(1) Definition of Operational Risk 2. Operational Risk Management System Operational risk is the risk of loss resulting from inadequate or failed  internal processes, people and systems or from external events.  Specifically, Basel II—which, in addition to processing risk and sys- tem risk, also covers legal risk, personnel risk, and physical asset  risk—defines the following seven types of events that may lead to  the risk of loss: (1) internal fraud, (2) external fraud, (3) employment  practices and workplace safety, (4) clients, products and business  practices, (5) damage to physical assets, (6) business disruption  and system failures, and (7) execution, delivery, and process  management.  SMFG and SMBC have drawn up the  Regulations on Operational  Risk Management  to define the basic rules to be observed in the  conduct of operational risk management across the entire Group.  Under these regulations, SMFG and SMBC have been working to  enhance the operational risk management framework across the  whole Group by establishing an effective system for identification,  assessment, controlling, and monitoring of material operational risk  and a system for executing contingency and business continuity  plans. In view of the inclusion of operational risk in the framework  of the capital adequacy requirements of Basel II, SMFG has been  working on a continuing basis to create a more sophisticated  quantification model and to enhance operational risk management  throughout the Group. (2) Fundamental Principles for Operational Risk Management  SMFG has designed and implemented an operational risk manage- ment framework for Groupwide basic policies for risk management. At SMBC, the Management Committee makes decisions on  important matters such as basic policies for operational risk man- agement, and these decisions are authorized by the SMBC Board  of Directors. In addition, SMBC has established its Operational Risk  Management Department, within the Corporate Risk Management  Department as an integrated operational risk management depart- ment. This department works together with other departments  responsible for controlling processing risk and system risk. The operational risk management framework is described in  more detail in the later part of this section, but it can be outlined as  follows: operational risk is managed by (1) collecting and analyzing  internal loss data, and (2) comprehensively identifying risk scenarios  in each business process through a regular risk control assessment  to estimate the loss severity and frequency. Operational risk impact  is assessed for each risk scenario. When high-severity scenarios  are identified, each branch/department establishes a risk mitigation  plan and the Operational Risk Management Department monitors  the progress. Furthermore, operational risk is quantified using the  internal loss data and scenarios, and the results of quantification are  used to manage and reduce operational risk. The generation of internal loss data, scenarios identified through  risk control assessments, and status of risk mitigation activities  are regularly reported to the director in charge of the Operational  Risk Management Department. In addition, there is the Operational  Risk Committee, comprising all relevant units of the bank, where  operational risk information is reported and risk mitigation plans  SMFG  2011 42 Auditing of management and measurement system Integrated Operational Risk Supervisory Dept. Measurement of  operational risk Corporate Risk Management Dept. Operational Risk Management Dept. Board of Directors Management Committee Corporate Auditors External Audit (Auditing Firm) Internal Audit Dept. Investment Banking Treasury Corporate Banking Middle Market Banking Consumer Banking International Banking Head Office departments Decision and authorization of important matters related  to operational risk management Reporting on operational  risk information,  discussion on measures  for risk mitigation Operational Risk Committee Direction Reporting Direction Reporting Reporting Feedback of  measurement  results related to  operational risk  and direction for  risk mitigation Audit Reporting Internal loss data Reflection of internal loss data,  external loss data and BEICFs in scenarios Generation of scenarios and development of risk  mitigation actions through risk control assessments Board Member in Charge of Risk Management Unit ■ SMBC’s Operational Risk Management System 1. Basic Approach to Operational Risk  Management Operational Risk