ICICI Bank 2013 Annual Report Download - page 199

F121
• Monitoring through key risk indicators; and
• Mitigation through process and controls enhancement and insurance.
The Bank has implemented Outsourcing Policy approved by the Board of Directors, which specifies the
composition, roles and responsibilities of Outsourcing Committee. The Outsourcing Committee is
responsible for:
• Assessing the risk and ensure mitigation for the same for all material outsourced activities;
• Approving new outsourced activities;
• Ensuring that periodic review of outsourced agencies is conducted by the business/operations group;
and
• Putting in place a central database on outsourcing.
Identification and assessment
Operational risks and controls across the Bank are documented and updated regularly. Each business
and operations group in the Bank has business operational risk managers within the group. ORMG along
with these managers facilitates the business and operation groups for carrying out risk and control self-
assessments on a periodic basis as per the plan approved by the ORMC. Risk mitigation plans are monitored
to ensure timely mitigation of risks. Internal controls are tested by Internal Audit Group in the Bank. The
testing results are incorporated in the operational risk assessment. The Bank has a comprehensive Product
and Process Approval framework along with the detailed operating guidelines for effective new product and
process risk management. As per the framework, Bank has a Product and Process Approval Committee (PAC)
in place. The role of PAC is to assess the proposed product offering/process improvement from the business
and operational perspective, examine the feasibility of system requirements for supporting the product/
process and ascertain that adequate risk mitigation, legal and compliance measures are considered. All the
new products and processes including modifications thereof are reviewed by the control groups such as risk,
compliance, legal and audit, prior to being placed before the Committee for approval.
Measurement, monitoring, mitigation and reporting
Operational risk incidents are reported regularly and transactions resulting in losses are routed through
operational risk account. Root cause analysis is carried out for the significant operational risk incidents
reported and corrective actions are incorporated back into respective processes. The Bank has implemented
incident reporting systems, which facilitate capturing of operational risk incidents by the employees of the
Bank.
The operational risk losses and incident analysis are submitted to the Risk Committee and to the Board on a
periodic basis. Operational risk exposures (risk and control self assessment results, operational risk incidents
analysis, key risk indicators and open risks) are monitored by the ORMC on a regular basis and reported to
the business heads in the form of dashboards on a periodic basis.
The Bank has initiated steps to adopt advanced approaches for operational risk capital computation. The
Bank had filed an application with the RBI for migration to The Standardised Approach (TSA). The Bank has
been estimating Operational Value at Risk (OpVaR) for the purpose of Internal Capital Adequacy Assessment
Process (ICAAP). The OpVaR is estimated based on the principles of AMA by using internal loss data, scenario
analysis and external loss data. The OpVaR is stress tested on a quarterly basis to ensure adequacy of the
capital provided for operational risk and is compared with trends of actual losses.
For facilitating effective operational risk management, the Bank has implemented a comprehensive operational
risk management system. The application software comprises five modules namely incident management,
risk and control self-assessment, key indicators, scenario analysis and issues and action.
BASEL II – PILLAR 3 DISCLOSURES (CONSOLIDATED)
at March 31, 2013