Operational Risk Governance:Sound Practices for the Management and Supervision of Operational Risk BIS June 2011 The Board of Directors Principle 3: The board of directors should establish, approve and periodically review the Framework. The board of directors should oversee senior management to ensure that the policies, processes and systems are implemented effectively at all decision levels. Principle 4: The board of directors should approve and review a risk appetite and tolerance statement for operational risk that articulates the nature, types, and levels of operational risk that the bank is willing to assume. Senior Management Principle 5: Senior management should develop for approval by the board of directors a clear, effective and robust governance structure with well defined, transparent and consistent lines of responsibility. Senior management is responsible for consistently implementing and maintaining throughout the organisation policies, processes and systems for managing operational risk in all of the bank’s material products, services and activities, consistent with the risk appetite and tolerance. Risk Management Environment Identification and Assessment Principle 6: Senior management should ensure the identification and assessment of the operational risk inherent in all material products, activities, processes and systems to ensure the inherent risks and incentives are well understood. Principle 7: Senior management should ensure that there is an approval process for all new products, activities, processes and systems that fully assesses operational risk. Monitoring and Reporting Principle 8: Senior management should implement a process to regularly monitor operational risk profiles and material exposures to losses. Appropriate reporting mechanisms should be in place at the board, senior management, and business line levels that support proactive management of operational risk. Control and Mitigation Principle 9: Banks should have a strong control environment that utilises: policies, processes and systems; appropriate internal controls; and appropriate risk mitigation and/or transfer strategies. Business Resiliency and Continuity Principle 10: Banks should have business resiliency and continuity plans in place to ensure an ability to operate on an ongoing basis and limit losses in the event of severe business disruption. Role of Disclosure Principle 11: A bank’s public disclosures should allow market participants to assess its approach to operational risk management.

by Youness El Kandoussi | 1 year ago | 0 Comment(s) | 226 Share(s) | Tags :


Introduction : Le Maroc a fait des progrès significatifs dans la mise en œuvre de sa Strat gie Nationale d'Inclusion Financière (SNIF) en 2022, malgr les d fis conomiques. Cette strat gie se concentre sur plusieurs domaines cl s tels que les paiements mobiles, la microfinance, l'assurance inclusive et l'infrastructure de cr dit. Le pays continue de faire de l'inclusion financière une priorit en tant que moteur cl du d veloppement conomique et social, avec le gouvernement, la banque centrale et d'autres parties prenantes collaborant pour relever les d fis restants. Voici un r sum des principaux axes de la SNIF : 1. Microfinance : - Après l'adoption de la loi n°50-20 en juillet 2021, les travaux d' laboration des textes d'application et du cadre prudentiel relatifs à la microfinance se sont poursuivis tout au long de l'ann e 2022. - Des mesures sp cifiques ont t entreprises en faveur de l'InsurTech, avec l' laboration d'une feuille de route pour la promotion de la digitalisation au sein du secteur de l'assurance. 2. Assurance Inclusive: - L'amendement de la circulaire g n rale de l'ACAPS a permis d' tendre le p rimètre de distribution des produits d'assurance aux tablissements de paiement, dans le but d' largir l'accès aux services d'assurance. - Des tudes ont t men es pour mieux comprendre les besoins en assurance des micro et petites entreprises, soulignant l'importance de solutions financières innovantes et inclusives. 3. Offres Bancaires : - Des efforts ont t d ploy s par les tablissements bancaires pour largir l'inclusion financière des particuliers et des très petites et moyennes entreprises (TPME). - Une mission de revue de la feuille de route des offres bancaires a t lanc e afin d'ajuster les priorit s compte tenu de l' volution du contexte et de l' ch ance de la première phase de la strat gie. 4. Outils d'aide au financement des TPE et Start-ups : - Les discussions se sont poursuivies entre Bank Al-Maghrib, le Ministère des Finances et le Secr tariat G n ral du Gouvernement (SGG) pour faire aboutir le projet de loi sur les Bureaux d'Information sur le Cr dit (BIC). - Des efforts ont galement t d ploy s pour d velopper des m canismes de financement suppl mentaires pour les TPE, notamment le crowdfunding, les fonds de dettes et les OPCC. 5. Comit de Pilotage et de Coordination (CPC) : - Le CPC a tenu des r unions de coordination sp cifiques en 2022 pour suivre l'avancement des travaux, notamment sur les leviers "Offres Bancaires" et "Éducation Financière". - Une approche participative et progressive a t approuv e par le Comit de Suivi pour le d veloppement des programmes d' ducation financière, impliquant les diff rentes parties prenantes. 6. Participation aux v nements internationaux : - L'exp rience marocaine en matière de Strat gie Nationale d'Inclusion Financière a t mise en avant lors de plusieurs v nements internationaux en 2022. - Bank Al-Maghrib a notamment partag les r alisations de la strat gie et les enseignements tir s lors de ces v nements. 7. B n ficiaires des programmes d' ducation financière : - En 2022, les efforts constants des parties prenantes ont permis d'atteindre 27 080 b n ficiaires directs de formation, dont 66% de femmes, 31% de jeunes de 15 à 24 ans et 27% de personnes en milieu rural. 8. Outils de pilotage de la strat gie : - Bank Al-Maghrib a multipli ses efforts pour assurer une valuation fiable des diff rentes dimensions de l'inclusion financière, notamment à travers la mise en place d'un Système de Cartographie de l'Inclusion Financière (SCIF). - Ce projet vise à concevoir un outil de r f rence nationale en termes de donn es sur l'inclusion financière, en consolidant les indicateurs côt offre et demande ainsi que les donn es sociod mographiques. Lien vers le Rapport: https://www.bkam.ma/content/download/804298/8866311/Rapport%20SNIF%202022%20V%2003042024.pdf

by Youness El Kandoussi | 2 months ago | 0 Comment(s) | 35 Share(s) | Tags :


Context In the last few days, several businesses, including aviation and banking sectors, experienced significant disruptions due to issues with Microsoft services. This outage affected various cloud-based services, including Microsoft 365, Azure, and Teams. The interruptions were caused by a combination of network configuration changes and infrastructure issues within Microsoft's global network (https://www.reedsmith.com/en/perspectives/2024/02/business-interruption-claims-in-2024-a-global-perspective) (https://status.cloud.microsoft/#:~:text=URL%3A%20https%3A%2F%2Fstatus,100). The outage highlighted the increasing reliance of global industries on cloud services and the significant impact such disruptions can have on business operations, from communication breakdowns to halted transactions (https://www.businesswire.com/news/home/20240116375142/en/Allianz-Risk-Barometer-A-Cyber-Event-Is-the-Top-Global-Business-Risk-for-2024). While Microsoft worked to resolve the issues, it underscored the importance of robust cyber risk management and contingency planning in mitigating the effects of such outages (https://www.nortonrosefulbright.com/en/knowledge/publications/20530078/the-cyber-risks-faced-by-the-aviation-industry---ten-things-to-know). The recent Microsoft outages, which disrupted services like Microsoft 365, Teams, and Outlook, were primarily caused by a series of technical and security issues. Initially, Microsoft identified that a "wide-area networking (WAN) routing change" led to connectivity problems. This change triggered issues with network latency and timeouts, affecting how packets were forwarded across Microsoft's global network. This impacted users' ability to access various cloud services, including Azure, SharePoint, and OneDrive (https://www.bankinfosecurity.com/microsoft-365-cloud-service-outage-disrupts-users-worldwide-a-21017) (https://www.techradar.com/news/this-is-what-caused-the-recent-huge-microsoft-365-and-teams-outage). Additionally, Microsoft faced cyber risks, particularly distributed denial-of-service (DDoS) attacks. These attacks, launched by a group known as Storm-1359, aimed to disrupt services by overwhelming Microsoft's infrastructure with malicious traffic. The DDoS attacks targeted layer 7 of the OSI model, affecting HTTP(S) traffic and causing resource exhaustion and slowdowns (https://msrc.microsoft.com/blog/2023/06/microsoft-response-to-layer-7-distributed-denial-of-service-ddos-attacks/). To mitigate these issues, Microsoft rolled back the problematic network changes and implemented additional protections to prevent similar disruptions in the future. These measures included enhancing their Web Application Firewall (WAF) and adding stricter controls on network command executions to avoid unintended consequences from network changes (https://www.bankinfosecurity.com/microsoft-experiences-second-major-cloud-outage-in-2-weeks-a-21134) (https://www.techradar.com/news/this-is-what-caused-the-recent-huge-microsoft-365-and-teams-outage). In recent days, significant disruptions in Microsoft services have caused major headaches for businesses worldwide. Industries ranging from aviation to banking found themselves grappling with unexpected downtime, impacting critical operations and highlighting a growing reliance on cloud-based services. This article explores whether Microsoft should be held legally accountable for failing to ensure business continuity for its global customers. The Outage and Its Impacts The recent Microsoft outages affected a range of cloud services, including Microsoft 365, Azure, and Teams. These disruptions were triggered by a combination of network configuration changes and infrastructure issues within Microsoft’s global network. Specifically, a "wide-area networking (WAN) routing change" led to severe connectivity problems. This change caused network latency and timeouts, disrupting the forwarding of data packets across Microsoft's global network. As a result, users experienced significant issues accessing cloud services such as Azure, SharePoint, and OneDrive. In addition to technical glitches, Microsoft also faced cyber threats, particularly distributed denial-of-service (DDoS) attacks. A group known as Storm-1359 targeted Microsoft’s infrastructure with malicious traffic, aiming to exhaust resources and slow down services. These attacks impacted layer 7 of the OSI model, affecting HTTP(S) traffic and causing further disruptions. The Importance of Business Continuity These outages underscore the critical role that cloud services play in modern business operations. From communication breakdowns to halted transactions, the ripple effects of such disruptions can be severe. The aviation and banking sectors, in particular, experienced significant operational impacts, illustrating the high stakes involved. As businesses increasingly rely on cloud services for their day-to-day operations, the importance of robust cyber risk management and contingency planning becomes more apparent. Legal and Ethical Considerations Given the scale and impact of these disruptions, the question arises: should Microsoft be sued for not ensuring business continuity? On one hand, businesses rely on service level agreements (SLAs) with cloud providers like Microsoft to guarantee a certain level of uptime and reliability. When these expectations are not met, it can lead to substantial financial losses and operational challenges. Businesses may argue that Microsoft failed to uphold its end of the agreement, warranting legal action to recover damages. On the other hand, the complexity of managing a global cloud infrastructure means that occasional outages are inevitable. Microsoft did take immediate steps to mitigate the issues, rolling back problematic network changes and enhancing protections against future disruptions. These efforts demonstrate a commitment to resolving the issues and improving service reliability. Cyber Risk Management and Contingency Planning The outages highlight the need for businesses to adopt comprehensive cyber risk management strategies and contingency plans. Relying solely on a single cloud provider can expose businesses to significant risks. Diversifying cloud services and implementing robust backup systems can help mitigate the impact of such outages. Additionally, regular testing and updating of contingency plans can ensure that businesses are better prepared to handle unexpected disruptions. Conclusion While the recent Microsoft outages have caused significant disruptions, suing the tech giant may not be the most effective solution. Instead, businesses should focus on enhancing their own cyber risk management and contingency planning efforts. By diversifying cloud services and implementing robust backup systems, businesses can better protect themselves against future outages. At the same time, cloud providers like Microsoft must continue to improve their infrastructure and security measures to minimize the risk of such disruptions and maintain customer trust. The recent events serve as a stark reminder of the interconnected nature of modern business operations and the importance of resilience in the face of unexpected challenges. References https://www.reedsmith.com/en/perspectives/2024/02/business-interruption-claims-in-2024-a-global-perspective https://status.cloud.microsoft/#:~:text=URL%3A%20https%3A%2F%2Fstatus,100). (https://www.businesswire.com/news/home/20240116375142/en/Allianz-Risk-Barometer-A-Cyber-Event-Is-the-Top-Global-Business-Risk-for-2024 https://www.nortonrosefulbright.com/en/knowledge/publications/20530078/the-cyber-risks-faced-by-the-aviation-industry---ten-things-to-know https://www.bankinfosecurity.com/microsoft-365-cloud-service-outage-disrupts-users-worldwide-a-21017 https://www.techradar.com/news/this-is-what-caused-the-recent-huge-microsoft-365-and-teams-outage https://msrc.microsoft.com/blog/2023/06/microsoft-response-to-layer-7-distributed-denial-of-service-ddos-attacks/

by Youness El Kandoussi | 18 hours ago | 0 Comment(s) | 2 Share(s) | Tags :