1. Operational Risk Management
Association of Serbian Banks
Wolfgang Walter
Palic – May 17th 2007

2. Relevance of Operational Risk1
Relevance of Operational Risk 2
Scope of Operational Risk 3
Regulatory Drivers / Requirements 4
Global OR Process by Divisions and S & C Functions 5
Regional OR Management 6
Risk Management Advisory
page 2 - EMEA ORM team

3. Senior Management & Operational Risk
Regulators will have high expectations regarding senior management’s awareness of Operational risk.
“We expect the governing body and senior management of AMA firms to have an assumed level of understanding of AMA”.
FSA – Strengthening Capital Standards 2 Feb 2006
“We expect the firm’s ‘governing body’ and senior management to be satisfied that the AMA is credible before applying to us for permission to use it. We also expect that the ‘governing body’ and senior management have knowledge of their AMA and understand how it works”.
FSA – Strengthening Capital Standards 2 Feb 2006
“The management body and senior management have an obligation to have a general awareness of the AMA framework used by their institution and have ultimate responsibility for implementing and developing it”.
CEBS – Guidelines on implementation, validation and assessment of AMA January 2006
“The management body and senior management should be responsible for approving all material aspects of the overall operational risk framework. They should have a general understanding of the institution’s operational risk measurement systems and detailed comprehension of its associated management reports and how operational risk affects the institution”.
CEBS – Guidelines on implementation, validation and assessment of AMA January 2006
page 3 - EMEA ORM team

4. Relevance of Operational Risk1
Relevance of Operational Risk 2
Scope of Operational Risk 3
Regulatory Drivers / Requirements 4
Global OR Process by Divisions and S & C Functions 5
Regional OR Management 6
Risk Management Advisory
page 4 - EMEA ORM team

5. What is Operational Risk?
Mizuho Securities tried to sell 610,000 shares at 1 yen apiece of J-Com Co.
It had actually intended to sell 1 share at 610,000 yen ($5,041).
The number of shares in Mizuho’s order was 41 times the number of J-Com’s outstanding shares, but the Tokyo Stock Exchange processed the order anyway.
Mizuho says it tried to cancel the order three times, but the exchange said it doesn’t cancel transactions even if they are executed on erroneous orders.
By the end of the day, Mizuho Securities had lost at least 27 billion yen ($225 million).
Mizuho Securities – Trader Error
Dec. 14, 2005
“Fat finger” – human errors can be costly
Targeted actions by terrorists result in large losses
Organised crime gangs use modern hacking technology
Internal Fraud – nature of business makes banks inherently susceptible to fraudulent activities
Internal Fraud – nature of business makes banks inherently susceptible to fraudulent activities
“Fat finger” – human errors can be costly
Organised crime gangs use modern hacking technology
Targeted actions by terrorists result in large losses
Mizuho Securities tried to sell 610,000 shares at 1 yen apiece of J-Com Co.
It had actually intended to sell 1 share at 610,000 yen ($5,041).
The number of shares in Mizuho’s order was 41 times the number of J-Com’s outstanding shares, but the Tokyo Stock Exchange processed the order anyway.
Mizuho says it tried to cancel the order three times, but the exchange said it doesn’t cancel transactions even if they are executed on erroneous orders.
By the end of the day, Mizuho Securities had lost at least 27 billion yen ($225 million).
Mizuho Securities – Trader Error
Dec. 14, 2005
page 5 - EMEA ORM team

6. Operational Risk – Deutsche Bank Definition
“Operational Risk is the potential for incurring losses in relation to employees, contractual specifications and documentation, technology, infrastructure failure and disasters, projects, external influences and customer relationships.”
Risk Aligned to
Control Groups
Global Sourcing
Global Technology & Operations
Compliance
Corporate Real Estate
Information Technology Risk Control
Controlling
Corporate Security & Business Continuity
All
Human Resources
Operations Risk: Control/Settlement Breaks,
Data Quality Risk,
Nostro reconciliation exceptions, Fails
Operational Risk Definition
Diverse Range of Risks
Vendor Risk
Transaction Processing Risk
Regulatory Risk
Real Estate Risk
Information Technology Risk
Financial Reporting & Recording Risk
Corp. Security & Business Continuity
Safeguarding of Assets
Staff Risk
Risk Grouped into Risk
“Buckets” (SRTs)
Sexual Harassment
Fraud
Advisory
Risk
Unauthorised Trading
Product Liability, Suitability,
Misselling
Project
Management Risk
Business Interruption
Natural Disaster
Legal Risk
Regulatory Risk
Data Security Risk
Discrimination
Model Risk
Restructuring/ Merger Risk
page 6 - EMEA ORM team

7. Relevance of Operational Risk1
Relevance of Operational Risk 2
Scope of Operational Risk 3
Regulatory Drivers / Requirements 4
Global OR Process by Divisions and S & C Functions 5
Regional OR Management 6
Risk Management Advisory
page 7 - EMEA ORM team

8. Who are DB’s Regulators?
New Basel
Accord
Final Version in June 2004: plus a trading book review in April 2005
DB’s home state supervision is BaFin (Germany)
Home State Consolidated Group Supervision
Host State Country Level Supervision
National Legislation
Non-EU Countries
EU Directives
(EU countries)
National Rulebooks
Russia, South Africa, India, USA, Japan, Switzerland, Canada
Germany, France, UK, Italy
EU Directives become law in 2005/06
The New Basel Accord is expected to be implemented by most countries
The EU and non-EU countries will transform the Accord into law and country-level rulebooks
Basel 2 implementation in most countries set for 1st January (AMA 1st January 2008)
Who are the Banking Regulators of DB?
DB has manay different regulators as we operate in over 70 countries worldwide
Requires enhanced cross-border cooperation
Basel Guidance
Final Basel paper to be issued in late June 2004
EU Directives
To incorporate Basel Guidance. Initially scheduled to be issued in June – now delayed to later this year
National Requirments
Generally assumed that the National Requirements will incorporate both Basel Guidance and EU Directives, however, some regualtors may choose not to adopt Basel
Home / Host State Coordination
Home and host supervisors should consider pracitcal ways to coordinate requests for information
Closer coordination between supervisors is essential to implement the New Accord effecitvely and efficiently
Envisaged that the Home Country regulators would leead the coordination effort
DB Timetable:
1st Jan 07 – Basic or Standardised Approaches implemented
1st Jan 08 – Full Implementation of Advanced IRB / AMA on Group level
page 8 - EMEA ORM team

9. Regulatory Drivers (Basel II) Regulators are encouraging major internationally active banks to utilise an Advanced Measurement Approach
AMA Pre-requisites:
3 years of OR loss data and experience
Internal and External Losses (db IRS & ORX)
Business Environment & Control Issues (self assessments)
Recognition of Insurance
Budgeting for Expected Losses.
Advanced
Measurement
Approach
Increasing Sophistication
Increasing Risk Sensitivity
Increasing Qualitative Standards
Sophisticated Risk Mgmt Capability
Basic
Indicator
Gross Income x 15%
Gross Income x (12%-18%)
Standardised
DB Strategy:
DB to apply with our home regulator (BaFin) for use of Advanced IRB-Approach for credit risk and of AMA for operational risk on a consolidated group-level only.
DB will use the Standardized Approach for credit risk and the BIA for operational risk on a local level.
page 9 - EMEA ORM team

10. Relevance of Operational Risk1
Relevance of Operational Risk 2
Scope of Operational Risk 3
Regulatory Drivers / Requirements 4
Global OR Process by Divisions and S & C Functions 5
Regional OR Management 6
Risk Management Advisory
page 10 - EMEA ORM team

11. Business Partnership Model Key for a more pro-active risk management
Independent ORM Function
Analytical framework
Target Setting
Reporting
Value-added Analysis
Strategy
Operational Risk
Management
Committee
Business Partnership model to achieve business ownership
Tactical framework implementation and daily risk management with divisional ORM centres of expertise
Monitoring within scope of the control functions
Improved risk management by value-added analysis across divisions
Raise efficiency by:
Integrating ORM more closely with other control functions
Rationalising IT / data collection and focussed reporting
Control Groups
Monitoring
Testing and verification by:
Audit, Compliance, Legal, Controlling, GTO, BCM, HR
Corporate Security
Daily
Execution
Business Partners reporting
into business lines
Framework implementation
Daily risk management
Business Partners
(Divisional OR Teams)
page 11 - EMEA ORM team

12. Forensic Investigation
ORM
PROCESS
ORM Process
Learn
from Past
Experience
Assess the
Current
Environment
Prepare for
the Future
Typical Losses
Forensic Investigation
Key Risk Indicators
Lessons Learned
OR Analytics
Hot Topics
IB Ops Collaboration
OR Self Assessments
Action Point Tracking
Key Risk Indicator Monitoring
OR events database
page 12 - EMEA ORM team

13. Relevance of Operational Risk1
Relevance of Operational Risk 2
Scope of Operational Risk 3
Regulatory Drivers / Requirements 4
Global OR Process by Divisions and S & C Functions 5
Regional OR Management 6
Risk Management Advisory
page 13 - EMEA ORM team

14. Primary Roles & Responsibilities
Summary of Primary Responsibilities
Group ORM
Establish overall OR strategic direction for the Group and ensure effective and regulatory compliant OR management and measurement process are adopted
Group ORM Contacts
Act as the primary interface in ORM on a Global basis between the respective Business Divisions and Control Groups
Country ORM Contact
Act as primary contact person for the local ORM Country Manager
Independent ORM Function
ORM Country Manager
Senior management representative who is actively involved in the oversight of the ORM programme for their respective countries
In-country ORM Business / Control Group Managers
Divisional / Control Group Risk Officers who are responsible for the tactical implementation of the ORM programme for their respective business areas. Note that this responsibility may be assumed at either a Country or Regional level
Country OR Management
page 14 - EMEA ORM team

15. Country ORM Manager – General Responsibilities
Ensure consistency of the overall OR strategic direction for the country and ensure effective OR management and measurement processes are adopted
Provide oversight, direction and support to the ORM Business & Control Group Managers
Assist with the ORM Toolset implementation
Assist with the development and compilation of ORM Country Reports (where considered necessary)
Conduct regular review meetings with country senior management to escalate issues
Develop Policies and Procedures concerning ORM and control to meet specific local regulatory requirements in collaboration with central teams
Promote information flow (communication and reporting) to support appropriate OR management awareness and knowledge (e.g. through education and training across the group)
Act as the primary contact for the local regulators for all jurisdictions within the respective regions on the subject of OR
page 15 - EMEA ORM team

16. ORM Minimum Requirements at country level
Country ORM Manager clearly identified
Regular ORM meetings (Terms of Reference & Minutes)
Existing & Running loss data collection process (Business Unit primary responsibility)
Updated & Reviewed Country Risk Profiles only for non-representative office countries
Adequate escalation procedures in place in case of OR emergency
page 16 - EMEA ORM team

17. Relevance of Operational Risk1
Relevance of Operational Risk 2
Scope of Operational Risk 3
Regulatory Drivers / Requirements 4
Global OR Process by Divisions and S & C Functions 5
Regional OR Management 6
Risk Management Advisory
page 17 - EMEA ORM team

18. Risk Management Advisory A strong partner to assist in achieving first class Risk Management
Deutsche Bank’s Risk Management Advisory offers an Integrated Risk Management approach which incorporates all functions of risk management:
Credit Risk Management
Market Risk Management
Operational Risk Management
Portfolio Management
Bank
Rakyat
Indonesia
RMA offer best-market practice to upgrade systems and processes and help comply with Basle II:
Rating Guidelines
Economic Capital / RaRoC
Three Pillars of Basle II / Operational Risk
page 18 - EMEA ORM team