In the main banks visited, internal audit had not yet reviewed firms’ OR approach, although auditors indicated that they would carry out a review in the future, once the OR framework was more embedded.
Furthermore, the Basel Committee on Banking Supervision (2003) issued the document “Sound practices for the management and supervision of operational risk” where all banks were encouraged to comply with a number of principles. Already then,
144 the second of the ten principles proposed states:
The board of directors should ensure that the bank’s OR management framework is subject to effective and comprehensive internal audit by operationally independent, appropriately trained and competent staff. The internal audit function should not be directly responsible for OR management.