commences

with defining operational risk categories.

is the preferred method for the actual

management of operational risk.

should interface with

the bottom-up approach to operational risk. management.

involves all employees throughout the

organisation.