HKMA SPM OR-1: OR-1 Operational Risk Management

Sets the supervisory approach to operational risk and the elements of effective management: an appropriate framework, risk governance (board oversight, senior management responsibilities, risk culture), the three lines of defence (business unit management, the operational risk management function, other related functions, independent assurance), strategy, policies and the definition of operational risk, the management process (identification and assessment, monitoring and reporting, control and mitigation), specific aspects (change management, information and communication technology, business continuity management and disaster recovery) and disclosure; it is read with OR-2 on operational resilience. Classification: a non-statutory guideline issued as a guidance note; version V.2, 25.07.2022; applies to all AIs.