ICICI Bank 2012 Annual Report Download - page 194

F116
The key elements in the operational risk management framework as defined in the Policy include:
 Identification and assessment of operational risks and controls;
 New product and processes approval framework;
 Measurement through incident and exposure reporting;
 Monitoring through key risk indicators; and
 Mitigation through process and controls enhancement and insurance.
The Bank has implemented Outsourcing Policy approved by the Board of Directors, which specifies the composition,
roles and responsibilities of Outsourcing Committee. The Outsourcing Committee is responsible for:
 Assessing the risk and ensure mitigation for the same for all material outsourced activities;
 Approving new outsourced activities;
 Ensuring that periodic review of outsourced agencies is conducted by the business/operations group; and
 Putting in place a central database on outsourcing.
Identification and assessment
Operational risks and controls across the Bank are documented and updated regularly. Each business and operations
group in the Bank has business operational risk managers within the group. ORMG along with these managers
facilitates the business and operation groups for carrying out risk and control self-assessments on a periodic basis
as per the plan approved by the ORMC. Risk mitigation plans are monitored to ensure timely mitigation of risks.
Internal controls are tested by Internal Audit Group in the Bank. The testing results are incorporated in the operational
risk assessment. The Bank has a comprehensive Product and Process Approval framework along with the detailed
operating guidelines for effective new product and process risk management. As per the framework, Bank has
a Product and Process Approval Committee (PAC) in place. The role of PAC is to assess the proposed product
offering/process improvement from the business and operational perspective, examine the feasibility of system
requirements for supporting the product/process and ascertain that adequate risk mitigation, legal and compliance
measures are considered. All the new products and processes including modifications thereof are reviewed by the
control groups such as risk, compliance, legal and audit, prior to being placed before the Committee for approval.
Measurement, monitoring, mitigation and reporting
Operational risk incidents are reported regularly and transactions resulting in losses are routed through operational
risk account. Root cause analysis is carried out for the significant operational risk incidents reported and corrective
actions are incorporated back into respective processes. The Bank has implemented incident reporting systems,
which facilitate capturing of operational risk incidents by the employees of the Bank.
The operational risk losses and incident analysis are submitted to the Risk Committee and to the Board on a periodic
basis. Operational risk exposures (risk and control self assessment results, operational risk incidents analysis, key
risk indicators and open risks) are monitored by the ORMC on a regular basis and reported to the business heads
in the form of dashboards on a periodic basis.
The Bank has initiated steps to adopt advanced approaches for operational risk capital computation. The Bank
had filed an application with the RBI for migration to The Standardised Approach (TSA) on a standalone basis in
September 2011. The Bank has taken steps for filing an application for migration to the Advanced Measurement
Approach (AMA). The Bank has been estimating Operational Value at Risk (OpVaR) for the purpose of Internal
Capital Adequacy Assessment Process (ICAAP). The OpVaR is estimated based on the principles of AMA by using
internal loss data, scenario analysis and external loss data. The OpVaR is stress tested on a periodic basis to ensure
adequacy of the capital provided for operational risk and is compared with trends of actual losses.
For facilitating effective operational risk management, the Bank has implemented a comprehensive operational risk
management system. The application software comprises five modules namely incident management, risk and
control self-assessment, key indicators, scenario analysis and issues and actions.
Operational risk management in overseas branches and banking subsidiaries
ORMG is responsible for design, development and continuous enhancement of the operational risk management
framework across the Bank including overseas banking subsidiaries and overseas branches. While the common
framework is adopted, suitable modifications in the processes are carried out depending upon the requirements
of the local regulatory guidelines. ORMG exercises oversight through the process of periodic review of operational
risk management in the international locations.
BASEL II – PILLAR 3 DISCLOSURES (CONSOLIDATED)
at March 31, 2012