II. Risk Management: Identification, Measurement, Monitoring and Control Principle 4: Banks should identify the operational risk inherent in all types of products, activities, processes and systems. Banks should also ensure that before new products, activities, processes and systems are introduced or undertaken the operational risk inherent in them is subject to adequate assessment procedures.

25. Risk identification is critical for the subsequent development of viable operational risk measurement, monitoring and control. Effective risk identification considers both internal factors (such as the complexity of the bank's structure, the nature of the banks activities, the quality of personnel, organisational changes and employee turnover) and external factors (such as fluctuating economic conditions, changes in the industry and technological advances) that could adversely affect the achievement of the bank's objectives.

26. The risk identification process should also include a determination of which risks are controllable by the bank to help them identify operational risk:

• Self- or Risk-Assessment: a bank assesses its operations and activities against a menu ...