What are the key roles and responsibilities for operational risk governance and oversight?

1 Board of directors

The board of directors is the highest authority for operational risk governance and oversight. It is responsible for setting the tone and culture for operational risk management, approving the operational risk strategy and policy, overseeing the implementation and effectiveness of the operational risk framework, and challenging and endorsing the operational risk reports and assessments. The board of directors should also ensure that there is adequate expertise, resources, and independence for the operational risk function and that there is a clear escalation and communication process for operational risk issues.

2 Senior management

Senior management is accountable for implementing and executing the operational risk strategy and policy in line with the board's direction and the organization's risk appetite. It is responsible for establishing and maintaining the operational risk governance structure, roles, and responsibilities, ensuring that the operational risk framework is integrated into the business processes and decision-making, and fostering a culture of operational risk awareness and ownership across the organization. Senior management should also monitor and report on the operational risk profile and performance, identify and mitigate the operational risk exposures, and ensure compliance with the relevant laws and regulations.

3 Operational risk function

The operational risk function is an independent and objective unit that supports the board and senior management in fulfilling their operational risk governance and oversight responsibilities. It is responsible for developing and maintaining the operational risk framework, methodologies, tools, and systems, providing guidance and advice on operational risk matters, facilitating the identification, assessment, measurement, monitoring, and reporting of operational risks, and conducting independent reviews and audits of the operational risk processes and controls. The operational risk function should also promote best practices and standards for operational risk management, provide training and education, and coordinate with other risk functions and external stakeholders.

4 Business units and support functions

Business units and support functions are the primary owners and managers of operational risks in their respective areas of operation. They are responsible for implementing and complying with the operational risk framework, policies, and procedures, identifying and assessing the operational risks inherent in their activities, products, and services, implementing and testing the operational risk controls and mitigation actions, reporting and escalating the operational risk incidents and issues, and participating in the operational risk reviews and audits. Business units and support functions should also embed the operational risk culture and awareness in their daily operations and interactions with customers, suppliers, and other parties.

5 Internal audit

Internal audit is an independent assurance function that provides an objective evaluation of the adequacy and effectiveness of the operational risk governance and oversight framework and processes. It is responsible for conducting periodic and risk-based audits of the operational risk management activities, systems, and controls, providing recommendations for improvement, and following up on the implementation of the corrective actions. Internal audit should also coordinate with the operational risk function and other assurance providers to ensure a comprehensive and consistent coverage of the operational risk areas.

6 External stakeholders

External stakeholders are the parties that have an interest or influence on the organization's operational risk management. They include regulators, supervisors, rating agencies, auditors, customers, suppliers, investors, media, and the general public. They are responsible for providing feedback, guidance, requirements, expectations, and information on the operational risk environment, trends, and best practices. They can also monitor, assess, and challenge the organization's operational risk governance and oversight framework and performance.

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?