PASHA Bank

The management of operational risks is part of the Bank’s risk management system. The need for managing operational risks is determined by the proportions of possible operational losses which may pose a threat to the Bank’s financial stability.

In order to improve its business reputation, OJSC Pasha Bank considers it appropriate to communicate information (including the information provided as part of annual reports) on the management of operational risks to partners (shareholders), lenders, depositors and other customers, external auditors, rating agencies and other interested persons. In doing so, the bank wants to ensure that the level of detail being disclosed corresponds to the nature and scope of its activities.

The system on the management of operational risks at OJSC Pasha Bank has been organized to meet the following objectives:
- to ensure complete, timely and effective achievement of the Bank’s strategic goals in accordance with the nature and scope of its activities;
- to optimize technological processes;
- to observe legislative requirements, rules and traditions of the business turnover, conditions of agreements and transactions being executed, and to enhance the level of confidence in the Bank (business reputation) on the part of its customers and deposits.

The key missions of the system on the management of operational risks are as follows:
- to identify, evaluate and analyze emerging operational risks;
- to minimize operational risks, including by way of introduction of standardized procedures and maximum automation of banking processes;
- to improve the effectiveness of banking processes.

The fundamental principles for the organization of a system on the management of operational risks are:
- to determine a procedure for identifying and evaluating an acceptable level of operational risks and monitoring of the level of operational risks, including consolidated grounds;
- to develop a set of measures towards maintaining an acceptable level of operational risks, including control and (or) minimization of risks;
- to specify a procedure for information support on issues of operational risks (procedure for exchange of information between subdivisions and employees, procedure and frequency of submission of reporting and other information pertaining to the management of operational risks, etc.);
- to determine a procedure for the management of operational risks in remote banking, in developing and introducing new technologies and conditions for bank operations and other transactions, in other financial innovations and technologies, in accessing new markets;
- to allocate authority and responsibility among the Supervisory Board, executive bodies, subdivisions and employees as regards main principles for the management of operational risks;
- to establish a procedure for exercising control over the effectiveness of management of operational risks.

The Bank has laid down principles for the management of operational risks through appropriate in-house regulatory documents pertaining to every direction of its activity. Considering the said principles, the Bank is using the following methods to minimize the level of operational risks:

- to standardize banking operations and other transactions (procedures, regulations, technologies for implementing operations and transactions and signing agreements);
- to organize a system of additional and subsequent control, a system of current verification of transactions and operations;
- to establish in-house regulations for the development and endorsement (approval) of in-house regulatory documents;
- to analyze the impact of the factor of operational risks (both as a whole and in line with their classification) on the Bank’s performance indicators;
- to ensure the required level of professional qualification and personnel development;
- automation of banking processes and technologies, especially in areas relating to standard operations and large workloads;
- to allocate responsibilities among subdivisions considering optimization of workload on individual employees;
- to furnish employees with the legal framework meeting domestic and external requirements to the maximum extent possible;
- to encourage employees depending on their impact on the level of operational risks.

The system on the management of operational risks is organized by the bank in three stages:
- preliminary;
- current;
- subsequent.

The level of operational risks is identified, evaluated and analyzed in accordance with an approved Methodology. Monitoring of operational risks is carried out on the basis of regular analysis of a system of indicators developed in accordance with the approved Methodology. Through this Methodology the Bank establishes the frequency of operational risk monitoring depending on its significance for a certain activity direction, in-house processes or the system of information technologies.

Minimization of operational risks envisages a wide range of measures aiming to reduce the likelihood of events and circumstances leading to operational losses and (or) reduce (limit) the volume of potential operational losses. Methods of minimizing operational risks depend on the nature of such risks.

The following measures are particularly important for exercising control over operational risks:
- to exercise control over compliance with limits established on banking operations and other transactions;
- to observe the established procedure for accessing the Bank’s information and material assets;
- to ensure proper personnel training;
- to regularly align basic documents and accounts on banking operations and other transactions.

In order to limit operational risks, the Bank has envisaged a comprehensive system of measures to ensure uninterrupted financial and economic activity in implementing banking operations and other transactions, including contingency plans (plans on ensuring uninterrupted and (or) resumed financial and economic activity).

The Bank attaches special importance to ensuring the integrity and restorability of its information systems and resources. To achieve this, the Bank stores initial and reserve information separately to avoid their simultaneous loss and (or) damage, and envisages other measures to protect information as stipulated under the Information security policy.

The Bank exercises control over the effectives of operational risks management. Management bodies regularly assess the effectives of operational risks management, and Bank employees are required to provide them with any requested information.

The Bank regularly but at least once in six months evaluates the level of operational risks and submits information to that effect to the Supervisory Board and the Board of Directors. The effectives of operational risks management is evaluated as a whole considering other elements of the risk management system.

The Bank regularly revises appropriate in-house processes and procedures and information technologies used to identify the previously unknown sources of operational risks. The frequency of such revisions is established as and when necessary but at least once in two years.