Knowledge of the relevant regulations

Implementation options

Local regulator/supervisor interpretations

Implementation planning considerations

Gaining user commitment

Tools and services

Trends and precedents

Board responsibilities and governance model

Assessment of current situation and confirmation of own risk profile

Basel II or Sarbanes-Oxley requirements

Impact on organisational structure and outsourcing

Discussions with local supervisors

Management buy-in, programme priorities and phasing

Conflict with other initiatives and quick hits

For Basel II, confirm Pillar 1 approach and requirements, Pillar 2 and Pillar 3 objectives and required organisational structure

Define control and data security environment

Define necessary risk framework, risk and loss event categorisations and reporting/responsibility structure

Identify target risk culture model, target risk monitoring, assessment, management and control framework and people management requirements

Select/specify systems requirements, plan and cost project

Develop necessary responsibilities, processes and systems

Audit programme and confirm targets achieved

Company procedures/handbooks - event definition, monitoring requirements, escalation processes, periodic reporting, etc.

Staff communications - training, help desks, newsletters, poster campaign, e-mail and post communications updates, web site, etc.

Staff management implications – “approved persons” monitoring, certification, grading, recruitment, training, remuneration analysis, etc.

Progress monitoring and target setting, maintenance of framework, categories, etc.

Compliance and quality management, impact on disclosure and relations with supervisor