of controls, and (c) estimate the frequency and severity of risk sce- narios.” SMFG and SMBC apply this methodology to their principal  business activities. The purpose of risk control assessment is to identify material  and potential operational risks pertinent to business processes, to  measure them, and to develop and carry out a risk mitigation plan  to manage the risks. Another purpose of risk control assessment is  to estimate the frequency of low-frequency and high-severity events  for each scenario (which may be difficult to estimate using internal  loss data alone). During the process of periodic risk control assessment, opera- tional risks inherent in various business processes are recognized as  “scenarios.” The risk and control conditions for each scenario are  assessed, and the frequency of occurrence and amount of losses  are estimated based on them. The assessment process comprises  three steps: (i) initial assessment, (ii) Operational Risk Management  Department review, and (iii) final assessment. Through the process,  the frequency of “low-frequency and high-severity” events for each  scenario are estimated in terms of four loss amounts (¥100 million,  ¥1 billion, ¥5 billion, and ¥10 billion). As an effective mechanism for mitigating operational risks, the  maximum loss occurring once in 100 years (hereinafter, “scenario  exposure”) is calculated for each scenario derived through the risk  control assessment, and then a magnitude rating is provided by  classifying them into five categories according to the severity of  loss. Risk mitigation plans are developed by the relevant business  units for those scenarios with high-severity risk identified through  magnitude rating. Risk control assessment is defined as “risk management methodol- ogy to (a) identify material operational risks, and describe them in  terms of risk scenarios, (b) assess the risks and the effectiveness  (4) Scenario Analysis through Risk Control Assessments (3) Business Environment and Internal Control Factors  (BEICFs) (2) External Loss Data (1) Internal Loss Data Internal loss data are defined as “the information on events in which  SMFG and SMBC incur losses resulting from the realization of oper- ational risk.” At SMFG and SMBC, internal loss data are collected  for all cases where the gross loss amount is at least one yen (the  threshold amount), and seven years of internal loss data are directly  used in the quantification of required capital for operational risk. External loss data are defined as “the information on events in  which other banks, etc., incur losses resulting from the realization of  operational risk.” SMFG and other Group companies collect external  loss data where such losses may occur within the Group. BEICFs are defined as “indicators of operational risk profiles of  SMFG and SMBC that reflect underlying business risk factors and  an assessment of the effectiveness of the internal control factors.”  The Group periodically collects data relating to changes in laws and  regulations, changes in internal rules and processes, and launch  of new business and products pertinent to the Group’s business  operations. ■ Flowchart for Risk Control Assessment (Example) (i) Initial Assessment (iii) Final Assessment (ii) Operational Risk Management Department Review Calculation  of required  capital Implementation  of risk mitigation  measures Review  of scenario  assessment Verification of  magnitude rating Check magnitude  rating empirically  against each risk  scenario Develop risk  mitigation plans Develop risk  mitigation plans by  scenario, focusing on  those with higher  magnitude rating Assess the magnitude  of scenarios Calculate the  maximum loss once  in 100 years and  assess the magnitude  and classify into five  categories Estimate the frequency  of the “low-frequency and  high-severity” loss cases Estimate the frequency  of the “low-frequency  and high-severity” loss  cases that are difficult  to estimate using  internal loss data  alone Estimate the  frequency of losses  for scenarios Estimate the  frequency of losses  by scenario, taking  account of past  internal loss data Estimate the severity  of losses  for scenarios Estimate the severity  of losses by  scenario, taking  account of the  amount of  transactions used in  various operations Deriving  scenarios Identify risk patterns  inherent in business  processes and  develop a  comprehensive set of  scenarios Conduct assessment  of risks and controls  by scenario Assessment of  scenarios 44 SMFG  2011