Operational Risk

This chapter sets out the key elements expected of an institution’s operational risk management framework and includes guidelines on business continuity and outsourcing. These guidelines are not intended to be exhaustive as institutions should also take into account applicable industry standards such as the Basel Committee on Banking Supervision’s “Principles for the Sound Management of Operational Risk” (June 2011), where appropriate.

Operational Risk Framework and Systems

An institution should establish sound and appropriate operational risk management strategies, policies and processes to identify, measure assess, monitor, report and control or mitigate operational risk. These operational risk management strategies, policies and processes should be consistent with the institution’s risk profile, risk appetite and capital strength, and take into account market and macroeconomic conditions, and address all relevant aspects of operational risk prevalent in the businesses of the institution on an institution-wide basis.

The institution’s strategies, policies and processes for the management of operational risks should be approved and subjected to regular review by the institution’s Board. The Board is responsible for ensuring that these policies and processes are implemented effectively by management and fully integrated into the institution’s overall risk management process.

Management Information Systems

The institution should establish appropriate and effective information systems to:

(a) monitor operational risk;

(b) compile and analyse operational risk data; and

(c) facilitate appropriate reporting mechanisms at the institution’s Board, senior management, and business line levels that support proactive management of operational risk.

Reporting Mechanism

The institution should establish an appropriate reporting mechanism to notify MAS of significant operational risk developments.

Business Continuity

Business Continuity Management (BCM) is a holistic management process that focuses on the effective recovery and rapid resumption of critical business functions and restoration of information technology infrastructure following operational disruptions. A proactive and robust BCM framework enables the institution to improve its readiness to respond to and recover from crises. Effective implementation of sound BCM strategies can minimise the impact from operational disruptions and enable the institution to fulfil its business obligations during crises.

Full-text PDFs on BCM and feedback to the BCM consultation paper are provided below.


While outsourcing can bring about cost and other benefits, it may increase the risk profile of an institution.

These guidelines on outsourcing set out MAS’ expectations on an institution that has entered into outsourcing or is planning to outsource its business activities to a business provider.

Full-text PDFs on outsourcing and feedback to the outsourcing consultation paper are provided below.

Last Modified on 18/02/2019