Competent authorities shall assess the degree to which the quality of the data used by an institution's in the AMA framework is maintained, and that the building and maintenance procedures are regularly analysed by that institution, by verifying that the institution has at least the following sets of data at its disposal:

1. (a)

   data to build and track its operational risk history, made up of internal and external data, scenario analysis, and BEICF;

2. (b)

   complementary data, including model parameters, model outputs and reports.

For the purposes of paragraph 1, competent authorities shall confirm that the institution has defined appropriate data quality dimensions to provide effective support to its operational risk management process and measurement system, and that it complies on a regular basis with the set dimensions.

For the purposes of paragraph 1, competent authorities shall confirm that the institution's data quality dimensions meet at least the following conditions:

1. (a)

   they are of sufficient breadth, depth, and scope for the task at hand;

2. (b)

   they meet current and potential user needs;

3. (c)

   they are updated promptly;

4. (d)

   they are appropriate for, and consistent with, the extent of their usage;

5. (e)

   they accurately represent the real-life phenomenon that they aim to represent;

6. (f)

   they do not violate any business rule in a database that has to be statically and dynamically maintained.

For the purposes of paragraph 1, competent authorities shall confirm that the institution has appropriate documentation for the design and maintenance of the databases used in the institution's AMA framework, and that the documentation contains at least the following:

1. (a)

   a global map of databases involved in the operational risk measurement system with their descriptions;

2. (b)

   a data policy and a statement of responsibility;

3. (c)

   descriptions of work-flows and procedures related to data collection and data storage;

4. (d)

   a statement of weaknesses with all the weaknesses identified in the databases of the validation and review processes and a statement on how the institution plans to correct or reduce the weaknesses identified.

Competent authorities shall confirm that the policies on the SDLC for AMA are approved by the institution's management body and senior management.

Where the institution uses external data sources, the institution shall ensure that the provisions in this Article are satisfied.

Competent authorities shall assess the degree to which an institution ensures the soundness, robustness and performance of the IT infrastructure used for AMA purposes by confirming at least the following:

1. (a)

   that the IT systems and infrastructure of the institution for AMA purposes are sound and resilient and that these features can be maintained on a continuous basis;

2. (b)

   that the SDLC for AMA purposes is sound and proper with reference to:

   1. (i)

      project management, risk management, and governance;

   2. (ii)

      engineering, quality assurance and test planning;

   3. (iii)

      systems' modelling and development;

   4. (iv)

      quality assurance in all activities, including code reviews and where appropriate, code verification;

   5. (v)

      testing, including user acceptance.

3. (c)

   that the institution's IT infrastructure implemented for AMA purposes is subject to configuration management, change management and release management processes;

4. (d)

   that SDLC and contingency plans for AMA purposes are approved by the institution's management body or senior management and that the management body and senior management are periodically informed about the IT infrastructure performance for AMA purposes.

Where the institution outsources parts of the IT infrastructure maintenance for AMA purposes, the institution shall ensure that the provisions in this Article are satisfied.