MANAGEMENT’S DISCUSSION AND ANALYSIS OF OPERATIONS AND FINANC IAL CONDITION Processes and Models Processes are in place to: develop policies for approval by senior governance committees; monitor policy compliance; maintain contingency plans; continuously track variables for changing risk conditions; and provide timely reports to senior governance committees. Models are used to project liquid asset holding requirements, funding capacity and financial commitments based on expected and stressed economic, market, political and enterprise-specific operating conditions. off-balance sheet SPEs can be found in Note 7 on page 77 of  the financial statements. We provide liquidity support to these  SPEs by extending credit through standby funding. These credit commitments are included in our total customer credit commit- ments. Customer credit commitments are an integral part of  our credit-granting practices and create liquidity and funding exposure through our obligation to fund customer drawdowns. Information on credit commitments can be found in Note 5 on page 75 of the financial statements. Operational risk is inherent in all business activities and the management of this risk is important to the achievement of BMO’s strategic objective. While operational risk can never be eliminated, it can be managed and mitigated, and in some cases insured against, to preserve and enhance shareholder value. To achieve this goal, we have developed an Integrated Opera- tional Risk Framework, which includes: risk identification; risk measurement; risk analysis and monitoring; capital at risk  allocation; and risk management.  BMO manages operational risk through a comprehensive gov- ernance framework and effective controls. These include business contingency plans, event management processes, change man- agement policies and procedures and an enterprise mergers  and acquisition framework. Operational risk  is the risk of loss resulting from inadequate or failed internal processes, system or human error, or external events. BMO’s operational risk governance structure includes the Operational Risk Committee, a sub-committee of the Risk Management Committee. This committee provides: Each line of business is responsible for managing its operational risk within the guidelines established by policy measurements. The Risk Management Group develops policy and guidelines  for the management of operational risk. In addition, the Risk Management Group monitors and reports on significant enter- prise issues and operational events to the Chief Executive Officer and the Risk Review Committee of the Board of Directors. Where appropriate and cost-effective, Risk Management Group buys corporate insurance to transfer components of operational risk to creditworthy insurance underwriters and thus hedge against components of operational risk. Corporate Audit also provides regular reports on the effective- ness of operational risk internal controls and management processes to the Chief Executive Officer and the Audit Committee of the Board of Directors. Operational risk is measured using an actuarial methodology, which combines the likelihood of an operational risk event occurring with the probable loss if it does occur, to arrive at the loss distribution. The expected and unexpected loss associated tailored process and model are used to determine the opera- tional risk for each line of business. For capital calculation purposes, confidence levels and holding periods used are con- sistent with the approaches used for credit and market risk. BMO’s goal is to make operational risk, like all other risks, transparent throughout the enterprise. This entails regularly reporting on: exposures to the types of operational risk and where they occur; their financial impact (expected loss, unex- pected loss, and stress loss); changes to the operational risk profile as a result of changes in the business and operating  environment; and a comparison to external benchmarks. Each component of our operational risk framework is at a different stage of development, and our approach is to continuously improve each component in a way that is useful to business and risk management while also meeting the forthcoming Basel II regulatory requirements. with particular operational risk events can be determined from the loss distribution. The unexpected loss is used to determine the Capital at Risk for each line of business and for each opera- tional risk type. Historical loss data is used, where available, for calculating frequency and severity of events. Where loss data  is not available or is limited, loss scenarios are developed in conjunction with line of business management. To ensure that all operational risks to which a line of business is exposed are adequately captured and appropriately quantified, specialized functions such as Finance, Taxation, Legal, Compliance, Human Resources, and Technology and Solutions are also involved in the measurement process as appropriate.  Measurement Processes and Models Operational risk  is composed of: b Operations risks, which are controlled through regular daily functions and are managed through internal procedures and monitoring mecha- nisms. These risks include physical and logical security, transaction  processing, operations control, technology and outsourcing risks.  b Business and event risks, which include underlying, structural and external risks that can have a material impact on BMO. These risks include strategic, image and reputation, taxation, accounting and financial management, legal, regulatory requirements and human resources risks, as well as risks resulting from the use of complex  pricing or valuation models. b a decision-making mechanism for material operational risk issues; b a forum to discuss cross-group impacts of significant risks; b review of new policies and changes to existing policies; and  b review and approval of risk and control self-assessments, oper - ational risk measurements and associated capital allocations. Operational Risk  34 BMO FINANCIAL GROUP ANNUAL REPORT 2002