OSFI Consults on Operational Risk Capital Data Management Expectations

The document on data maintenance expectations outlines data management principles that OSFI expects institutions using the standardized approach to adhere to, which include the BCBS principles for effective risk data integration and risk data reporting. These principles include governance, data architecture and IT infrastructure, accuracy and integrity, completeness, timeliness, adaptability, accuracy, comprehensiveness, clarity and usefulness, frequency, and distribution. In addition, OSFI expects that data used in the calculation of operational risk capital institutions will have:

• Documentation outlining the end-to-end systems and data flows, including key controls for critical failure points, to support the data management processes required to calculate operational risk capital
• Established policies and documented procedures for the storage, retention, and archiving, including, where applicable, the procedures for logical/physical deletion of loss data and destruction of data storage media and peripherals
• Processes to maintain backups of relevant data files/stores and databases in a manner that can facilitate ready retrieval in the event of information calls on the institutions’ compliance and ongoing supervisory assessments
• Processes to ensure that the electronic versions of all relevant data are accessible in a format that provides flexibility to enable searching, aggregation and reporting

These criteria should be used in assessing, both initially and on an ongoing basis, an institution’s data used in the calculation of operational risk capital. OSFI will consider the institution’s risk profile and complexity when assessing its compliance with these criteria. Additional details on the OSFI expectations can be found in the assessment tool. The assessment tool summarizes the detailed expectations based on Chapter 3 of the draft CAR guideline, Aggregation and Risk Reporting (RDARR) principles, and the data maintenance expectations. Together, the data maintenance expectations and assessment tool aim to ensure that institutions effectively manage the current and historical operational risk capital data.

In this context, OSFI has reviewed the existing implementation notes and self-assessment templates for institutions using standardized approach/advanced measurement approach, in light of the new requirements for the Basel III standardized approach. The regulator found that many of the qualifying requirements for standardized approach/advanced measurement approach (for example: scenario analysis, external data, business environment, and internal control factors) are not part of the new standardized approach, which uses internal operational loss data as a direct input as part of the capital charge calculation. Moreover, many of the operational risk management expectations found in the implementation notes have been updated and incorporated into other Basel standards as well as OSFI guidance (for example, Guideline E-21 on operational risk management and the corporate governance guideline). Thus, OSFI is proposing to rescind the existing governance and data maintenance implementation notes for the standardized approach/advanced measurement approach institutions as well as the self-assessment template, upon implementation of the revised Capital Adequacy Requirements guideline in 2023.

Related Links

• OSFI Letter
• Data Maintenance Expectations
• Assessment Tool

Comment Due Date: July 30, 2021

Keywords: Americas, Canada, Banking, Operational Risk, CAR Guideline, Standardized Approach, Reporting, Basel, Regulatory Capital, Data Assessment Tool, OSFI