The banking industry, in close dialog with the Basel Committee on Banking Supervision, achieved further progress in 2003 in developing the new Regulatory Operational Risk Framework, although the discussions with the regulators concerning the capital and framework guidelines have not yet ended. On the basis of the regulatory discussion we define operational risk as the potential for incurring losses in relation to employees, project management, contractual specifications and documentation, technology, infrastructure failure and disasters, external influences and customer relationships. This definition includes, among others, legal and regulatory risk.
The development of guidelines, standards, tools and methodologies to measure and protect against operational risk is a major challenge to the banking sector. This is especially true in view of the new capital adequacy regulations currently under discussion, which will come into force at the end of 2006 and which will impose a capital charge for operational risks. Moreover the regulators specify in their paper “Sound Practices for the Management and Supervision of Operational Risk” qualitative demands regarding a bank's organization and risk management as well as quantitative directives for risk identification and risk measurement. We are working towards fulfilling these future requirements.
Managing Our Operational RiskWe are implementing a framework for managing our operational risk on a global basis. A Group Operational Risk Management Policy defines roles and responsibilities for managing and reporting operational risk. Divisional standards supplement this Group policy. Responsibility for operational risk management essentially lies with our Business Divisions. We are implementing four different systems for the management of operational risks:
- We perform operational risk “self-assessments” using our db-RiskMap tool. This results in a specific operational risk profile (high risk potential) for business lines, service functions and the Corporate Center. db-SAT complements the self-assessment approach. Focus is on business efficiency and improvement of controls.
- We collect losses arising from operational risk events in our db-Incident Reporting System database.
- We capture and monitor qualitative and quantitative risk indicators in our tool db-Score for transaction processing risk and information security risk.
- We capture action points resulting from risk assessments or db-Score in db-Track. Within db-Track we will monitor the progress of the operational risk action points on an on-going basis.
These systems help to give an overview of our current operational risk profiles and to define risk management measures and priorities. We monitor the status of framework implementation in a scorecard, which forms the basis for quarterly review by the Group Operational Risk Committee. As an incentive to implement this framework, we grant certain deductions of the economic capital for operational risk to the Business Divisions. The calculation of economic capital for operational risk is based on a statistical model using internal and external loss data with certain top-down assumptions.
The Chief Operational Risk Officer with Group-wide responsibility reports directly to our Group Chief Risk Officer. He is represented on the Group Risk Committee and is Chairman of the Group Operational Risk Committee. The latter committee, whose members include the divisional Operational Risk Officers and representatives of Service Functions and Corporate Center such as Audit, Controlling, Human Resources, Legal, Tax and Compliance, develops and implements our internal guidelines for managing operational risk. The Chief Operational Risk Officer is head of our Operational Risk Management, with responsibility to roll-out the Operational Risk framework, i.e. policy, tools, reporting. The Operational Risk Management functions of the Corporate Divisions are part of our independent Operational Risk Management function and report to the Chief Operational Risk Officer.
We seek to minimize operational risk associated with our communication, information and settlement systems through the development of back-up systems and emergency plans. We engage in regular employee training, operating instructions and inspections to help limit operational defects or mistakes. Where appropriate, we purchase insurance against operational risks.