ECF - Operational Risk Management

Overview

With the aim of supporting capacity building and talent development for banking professionals, the Hong Kong Monetary Authority (HKMA) has been working together with the banking industry to introduce an industry-wide competency framework - “Enhanced Competency Framework (ECF) for Banking Practitioners” in Hong Kong.

The Enhanced Competency Framework on Operational Risk Management (hereinafter referred to as “ECF-ORM”) is a non-statutory framework which sets out the common and core competences required of operational risk management practitioners in the Hong Kong’s banking industry. The objectives of the ECF-ORM are twofold:

1. to develop a sustainable talent pool of operational risk management practitioners for the banking industry; and

2. to raise the professional competence of existing operational risk management practitioners in the banking industry

Although the ECF-ORM is not a mandatory licensing regime, AIs are encouraged to adopt it for purposes including but not limited to:

1. using the ECF-ORM as a benchmark to determine the level of competence required and assess the ongoing competence of relevant employees;

2. supporting relevant employees to attend training programmes and examinations that meet the ECF-ORM benchmark;

3. supporting the continuing professional development (CPD) of relevant employees; AND

4. promoting the ECF-ORM as an industry-recognised qualification, including for recruitment purposes

Please refer to the HKMA Circular on “Enhanced Competency Framework on Operational Risk Management” for details.

Scope of Application

The ECF-ORM is intended to apply to “Relevant Practitioners” (RPs) whose primary responsibilities are performing operational risk governance, operational risk identification and assessment, operational risk monitoring and reporting, operational risk control and mitigation, and business resiliency and continuity planning within an AI. The ECF-ORM is aimed at RPs located in the Hong Kong office of an AI performing the operational risk management and business control risk and control functions:

Role 1 - Operational Risk Management (i.e. staff in charge of managing operational risks in the second line of defence) and

Role 2 - Business Function Risk and Control (i.e. staff working at the business units to manage operational risks in the first line of defence)

Competency Standards

The competency standards of the ECF-ORM are set at two levels:

1. Core level – applicable to entry-level and junior-level staff in the operational risk management and business function risk and control with 0-5 years of experience.

2. Professional level – applicable to staff taking up middle-level or senior positions in the operational risk management and business function risk and control with more than 5 years of experience.

Certification

RPs may apply to the HKIB for certification as an Associate Operational Risk Management Professional (AORP) or a Certified Operational Risk Management Professional (CORP) upon completing the above qualifications and fulfilling the minimum relevant work experience requirement.

AORP – (1) successfully completed all the 3 core level training modules (Modules 1 to 3) and obtained a pass in the relevant examination of each module or (2) grandfathered pursuant to the criteria specified in the Grandfathering section below.

CORP – (1) successfully completed the professional level training module (Module 4) and obtained a pass in the relevant examination of the module on top of the Core Level qualification plus at least 5 years’ relevant work experience in operational risk management, business function risk and control, and/or internal audit (related to operational risk management and controls within an AI) or (2) grandfathered pursuant to the criteria specified in the Grandfathering section below.

1. Training and examinations

Core Level

The Core level training programme of the ECF-ORM consists of 3 modules. A core level training award "Advanced Certificate for ECF on Operational RIsk Management (ORM)" will be given to candidates who have successfully completed all the 3 core level trainng modules (Module 1 to 3) and obtained a pass at the relevant examination of each module.

Professional Level

The Professional level training programme of the ECF-ORM consists of 1 module. A professional level training award “Professional Certificate for ECF on Operational Risk Management (ORM)” will be given to candidates who have successfully completed the professional level training module (Module 4) and obtained a pass at the relevant examination of the module on top of the Core Level qualification.

Eligible candidates may apply for exemption from completing individual training module. Detailed information of the training programmes and examinations will be available in due course.

2. Exemption

RP who has passed the following related training programme(s) is eligible to apply for exemption on Module 1 and / or Module 3 of the ECF-Operational Risk Management Core Level training programme:

Module 1

Certification in Risk Management Assurance of the Institute of Internal Auditors; or
Bachelor’s or higher degree in law; or
Professional Ethics and Compliance module under the Advanced Diploma for Certified Banker (Stage I) of the HKIB; or
Certified Professional Risk Manager of the Asia Risk Management Institute (ARIMI); or
Certified Public Accountant of the Hong Kong Institute of Certified Public Accountants (HKICPA);
Full member of Association of Chartered Certified Accountants (ACCA); or
Members of overseas accountancy bodies which are eligible for full exemption from the qualification programme for membership admission at the HKICPA under the HKICPA’s reciprocal membership and mutual recognition agreements (as listed on its website)

Module 3

Operational Risk Manager Certificate of the Professional Risk Managers' International Association (PRMIA); or
Professional Risk Manager of the PRMIA; or
Certificate in Operational Risk Management of the Institute of Operational Risk (IOR), which is now a part of the Institute of Risk Management (IRM) Group

3. Grandfathering

A RP may be grandfathered on a one-off basis (i.e. within the grandfathering application period) based on his or her years of qualifying work experience and/or professional qualification. Such work experience need not be continuous. The detailed grandfathering requirements are as follows:

1. Core Level via Path (i) or Path (ii):

Path (i):

Possessing at least 3 years of relevant work experience in operational risk management, business function risk and control, and/or internal audit (related to operational risk management and controls within an AI); AND
Employed by an AI at the time of application

Path (ii):

Completion of one of the following training programmes:

- Operational Risk Manager Certificate of the PRMIA; or

- Professional Risk Manager of the PRMIA; or

- Certificate in Operational Risk Management of the IOR, which is now a part of the IRM Group;

Possessing at least 2 years of relevant work experience in operational risk management, business function risk and control gained from AIs and/or non-bank financial institutions, and/or internal audit (related to operational risk management and controls within an AI); AND
Employed by an AI at the time of application.

2. Professional Level via Path (i) or Path (ii):

Path (i):

Possessing at least 8 years of relevant work experience in operational risk management, business function risk and control, and/or internal audit (related to operational risk management and controls within an AI), of which at least 3 years must be gained from Professional Level job roles within an AI; AND
Employed by an AI at the time of application

Path (ii):

Completion of HKIB’s Postgraduate Diploma for Certified Banker (Operations Management Stream); AND
Possessing at least 5 years of relevant work experience in operational risk management, business function risk and control, and/or internal audit (related to operational risk management and controls within an AI); AND
Employed by an AI at the time of application

Existing RPs who meet the above criteria can submit their grandfathering applications to the HKIB from 1 July 2021 to 30 June 2022. A one-off grandfathering fee will apply.

Annual Renewal

Certification of AORP and CORP is subject to annual renewal by HKIB. AORP and CORP holders are required to meet the annual Continuing Professional Development (CPD) requirements and pay an annual certification fee to renew their ECF-ORM certification. For details, please refer to the CPD Requirements section below.

CPD Requirements

For both AORP and CORP holders, a minimum of 12 CPD hours is required for each calendar year, of which at least 6 hours should be on topics related to compliance, legal and regulatory requirements, risk management and ethics.

Any excess CPD hours accumulated within a particular year cannot be carried forward to the following year.

Activities that qualify for CPD include:

1. Attending seminars or courses provided by AIs, financial services regulators, professional bodies, academic and training institutions, and the HKIB;

2. Taking professional examinations;

3. Attending e-learning; and

4. Delivering training and speeches.

CPD training topics should be related to banking and finance or the job function. Examples of appropriate training topics include:

1. Compliance, code of conduct, professional ethics or risk management (e.g. topics related to jurisdiction, structure, collateral and regulatory changes)

2. Banking and financial knowledge

3. Economics

4. Accounting

5. Legal principles

6. Business and people management

7. Language and information technology

8. Subject areas covered in the HKIB’s professional examinations

The CPD requirements will be waived for the first calendar year (ending 31 December) of certification and grandfathering.