk drivers, risk events, risk event impacts, and, finally, controls that prevent, detect, or mitigate the consequences of a risk event. we are using this risk taxonomy on a forward - https : / / www. newyorkfed. org / aboutthefed / audit. html. bis central bankers ’ speeches looking basis to assess the risks of bank processes and as an analysis tool to investigate risk events after the fact. using standardized process, risk, and control types allows us to aggregate as well as slice and dice our risks around dimensions of interest. for example, we identify processes associated with the highest levels of residual risk and the largest number of risk events as areas for additional attention. it may be the case that additional mitigation is required or there are weaknesses in controls. we identify common control profiles for process types and assess their effectiveness based on risk ratings and past risk events. that informs the second line ’ s recommendations to business areas on control protocols. we also use the common control profiles to assess where we are over - controlled and have the opportunity to shift resources to other priorities. the risk information collected and the risk analysis performed by the second line is the basis for operational risk reporting in the bank ’ s risk profile report that is presented to the risk subcommittee, the management committee, and the audit and risk subcommittee. the risk profile report shows the bank ’ s most significant risks ( including operational risks ) along with a risk rating and the status of mitigating actions and mitigation plans. in addition, the report highlights significant and notable risk events along with the event ’ s impact, root causes, and remediation activities. we have found that the risk profile report provides the necessary flow of information to create meaningful committee dialogue around risk issues, feedback to business areas, coordination across

joshua rosenberg : operational risk management at the federal reserve bank of new york remarks by mr joshua rosenberg, executive vice president and chief risk officer of the federal reserve bank of new york, at the 18th annual oprisk north america 2016 conference, new york city, 15 march 2016. * * * good morning. i would like to thank the organizers for inviting me to speak at this year ’ s oprisk north america conference. today, i will share my perspectives on operational risk based on my experiences at the federal reserve bank of new york including those in my current role as the bank ’ s chief risk officer. before i begin, i wanted to state that the views i will be expressing are mine and do not necessarily reflect those of the federal reserve bank of new york or the federal reserve system. as you know, operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems, or external events. the new york fed faces operational risks because, like other public and private institutions, it relies on people, processes, and systems to execute its objectives, and, in the same way, the bank is subject to external events that can impact the effectiveness of our people, processes, and systems. to give you a better sense of the new york fed as an operational entity, i wanted to touch briefly on the broad range of the bank ’ s operations. most familiar are likely to be the bank ’ s execution of market operations to implement monetary policy directives of the federal open market committee and financial supervisory activities. as significant in the bank ’ s operational profile are the financial services that the bank provides to the u. s. government, financial institutions and businesses, and to foreign central banks and international institutions. notably, the bank operates the fedwire® electronic payments and securities transfer service, which is a critical part of the nation ’ s payment system infrastructure. the bank performs fiscal agency functions for the u. s. government including the auction of treasury securities, and it provides correspondent banking and custody services to foreign central banks and international institutions. 1 the bank ’ s risk framework operations imply operational risk, so how does the bank approach operational risk management? let me back up for a moment, since a useful starting point to answer this question is to begin by describing the bank ’ s overall approach to managing risk within the bank ’ s risk framework. in particular, the risk framework is designed to enable the bank to understand and communicate its risk profile to key stakeholders, assess