Key Risk Indicator Templates

RISK AND CONTROL SELF-ASSESSMENT / KEY RISK INDICATORS. Area of Assessment 1. Risk identification

Reference SP (23)

2. Assessment of identified risks SP (24)

3. Tools for assessment of operational risk

SP (25)

#

Criteria

1.1 The bank has an effective risk identification process of both internal and external factors that could adversely affect the achievement of the bank's objectives. 2.1 The bank assesses the vulnerability of potentially adverse risks to better understand risk profile and target risk management resources. 3.1 Self- or risk assessment - The bank completes an internal assessment of its operations and activities against a menu of potential operational risk vulnerabilities.

3.2 Self- or risk assessment - This process is internally driven and often incorporates checklists and/or workshops to identify the strengths and weaknesses of the operational risk environment. 3.3 Risk mapping - The bank has mapped various business units, organizational functions or process flows by risk types.

3.4 Risk indicators - The bank uses statistics and/or metrics to provide a bank's risk position.

3.4 Measurement - The bank has established practises for quantification of exposure to operational risk using a variety of approaches. 4. Reporting

n/a

4.1 Operational risk results from risk assessment tools are reported and used in the management of operational risk.

Risk and Control Self-Assessment / Key Risk Indicators

Information Request

Assessment Rating

(a) Describe the bank's processes for identification of both internal and external risk factors. None

(a) Identify if the bank is using a Risk Control Self-Assessment process. (b) Describe the process and state if it is an enterprise wide process. (c) Describe how RCSA results are used in risk identification as well as mitigation. (d) Describe the effectiveness of the risk control self-assessment process. (a) Describe how the process identifies the strengths and weaknesses of the operational risk environment.

(a) Identify if the bank is risk mapping business units, organizational functions or process flow by risk types. (b) Describe this risk mapping process. (c) Describe how risk mapping is used for risk identification and mitigation. (a) Identify if the bank is using key risk indicators to assess operational risk. (b) Provide list of key risk indicators used by the bank. (c) Describe how the key risk indicators were developed. (d) Identify how key risk indicators are used. (e) Describe how key risk indicators reported to senior management and the board are used. (a) Identify if the bank has established practices for quantification of operational risk exposure. (b) Describe the quantification approaches used. (a) List all reports of risk assessment tools and indicate how they are used. Page 1 of 4

RISK AND CONTROL SELF-ASSESSMENT / KEY RISK INDICATORS.

4. Reporting

Area of Assessment

n/a

Reference

#

Criteria

4.2 There is appropriate reporting of results from risk assessments tools to the Board, senior management and business units.

Risk and Control Self-Assessment / Key Risk Indicators

Information Request

Assessment Rating

None

Page 2 of 4

PROTECTED B WHEN COMPLETED

Rating Rationale

Risk and Control Self-Assessment / Key Risk Indicators

Page 3 of 4

PROTECTED B WHEN COMPLETED

Rating Rationale

Risk and Control Self-Assessment / Key Risk Indicators

Page 4 of 4