According to the first qualitative criterion, there should be an independent operational risk management function responsible for the design and implementation of the operational risk management framework, including policies and procedures, measurement methodology, reporting system and operational risk management process. The 4th and 5th quantitative criteria stipulate the use of internal data, relevant external data and internal control systems and the business environment. These criteria indicate that an
institution’s operational risk measurement system should have four key elements: internal data, external data, scenario analysis, and factors reflecting the business environment and internal control system.