FFIEC IT Examination Handbook MGT-II.A: II.A Operational Risk (Management)

Management understands that operational risk from IT arises in back-office processing, customer service, systems development, internal controls and capacity planning across all lines of business and drives strategic risk from inaccurate information, compliance risk from failing to meet regulatory requirements or from dependence on products and services, and reputation risk from errors, delays, unauthorised access or loss of confidential information; management keeps a comprehensive view of the operations technology supports, keeps IT in strategic planning, ensures IT controls throughout the institution by direct oversight or by holding lines of business accountable, and participates in the IT risk management process to identify, measure, mitigate, monitor and report IT risk.