Section 291 of the Solvency Regulation (as of 01.01.2007)

Business environment and internal control system

¹The operational risk measurement system shall capture the key factors of the business environment and the internal control system that affect its operational risk profile. ²The following requirements shall be met:

1. the chosen factors shall be major risk drivers whose choice must be justified on the basis of experience and involving the expert judgement of the internal business areas affected,

2. the sensitivity of the risk estimates to changes in the factors and the relative weighting of these factors need to be well reasoned, in particular altered risks due to changes in the internal risk control system, in the complexity of activities or in the business volume must be taken into account,

3. over time, the choice and implementation of the internal control and business environment factors and their influence on the measurement system need to be validated by empirical means, especially through comparison with internal loss data and relevant external data and, if appropriate, have to be reassessed,

4. the choice and implementation of the internal control and business environment factors shall be documented and subject to independent review.

Explanatory comments

The operational risk measurement system comprises the instruments for identifying, measuring and monitoring operational risks and the risk capital model. In the light of the requirements of section 284 (1) of the Solvency Ordinance, proper account must be taken of the internal control factors and business environment factors when calculating the capital requirement. The Ordinance does not regulate how the input elements are to be combined. The business environment and internal control factors may be taken into account in different places in the calculation procedure. The institution must document whereabouts in the measurement system the BE&ICF are taken into account and state the grounds for how they are used.

The measurement system is meant to consider, as a minimum, those BE&ICF to which material influence on the operational risk of an institution is ascribed, in the light of its own experience. In the initial implementation phase, in particular, it may be possible that the risk sensitivity cannot be adequately substantiated beyond an expert opinion, since the collected data is not yet capable of meeting such a requirement, especially for “tail” modelling. In such cases institutions must demonstrate, by means of plausibility considerations at the least, the extent to which their methods are suited to taking the BE&ICF into account.

Changes in operational Risk changes due to any change in the scope of the business, the complexity of activities or the internal control system should be picked up separately via the BE&ICF if this is not already done properly elsewhere in the calculation procedure. Double-counting shall be avoided.

The process of the selection and incorporation of the factors and the results should be reviewed over time. In the event of any indications of an unsatisfactorily low degree of coverage and/or sensitivity (especially the lack of a proper signal effect) on the part of the BE&ICF, appropriate adjustments should be provided for. One such indication may be, for example, if fairly large losses arise which are not linked to a reasonable BE&ICF or a linked BE&ICF has not shown an observable previous sign of it.