. Existence of operational losses databases that allow the OR function to manage
information easily.
. Establishment of reporting flows directed at the senior management and the
business units.
. Existence of supervision processes that validate the performances carried out.
One of the key aspects when thinking about the implementation of advanced
measurement models is the need to have historical series of loss data (with a minimum
of three years and preferably five years or more) to provide input to statistical models
and capital models. Therefore, the internal auditors will focus on those aspects related
to the collection of operational losses, including:
. Ensuring the databases contain the information required for the description of
the loss events.
. The relationship between the operational losses collected and the accounting
records.
. The establishment of approaches to assign OR losses to the business lines.
. The existence of procedures for consolidating information on multiple losses
caused by a single main event.
. The integrity of the historical series so that the full recovery of a loss does not
result in the deletion of the original event and it is possible to identify the events
that formed the historical series at a given date.
. The evolution and development of analysis of the correlation of the historical
series of operational losses with regard to the internal and external factors that
influence OR.
. The establishment and recording of analysis of the frequency and severity
curves of the operational events.
In this sense, the Bank of Spain (2006), in the document titled “Implementation and
validation of Basel II advanced approaches in Spain” indicates that “it is necessary that
the department of internal audit establishes a plan for the periodic revision of the
model to manage and measure OR”. Also, it establishes that “the entities that seek to
use the internal models to regulatory effects will send periodically to the Bank of Spain
formal statements.”
In that document, in their Annex 7, reference is made to the content that should
be included in the specific report to be sent by the internal auditor for the validation
of the internal model of OR. It should justify its opinion, expressing conclusions and
giving well-documented evidence about its confirmation on the following aspects:
. Integration of the measurement system in the management process. Internal audit
will verify that the internal measurement system of OR is integrated in the day to
day management process.
. Procedures and tools of managing OR. Internal audit will have to verify the
compliance to internal rules, controls and requirements related to this risk.