Page 81 - EXIM-Bank_Annual-Report-2022

A VISION COMMITMENT EMPOWERING ENSURING ENHANCINg FINANCIAL
78 EXIM BANK MALAYSIA ANNUAL REPORT 2022 TO SERVE TO LEAD GROWTH SUSTAINABILITY gOVERNANCE STATEMENTS 79

RISK AND COMPLIANCE CuLTuRE

The Bank aims to strengthen the Designated Compliance and Operational Risk Officer (DCORO) programme to promote effective
compliance and risk management practices by business units and functional lines, and to cultivate positive risk and compliance
culture across the Bank.
The DCOROs are responsible for identifying, documenting, and assessing the compliance risk as well as to review the
operational and Shariah non-compliance risk that may arise from the Bank’s product, people, processes, and system. In addition,
they facilitate the effective management of information disclosure from regulatory authorities forwarding submission to the
Chief Compliance Officer (CCO) for compliance related issues and the Chief Risk Officer (CRO) for operating risk related matters.
Additionally, the DCOROs are responsible for periodically reporting on compliance and operational risk matters, as well as
reporting on loss event as required by the Operational Risk Integrated Online Network (ORION) Reporting Procedures and
Procedures on Managing Shariah Non-Compliance (SNC) Risk.

COMPLIANCE RISK MANAgEMENT

The compliance function uses both the qualitative or quantitative indicators to identify and assess the adequacy of internal
controls in managing compliance risk.

The compliance function reports to the Board oversight on the assessment and analysis of compliance risk highlighting key
changes in the compliance risk profile that require further attention. Additionally, the compliance function reports any identified
deficiencies and provides action plans to address them within stipulated a timeframe.
The compliance function also serves as an advisory resource to the Board and the Bank’s staff providing updates on the
developments affecting legal and regulatory requirements and accessing their implications on the Bank’s compliance risk
profile and capacity to manage compliance risk in the future.

TECHNOLOgY RISK MANAgEMENT
The technology risk management function is responsible for the establishment of board-approved Technology Risk Management
Framework (TRMF) and Cyber Resilience Framework (CRF) as well as the specific policies and procedures that are consistent
with the regulatory requirements.

These specific policies and procedures include the Bank’s technology processes and services as well as proper cyber-resilience
capabilities with continuous validation of controls and as the overseeing party of the information technology and cyber risks.

The technology risk management function also provides independent advice on critical technology projects and ensuring critical
issues that may have an impact on the Bank’s risk appetite are adequately deliberated or escalated in a timely manner.

RISK APPETITE

The amount and type of risk the Bank is willing to undertake and implemented given the relevant
controls for measuring and managing the risks identified

RIsk Appetite Reflects the long-term view of the Bank’s meeting its financial capacity and continuing ability to
meet obligations towards stakeholders

Specific risk metrics which are acceptable to EXIM Bank in executing the business strategy