Operational Risk - Basel II & SOX

8 principles for op risk mgt framework :

1. definition and approval
2. internal audit scrutiny
3. formulation and implementation
4. assessment and identification
5. monitoring and reporting
6. control and review policies
7. contingency strategies
8. public disclosure

Integrating 8 principles in a firm-wide op risk mgt. framework:

• roles and responsibilities across managers and fuctional areas must be identified
• dependencies among various functional units must be recognized
• a list of key op risk events and preventive controls must be developed

SOX :

• objective :
• establish requirements for internal control over financial reporting
• requirements
• 製訂確保財務報表可靠性的流程
• 要將內控如何有效產生可靠的財務報表評估放入年報中
• 在年報中揭露內控虛的地方
• 關於內控效度需要在年報出示 auditor 的認證報告
• 整合管理階層內控評估報告及 auditor 的確認報告於年報中
• 6 implication
• assessment mechanism
• control design
• design testing
• testing methods
• fraud disclosure
• control shortcomings disclosure
• SOX vs. Basel II
• SOX : not mentioned anything spcifically about op risks
• Basel II : not state about financial reporting

Key highlights of UBS risk management plan (require functional area)

• 清楚描述工作和職責
• 提供額外資訊的說明文件
• 列出 specific expectations about achievements on implementation of control standards
• identify 重要的 indicator 提供早期的 warning sign