Do operational risk and corporate governance affect the banking industry of Pakistan?

Altaf, Komal; Ayub, Huma; Shabbir, Malik Shahzad; Usman, Muhammad Article Do operational risk and corporate governance affect the banking industry of Pakistan? Review of Economics and Political Science (REPS) Provided in Cooperation with: Cairo University, Cairo Suggested Citation: Altaf, Komal; Ayub, Huma; Shabbir, Malik Shahzad; Usman, Muhammad (2022) : Do operational risk and corporate governance affect the banking industry of Pakistan?, Review of Economics and Political Science (REPS), ISSN 2631-3561, Emerald, Bingley, Vol. 7, Iss. 2, pp. 108-123, https://doi.org/10.1108/REPS-12-2019-0156 This Version is available at: https://hdl.handle.net/10419/316056 Standard-Nutzungsbedingungen: Die Dokumente auf EconStor dürfen zu eigenen wissenschaftlichen Zwecken und zum Privatgebrauch gespeichert und kopiert werden. Sie dürfen die Dokumente nicht für öffentliche oder kommerzielle Zwecke vervielfältigen, öffentlich ausstellen, öffentlich zugänglich machen, vertreiben oder anderweitig nutzen. Sofern die Verfasser die Dokumente unter Open-Content-Lizenzen (insbesondere CC-Lizenzen) zur Verfügung gestellt haben sollten, gelten abweichend von diesen Nutzungsbedingungen die in der dort genannten Lizenz gewährten Nutzungsrechte. Terms of use: Documents in EconStor may be saved and copied for your personal and scholarly purposes. You are not to copy documents for public or commercial purposes, to exhibit the documents publicly, to make them publicly available on the internet, or to distribute or otherwise use the documents in public. If the documents have been made available under an Open Content Licence (especially Creative Commons Licences), you may exercise further usage rights as specified in the indicated licence. https://creativecommons.org/licenses/by/4.0/ Do operational risk and corporate governance affect the banking industry of Pakistan? Komal Altaf and Huma Ayub Fatima Jinnah Women University, Rawalpindi, Pakistan Malik Shahzad Shabbir Lahore Business School, University of Lahore-Defence Road Campus, Lahore, Pakistan, and Muhammad Usman National University of Sciences and Technology, Islamabad, Pakistan Abstract Purpose –Due to increase in operational risk, banks are facing huge losses. In order to avoid losses, banks need to manage operational risk. This study aims to analyze the impact of operational risk management (ORM) processes, which include identification, assessment, analysis, monitoring and control in the presence of corporate governance (CG) that can also contribute to effective ORM practices. Design/methodology/approach –Operational risk management processes are used to manage operational risk along with CG. Primary data are collected through questionnaire from (167) operational risk managers of commercial banks. Multiple linear regressions has been run to analyze the data. Findings –Results indicate significant impact of CG and operational risk identification (ORI), monitoring and control on ORM practices in commercial banks of Pakistan. Originality/value –The study suggests policy makers to improve the ORM framework by CG. Beside this, in order to lessen operational risk, proper identification, monitoring and control of operational risk could also contribute. Keywords Operational risk management, Basel accord, SBP, Corporate governance Paper type Research paper 1. Introduction Operational risk is the risk of direct or indirect loss resulting due to inadequate external events and failed internal processes, people and systems (PWC, 1999). Operational risk is inherent in all banking products, activities, processes and systems. Effective management of operational risk has always been a fundamental element of a bank’s risk management programs. In September 1998, the Banking Committee on Banking Supervision (BCBS) published a document “Operational risk management”(ORM) in which operational risk is treated as a self-contained regulatory issue. It was acknowledged that large losses in banking industry are due to operational risk and can be avoided when they are identified, analyzed, monitored and controlled properly. Along with this, corporate governance (CG) also contributes to effective ORM. REPS 7,2 108 © Komal Altaf, Huma Ayub, Malik Shahzad Shabbir and Muhammad Usman. Published in Review of Economics and Political Science. Published by Emerald Publishing Limited. This article is published under the Creative Commons Attribution (CC BY 4.0) licence. Anyone may reproduce, distribute, translate and create derivative works of this article (for both commercial and non-commercial purposes), subject to full attribution to the original publication and authors. The full terms of this licence maybe seen at http://creativecommons.org/licences/by/4.0/legalcode The current issue and full text archive of this journal is available on Emerald Insight at: https://www.emerald.com/insight/2631-3561.htm Received 9 December 2019 Revised 11 November 2020 Accepted 30 December 2020 Review of Economics and Political Science Vol. 7 No. 2, 2022 pp. 108-123 Emerald Publishing Limited e-ISSN: 2631-3561 p-ISSN: 2356-9980 DOI 10.1108/REPS-12-2019-0156 Due to weakened ORM, fraud and forgery cases are rapidly increasing in Pakistani banking sector for many years. As argued by Bastomi et al. (2017), poor CG and risk management are the main causes of bank. State Bank of Pakistan (SBP) has instructed banks to properly identify, analyze, monitor and control operational risk in order to reduce the level of operational risk. The current study aims to analyze how ORM practices can be made more effective through ORM processes along with CG. The survey-based methodology has been used. The researcher intended to at least partly reduce the gap found through literature in the theme of the impact of CG and ORM processes on ORM practices of commercial banks in Pakistan. Continuity and success of banks depends upon ORM. Previous studies related to operational risk are not done on the Pakistani banking sector. Beside this, no study finds together the impact of CG and ORM processes on ORM. The current study attempts to fill this gap while keeping the ORM process and CG together that can determine the ORM practice of banks. Furthermore, it is clear from the above discussion that a dedicated study is required on ORM practices in Pakistan’s commercial banks. CG ensures that operational risk managers have resources for performing duties assigned to them, and they may work as an independent unit. The ultimate goal behind the establishment of an ORM unit is to decrease risk, not to increase profit. Briefly speaking, it is board of director’s responsibility that bank policies and strategies must be consistent with operational management practices. It is the duty of board of directors (BODs) to place an effective risk management system, which means that along with awareness on risks faced by bank, employees must also be aware of system which is placed to monitor and control risk. This shows that CG encompasses risk management in banking operations (Lam, 2001; Shabbir et al., 2020;Sobel and Reding, 2004). The findings of the study provide implications for effective CG in order to better manage ORM practices in banks. The study provides policy implications to SBP as a regulatory body for giving insights on current ORM practices of commercial banks Shabbir and Wisdom (2020). The study also suggests commercial banks to improve the ORM practices by involving governance body, i.e. (BODs, senior management). This study addresses the following questions such as, what is the impact of operational risk processes such as operational risk identification (ORI), operational risk assessment and analysis (ORAA) and operational risk monitoring and control (ORMC) on ORM in banks. Furthermore, what is the impact of CG through board of director and senior management on ORM in banking industry. This study aims to identify the impact of ORM practices and CG which mainly include: To investigate the impact of ORM processes on ORM practices in commercial banks of Pakistan. Moreover, at what extent the impact of CG on ORM practices in commercial banks of Pakistan. Furthermore, to investigate the impact of ORM processes, the main objective of the study, which may be specified as sub-objectives, is as follow: in order to determine the impact of ORI on ORM practices of commercial banks; to determine the impact of ORAA on ORM practices of commercial banks; and finally, the impact of ORMC on ORM practices of commercial banks. Lastly, the structure of paper is as follows: in section 2, literature is reviewed; section 3 illustrates the theoretical framework; in section 4, methodology has been discussed; section 5 shows the results, and in the last section, conclusion and recommendations have been given. 2. Literature review ORM has become one of the fastest-growing and most complex risk disciplines in banking industry (Koomson, 2011). In 2006 Basel Committee of Banking Supervision provide the operational risk definition as: “Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events”. The impact of operational risk management 109 This definition includes legal risk, but excludes strategic and reputational risk”According to Hussain and Ajmi (2012), ORM includes all the procedures, policies, expertise and systems that are required to manage all the risks occur due to financial transactions. Based on internal data loss, three approaches are used to calculate operational risk: basic indicator approach, standardized approach and the advanced measurement approach (Coetzee and Lubbe, 2014). Basel II and III encourage banks to identify, assess, measure, control and manage operational risk (Moosa, 2007;Shabbir, 2020). Pakhchanyan (2016) conducted a survey of the operational risk literature where he reviewed collected articles and identify studies that provide an overview of the operational risk literature, highlighting its importance and assessment methodologies. ORM processes includes: ORI, ORAA and ORMC ling. ORM initiated with its identification. Bocker and Kluppelberg (2005) suggest that the only feasible way to manage operational risk successfully is by identifying and minimizing it, which requires the development of adequate quantification techniques. It is a challenging issue to identify operational risk, as the factors of operational risk are not well defined (Muermann and Oktem, 2002). Both internal and external factors are included in risk identification process (Nastase et al., 2013). However, Wei (2007) suggested that “quantification of operational risk has been hindered by the lack of internal and external data on operational losses”.Geiger and Raghunandan (2002) propose that to identify operational risk, RIM (risk identification matrix) can be used. Identification tools comprised of: risk mapping, self-assessment, establishing key risk indicators and measurement processes (Nastase and Unchiasu, 2013). PWC (1999) also suggests that management may also identify operational risk through process mapping, in which business key processes are identified and mapped. According to Kuritzkes (2002) assessment of the operational risk is very crucial, for achieving the objectives, as objective establishment provide basis for determining how operational risk should be managed. “Top-down”single indicator method, “bottom-up” models including expert judgment and “causal models”, classical statistical approach are some methods used for measuring operational risk (Heinricj, 2006). Risk analysis involves analyzing risk type and outcomes of actions made. According to Herring (2002),thereare different ways bank may use to identify and assess operational risk. These processes are: self-assessment, scorecards. According to Davies and Haubenstock (2002), banks are required to define their own approach, the scope of analysis and method used in analysis, either qualitative or quantitative. Banks are required to establish a guiding principle for the ORM process which guarantees that proper measure of operational risk is available in all bank business lines (Crouhy et al., 2003). According to Ishtiaq (2015) disclosure of information on time is necessary for banks, so that a reliable structure is provided to banks for the assessment of their operational risk monitoring. This can also be found from the case study by (Masenene, 2015)that information on operational risk must be communicated to right people and on right time. Firew (2013) argues that under bank guidelines for ORM, actual level of operational risk and operational risk tolerance level should compare. By this way, bank’soperational risk is continuously monitored and also would help to ensure that the bank’s operational risk level lies within acceptable range. In an operational risk context, a KRI is a metric that provides information on the level of exposure to some operational risk, at a given point in time. Preventive KRIs measure a rise in the causes of risk, either in probability (KRI of likelihood) or in potential impact should the risk materialize (Chapelle, 2019). Neifar and Jarboui (2018) suggest that Islamic banks shall disclose their ORM framework to inform stakeholders to know about the process of managing OR including the way that the bank identify, assess, monitor and control the OR and how effectively it manages this type of risk. REPS 7,2 110 Masenene (2015) also stated that the effectiveness of internal controls needs to monitor after their placement so that they could be function properly. According to Allen and Bali (2007), controlling operational risk is more important than market and credit risk. Control activities are placed to safeguard the execution of management directives (Andrew, 1995). These policies and procedures help to ensure that risk is addressed and mitigating activities are used in order to achieve bank’s objectives. Kuritzkes (2002) argues that control activities must place in the functions of the bank at all levels. Masenene (2015,p.25) proposes that ORM system reliability depends upon the strength of its internal control processes and reporting system. In case banks unable to monitor and control operational risk, financial penalties are placed by the regulators (Mainelli, 2002;Shabbir, 2018a,b,c; Lewis, 2004). Kasim and Hussin (2010) argue that in banking operations there is close relationship between CG and risk management. “Corporate Governance”refers to corporate discipline. According to BIS (2006),ISACA (2009) governance, risk management and control (GRC) play a critical role in minimizing operational risk. Corporate failure results, due to inefficient risk management and inefficient CG, i.e. inefficient control of activities by the BODs (Manab et al.,2010). Al Hussiny (2010) argues that bank may use CG as risk mitigation strategy, to safeguard the interest of its stakeholders. According to Quon et al. (2012),Shahzad and Rehman (2015), risk management and CG are interdependent and interrelated. Good CG and effective risk management leads to improvement in bank performance (Manab et al.,2010;Shahzad and Zaman, 2016;Sobil and Reding, 2004). Van Greuning and Brajovic-Bratanovic (2009a,b) argued that for management of operational risk, CG process key players (like the director and executive managers) are responsible. It is observed that good ORM, senior management involvement and support is required who could give considerable attention to operational risk along with the allocation of resources (Davies and Haubenstock, 2002). Directing senior managers is the responsibility of BODs about setting tolerance level for operational risk and for all major areas of operations the establishment of correspondent processes, procedures, controls and systems (Ishtiaq, 2015). Firew (2013) proposed that for effective ORM by the operational risk managers, BODs may set out strategies, policies and guidelines. Neifar and Jarboui (2018) also suggest that Islamic banks shall encourage to ensure an effective risk culture because it is an important task for learning how to manage unexpected situations. A culture that is conducive to effective risk management urges open and upward communication, sharing of knowledge and best practices, continuous process improvement and a deep commitment to ethical and responsible business behavior. In light of the above literature, the current study aims to bridge the gap between the relationships of ORM, its processes and CG practice, which will provide a way to realize the vision of mitigating operational risks and optimizing the performance of banking sector. Thus the study is an empirical analysis of operational risks management and role of CG practice followed by the banking sector of developing economieslikePakistan. 3. Theoretical framework The relationship between proper identification, assessment and analysis, monitoring and control of operational risk and ORM takes center stage: in addition to this relationship, the study proposed that banks can improve their ORM through CG. The study will help to explain the cause-and-effect relationship between the operational risk process, CG and ORM in banks. Following framework has been proposed: The impact of operational risk management 111 Operational risk Identification Operational risk Assessment and Analysis Operational risk Monitoring and controlling Corporate Governance Board of directors Senior management Operational Risk Management H1 H2 H3 H4 Following hypothesis has been H1. There is a significant impact of operational risk identification on operational risk management. H2. There is a significant impact of operational risk assessment and analysis on operational risk management. H3. There is a significant impact of operational risk monitoring and control on operational risk management. H4. There is a significant impact of corporate governance on operational risk management. 4. Research methodology Sampling method and data collection process and techniques has been discussed in this section. One of the non-probability judgmental sampling techniques, expert sampling technique that has been used in this study is the best way to elicit the views of operational risk managers on the proposed cause an effect relationship of operational risk process and CG on ORM. The experts have demonstrable experience and expertise in the field of ORM in banks. However, 200 questionnaires were distributed among the operational risk managers, area managers, zonal head coordinator and risk managers of commercial banks in Rawalpindi and Islamabad. The questionnaire has been used to collect data for finding the impact of ORM processes and CG on ORM. All the questions were close-ended and five-point Likert scale has been used to get response against every item. Data have been analyzed in Statistical Package for Social Sciences (SPSS) to find data reliability, demographics and descriptive analysis to investigate correlation among variables and to perform regression analysis. The study empirically examine whether the processes of ORM such as the risk identification, risk assessment and analysis and risk monitoring and controlling leads to improved risk management or not. Where, results of the study confirm that the operational risk assessment and analysis (one of X) play an insignificant role toward the risk management which also highlight that Xis different than Y. This is predominantly due to the fact that banks in Pakistan still lack behind on the assessment and analysis of operational risk in order to manage it effectively. This is mainly due to the reason that majority of banks are still using basic indicator approach to assessing operational risk however there is a strong need to adopt standardize or advance approach for the assessment of operational risk by employing qualitative techniques (audit findings, scorecards and self-assessment) and REPS 7,2 112 quantitative techniques (loss distribution, economic models) to better manage operational risk. Moreover, as we have incorporated the role of CG in the proposed framework therefore the regression analysis is suitable methodology. 5. Findings and discussion The following section discusses the results of reliability analysis, demographic analysis, descriptive and normality analysis, Pearson correlation and multiple linear regression. 5.1 Reliability analysis Cronbach’s alpha ( α ), an internal consistency statistical tool is used by the researcher to measure the reliability as suggested by researchers (Pallant, 2013;Gujarati and Porter, 2009 and Shabbir, 2018a,b,c).Table 1 shows reliability measure values of all the variables, and it can be seen from the table that Cronbach’s alpha values for all variables are more than (0.60) which is in the acceptable range (Hair et al., 2006). 5.2 Demographic analysis Majority of the respondents were male, i.e. (76%). Most of the respondent’s age is between 30 and 39 years. None of the respondents fall in the age group of 40–49 and above. Work experience of majority of the participants is 16–20 years with a share of 37.7% in the total data. The highest education attained by the respondents is a master’s degree with a frequency and percentage of (121, 72.5%) (see Table 2). 5.3 Normality and descriptive analysis Table 3 depicts mean and standard deviation values of all the variables. Participants score highest mean score on ORI and ORAA (m53.974) and the lowest score on ORM (m53.8308). Highest standard deviation value for ORMC (0.5676) indicates variability in respondent’s response from the average (m53.8915). Normality analysis is tested through skewness and kurtosis. Table 3 shows that data is normal as all values lie in the acceptable range, i.e. 1toþ1 for skewness and 3toþ3 for kurtosis. 5.4 Correlation Significant positive correlation is observed between all variables (p≤0.01). Table 4 shows no problem of correlation among all the independent variables. 5.5 Multicollinearity Multicollinearity has been tested by employing both tolerance and VIF. The acceptable range of VIF and Tolerance, i.e. (<510 and >0.20) and Table 5 indicates that there is no issue of multicollinearity in the data. Variables No. of items Cronbach’s alpha ( α ) ORI 6 0.779 ORAA 6 0.750 ORMC 8 0.776 CG 6 0.738 ORM 9 0.750 Note(s): ORI 5Operational risk identification, ORAA 5Operational risk assessment and analysis, ORMC 5Operational risk monitoring and control, CG 5Corporate governance, ORM 5Operational risk management Table 1. Reliability analysis of the study variables The impact of operational risk management 113 Variables Mean St. Deviation Skewness Kurtosis ORI 3.974 0.563 0.505 0.967 ORAA 3.974 0.559 0.376 1.349 ORMC 3.891 0.567 0.368 0.380 CG 3.948 0.564 0.485 0.776 ORM 3.830 0.502 0.237 0.107 Note(s): ORI 5Operational risk identification, ORAA 5Operational risk assessment and analysis, ORMC 5Operational risk monitoring and control, CG 5Corporate governance, ORM 5Operational risk management Variables ORI ORAA ORMC CG ORI 1 ORAA 0.441** 1 ORMC 0.537** 0.490** 1 CG 0.483** 0.511** 0.612** 1 Note(s): **Correlation is significant at the 0.01 level (2-tailed) Frequency Percentage frequency Gender Male 127 76% Female 40 24% Age 18–29 years 65 38.9% 30–39 years 78 46.7% 40–49 years 24 14.4% Work experience <55 years 48 28.7% 6–10 years 35 21.0% 11–15 years 63 37.7% 16–20 years 10 6.0% Above 20 years 11 6.6% Education Undergraduate 3 1.8% Graduate 33 19.8% Master’s degree 121 72.5% PhD 10 6.0% Variables Tolerance VIF ORI 0.651 1.537 ORAA 0.665 1.504 ORMC 0.530 1.887 CG 0.551 1.816 Table 3. Descriptive and normality analysis Table 4. Correlation Table 2. Demographic analysis Table 5. Multicollinearity REPS 7,2 114 5.6 Multiple regression analysis The researcher done the regression analysis to measure the cause-and-effect relationship of multiple independent and one dependent variable. Independent variables ORI, ORAA, ORMC and CG regressed on dependent variables, i.e. ORM. Y1¼0:206 X1þ0:019 X2þ0:121 X3þ0:451 X4þ μ i Dependent variable ORM is measured by ORI, ORAA, ORMC and CG. Table 6 also shows values for these variables. The value for R 2 50.579, tells that 57.9% variance in ORM was explained by the desired model, while the remaining 42.1% variation is explained by other factors which the researcher does not include in this model. Rejection or acceptance of a hypothesis depends upon Pvalue in regression analysis. If the value of Pis greater than 0.1, it means that the hypothesis is rejected. Variables importance is indicated by beta coefficients. The beta coefficient for ORI with value 0.206 is showing that with one unit increase in ORI, there will be a 20.6% increase in ORM which shows an equal change in both constructs. The tvalue and the Sig. opposite ORI, i.e. (3.656, 0.000) indicate that variable is significantly contributing to the equation for predicting ORM (Sekaran, 2003). Therefore, hypothesis H1 is accepted. Acceptance of the hypothesis shows that banks are properly identifying and prioritizing operational risk. Commercial banks have developed procedures for identifying operational risk found in their products, procedures and they are working properly on the identification of external and internal events. Banks are instructed by SBP (2015) to identify risk through risk mapping, key risk indicators and self-assessment tools, results show that banks are using these tools to identify operational risk. The results are in line with the study of Ishtiaq (2015) that proper identification of operational risk legitimate the effective management of operational risk. Similar kind of relationship was also observed by Pearl-Kumah et al. (2014) in the banking sector of Ghana in which they identify a positive significant relationship between risk identification and risk management practices. The work of study is also supported by Al Hussiny (2010) and Masenene (2015, pp. 30-31) in the context of UAE banking industry and Dar-Es-Salaam selected banks respectively. The results of current study indicates that commercial banks in Pakistan are properly identifying operational risk as per Basel guidelines implemented by SBP to manage operational risk more effectively as mentioned by SBP in BPRD circular No. 4 on 20th May, 2014 that proper identification of operational risk is very essential for effectively managing operational risk and results are also in line with this statement that proper identification leads to good management. Beta coefficient value for ORAA is 0.019, which means that 1.9% increase in the dependent variable is due to ORAA which is a nominal charge, but in both constructs, equal change is predicted. T-value 0.342 along with significance level at 0.733 predicts that this variable has no significant impact on ORM (Sekaran, 2003). Therefore, H2 is rejected. From the analysis, an insignificant impact of ORAA on ORM indicates that banks still lack behind on the assessment and analysis of operational risk in order to manage it Independent variables BtSig. ORI 0.206 3.656 0.000 ORAA 0.019 0.342 0.733 ORMC 0.121 1.956 0.052 CG 0.451 7.368 0.000 Note(s): R 2 50.579; F(4, 162) 555.694. *p≤0.1,**p≤0.05, ***p≤0.01 Table 6. Regression analysis for predictor variables and operational risk management The impact of operational risk management 115 Operational risk assessment and analysis Strongly disagree Disagree Neutral Agree Strongly agree 9. My bank assesses operational risks by using qualitative analysis methods (e.g. risk maps, audit findings, scorecards and selfassessments) 12345 10. My Bank has contingency and business continuity plans to ensure its ability to operate as going concern and minimize losses in the event of severe business disruption 12345 11. My bank response to analyze operational risks includes an assessment of the costs and benefits of addressing operational risks 12345 12. My bank response to analyze operational risk includes prioritizing of operational risks and active management for operational risk 12345 Operational risk monitoring and control Strongly disagree Disagree Neutral Agree Strongly agree 13. Monitoring the effectiveness of operational risk management is an integral part of routine management reporting 12345 14. My bank continuously compares the actual operational risk levels with permissible operational risk level under Basel II 12345 15. The level of control mechanism is appropriate for the operational risk processes in my bank 12345 16. My bank is reporting disclosure of information on timely basis for monitoring the operational risk 12345 17. My bank monitors the operational risk and provides immediate feedback to the management 12345 18. My bank’s response to operational risk includes action plans for implementing decisions about identified operational risk 12345 19. My bank’s evaluates the effectiveness of the existing controls for operational risk 12345 20. There is an active insurance made to cover daily operational risks at my bank 12345 Corporate governance and operational risk management Strongly disagree Disagree Neutral Agree Strongly agree 21. Executive management and board of directors receive operational risk-based management information on a regular basis 12345 22. My bank’s executive management regularly reviews the organization’s performance in managing its operational risks 12345 Table A2. (continued) REPS 7,2 122 Corresponding author Malik Shahzad Shabbir can be contacted at: [email protected] For instructions on how to order reprints of this article, please visit our website: www.emeraldgrouppublishing.com/licensing/reprints.htm Or contact us for further details: [email protected] Corporate governance and operational risk management Strongly disagree Disagree Neutral Agree Strongly agree 23. The boards of directors are directly responsible for operational risk management 12345 24. The bank’s risk management procedures and processes are documented and provide guidance to staff about managing operational risk 12345 25. Senior management of the bank transforms the strategic direction given by the board through operational risk management policy 12345 26. Efficient operational risk management is one of my bank’s objectives 12345 Operational risk management Strongly disagree Disagree Neutral Agree Strongly agree 27. There is a proper set of rules and guidelines, for managing operational risk, available in the bank 12345 28. Board and executive management of the bank understands all categories of operational risk applicable to the bank 12345 29. My bank has been encountered to daily operational risk 12345 30. My bank regularly prepares periodic report of operational risk 12345 31. The issue of operational risk control is taken to a great consideration at my bank 12345 32. My bank takes more consideration on operational risks occurring to its systems and procedures 12345 33. My bank takes more consideration on operational risks occurring to its systems and procedures 12345 34. My bank takes more consideration on operational risk occurring to its people side 12345 35. Lack of strong rules and principles for operational risk management cause more operational risk to take place in my bank 12345 36. Overall, my bank operational risk management practices are consider excellent 12345 Table A2. The impact of operational risk management 123