24. Operational Risk

Template OR3 - Minimum required operational risk capital Table ORA: General qualitative information on a bank’s operational risk framework Purpose: To describe the main characteristics and elements of a bank’s operational risk management framework. Scope of application: The table is mandatory for all banks Content: Qualitative information. Frequency: Annual. Format: Flexible. Banks must describe a) Their policies, frameworks and guidelines for the management of operational risk. b) The structure and organisation of their operational risk management and control function. c) Their operational risk measurement system (ie the systems and data used to measure operational risk in order to estimate the operational risk capital charge). d) The scope and main context of their reporting framework on operational risk to executive management and to the board of directors. e) The risk mitigation and risk transfer used in the management of operational risk. This includes mitigation by policy (such as the policies on risk culture, risk appetite, and outsourcing), by divesting from high-risk businesses, and by the establishment of controls. The remaining exposure can then be absorbed by the bank or transferred. For instance, the impact of operational losses can be mitigated with insurance. Template OR1: Historical losses Purpose: To disclose aggregate operational losses incurred over the past 10 years, based on the accounting date of the incurred losses. This disclosure informs the operational risk capital calculation. The general principle on retrospective disclosure set out in section 8.2 does not apply for this template. From the implementation date of the template onwards, disclosure of all prior periods is required, unless firms have been permitted by SAMA to use fewer years in their capital calculation on a transitional basis. Scope of application: The table is mandatory for: (i) all banks that are in the second or third business indicator (BI) bucket, regardless of whether SAMA has exercised the national discretion to set the internal loss multiplier (ILM) equal to one; and (ii) all banks in the first BI bucket which have received SAMA approval to include internal loss data to calculate their operational risk capital requirements. Content: Qualitative information. Frequency: Annual. Format: Fixed. Accompanying narrative: Banks are expected to supplement the template with narrative commentary explaining the rationale in aggregate, for new loss exclusions since the previous disclosure. Banks should disclose any other material information, in aggregate, that would help inform users as to its historical losses or its recoveries, with the exception of confidential and proprietary information, including information about legal reserves. a b c d e f g h i j k T T-1 T-2 T-3 t-4 t-5 t-6 t-7 t-8 t-9 Ten-year average Using 44,600 SAR threshold 1 Total amount of operational losses net of recoveries (no exclusions) 2 Total number of operational risk losses 3 Total amount of excluded operational risk losses 4 Total number of exclusions 5 Total amount of operational losses net of recoveries and net of excluded losses Using 446,000 SAR threshold 6 Total amount of operational losses net of recoveries (no exclusions) 7 Total number of operational risk losses 8 Total amount of excluded operational risk losses 9 Total number of exclusions 10 Total amount of operational losses net of recoveries and net of excluded losses Details of operational risk capital calculation 11 Are losses used to calculate the ILM (yes/no)? 12 If “no” in row 11, is the exclusion of internal loss data due to non-compliance with the minimum loss data standards (yes/no)? 13 Loss event threshold: 44,600 SAR or 446,000 SAR for the operational risk capital calculation if applicable Definitions Row 1: Based on a loss event threshold of 44,600 SAR, the total loss amount net of recoveries resulting from loss events above the loss event threshold for each of the last 10 reporting periods.