A Bank must have adequate policies and procedures to ensure that the risks inherent in strategic or major operational initiatives such as changes in systems, business models, or acquisitions are identified, understood and mitigated to the extent possible. At a minimum, policies and procedures must require:
Approval by the Board, or a board committee, of strategic and major operational decisions; and
Reporting that enables the Board and Senior Management to monitor and manage these risks on an ongoing basis.
Policies and procedures must establish appropriate levels of approval authority for introducing new products and material modifications to existing products. The Board remains ultimately accountable notwithstanding any delegation of approval authority to Senior Management. At a minimum, policies and procedures must ensure:
Assessment of the risks and determination that the Bank’s control functions and systems are adequate to measure and mitigate the risks; and
Reporting that enables the Board and Senior Management to monitor and manage these risks on an ongoing basis.
A Bank must appropriately account for risks in its internal pricing, performance measurement and new product approval process, for all significant business activities.