To:
The Board of Directors of Sharia Rural Financing Banks Location.

COPY
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 10 /SEOJK.03/2019 CONCERNING THE IMPLEMENTATION OF RISK MANAGEMENT FOR SHARIA RURAL FINANCING BANKS

In view of the establishment of Financial Services Authority Regulation Number 23/POJK.03/2018 concerning the Implementation of Risk Management for Sharia Rural Financing Banks, hereinafter referred to as POJK MR BPRS, it is necessary to regulate the implementation of the aforementioned Financial Services Authority Regulation in this Financial Services Authority Circular Letter as follows:

I. GENERAL PROVISIONS

This Financial Services Authority Circular Letter aims to provide minimum standards for the implementation of Risk Management for BPRS, including the formulation of policies and guidelines for the implementation of Risk Management for BPRS, while still referring to POJK MR BPRS.
In the event that BPRS already has policies and guidelines for the implementation of Risk Management but they do not yet comply with the implementation standards of Risk Management, BPRS must adjust the policies and guidelines for the implementation of Risk Management to the implementation standards of Risk Management for BPRS as referred to in Appendix I, which is an integral part of this Financial Services Authority Circular Letter.
Policies and guidelines for the Implementation of Risk Management may be developed by BPRS according to the complexity of the business, the development of conditions, and potential problems faced, while still referring to the implementation standards of Risk Management as referred to in Appendix I, which is an integral part of this Financial Services Authority Circular Letter.
In accordance with Article 23 of POJK MR BPRS, BPRS is obligated to submit Risk Profile Reports and other Risk Profile Reports to the Financial Services Authority online through the Financial Services Authority reporting system. In the event that online submission through the Financial Services Authority reporting system cannot yet be performed, reports are submitted offline. The submission of Risk Profile Reports and other Risk Profile Reports online through the Financial Services Authority reporting system or offline is carried out in accordance with Financial Services Authority Regulations regarding reporting by rural credit banks and Sharia rural financing banks through the Financial Services Authority reporting system.

II. IMPLEMENTATION STANDARDS OF RISK MANAGEMENT

The standard guidelines for the implementation of Risk Management for BPRS function to ensure that all Risks faced by BPRS are identified, measured, monitored, and controlled accurately.
The standard guidelines for the implementation of Risk Management for BPRS must at least cover:
a. the implementation of Risk Management in general, covering:
1) active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board (DPS);
2) the adequacy of Risk Management policies and procedures, and the determination of Risk limits;
3) the adequacy of the Risk identification, measurement, monitoring, and control processes, as well as the Risk Management information system; and
4) a comprehensive internal control system.
b. the implementation of Risk Management for each type of Risk, covering the implementation of Risk Management for all types of Risk, namely Credit Risk, Operational Risk, Compliance Risk, Liquidity Risk, Reputational Risk, and Strategic Risk, while still referring to the types of Risk that must be managed by each BPRS based on core capital.
c. the assessment of Risk Management implementation in the form of Risk Profile assessment, including the assessment of Inherent Risk and the assessment of the quality of Risk Management implementation, which reflects the BPRS Risk control system.
In implementing effective Risk Management, BPRS must carry out preparation, development, and/or improvement steps at least covering:
a. conducting diagnosis and analysis regarding the organization, policies, procedures, limits, guidelines, and system development related to the implementation of Risk Management; b. formulating improvement plans according to the implementation standards of Risk Management for BPRS in the event of inconsistencies between BPRS internal guidelines and the standard guidelines for the implementation of Risk Management for BPRS;
c. socializing the Risk Management implementation guidelines to employees so that they understand Risk Management practices and develop a Risk culture (risk culture) among all employees at every level of the BPRS organization; and
d. ensuring that the Internal Audit Working Unit (SKAI) or Executive Officials responsible for implementing the internal audit function (PEAI) participate in the process of formulating Risk Management implementation guidelines and the implementation of Risk Management.

III. REPORTING

Risk Profile Report
a. In accordance with Article 21 paragraph (1) of POJK MR BPRS, BPRS is obligated to submit Risk Profile Reports every semester to the Financial Services Authority. Risk Profile Reports are submitted to the Financial Services Authority according to the stages as referred to in Article 21 paragraph (5) and paragraph (6) of POJK MR BPRS.

 1) Inherent Risk Assessment  
     a) Inherent Risk is Risk inherent in the business activities of BPRS, both those that can be quantified and those that cannot be quantified, which significantly affect the financial condition of BPRS. b) Inherent Risk is determined by internal and external factors. Internal factors that can affect Inherent Risk include human resource competence and the adequacy of information technology used. Meanwhile, external factors that can affect Inherent Risk include government regulations and natural conditions. c) Assessment of Inherent Risk is conducted by considering quantitative and qualitative parameters. Quantitative parameters consist of ratios, such as the Non-Performing Financing ratio or the comparison between total problematic financing and total financing, and the Financing to Deposit ratio or the comparison between total financing and total third-party funds from non-banks. Qualitative parameters include the diversity of BPRS products or services and the credibility of parties associated with BPRS. The aforementioned parameters can be given indicative ratings as referred to in Appendix II, which is an integral part of this Financial Services Authority Circular Letter, to assist in determining the level of Inherent Risk. d) In conducting Inherent Risk assessment, the assessment is conducted against Risk inherent in an activity, without considering the control functions established by BPRS for each type of Risk. e) The determination of the level of Inherent Risk for each type of Risk is conducted based on a comprehensive analysis of all parameters and pillars, including considering the significance of the interconnection between parameters and between pillars. f) The determination of the level of Inherent Risk for each type of Risk is categorized into:  
         (1) rating 1 (very low);  
         (2) rating 2 (low);  
         (3) rating 3 (medium);  
         (4) rating 4 (high); and  
         (5) rating 5 (very high).

 2) Risk Management Implementation Quality Assessment  
     a) Risk Management Implementation Quality (KPMR) is the adequacy of the Risk control system covering all pillars of Risk Management implementation as referred to in Appendix I, which is an integral part of this Financial Services Authority Circular Letter. b) BPRS Risk Management implementation varies greatly according to characteristics, complexity, and the level of Risk to be taken and tolerated by BPRS. c) Assessment of KPMR is conducted by considering qualitative parameters. Some examples of KPMR parameters for BPRS are the approval of the Board of Commissioners for Credit Risk Management policies formulated by the Board of Directors and periodic evaluation of the aforementioned policies. d) Parameter rating determination is conducted through comprehensive parameter assessment analysis, considering the interconnection between one assessment parameter and other parameters. e) The determination of the level of KPMR for each type of Risk is categorized into:  
         (1) rating 1 (very adequate);  
         (2) rating 2 (adequate);  
         (3) rating 3 (fairly adequate); (4) rating 4 (inadequate); and (5) rating 5 (not adequate).

 3) Determination of Risk Level for Each Type of Risk  
     Based on the assessment of Inherent Risk and KPMR for each type of Risk, the Risk Level is subsequently determined. The Risk Level is Risk inherent in BPRS activities after considering KPMR. The Risk Level is determined based on the Risk Level determination matrix as referred to in Appendix II, which is an integral part of this Financial Services Authority Circular Letter.

 4) Risk Rating Determination  
     a) Based on the determination of the Risk Level for each type of Risk, the Risk Rating is determined by considering the significance and materiality of each type of Risk to the overall Risk Profile. b) Risk Rating determination consists of 5 (five) ratings, namely:  
         (1) Rating 1 (very low);  
         (2) Rating 2 (low);  
         (3) Rating 3 (medium);  
         (4) Rating 4 (high); and  
         (5) Rating 5 (very high).  
         Risk Rating determination refers to the guidelines as referred to in Appendix II, which is an integral part of this Financial Services Authority Circular Letter. c) In considering the significance and materiality of Risk to the overall BPRS Risk Profile, generally Credit Risk, Operational Risk, and Compliance Risk determine the BPRS Risk Profile assessment results. However, as a reference to test the significance and materiality of a Risk, including Risks other than the 3 (three) aforementioned Risks, to the BPRS Risk Profile, the following must be considered:  
         (1) exposure or volume of Risk and significance to the overall BPRS Risk Profile; and (2) the impact of problems arising from such Risk on the financial condition of BPRS. b. Risk Rating determination is conducted by considering general principles, namely risk orientation, proportionality, significance and materiality, as well as comprehensiveness and structure as referred to in Appendix II, which is an integral part of this Financial Services Authority Circular Letter.  
     c. In accordance with Article 25 of POJK MR BPRS, the Financial Services Authority conducts assessments on the implementation of Risk Management in BPRS. In the event of a discrepancy between the results of the Risk Management implementation assessment conducted by the Financial Services Authority and the results of the Risk Management implementation assessment by BPRS, the result of the Risk Management implementation assessment by BPRS conducted by the Financial Services Authority prevails.  
     d. In the event that based on the assessment results there are matters that need to be reviewed and followed up by BPRS, BPRS submits the review results and immediate action plans after the assessment is conducted. e. The procedure for Risk Profile assessment is explained further in Appendix II, which is an integral part of this Financial Services Authority Circular Letter. f. Risk Profile Reports consist of types of Risk, Risk levels per type of Risk, assessment per position, and previous position assessments, referring to the format as referred to in Appendix III, which is an integral part of this Financial Services Authority Circular Letter.

Other Risk Profile Reports
a. In accordance with Article 22 paragraph (1) of POJK MR BPRS, BPRS is obligated to submit other Risk Profile Reports to the Financial Services Authority in the event of conditions that have the potential to cause significant losses to the financial condition of BPRS. b. Other Risk Profile Reports are incidental reports submitted to the Financial Services Authority based on the current conditions of BPRS having specific exposure and the results of the Financial Services Authority's assessment of BPRS.
c. In accordance with Article 22 paragraph (3) and paragraph (4) of POJK MR BPRS, other Risk Profile Reports are submitted no later than 1 (one) month after the condition potentially causing significant losses to the financial condition of BPRS is known or based on the request of the Financial Services Authority.
d. Other Risk Profile Reports consist of types of Risk, Risk levels per type of Risk, explanations of Inherent Risk, and explanations of the quality of Risk Management implementation, referring to the format as referred to in Appendix III, which is an integral part of this Financial Services Authority Circular Letter.
Action Plan
a. In accordance with Article 19 paragraph (1) and paragraph (2) of POJK MR BPRS, BPRS is obligated to formulate and submit an offline action plan for the implementation of Risk Management no later than June 30, 2019, to the Financial Services Authority. b. The Risk Management implementation action plan contains steps that BPRS will take to fulfill obligations as referred to in POJK MR BPRS, with completion targets during a specific period.
c. The Risk Management implementation action plan consists of types of action plans, fulfillment plans, and fulfillment periods, referring to the format as referred to in Appendix III, which is an integral part of this Financial Services Authority Circular Letter.
d. Types of action plans include:
1) Fulfillment of the completeness of BPRS organizational structure based on core capital as referred to in Article 16 paragraph (1), paragraph (2), paragraph (3), and paragraph (4) of POJK MR BPRS;
2) Formulation of internal regulations containing the authority and responsibilities of the Board of Directors, Board of Commissioners, and DPS related to the implementation of Risk Management;
3) Formulation of policies and procedures containing:
a) Risk Management policies, Risk Management procedures, and determination of Risk limits; b) Risk identification, measurement, monitoring, and control processes; c) Risk Management information systems; and d) Internal control systems. e. Guidelines for formulating action plans are:
1) Fulfillment plans are filled with actions to be taken by BPRS to fulfill types of Risk Management implementation action plans as referred to in letter d.
2) Fulfillment periods are filled with target times for fulfilling types of Risk Management implementation action plans as referred to in letter d.
Action Plan Realization Report
a. In accordance with Article 20 paragraph (1) of POJK MR BPRS, BPRS is obligated to submit offline Action Plan Realization Reports every semester to the Financial Services Authority. b. In the event that there are no targets and/or action plan realizations in the reporting period, BPRS is still obligated to submit Action Plan Realization Reports as referred to in Article 20 paragraph (1) of POJK MR BPRS.
c. Action Plan Realization Reports for Risk Management implementation consist of types of action plans, planned fulfillment periods, realization periods, and fulfillment obstacles, referring to the format as referred to in Appendix III, which is an integral part of this Financial Services Authority Circular Letter.
d. Guidelines for formulating Action Plan Realization Reports are:
1) Planned fulfillment periods are filled with fulfillment periods submitted in the Risk Management implementation action plans as referred to in item 3.e.2).
2) Realization periods are filled with realization periods for types of Risk Management implementation action plans that can be fulfilled by BPRS.
3) Fulfillment obstacles are filled with obstacles, whether from internal or external factors, faced by BPRS in fulfilling Risk Management implementation action plans, if any.

IV. CLOSING

Provisions in this Financial Services Authority Circular Letter take effect on the date of establishment.

Established in Jakarta on June 27, 2019

EXECUTIVE HEAD OF BANKING SUPERVISOR
FINANCIAL SERVICES AUTHORITY
REPUBLIC OF INDONESIA,

signed

HERU KRISTIYANA

Copy matches the original
Legal Director 1
Legal Department signed
Yuliana

APPENDIX I
FINANCIAL SERVICES AUTHORITY CIRCULAR LETTER
NUMBER 10 /SEOJK.03/2019
CONCERNING
THE IMPLEMENTATION OF RISK MANAGEMENT
FOR SHARIA RURAL FINANCING BANKS

CHAPTER I
GENERAL GUIDELINES

In accordance with Article 2 paragraph (2) of Financial Services Authority Regulation Number 23/POJK.03/2018 concerning the Implementation of Risk Management for Sharia Rural Financing Banks (POJK MR BPRS), Sharia Rural Financing Banks (BPRS) are obligated to implement Risk Management at least covering:

active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board (DPS);
the adequacy of Risk Management policies and procedures as well as the determination of Risk limits;
the adequacy of Risk identification, measurement, monitoring, and control processes as well as Risk Management information systems; and
a comprehensive internal control system.

Risk Management Principles are described as follows:

A. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board

The Board of Directors, Board of Commissioners, and DPS are responsible for the effectiveness of Risk Management implementation in BPRS. The Board of Directors and Board of Commissioners must understand the Risks faced by BPRS and provide clear directives, conduct active supervision and mitigation, and develop a Risk Management culture in BPRS. The Board of Directors and Board of Commissioners must also ensure adequate organizational structure, establish clear tasks and responsibilities for each unit, and ensure the adequacy of the quantity and quality of Human Resources (HR) to support the effective implementation of Risk Management.

a. Active Supervision by the Board of Directors In accordance with Article 5 of POJK MR BPRS, the authority and responsibilities of the Board of Directors for supervising the implementation of Risk Management for BPRS at least cover:
1. Formulating Risk Management implementation policies and guidelines in writing
  Risk Management policies include among others the established Risk Management strategy and framework, including overall Risk limits and per type of Risk according to the level of Risk to be taken (risk appetite) and Risk tolerance (risk tolerance) according to BPRS conditions, as well as considering the impact of Risk on capital adequacy. The Board of Directors must formulate Risk Management policies and guidelines in writing and comprehensively for each type of Risk and provide clear directives regarding the level of Risk to be taken and BPRS Risk tolerance. The formulation of Risk Management implementation policies and guidelines must involve working units or employees who perform BPRS operational functions and the Risk Management Working Unit (SKMR) or Executive Officials responsible for implementing the Risk Management function (PEMR).
2. Evaluating and deciding on transactions requiring Board of Directors approval
  The Board of Directors evaluates transaction proposals received before granting approval. Transactions requiring Board of Directors approval include transactions that have exceeded the authority of BPRS officials one level below the Board of Directors, in accordance with internal policies and procedures, including transaction approval mechanisms and approval authority for each job level.
3. Developing Risk Management culture at all organizational levels
  The Board of Directors develops Risk Management culture by, among others, providing information to all employees and adequate communication regarding Risk Management principles, including developing a Risk-aware culture and the importance of effective internal controls. Risk Management culture development can also be conducted in the form of employee training at BPRS regarding Risk Management according to each unit at BPRS. Risk-aware culture consists of adequate awareness and understanding from each individual employee of BPRS, whether handling operational or non-operational functions, regarding the potential Risks that may arise from all BPRS activities. Furthermore, the implementation of Risk-aware culture aims to ensure that BPRS employees understand the role and responsibilities of each in implementing Risk Management.
4. Ensuring the improvement of HR competence related to Risk Management
  The Board of Directors ensures adequate resource support to manage and control Risk, including the adequacy of the quantity and quality of HR. HR competence improvement can be realized, among others, through continuous education and training programs regarding Risk Management implementation. The Board of Directors must ensure that officials and staff placed in each unit at BPRS have an understanding of the Risks inherent in each product and/or BPRS activity, as well as Risk Management policies formulated by the Board of Directors and approved by the Board of Commissioners.
5. Ensuring that the Risk Management function operates independently
  The Board of Directors ensures that the Risk Management function is implemented independently, reflected, among others, by the separation of functions between SKMR or PEMR conducting Risk identification, measurement, monitoring, and control, and working units or employees performing operational functions and internal audit functions. Operational functions refer to functions related to fund collection and distribution.
6. Responsible for:
  a) Implementation of Risk Management Policies The Board of Directors is responsible for the implementation of Risk Management policies, namely:
  (1) Evaluating and providing directives based on reports submitted by SKMR or PEMR.
  (2) Submitting accountability reports to the Board of Commissioners and DPS every 6 (six) months or more frequently depending on operational changes, new product issuance, and/or new activities. The reporting period may consider the Risk Profile Report submission period, which is submitted no later than July 31 for the first semester report and January 31 of the following year for the second semester report. (3) Ensuring that significant Risks have been followed up. Significant Risks based on reports submitted by SKMR or PEMR to the Board of Directors as referred to in number (1). Significant Risks are Risks that have the potential to cause losses that could disrupt BPRS operations. (4) Effectively communicating Risk Management policies to all relevant organizational levels to be clearly understood. The Board of Directors must ensure that communicated Risk Management policies can be understood and implemented by all organizational levels of BPRS. (5) Ensuring that working units or employees handling operational functions inform the exposure of Risks inherent in their respective units to SKMR or PEMR every 6 (six) months or more frequently depending on operational changes, new product issuance, and/or new activities. Submission of information on exposure of Risks inherent in the respective units to SKMR or PEMR can be done, among others, through meetings between SKMR or PEMR and the working units that...

handling operational functions. b) Overall Risk Exposure Taken by BPRS In determining the overall Risk Exposure taken by BPRS, the Board of Directors must know the Risk inherent in the unit performing operational functions. Information regarding the Risk inherent in the unit performing operational functions is obtained based on reports submitted by the Risk Management Unit (SKMR) or Risk Management Officer (PEMR) as referred to in letter a) number (1). The determination of Risk Exposure taken must be supported by complete, accurate, current, and complete data and information related to the implementation of Risk Management. In exercising the authority and responsibility regarding the supervision of the implementation of BPRS Risk Management, the Board of Directors must have adequate understanding of the Risk inherent in all functional activities of BPRS, including understanding of Sharia Principles, and be able to take necessary actions according to the BPRS Risk profile. b. Active Supervision by the Board of Commissioners In accordance with Article 6 of the POJK on BPRS Risk Management, the authority and responsibility of the Board of Commissioners regarding the supervision of the implementation of BPRS Risk Management must at least include:

Approving and Evaluating Risk Management Policies
The Board of Commissioners approves the Risk Management policy drafted by the Board of Directors, considering the strategy and Risk Management framework established in accordance with the level of Risk to be taken and the BPRS Risk tolerance. Furthermore, the evaluation of Risk Management policies is conducted by the Board of Commissioners at least 1 (one) time in 1 (one) year or whenever there are changes that significantly affect BPRS business activities. The evaluation results from the Board of Commissioners serve as input for the Board of Directors to adjust Risk Management policies if needed.
Ensuring the Implementation of Risk Management by the Board of Directors
In ensuring the implementation of Risk Management by the Board of Directors, the Board of Commissioners supervises the implementation of Risk Management policies. If necessary, the Board of Commissioners may provide input to the Board of Directors regarding the refinement of Risk Management implementation.
Evaluating the Accountability of the Board of Directors regarding the Implementation of Risk Management Policies
The Board of Commissioners evaluates the accountability of the Board of Directors regarding the implementation of Risk Management policies based on accountability reports on the implementation of Risk Management policies submitted by the Board of Directors to the Board of Commissioners every semester or more as referred to in item 1.a.6).a).(2). The evaluation results from the Board of Commissioners serve as input for the Board of Directors in improving the quality of Risk Management implementation.
Evaluating and Deciding on Board of Directors' Requests Related to Transactions Requiring Board of Commissioners Approval
The Board of Commissioners evaluates and decides on Board of Directors' requests for transactions requiring evaluation and approval by the Board of Commissioners, including:
a) Disbursement of funds in the form of financing to related parties as referred to in regulations regarding the maximum limit for disbursement of funds by Sharia microfinance banks; and/or b) transactions exceeding the authority of the Board of Directors according to regulations.
c. Active Supervision by the Sharia Supervisory Board (DPS)
Based on Article 7 of the POJK on BPRS Risk Management, the authority and responsibility of the DPS in supervising the implementation of BPRS Risk Management must at least include:
Evaluating Risk Management Policies Related to Fulfillment of Sharia Principles
The evaluation of Risk Management policies related to the fulfillment of Sharia Principles is conducted by the DPS 1 (one) time in 1 (one) year or whenever there are changes that significantly affect BPRS business activities. The evaluation results from the DPS serve as input for the Board of Directors to adjust Risk Management policies if needed.
Evaluating the Accountability of the Board of Directors regarding the Implementation of Risk Management Policies Related to the Fulfillment of Sharia Principles
The evaluation of the accountability of the Board of Directors regarding the implementation of Risk Management policies related to the fulfillment of Sharia Principles is conducted by the DPS every semester or more. The evaluation results from the DPS serve as input for the Board of Directors in improving the quality of Risk Management implementation.

Human Resources
In carrying out the responsibility of implementing Risk Management regarding the improvement of HR competence as referred to in item 1.a.4), the Board of Directors must:
a. determine clear HR qualifications for each level of position related to the implementation of Risk Management; b. ensure the sufficiency of quantity and quality of existing HR in BPRS and ensure that such HR understands the tasks and responsibilities, for business units, Risk Management units, or supporting units responsible for implementing Risk Management;
c. develop systems for employee recruitment, development, and training, including managerial succession plans and adequate remuneration to ensure the availability of competent employees in Risk Management;
d. ensure the improvement of competence and integrity of leaders and personnel of business work units, SKMR or PEMR, and Internal Audit Work Units (SKAI) or Executive Officials handling internal audit functions, hereinafter referred to as PEAI, by considering factors such as knowledge, experience or track record, and adequate capabilities in Risk Management through continuous education and training programs to guarantee the effectiveness of the Risk Management process; e. place competent employees in each unit according to the nature, number, and complexity of BPRS business activities; f. ensure that employees placed in each unit have:

understanding of the Risk inherent in each product and/or BPRS activity;
understanding of relevant Risk factors and market conditions affecting products and/or BPRS activities, and the ability to estimate the impact of changes in these factors on the continuity of BPRS business;
ability to communicate the implications of BPRS Risk exposure to the Board of Directors, SKMR, PEMR, and Risk Management committees if any, in a timely manner; and
g. ensure that all HR understand the strategy, level of Risk to be taken and Risk tolerance, Risk Management framework established by the Board of Directors and approved by the Board of Commissioners, and ensure that all HR consistently apply it in handled activities.

Risk Management Organization and Functions
In implementing Risk Management, the BPRS Board of Directors organizes the Risk Management organization structure and functions in accordance with the POJK on BPRS Risk Management. The organization structure and functions may be developed according to the business characteristics and complexity of BPRS business activities. The Risk Management organization structure and functions consist of:
a. Risk Management Committee

In accordance with Article 16 paragraph (1) of the POJK on BPRS Risk Management, BPRS having core capital of at least IDR 80,000,000,000.00 (eighty billion rupiah) is required to form a Risk Management Committee and SKMR.
If necessary, BPRS with core capital less than IDR 80,000,000,000.00 (eighty billion rupiah) may form a Risk Management Committee considering the complexity of business activities, size, and capabilities of BPRS.
The Risk Management Committee is a non-structural unit with membership that may be permanent or non-permanent according to BPRS policy, consisting of at least:
a) Majority of the Board of Directors
(1) The majority of Board of Directors members is more than 50% (fifty percent) of the total number of Board of Directors members. (2) Board of Directors members overseeing compliance functions must be members of the Risk Management Committee. (3) The President Director cannot be a member of the Risk Management Committee. In the event that BPRS has core capital less than IDR 50,000,000,000.00 (fifty billion rupiah) and will form a Risk Management Committee, BPRS must have at least 3 (three) Board of Directors members. b) Relevant Executive Officials (1) Relevant Executive Officials are BPRS officials 1 (one) level below the Board of Directors, consisting of at least 1 (one) Executive Official leading the operational work unit and 1 (one) Executive Official leading the SKMR. (2) The membership of Executive Officials in the Risk Management Committee is adjusted according to BPRS problems and needs. In the event that BPRS has core capital less than IDR 50,000,000,000.00 (fifty billion rupiah) and will form a Risk Management Committee, Executive Officials who are members of the Risk Management Committee must consist of at least 1 (one) Executive Official leading the operational work unit and 1 (one) PEMR. In carrying out authority and responsibility regarding the fulfillment of Sharia Principles, the DPS may become a non-permanent member of the Risk Management Committee.
The authority and responsibility of the Risk Management Committee are to provide recommendations to the President Director, at least including:
a) the drafting of policies and guidelines for implementing Risk Management, including recommendations regarding the level of Risk to be taken and Risk tolerance in determining BPRS business strategy; b) improvement and/or refinement of Risk Management implementation based on the results of Risk Management implementation evaluations; and c) consideration and/or determination of matters related to operational decisions deviating from normal procedures. b. SKMR or PEMR
In accordance with Article 16 paragraph (1) of the POJK on BPRS Risk Management, BPRS having core capital of at least IDR 80,000,000,000.00 (eighty billion rupiah) is required to form SKMR.
In accordance with Article 16 paragraph (2) of the POJK on BPRS Risk Management, BPRS having core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) and less than IDR 80,000,000,000.00 (eighty billion rupiah) is required to form SKMR.
In accordance with Article 16 paragraph (3) of the POJK on BPRS Risk Management, BPRS having core capital less than IDR 50,000,000,000.00 (fifty billion rupiah) is required to appoint at least 1 (one) PEMR.
SKMR is a structural work unit responsible directly to Board of Directors members overseeing Risk Management functions.
SKMR and Compliance Work Units (SKP) may be combined structurally, i.e., a work unit handling Risk Management and compliance.
PEMR is responsible directly to Board of Directors members overseeing Risk Management functions.
PEMR may concurrently serve as Executive Officials responsible for implementing compliance functions (PE Compliance).
SKMR and PEMR must be independent, i.e., not handling fund collection and disbursement functions, and not executing internal audit functions.
In accordance with Article 18 paragraph (3) of the POJK on BPRS Risk Management, the authority and responsibility of SKMR or PEMR include:
a) Monitoring the implementation of policies and guidelines for implementing Risk Management approved by the Board of Directors Monitoring the implementation of policies and guidelines for implementing Risk Management is conducted, among others, through impact tests or simulations. Impact tests or simulations are used, among others, to determine the impact of implementing Risk Management policies and strategies on the portfolio or overall performance of BPRS. b) Monitoring overall Risk positions, by type of Risk, and by type of functional activity The monitoring covers compliance with established Risk tolerance and limits. c) Assessment of proposals for issuing products and/or implementing new activities Assessment of product proposals and/or new activities aims to assess BPRS' ability to issue products and/or implement new activities, including assessments of system and procedure changes due to the issuance of products and/or implementation of new activities, and to see the impact on overall BPRS Risk exposure. d) Submission of recommendations to work units or employees handling operational functions and the Risk Management Committee according to their authority Work units or employees handling operational functions are work units or employees handling financing activities, fund collection, and other operational activities. Recommendations submitted by SKMR or PEMR include information regarding the magnitude or maximum Risk exposure that BPRS must maintain. These recommendations are submitted to Board of Directors members overseeing Risk Management functions and the Risk Management Committee if any. e) Drafting and submitting Risk Profile Reports periodically to Board of Directors members overseeing Risk Management functions and the Risk Management Committee Risk Profile is a comprehensive picture of the magnitude of potential Risk inherent in the entire portfolio or BPRS exposure. Periodic submission of reports is adjusted to BPRS conditions and must be conducted at least every semester. Risk Profile reports are submitted to Board of Directors members overseeing Risk Management functions and the Risk Management Committee if any. The reports are evaluated and serve as the basis for providing directives to the Board of Directors in drafting Risk Management policies and guidelines.
The authority and responsibility of SKMR or PEMR may be adjusted according to business characteristics and the complexity of BPRS business activities.
B. Risk Management Policies, Risk Management Procedures, and Determination of Risk Limits Effective implementation of Risk Management must be supported by a framework including Risk Management policies and procedures and Risk limits established clearly in line with BPRS vision, mission, and business strategy. The drafting of Risk Management policies and procedures is conducted considering, among others, the type, complexity of business activities, Risk profile, level of Risk to be taken, interrelationship of Risks, and regulations established by authorities and/or healthy banking practices. Furthermore, the implementation of Risk Management policies and procedures owned by BPRS must be supported by sufficient capital and HR quality. For effective Risk control, the policies and procedures owned by BPRS must be based on Risk Management strategies supplemented by Risk tolerance and Risk limits. The determination of Risk tolerance and Risk limits is conducted considering the level of Risk to be taken and BPRS overall strategy. Matters to be considered in establishing the Risk Management framework, including policies, procedures, and limits, include:

Risk Management Strategy
a. BPRS formulates Risk Management strategy in accordance with overall business strategy, considering the level of Risk to be taken and Risk tolerance. b. Risk Management strategy is drafted to ensure that BPRS Risk exposure is managed in accordance with BPRS internal policies and procedures and regulatory provisions.
c. Risk Management strategy is drafted based on the following general principles:

Risk Management strategy is long-term oriented to ensure the continuity of BPRS business considering economic conditions or cycles;
Risk Management strategy is comprehensive and can control and manage BPRS Risk; and
achieving capital adequacy accompanied by adequate resource allocation.
d. Risk Management strategy is drafted considering the following factors:
economic and industrial development and its impact on BPRS Risk;
BPRS organization, including HR sufficiency and supporting infrastructure;
BPRS financial conditions, including the ability to generate profit, and BPRS' ability to manage Risk arising from changes in external and internal factors; and
BPRS portfolio mix and diversification.
e. The Board of Directors effectively communicates the Risk Management strategy to all work units and employees for clear understanding. f. The Board of Directors periodically evaluates the Risk Management strategy, including its impact on BPRS financial performance, to determine the urgency of changing BPRS Risk Management strategy.

Risk Management Policies
a. BPRS Risk Management policies are formed to identify and analyze Risk faced by BPRS, to determine appropriate Risk limits and controls, and to supervise Risk and compliance with established limits. b. Risk Management policies are written directives in implementing Risk Management and must be in line with BPRS vision and mission.
c. The drafting of Risk Management policies must involve work units or employees performing BPRS operational functions and SKMR or PEMR, and the Risk Management Committee if any.
d. The determination of Risk Management policies considers business characteristics, complexity of business activities, Risk profile, level of Risk to be taken, Risk tolerance, Risk limits, financial conditions, and BPRS organizational structure. e. Risk Management policies are drafted and determined by the Board of Directors and approved and evaluated by the Board of Commissioners and DPS. The evaluation conducted by the DPS is only related to the fulfillment of Sharia Principles. Evaluations by the Board of Commissioners and DPS are conducted 1 (one) time in 1 (one) year or whenever there are changes that significantly affect BPRS business activities. f. In accordance with Article 8 of the POJK on BPRS Risk Management, the sufficiency of Risk Management policies must at least include:

Determination of Risk Related to Business Activities, Products, and BPRS Services
Determination of Risk related to business activities, products, and BPRS services is based on BPRS analysis results of Risk inherent in business activities, products, and BPRS services, considering business characteristics and complexity of BPRS business activities.
Determination of Risk Management Information Systems
BPRS needs to determine methods for identifying, measuring, monitoring, and controlling Risk, as well as Risk Management information systems to accurately assess Risk exposure on each banking product and transaction and BPRS business activities. Included in Risk Management information systems are information flows to the Board of Directors utilizing information technology or data processing results to support decision-making. The implementation of Risk Management policies must be supported by Risk Management information systems capable of providing complete, accurate, current, and complete information, including data and information for assessing Risk Management implementation, such as customer data, violation data, deviation (fraud) data, customer complaint data, and negative news data. The determination of data to be reported, report formats, and types of information must be included in Risk Management reports so as to reflect Risk exposure considered in business decision-making while still observing prudence and Sharia Principles.
Determination of Limits and Determination of Risk Tolerance
BPRS must determine the authority and magnitude of limits hierarchically, including transaction limits requiring Board of Directors approval. BPRS must determine Risk limits in accordance with the level of Risk to be taken, Risk tolerance, and overall BPRS business strategy, considering BPRS capital capacity to absorb Risk exposure or losses arising, past loss experience, HR capabilities, and compliance with regulatory provisions. Limit determination is conducted comprehensively on all aspects related to Risk by determining the level and type of Risk to be taken to achieve BPRS targets. BPRS must determine Risk tolerance, which is the potential loss that can be absorbed by BPRS capital.
Determination of Risk Rating Assessment
Risk rating assessment is the basis for BPRS to determine BPRS Risk ratings categorized into 5 (five) Risk ratings, namely rating 1 (very low), rating 2 (low), rating 3 (medium), rating 4 (high), and rating 5 (very high). The results of Risk rating assessment can be used by BPRS as a basis for determining improvement steps for business activities, products, and BPRS services. The results of Risk rating assessment can also be used by BPRS to evaluate the results of Risk Management policy implementation.
Drafting Emergency Plans in Worst-Case Conditions or Contingency Plans
Emergency plans are scenario development plans to anticipate internal disruptions, including system failures, and external disruptions causing emergency conditions that can cause BPRS operational disruptions. In drafting emergency plans in worst-case conditions or contingency plans, BPRS must also draft business continuity plans for possible worst-case external and internal conditions, so that BPRS business continuity can be maintained, including disaster recovery plans. The drafting of business continuity plans must meet at least:
a) involving various related work units; b) being flexible to respond to various unexpected and specific disruption scenarios, i.e., specific conditions and immediate required actions; and c) periodic testing and evaluation of business continuity plans. The Board of Directors periodically tests and updates business continuity plans to ensure the effectiveness of the drafted business continuity plans.
Determination of Internal Control Systems in the Implementation of Risk Management
The determination of internal control systems in the implementation of Risk Management is conducted to ensure BPRS compliance with internal BPRS regulations and regulatory provisions, the effectiveness and efficiency of BPRS operational activities, the effectiveness of Risk Management culture at all levels of BPRS organization, and the availability of complete, accurate, current, and complete Risk Management information.

Risk Management Procedures
Risk Management procedures are adjusted to the level of Risk to be taken against BPRS Risk. The level of Risk to be taken considers the experience owned by BPRS regarding BPRS business transaction Risk in the past. Risk Management procedures must at least include:
a. Clear levels of delegation of authority and accountability BPRS must have a clear organizational structure regarding the implementation of Risk Management. The organizational structure that

clearly formulate the roles and responsibilities of the Board of Directors, Board of Commissioners, Sharia Supervisory Board (DPS), Risk Management Committee if any, Risk Management Committee (SKMR) or Risk Management Executive (PEMR), operational function units or employees, Internal Audit Unit (SKAI) or Internal Audit Officer (PEAI), and other supporting work units. BPRS must have procedures that explain the authority of each position, including in conditions where there is an exceedance of positional authority in the implementation of Risk Management.

b. Adequate documentation of procedures and risk limit setting Adequate documentation is written, complete, accurate, current, and intact documentation so that it facilitates audit trails for the purpose of BPRS internal control. Documentation of procedures and risk limit setting must facilitate the SKAI or PEAI in carrying out tasks related to internal control.

Setting Risk Limits
a. In formulating Risk Management policies, the Board of Directors must provide clear directions regarding the level of Risk to be taken and the BPRS Risk tolerance. b. The level of Risk to be taken is the level and type of Risk that BPRS is willing to take to achieve BPRS objectives. The level of Risk to be taken is reflected in the BPRS business strategy and objectives.
c. Risk tolerance is the maximum level and type of Risk established by BPRS. Risk tolerance is an elaboration of the level of Risk to be taken.
d. In setting Risk tolerance, BPRS needs to consider the BPRS business strategy and objectives as well as BPRS's ability to take Risk (risk bearing capacity). e. The level of Risk to be taken and Risk tolerance must be considered in the formulation of Risk Management policies, including in the setting of risk limits. f. BPRS must set risk limits that are in accordance with the level of Risk to be taken, Risk tolerance, and BPRS business strategy, taking into account BPRS's capital ability to absorb Risk exposure or losses arising, past loss experience, human resource capabilities, and compliance with statutory regulations. g. Procedures and risk limit setting must at least cover:

clear accountability and delegation of authority levels;
adequate documentation of procedures and risk limit setting to facilitate audit trails; and
risk limit setting is conducted comprehensively on all aspects related to Risk, which includes overall risk limits, risk limits per Risk type, and risk limits per specific functional activity of BPRS that has Risk exposure.
h. Risk limits must be understood by all relevant parties and communicated well, including in the event of changes.
i. The magnitude of risk limits is proposed by the work unit or employee handling the operational function, which is then recommended to the SKMR or PEMR to obtain approval from the Board of Directors or Board of Commissioners through the Risk Management Committee if any.
j. Risk limits are used as a threshold to determine the intensity level of Risk mitigation to be carried out by BPRS. k. Any exceedance of risk limits must obtain approval based on mechanisms and procedures regulated in BPRS internal regulations.
l. The SKMR or PEMR, in coordination with the work unit or employee handling the operational function, must provide complete, accurate, current, and intact information that facilitates the Board of Directors in formulating and setting risk limits.
m. Risk limit setting includes:
Overall Limits
Overall limits are the Risk limits that can be tolerated by BPRS over all Risks applied.
Limits per Risk Type
Limits per Risk type are the Risk limits that can be tolerated by BPRS for each type of Risk.
Limits per Specific Functional Activity with Risk Exposure
Limits per specific functional activity are the Risk limits that can be tolerated by BPRS for each functional activity.

C. Risk Identification, Measurement, Monitoring, and Control Processes, and Risk Management Information System
Risk identification, measurement, monitoring, and control are main parts of the Risk Management implementation process. Risk identification is proactive, covering all BPRS business activities and is conducted to analyze Risk sources and possible emerging impacts. Subsequently, BPRS needs to measure Risk according to the characteristics and complexity of business activities. In monitoring Risk measurement results, the SKMR or PEMR monitors the level and trends and analyzes the direction of Risk. Furthermore, the effectiveness of Risk Management implementation needs to be supported by Risk control by considering the results of Risk measurement and monitoring. To support the processes of risk identification, measurement, monitoring, and control, BPRS also needs to develop a management information system adapted to the characteristics, activities, and complexity of BPRS business activities, as well as an accurate and informative reporting system regarding BPRS financial conditions, functional activity performance, and BPRS Risk exposure.

Risk Identification
In accordance with Article 11 paragraph (1) of the POJK on BPRS Risk Management, the implementation of the Risk identification process is at least conducted by conducting analysis on:
a. Risk characteristics inherent in BPRS; and b. Risks from BPRS business activities, products, and services.
Risk identification aims to know all types of Risks inherent in each functional activity that has the potential to harm BPRS. Risk identification is conducted based on past experience related to transactions that caused losses, reduced profits, or caused problems in BPRS. The Risk identification process must be conducted periodically. The implementation of the Risk identification process is conducted by analyzing all Risk sources, at least conducted on Risks from BPRS products and activities, and ensuring that Risks from new products and activities have gone through an appropriate Risk Management process before the product is issued or the activity is carried out.
Risk Measurement
Risk measurement approaches are used to measure BPRS Risk exposure as a reference for conducting Risk control. The Risk measurement process must be conducted periodically on business activities, products, and BPRS services. In accordance with Article 11 paragraph (2) of the POJK on BPRS Risk Management, in carrying out Risk measurement, BPRS conducts at least:
a. Evaluation of the suitability of assumptions, data sources, and procedures used to measure Risk Evaluation is conducted by independent work units or officials not related to the formulation and/or setting in carrying out Risk measurement, and is conducted in accordance with business developments, BPRS internal and external conditions that can directly affect BPRS conditions. In the event that the formulation and/or setting of Risk measurement is conducted by the operational function, evaluation is conducted by the SKMR or PEMR. In the event that the formulation and/or setting related to Risk measurement is conducted by the SKMR or PEMR, evaluation is conducted by the SKAI or PEAI. Evaluation of the suitability of assumptions, resources, and procedures used to measure Risk can also be conducted by the SKMR or PEMR through a self-evaluation mechanism. b. Adjustment of the Risk measurement process in the event of material changes in business activities, products, transactions, and Risk factors Material changes include changes in business activities, products, transactions, organizational structure, information systems, and Risk factors that are quantitative and qualitative and have a significant impact on BPRS conditions. The results of Risk measurement are BPRS's assessment of Risks inherent in BPRS functional activities. The aforementioned assessment results are part of the BPRS Risk profile assessment documented in the BPRS Risk profile report.
Risk Monitoring
In accordance with Article 11 paragraph (3) of the POJK on BPRS Risk Management, in carrying out Risk monitoring, BPRS conducts at least:
a. Evaluation of Risk exposure conducted by independent work units or officials not related to the formulation and/or setting of Risk exposure through monitoring and reporting of significant Risks or those impacting BPRS capital conditions, which is at least conducted using historical data analysis. In the event that the formulation and/or setting of Risk exposure is conducted by the operational function, evaluation of Risk exposure is conducted by the SKMR or PEMR. In the event that the formulation and/or setting of Risk exposure is conducted by the SKMR or PEMR, evaluation of Risk exposure is conducted by the SKAI or PEAI, or by the SKMR or PEMR through a self-evaluation mechanism. b. Adjustment of the reporting process in the event of material changes in business activities, products, transactions, Risk factors, information technology, and Risk Management information systems. Monitoring results are presented in periodic reports submitted to the Board of Directors for Risk mitigation and decision-making on necessary actions. BPRS must prepare a backup system and effective procedures to prevent disruptions in the Risk monitoring process, and conduct periodic checks and re-evaluations of the backup system.
Risk Control
The implementation of the Risk control process is used by BPRS to manage Risks that can endanger the continuity of BPRS business. Included in the Risk control process is capital addition to absorb potential losses. BPRS conducts the Risk control process based on analysis results of Risk identification, measurement, and monitoring. Risk control is an action taken by BPRS in Risk mitigation conducted by work units related to each respective Risk. BPRS must have an adequate Risk control system referring to established policies and procedures. The Risk control process applied by BPRS must be in accordance with Risk exposure as well as the level of Risk to be taken and Risk tolerance.
Risk Management Information System
a. An adequate Risk Management information system is a management information system capable of providing complete, accurate, current, and intact data and information for decision-making by the Board of Directors. b. The Risk Management information system must be owned and developed according to BPRS needs in the implementation of effective Risk Management. The Risk Management information system is used to support the implementation of the risk identification, measurement, monitoring, and control processes.
c. The Risk Management information system must be able to ensure:

the effectiveness of Risk Management implementation covering Risk Management policies and procedures as well as risk limit setting; and
the availability of information on the results or realization of Risk Management implementation compared to targets set by BPRS in accordance with Risk Management implementation policies and strategies.
d. The Risk Management information system must be able to generate data and information needed in accordance with the development of BPRS internal and external conditions, business characteristics, and complexity of BPRS business activities, and can adapt to changes. e. In accordance with Article 12 paragraph (1) of the POJK on BPRS Risk Management, the Risk Management information system at least includes reports or information regarding:
Risk Exposure
Risk exposure reports or information cover Risk exposure that is quantitative and/or qualitative overall, details per Risk type, and per functional activity type.
Compliance with the adequacy of Risk Management policies, considering the objectives of formulating Risk Management policies, including among others to supervise Risk and compliance with established Risk boundaries and controls.
Compliance with the adequacy of Risk Management procedures and risk limit setting, including among others regarding the implementation of delegation of authority and accountability, and the use of risk limits.
Realization of Risk Management implementation compared to established targets, to ensure information on the results or realization of Risk Management implementation compared to targets set by BPRS in accordance with Risk Management implementation policies and strategies.
f. Reports or information generated from the Risk Management information system are submitted periodically by the SKMR or PEMR to the Board of Directors every 6 (six) months or more frequently in the event of operational changes, new product issuance, and/or new activity implementation. The Risk Management information system supports reporting to the Financial Services Authority. g. As part of the Risk Management information system, the Risk profile report is compiled periodically by the SKMR or PEMR. h. The frequency of reporting to the Board of Directors related to, and the Risk Management Committee if any, can be increased according to needs, especially in the event of rapidly changing market conditions.
i. In developing new information systems and software, BPRS must ensure that the implementation of new information systems and technology will not disrupt the continuity of BPRS information systems.
j. BPRS must account for and update system documentation containing hardware, software, databases, parameters, process stages, assumptions used, data sources, and generated outputs so as to facilitate control and audit trail implementation.

D. Internal Control System
The internal control system is a supervision mechanism established by BPRS management on an ongoing basis. BPRS must implement a comprehensive internal control system effectively on the implementation of business activities and operations at all organizational levels. The implementation of a comprehensive internal control system must at least be able to detect weaknesses and deviations that occur in a timely manner. BPRS must consider several factors in the implementation of the internal control system, including total assets, types of products and services, operational complexity, office network, Risk profile of each business activity, and statutory regulations.

The objectives of a comprehensive internal control system are to ensure:
a. Compliance with statutory regulations, BPRS internal regulations, and Sharia Principles This is intended to guarantee that all BPRS business activities have been carried out in accordance with statutory regulations, BPRS internal regulations, and Sharia Principles. b. Availability of complete, accurate, current, and intact financial and management information This is intended to ensure the availability of information to support the preparation of complete, accurate, current, and intact reports required for appropriate and accountable decision-making by the Board of Directors.
c. Effectiveness and efficiency in operational activities
This is intended to increase effectiveness and efficiency in using assets and other resources to protect BPRS from losses. d. Effectiveness of Risk culture throughout the BPRS organization This is intended to identify weaknesses and assess deviations early and to continuously re-evaluate the fairness of existing Risk Management policies and procedures at BPRS.
A reliable and effective internal control system is the responsibility of all parties involved in the BPRS organization, including:
a. Board of Commissioners
The Board of Commissioners is responsible for supervising the implementation of the internal control system in general, including the policies of the Board of Directors that establish such internal control. b. Board of Directors The Board of Directors is responsible for the internal control system, including:

creating and maintaining an effective internal control system;
establishing an effective and efficient organizational structure that supports the internal control system;
ensuring that all work units in BPRS are aware of the internal control system as one of the BPRS cultures, so that each work unit can cooperate in supporting the implementation of the internal control system;
ensuring the implementation of SKAI or PEAI tasks and responsibilities in internal control implementation; and
ensuring the independence and adequate competence of SKAI or PEAI.
c. SKMR or PEMR
In exercising authority and responsibilities, the SKMR or PEMR is involved in supporting the implementation of the internal control system, including providing information on the types and levels of Risks inherent in business activities and BPRS service types. d. SKAI or PEAI SKAI or PEAI must be able to evaluate and play an active role in improving the effectiveness of the internal control system. Evaluation is conducted continuously in relation to BPRS operational implementation that has the potential to cause losses in achieving objectives set by the Board of Directors and Board of Commissioners of BPRS. e. BPRS Officials and Employees Every BPRS official and employee must understand and participate in implementing the established internal control system. Effective internal control will increase the responsibility of BPRS officials and employees, encourage an adequate Risk culture, and accelerate the identification process of unhealthy banking practices and the organization through an efficient early detection system. f. External Parties External parties of BPRS include among others the Financial Services Authority, external auditors, and BPRS customers who are interested in the implementation of BPRS internal control systems.

A comprehensive internal control system in the implementation of Risk Management at least covers:
a. Suitability of the internal control system with the types and levels of Risks inherent in business activities and BPRS service types The determination of the internal control system is adapted to BPRS needs linked to the types and levels of Risks inherent in business activities and BPRS service types. The more complex the types and levels of BPRS Risk, the more adequate the internal control system required. b. Establishment of authority and responsibility for monitoring compliance with the adequacy of Risk Management policies The implementation of monitoring compliance with the adequacy of Risk Management policies is the authority and responsibility of the SKMR or PEMR.
c. Establishment of authority and responsibility for monitoring compliance with the adequacy of Risk Management procedures and risk limit setting
The implementation of monitoring compliance with the adequacy of Risk Management procedures and risk limit setting is the authority and responsibility of the SKMR or PEMR. d. Establishment of clear reporting lines and separation of functions Establishment of clear reporting lines and separation of functions means:

Reporting lines from work units or employees handling operational functions to work units or employees carrying out control functions, namely SKMR or PEMR and SKAI or PEAI.
Separation of functions between work units or employees handling operations and work units or employees carrying out control functions, namely SKMR or PEMR and SKAI or PEAI.
e. Organizational structure clearly depicting BPRS business activities BPRS must have an organizational structure that supports the effective and efficient implementation of business activities. The BPRS organizational structure must also meet requirements in the implementation of Risk Management functions and governance as regulated in the POJK on BPRS Risk Management and Financial Services Authority Regulations regarding the implementation of governance for Sharia microfinance banks. f. Accurate and timely financial and operational activity reporting BPRS must ensure that financial and operational activity reporting is supported by complete, accurate, current, and intact data and information. To support this, BPRS must have an adequate management information system that facilitates the Board of Directors in decision-making. g. Adequacy of procedures to ensure BPRS compliance with statutory regulations, BPRS internal regulations, and Sharia Principles BPRS must have procedures for all activities and functional activities to ensure BPRS compliance, created in the form of BPRS internal regulations. BPRS must ensure that these procedures are in accordance with statutory regulations, BPRS internal regulations, and Sharia Principles. h. Complete and adequate documentation BPRS must conduct complete and adequate documentation on all matters related to the implementation of Risk Management, including among others:
active supervision by the Board of Directors, Board of Commissioners, and DPS;
Risk Management policies and procedures, risk limit setting;
Risk identification, measurement, monitoring, and control processes, Risk Management information system; and
comprehensive internal control system.
i. Verification and review of the internal control system
Verification and review of the internal control system cover the handling of significant BPRS weaknesses and BPRS management actions to correct deviations that occur.

Monitoring must be conducted by the SKAI or PEAI on improvements based on internal audit findings as well as external audit findings. Audit findings that have not been followed up must be informed by the SKAI or PEAI to the Board of Directors to take necessary steps.
BPRS must be responsive to weaknesses and/or deviations that occur against statutory regulations, BPRS internal regulations, and Sharia Principles.

CHAPTER II
CREDIT RISK

Credit Risk is the Risk arising from the failure of customers or other parties to fulfill their obligations to the Sharia Rural Financing Institution (BPRS), including Risk arising from the BPRS sharing in the losses of customer businesses financed through profit-sharing financing, whether using the net revenue sharing method or the profit and loss sharing method (Investment Risk). Credit Risk is generally present in all BPRS activities whose performance depends on the performance of counterparty parties (banks and non-banks). Credit Risk can also be caused by the concentration of fund disbursement to customers, geographic regions, products, types of financing, or specific economic sectors. This risk is commonly referred to as Financing Concentration Risk and is calculated in the assessment of Inherent Risk.
Credit Risk can be the primary cause of BPRS failure. Therefore, the BPRS's ability to identify, measure, monitor, and control Credit Risk, as well as to provide sufficient capital reserves for Credit Risk, is an absolute necessity.
The application of Risk Management to Credit Risk aims to ensure that the BPRS's fund disbursement activities are not exposed to Credit Risk that could cause losses to the BPRS. The application of Risk Management is adjusted to the business characteristics, scale and complexity of business activities, and the level of Risk that the BPRS can tolerate.
Asset portfolios containing Credit Risk are:
a. Financing
Generally, financing constitutes the largest portion of the BPRS balance sheet and is also the largest source of Credit Risk, which can directly impact the BPRS's capital. b. Placements in other banks Credit Risk in placements in other banks arises from the possibility that the aforementioned other banks may not be able to fulfill their obligations upon maturity.
The interrelation of Credit Risk with other Risks is as follows:
a. Operational Risk
Credit Risk can also be influenced by Operational Risk arising, among others, from weaknesses in human resources, processes, or systems related to fund disbursement. b. Compliance Risk Financing disbursement activities can influence Compliance Risk, considering there are regulations and limitations that the BPRS must fulfill regarding these activities, including Maximum Limit of Fund Disbursement (BMPD) for both related and unrelated parties, as well as for individual customers and customer groups. Non-compliance with Sharia Principles can also cause Credit Risk.
c. Liquidity Risk
Financing management generally has a significant impact on the BPRS's liquidity conditions. Credit Risk due to low financing quality, where disbursed funds cannot be returned to their initial value, can cause the BPRS to experience Liquidity Risk when third-party fund holders withdraw funds. d. Reputational Risk Financing problems experienced by the BPRS can affect the BPRS's performance, which can have a negative impact on the BPRS's reputation. Financing problems, for example, if the BPRS is not transparent with customers regarding customer rights and obligations, can lead to legal claims against the BPRS, resulting in a poor reputation for the BPRS. e. Strategic Risk Inappropriate strategies in fund disbursement standards, financing growth, or products and/or new activities can affect the BPRS's performance and increase Credit Risk. In the application of Credit Risk Management, adequate analysis is required for Risks arising from business activities, products, and/or new BPRS activities, as well as realistic Strategic Risk analysis.
BPRS must identify and manage Credit Risk inherent in all products and/or new activities, ensure the implementation of adequate Risk Management control processes before the issuance of products and/or implementation of new activities, and obtain Board of Directors approval based on the results of the Risk Management Unit (SKMR) or Risk Management Committee (PEMR) study.

B. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In the application of Risk Management through active supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board (DPS) for Credit Risk, in addition to implementing supervision as referred to in Chapter I letters A and B, BPRS must add the application of:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a. The Board of Directors is responsible for establishing and implementing Credit Risk Management policies and developing procedures for the identification, measurement, monitoring, and control of Credit Risk. The policies and procedures developed and implemented must at least:
1) support healthy financing standards;
2) monitor and control Credit Risk; and
3) identify and handle troubled financing.
b. The Board of Directors is responsible for ensuring that all fund disbursement activities are carried out in accordance with the Credit Risk Management strategy and policies approved by the Board of Commissioners.
c. The Board of Directors must ensure that the application of Risk Management is carried out effectively in the implementation of fund disbursement activities, including monitoring developments and problems in BPRS business activities related to Credit Risk, including the resolution of troubled financing.
d. In implementing Credit Risk Management policies, the Board of Directors must ensure that relevant operational work units for financing disbursement have functions that perform:
1) marketing, analysis, and financing approval;
2) financing realization;
3) financing monitoring, including financing collection, assessment of financing quality, collateral assessment, and reserve formation;
4) resolution of troubled financing; and
5) financing administration.
e. The Board of Directors overseeing financing functions must know customer financial records as the basis for profit-sharing calculations. f. The Board of Commissioners monitors fund disbursement, including disbursement of large amounts or those given to related parties. g. The Board of Commissioners is responsible for periodic approval and evaluation of BPRS Credit Risk Management policies, including credit risk tolerance limits, at least 1 (one) time per 1 year or ad hoc in the event of changes that significantly affect BPRS business activities. h. The DPS is responsible for periodic evaluation of BPRS Credit Risk Management policies related to the fulfillment of Sharia Principles, at least 1 (one) time per 1 year or ad hoc in the event of changes that significantly affect BPRS business activities.
Human Resources
Adequacy of Human Resources for Credit Risk refers to the scope of application in general as referred to in Chapter I item A.2.
Credit Risk Management Organization
In the application of Risk Management for Credit Risk, there are several units handling functions:
a. business units that carry out financing or fund disbursement activities; b. troubled financing resolution units that handle troubled financing; and
c. Risk Management (SKMR or PEMR), specifically those that assess and monitor Credit Risk.

In addition, BPRS may also form a financing committee, specifically responsible for deciding financing in certain amounts according to each BPRS's policy. Financing committee membership is not limited to business units but also includes other units related to Credit Risk management, such as the troubled financing resolution unit.

C. Risk Management Policies, Risk Management Procedures, and Risk Limit Determination
In implementing Risk Management policies and procedures, as well as Risk Limit determination for Credit Risk, in addition to implementing Risk Management policies and procedures as referred to in Chapter I letter B, BPRS adds the application of:

Risk Management Strategy
a. Credit Risk Management Strategy includes strategies for all products and/or activities that have Credit Risk exposure, clearly containing the steps the BPRS will take in disbursing funds. b. Credit Risk Management Strategy must align with the BPRS's objectives to maintain financing quality, profit, and business growth.
Policies and Procedures
a. In Credit Risk policies covering the application of Risk Management for Credit Risk to all BPRS business activities, BPRS must have policies and procedures covering the framework for fund disbursement and healthy fund disbursement policies, including policies and procedures for controlling Financing Concentration Risk. BPRS must have clearly established procedures for approving fund disbursement, including changes, renewals, and refinancing. b. The policies and procedures referred to in letter a also include policies and procedures to ensure that all fund disbursement is carried out fairly on an arm's length basis. In the event that BPRS has policies allowing fund disbursement outside normal policies under certain conditions, such policies must clearly contain criteria, requirements, and procedures, including steps to control or mitigate Risk from the aforementioned fund disbursement.
c. BPRS must have policies and procedures to identify Financing Concentration Risk.
d. BPRS must develop and apply policies and procedures accurately so that they can:
1) support healthy fund disbursement;
2) monitor and control Credit Risk; and
3) identify and handle troubled financing.
e. BPRS has sufficient information to conduct a comprehensive assessment of customer Risk profiles. BPRS policies contain information required for healthy financing. Factors to be considered and documented in financing approval at least:
1) financing purpose and payment source;
2) analysis of the customer's ability to repay financing historically based on historical financial developments;
3) analysis of the customer's ability to repay financing in the future, such as cash flow projections for profit-sharing financing;
4) customer business capabilities and field conditions, as well as the customer's position in a specific industry; and
5) financing requirements submitted, including agreements designed to anticipate changes in customer Risk exposure in the future.
Specifically for financing exceeding IDR 5,000,000,000.00 (five billion rupiah), at most IDR 5,000,000,000.00 (five billion rupiah) but included in the 25 (twenty-five) largest debtors, and/or a group of customers with similar Risk profiles, BPRS needs to consider and document other consideration factors in the form of customer Risk profiles, mitigation, and the influence of economic and market condition developments on customers, in financing approval. f. BPRS policies contain factors to be noted in the financing approval process, including:
1) Selection conducted on financing transactions and commitments to take Credit Risk exposure must consider profitability levels. Credit Risk transaction selection is at least conducted by ensuring that estimated cost and revenue analysis is carried out comprehensively, including operational costs, funding costs, individual customer Risk premiums, and capital requirement calculations.
2) Financing facility pricing must be done consistently by considering the Risk level of the relevant transaction, specifically overall customer conditions, asset quality, and the ease of liquidating collateral.
3) The Board of Directors must obtain profit performance analysis results from financing transactions at least every semester. Financing facility pricing can be adjusted if needed to prevent the worsening of BPRS financial conditions.
g. BPRS must have procedures for financing analysis, approval, and administration, which include:
1) Decision-making procedures for financing approval, particularly those conducted through delegation of authority, must be clearly formalized according to BPRS characteristics and supported by the systems owned by BPRS.
2) Separation of functions between work units, units, or employees who conduct analysis, provide approval, and perform financing administration within the framework or mechanism of decision-making procedure delegation for fund disbursement.
3) BPRS conducts periodic monitoring to determine or update the quality of fund disbursement affected by Credit Risk.
4) In developing financing administration systems, BPRS ensures:
a) efficiency and effectiveness of financing administration operations, including monitoring documentation, financing agreements, and collateral binding; b) accuracy and timeliness of information provided for Risk Management information systems; c) adequate separation of functions and/or tasks; d) feasibility of controlling all financing procedures; and e) compliance with statutory regulations, internal BPRS regulations, and Sharia Principles.
5) BPRS must account for and document all quantitative and qualitative information and material evidence in financing archives used in conducting assessment and monitoring.
6) BPRS needs to have special procedures in the event of fund disbursement outside normal procedures. Criteria, procedures, and control steps regarding conditions for fund disbursement outside normal policies must be clearly stated, considering statutory regulations.
Risk Limit Determination
a. BPRS must determine overall fund disbursement limits for all BPRS business activities containing Credit Risk, for both related and unrelated parties, as well as for individual and customer groups. b. BPRS needs to determine Risk tolerance for Credit Risk.
c. Limits for Credit Risk are intended to reduce Risk arising from financing concentration. Established Risk limits must at least cover exposure to counterparty parties (banks and non-banks) and related parties.
d. Risk limits for counterparty parties (banks and non-banks) can be based on the results of quantitative data analysis obtained from reports or financial information, as well as the results of qualitative information analysis that can be sourced from interviews with customers. e. The determination of Credit Risk limits must be documented in writing and completely, facilitating the establishment of audit trails for the benefit of internal and external auditors. f. BPRS must determine Risk limits appropriate to the level of Risk to be taken, Risk tolerance, and BPRS business strategy, considering BPRS's capital capacity to absorb Risk exposure or losses arising, past loss experience, Human Resources capabilities, and compliance with statutory regulations. g. The determination of the level of Risk to be taken and Risk tolerance for Credit Risk refers to the scope of application in general as referred to in Chapter I item B.4.

Example:
BPRS A determines the level of Risk to be taken and Risk tolerance for Credit Risk after comparing historical data, economic and market conditions, and peer groups, for several parameters as follows:

Parameter	Risk Appetite	Risk Tolerance
NPF Net	3%	6%
Ratio of low-quality financing to total financing	7%	10%

Note: This table is only an example and cannot immediately serve as the basis for determining the level of Risk to be taken or Risk tolerance for each BPRS.

D. Risk Identification, Measurement, Monitoring, and Control Processes, and Risk Management Information Systems In applying Risk Management through the processes of risk identification, measurement, monitoring, and control, as well as Risk Management information systems for Credit Risk, in addition to implementing processes as referred to in Chapter I letter C, BPRS adds the application of:

Credit Risk Identification
a. BPRS must identify Credit Risk inherent in all products and activities. This Credit Risk identification is the result of studies on the characteristics of Credit Risk inherent in specific functional activities such as financing and placements in other banks. b. Credit Risk assessment must consider customer financial conditions, the ability to pay on time, and the guarantees or collateral provided. Customer assessment must include analysis of:
1) customer environment, such as competition at the business location;
2) business partner characteristics, such as suppliers or buyers;
3) quality of shareholders and management, including track records, specifically for corporate customers;
4) latest reports or financial information;
5) payment ability, including cash flow projections;
6) business plan quality, particularly for financing exceeding IDR 5,000,000,000.00 (five billion rupiah); and
7) other documents that can be used to support a comprehensive analysis of customer conditions and credibility.
c. Systems for conducting Credit Risk identification must be able to provide adequate information, including financing portfolio composition.
d. In conducting Credit Risk identification, factors that can affect the level of Credit Risk in the future must be considered, including possible changes in economic conditions, changes due to natural disasters, and government policies. e. In identifying Credit Risk, the results of financing quality assessments based on analysis of payment accuracy, customer payment sustainability, and customer compliance with financing agreements must be considered. f. Specifically for Financing Concentration Risk, BPRS must also identify the causes of Financing Concentration Risk to be monitored and considered in determining BPRS financing policies.
Credit Risk Measurement
a. BPRS must have written systems and procedures for measuring Risk that at least allow:
1) viewing Risk exposure from counterparty parties (banks and non-banks);
2) assessment of differences in Credit Risk categories using a combination of qualitative and quantitative data aspects and the selection of specific criteria;
3) distribution of complete Risk measurement results information for monitoring by relevant work units; and
4) comprehensive management of Credit Risk due to counterparty (bank and non-bank) failure.
b. Credit Risk measurement systems must at least consider:
1) characteristics of each type of transaction affected by Credit Risk;
2) counterparty (bank and non-bank) financial conditions and financing agreement terms such as interest rates;
3) financing tenure related to potential changes occurring in the market;
4) collateral and/or guarantee aspects;
5) potential for default; and
6) BPRS's ability to absorb potential failure.
c. Measurement tools must be able to measure quantifiable Inherent Risk exposure, including portfolio composition including composition and concentration levels, and financing quality including the level of troubled assets and foreclosed assets.
d. One model that BPRS can use is statistical or probabilistic methodologies to measure Risk related to specific types of Credit Risk transactions, such as credit scoring tools. e. In using systems to measure Credit Risk, BPRS:
1) periodically evaluates the accuracy of models and assumptions used to project failure; and
2) adjusts assumptions with changes occurring in internal and external conditions.
f. In the event of large Risk exposure or relatively complex transactions, transaction decision-making for Credit Risk is not only based on such systems but must also be supported by other Credit Risk measurement tools. g. BPRS documents assumptions, data, and other information used in Credit Risk measurement systems, including changes. This documentation is subsequently reviewed periodically. h. The application of Credit Risk measurement systems must:
1) support decision-making processes and ensure compliance with delegation of authority regulations;
2) be independent of potential manipulation that would affect results through adequate and effective security procedures; and
3) be evaluated by work units or independent parties against the work units applying the system.
Credit Risk Monitoring
a. BPRS develops and applies comprehensive information systems and procedures to monitor the composition and conditions of counterparty parties (banks and non-banks) against all BPRS financing portfolios. Such systems must align with BPRS portfolio characteristics, size, and complexity. b. Monitoring procedures must be able to identify troubled assets or other transactions to ensure that such troubled assets receive attention, including rescue actions and the formation of adequate reserves.
c. Credit Risk monitoring systems must at least contain measures to:
1) ensure that BPRS knows the latest financial conditions of counterparty parties (banks and non-banks);
2) monitor compliance with financing agreement requirements;
3) assess collateral adequacy compared to counterparty (bank and non-bank) obligations;
4) identify payment delays and classify troubled financing accurately and timely;
5) handle troubled financing quickly; and
6) identify overall Credit Risk levels.
d. BPRS must also monitor Credit Risk exposure compared to established Credit Risk limits. e. Credit Risk exposure monitoring must be carried out continuously by comparing actual Credit Risk with established Credit Risk limits. f. SKMR or PEMR prepares reports on Credit Risk developments periodically, including cause factors, submitted to Board of Directors members overseeing Risk Management functions and Risk Management committees, if any. g. Basic principles in conducting Credit Risk monitoring for BPRS are as follows:
1) Monitoring processes must be written in procedures and documented.
2) Monitoring processes must be able to identify early changes in Risk profiles caused by potential or actual declines in Credit Risk.
3) Monitoring procedures must be periodically evaluated by independent parties against the work units applying the monitoring procedures;
4) In the event that BPRS applies monitoring procedures to determine asset quality and provision amounts, there must be formal procedures ensuring that asset quality and provision determinations using

measurement methods established by the BPRS are stricter than or equal to the provisions of applicable legislation; and
5) Reports on the results of Credit Risk measurement, such as financing portfolio condition reports, are submitted periodically to the Board of Directors members who oversee the Risk Management function.

Credit Risk Control
a. BPRS ensures that work units or employees handling financing and other work units conducting transactions affected by Credit Risk have functioned adequately and that Credit Risk exposure is kept consistent with established limits and meets prudential principles and Sharia Principles. b. Credit Risk control can be conducted through Risk mitigation, setting authority levels in the fund disbursement approval process, and periodic analysis of financing concentration.
c. BPRS has an effective system to detect troubled financing so that it can be followed up immediately. In addition, BPRS separates employees handling the resolution of troubled financing from employees handling the financing approval function.
BPRS with core capital above IDR 80,000,000,000.00 (eighty billion rupiah) must separate the troubled financing resolution function from the financing approval function. The results of handling troubled financing are accounted for and subsequently used as input for the interest of work units responsible for disbursing or restructuring financing.
Risk Management Information System
a. In improving the effectiveness of the Credit Risk measurement process, BPRS must have a Risk Management information system that provides complete, accurate, current, and comprehensive reports and data to support decision-making by the Board of Directors and other officials. b. The Risk Management information system must generate reports or information on monitoring actual exposure against established limits and breaches of Risk exposure limits that require the attention of the Board of Directors.
c. The Risk Management information system must provide data accurately and timely regarding the total amount of counterparty financing exposure (banks and non-banks), financing portfolios, and reports on Credit Risk limit exceptions.
d. BPRS must have a Risk Management information system that allows the Board of Directors to identify the presence of Risk concentration in the financing portfolio.

E. Internal Control System

BPRS establishes an independent and continuous assessment system regarding the effectiveness of Credit Risk Management implementation. This assessment must at least contain an evaluation of the financing administration process, an assessment of the accuracy of Credit Risk monitoring, and the effectiveness of the implementation by work units or employees conducting individual financing quality monitoring.
BPRS ensures that work units or employees handling the financing function and other transactions exposed to Credit Risk are managed adequately so that Credit Risk exposure remains consistent with established limits and meets prudential principles and Sharia Principles.
Internal audit of the Credit Risk process is conducted periodically, which among others includes identification regarding:
a. fund disbursement activities are in accordance with the established Credit Risk Management policies; b. all authorizations are conducted within the limits of the guidelines provided;
c. individual financing quality and portfolio composition are reported accurately to the Board of Directors;
d. weaknesses in the Credit Risk Management process, Credit Risk Management policies, including any exceptions to policies and procedures, and breaches of Credit Risk limits; and e. compliance with Credit Risk limits.

CHAPTER III
OPERATIONAL RISK

Operational Risk is Risk caused, among others, by the inadequacy and/or malfunction of internal processes, human resource errors, system failures, and/or external problems affecting BPRS operations.
Operational Risk can cause direct or indirect financial losses and potential losses from the loss of opportunities to obtain profits.
Operational Risk can be inherent in every functional activity of BPRS, such as financing activities (fund disbursement), operations and services, information technology, management information systems, and HR management. In addition, Operational Risk is also inherent in the complexity of business and institutional structures viewed from the scale of business and organizational structure, diversity of BPRS products and/or services, office networks, and corporate actions.
Operational Risk is an important Risk because it is related to all BPRS business processes and procedures, inherent in all BPRS business lines, and reflects changes in BPRS Risk profiles.
All employees in BPRS business units and support activities must be part of the implementation of Operational Risk Management.
Operational Risk at BPRS is generally caused by 4 (four) main sources, namely:
a. Human Resources
HR can be a source of Operational Risk as a result of HR's inability to perform tasks according to responsibilities. Operational Risk caused by HR among others is caused by:

occupational health and safety issues;
employee turnover;
internal misconduct (fraud);
inadequate number of HR; and
low HR competence.

b. Internal Processes
Failure of processes or procedures internally at BPRS becomes a cause of Operational Risk which among others is caused by:

ineffective organizational structure;
inappropriate division of labor;
incomplete documentation;
inaccurate reports;
overlapping functions;
inadequate internal procedures; and
abuse of authority.
c. Systems and Infrastructure
Failure to use information technology and infrastructure used by BPRS can be a cause of Operational Risk which among others is caused by:
absence of systems;
programming errors;
inadequate data control;
service disruptions; and
weak system security.
d. External Events
External events can be a source of Operational Risk as a result of events outside the direct control of BPRS which generally have low frequency but high impact. Examples of such external events among others:
fire;
natural disasters; and
social and political conditions.

Operational Risk can cause the following impacts:
a. Direct losses, i.e., financial losses that directly impact the income statement such as asset value decline, business activities, asset damage or loss, payment of administrative fines, and payment of compensation to third parties. b. Indirect losses, i.e., losses that are difficult to calculate financially but reduce the effectiveness and efficiency of BPRS business, including loss of income such as work process inefficiencies, reporting errors, loss of opportunities to obtain profits, loss of potential customers, and resignation of potential employees.
The main objective of Risk Management for Operational Risk is to minimize the possibility of negative impacts from the malfunction of internal processes, human error, system failures, and/or external events.
Operational Risk is inherent in all business lines and support activities of BPRS, thus touching upon other Risks such as Compliance Risk, Credit Risk, Reputational Risk, Liquidity Risk, and Strategic Risk.
Weaknesses in HR, internal processes, systems and infrastructure, and external events can cause weaknesses in compliance aspects, compliance violations, and BPRS reputational issues that can impact Compliance Risk, Credit Risk, Reputational Risk, Liquidity Risk, and Strategic Risk.

B. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and DPS for Operational Risk, in addition to implementing supervision as referred to in Chapter I letter A, BPRS adds the implementation of:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a. The Board of Directors, Board of Commissioners, and DPS of BPRS understand Operational Risk and actively conduct approval and evaluation of Operational Risk policies and strategies periodically. b. The Board of Directors and Board of Commissioners are responsible for developing an organizational culture aware of Operational Risk and fostering commitment in managing Operational Risk in accordance with BPRS business strategy.
c. The Board of Directors and Board of Commissioners are responsible for ensuring that the implementation of Operational Risk Management is adequate in accordance with business characteristics, complexity of business activities, and BPRS Risk profile.
d. Operational Risk policies and strategies must consider the impact on capital by paying attention to external and internal changes. e. The Board of Directors must elaborate and communicate Operational Risk Management policies to all work units as well as employees or functions at BPRS and evaluate the implementation of said policies. f. The Board of Directors must be able to identify and manage Operational Risk inherent in new products and activities and ensure that the Risk of new products and activities has gone through adequate Risk control processes before the product is issued or the activity is carried out. g. The Board of Directors must ensure the placement and improvement of adequate HR competence and integrity in all functional activities of BPRS. h. The Board of Directors must create a culture of objective disclosure of Operational Risk in all organizational elements so that Operational Risk can be identified quickly and mitigated appropriately.
i. The Board of Directors establishes effective reward policies including remuneration and punishment integrated into the performance evaluation system to support optimal Risk Management implementation.
j. The Board of Commissioners ensures that BPRS remuneration policies are in accordance with BPRS Risk Management strategy. k. The Board of Commissioners is responsible for conducting periodic approval and evaluation of BPRS Operational Risk Management policies including Operational Risk tolerance limits at least 1 (one) time in 1 (one) year or whenever there are changes that significantly affect BPRS business activities.
l. The DPS is responsible for evaluating Operational Risk Management policies and strategies related to the fulfillment of Sharia Principles, such as profit-sharing calculation applications and recording of non-halal income.

m. The DPS is responsible for conducting periodic evaluation of BPRS Operational Risk Management policies related to the fulfillment of Sharia Principles 1 (one) time in 1 (one) year or whenever there are changes that significantly affect BPRS business activities.
2. Human Resources
a. BPRS must have a code of ethics applied to all employees at every level of the organization; and b. BPRS must apply sanctions consistently to employees proven to have committed misconduct and violations.
3. Operational Risk Management Organization
Regarding the organization of Operational Risk Management, business unit or support unit management is responsible for the Operational Risk Management process for daily operations and reports specific operational Risk issues in the unit according to the reporting level.

C. Risk Management Policies, Risk Management Procedures, and Risk Limit Establishment
In implementing Risk Management policies and procedures and Risk limit establishment for Operational Risk, in addition to implementing Risk Management policies and procedures and Risk limit establishment as referred to in Chapter I letter B, BPRS adds the implementation of:

Risk Management Strategy
The formulation of strategy for Operational Risk refers to the general scope of implementation as referred to in Chapter I item B.1.
Policies and Procedures
a. BPRS must establish Operational Risk Management policies that must be internalized in the business process of all BPRS business lines and support activities. b. BPRS must have procedures that are derived from Operational Risk Management policies which can be general controls such as separation of functions or the requirement to take leave and specific controls such as accounting of customer financing documents.
c. BPRS must have procedures to measure transaction settlement Risk exposure.
d. BPRS conducts an assessment of the stages in the transaction settlement process, specifically regarding the final deadline for payment orders, final deadline for receipt, and time for recording fund payments. e. BPRS must formulate a procedure for monitoring new transaction settlements or if there are transactions whose payments have not been completed. f. BPRS must provide transaction settlement procedures caused by worsening BPRS liquidity conditions. g. BPRS confirms transactions timely according to established procedures and monitors said transactions consistently. h. BPRS is expected to have business continuity management (BCM), i.e., an integrated and comprehensive protocol to ensure the continuity of BPRS operations in conducting business and serving customers, to anticipate unfortunate conditions such as natural disasters, fires, robberies, or technical problems experienced by BPRS that affect the continuity of BPRS operational activities. In implementing BCM, BPRS has policies that at least include:

business impact analysis;
assessment of Operational Risk that may occur due to disruptions in BPRS operations;
recovery strategies executed by BPRS for each form of disruption that occurs;
documentation (among others disaster recovery plans and emergency plans); and
periodic testing of the BCM approach used to ensure it can be operated effectively during disruptions.
Effective BCM needs to be supported by several things, one of which is the formulation of a business continuity plan (BCP). The BCP procedure components that BPRS must have are disaster recovery plans as referred to in the Financial Services Authority Regulation regarding standards for the implementation of information technology for rural credit banks and Sharia financing banks.
i. To mitigate Operational Risk originating from the complexity of internal processes, BPRS must have Operational Risk Management policies in accordance with vision, mission, business strategy, capital adequacy, and HR adequacy that at least include:
controls to prevent Operational Risk for both all internal processes and those directly related to customers;
procedures for resolving internal process transactions among others to ensure the effectiveness of the transaction settlement process;
accounting execution procedures to ensure accurate accounting records, among others consisting of the suitability of accounting methods used, accounting processes executed, and documentation of supporting documents;
procedures for the provision of products and other activities conducted by BPRS; and
procedures for prevention and resolution of misconduct (fraud).
j. To reduce the possibility of Operational Risk originating from HR, BPRS Risk Management policies must at least contain policies regarding recruitment and placement according to organizational needs, competitive remuneration and incentive structures, training and development, periodic rotation, career and succession planning policies, and handling of labor termination and union issues. k. To reduce the possibility of Operational Risk originating from systems and infrastructure, BPRS Risk Management policies must be supported by access procedures among others for management information systems, accounting information systems, and Risk management systems.
l. To reduce the possibility of Operational Risk originating from customer and prospective customer profiles, Risk Management policies must include the obligation for BPRS to conduct Customer Due Diligence (CDD) or Enhanced Due Diligence (EDD) periodically and consistently according to Operational Risk exposure. The implementation of CDD or EDD refers to all requirements and guidelines as referred to in applicable legislation and Financial Services Authority Regulation regarding the implementation of anti-money laundering and counter-terrorism financing programs in the financial services sector. CDD or EDD must be supported by an effective internal control system, specifically efforts to prevent BPRS against internal misconduct (internal fraud).
m. BPRS ensures that the use of accounting methods must be in accordance with applicable accounting standards and pay attention to the following matters:
conduct periodic evaluations to ensure the accuracy of methods used to assess transactions;
conduct periodic evaluations of the suitability of accounting methods used with applicable financial accounting standards;
conduct periodic reconciliation of transaction data;
identify and analyze any irregularities in transactions that occur;
maintain all documents and archives (files) related to account details, general ledgers, asset classification administration, and provision formation documentation, to facilitate the audit trail process.

Risk Limit Establishment
a. BPRS must establish Operational Risk limits by considering Risk exposure and past loss experience caused by Operational Risk. The establishment of said limits must be evaluated and adjusted in the event of significant changes in Operational Risk exposure. b. BPRS must establish Risk limits in accordance with the level of Risk to be taken, Risk tolerance, and BPRS business strategy by paying attention to BPRS capital ability to absorb Risk exposure or losses arising, past loss experience, HR ability, and compliance with applicable legislation.
c. The establishment of the level of Risk to be taken and Risk tolerance for Operational Risk refers to the general scope of implementation as referred to in Chapter I item B.2.
Example:
After comparing historical data, economic and market conditions, and peer groups, BPRS A establishes the level of Risk to be taken and Risk tolerance for Operational Risk by establishing several parameters among others:

Parameter	Risk Appetite	Risk Tolerance
Human error causing impact	Max 2% impact on BPRS finances	Max 5% impact on BPRS finances
Core Banking System	Max 1 system error	Max 2 system errors

Note: This table is only an example and cannot immediately be used as a basis for determining the level of Risk to be taken nor Risk tolerance for each BPRS.

D. Risk Identification, Measurement, Monitoring, and Control Processes, as well as Risk Management Information System In implementing Risk Management through the processes of Risk identification, measurement, monitoring, and control, as well as Risk Management information system for Operational Risk, in addition to implementing processes as referred to in Chapter I letter C, BPRS adds the implementation of:

Identification and Measurement of Operational Risk
a. BPRS must conduct identification and measurement of parameters affecting Operational Risk exposure, among others frequency and impact of:

system failures and errors;
administrative system weaknesses;
failure of customer relationships;
accounting errors;
delays and errors in payment settlement;
misconduct (fraud); and
accounting manipulation.
b. BPRS develops a database regarding:
types and impacts of losses, caused by Operational Risk based on Risk identification results, consisting of predictable and hard-to-predict loss data;
violations of control systems; and/or
other operational issues that can cause losses in the future.
c. BPRS considers various internal and external factors in conducting identification and measurement of Operational Risk among others:
BPRS organizational structure, Risk culture, HR management, organizational changes, and employee turnover;
BPRS customer characteristics, products and/or activities, and complexity of BPRS business activities and transaction volume;
design and implementation of systems and processes used; and/or
external environment, industry trends, market structure including social and political conditions.
d. Methods that BPRS can use to identify and measure Operational Risk, among others:
self risk assessment consisting of checklists to identify strengths and weaknesses in the BPRS Operational Risk environment, such as the role of the Board of Directors and Board of Commissioners, organizational structure, HR, and information and communication flows at BPRS;
risk mapping consisting of mapping according to Risk types against functional activities, organizational structure, and transaction process flows;
key risk indicators consisting of statistics or matrices that provide data on BPRS Operational Risk positions, such as the number of transaction cancellations, employee turnover rates, and frequency of errors; and
scorecards that provide methods to translate qualitative assessments or criteria into quantitative matrices, which can be used to allocate capital requirements for each functional activity.

Operational Risk Monitoring
a. BPRS conducts continuous monitoring of Operational Risk against all Operational Risk exposure and losses that can be caused by main functional activities, among others by implementing internal control systems and providing periodic reports on losses caused by Operational Risk. b. BPRS conducts periodic evaluations of Operational Risk causes and loss impacts.
c. BPRS has a reliable monitoring mechanism for Operational Risk and operational losses that is able to generate informative and current Operational Risk profiles for the Board of Directors to establish necessary control steps.
d. SKMR or PEMR must compile reports on losses from Operational Risk and submit said reports to the Board of Directors and Risk Management committee if any.
Operational Risk Control
a. BPRS conducts effective Operational Risk control by at least considering:

Risks that can be accepted;
Risks that must be avoided including resolution steps; and
steps to mitigate Risk among others by transferring Risk to third parties such as insurance.
b. BPRS controls Risk consistently in accordance with the level of Operational Risk to be taken and the results of Operational Risk identification and measurement as determined in Risk Management policies.

c. BPRS establishes delegation of authority and clear control measures for parties responsible for implementing Operational Risk Management across all work units, employees, or BPRS functions.

d. BPRS may develop programs to mitigate Operational Risk, including among others the security of information technology processes. In the event BPRS develops information technology process security, BPRS ensures the level of security for electronic data processing.

e. Controls over information systems must ensure:

periodic assessment of information system security, accompanied by corrective actions when necessary;
backup procedures and contingency plans for worst-case scenarios or contingency plans to ensure BPRS operational activities continue and to prevent significant disruptions, and are tested periodically;
reporting to the Board of Directors regarding activities as referred to in items 1) and 2); and
storage of information and documents related to analysis, programming, and execution of data processing.

f. BPRS has a support system, which at least includes:

early identification of errors;
efficient, accurate, and timely processing and settlement of all transactions; and
confidentiality, truthfulness, and security of transactions.

g. In implementing Operational Risk controls, BPRS may develop programs to mitigate Operational Risk, including among others information technology process security, insurance, and outsourcing of some BPRS operational activities.

Risk Management Information System
a. BPRS has adequate information systems and technology, in accordance with the nature and volume of transactions.

b. The Risk Management information system must be able to generate complete and accurate reports used for Risk monitoring to detect and correct deviations in a timely manner to reduce the potential for losses.

c. BPRS has a reporting mechanism for Operational Risk that must be able to provide information according to user needs, including among others:

operational Risk profiles and losses caused by Operational Risk;
results from various Operational Risk measurement methods and trends, and/or summaries of internal audit findings;
reports on the status and effectiveness of the implementation of action plans for Operational Risk issues;
reports on procedure deviations;
reports on deviations (fraud); and
recommendations from the Risk Management Committee or Operational Risk Manager for Operational Risk, external auditor guidance letters, particularly regarding BPRS operational controls, and guidance letters from the Financial Services Authority.

d. The Risk Management information system must be able to provide complete, accurate, current, and comprehensive reports on Operational Risk exposure so that decision-making by the Board of Directors can be done in a timely manner.

e. The Risk Management information system must be able to provide storage of information and documents related to analysis, programming, and execution of data processing.

E. Internal Control System

In implementing Risk Management through the implementation of the internal control system for Operational Risk, in addition to implementing internal controls as referred to in Chapter I letter D, BPRS needs to have a routine rotation system to avoid the potential for self-dealing, collusion, or concealment of documentation or transactions that are not normal.
BPRS must conduct periodic evaluations of procedures, documentation, data processing systems, contingency plans for worst-case scenarios or contingency plans, and other operational practices to reduce the likelihood of human error causing Operational Risk.

CHAPTER IV
COMPLIANCE RISK

Compliance Risk is the Risk resulting from BPRS not complying with and/or not implementing regulations, internal BPRS regulations, and Sharia Principles, including Risks resulting from weaknesses in legal aspects.
Compliance Risk stems from legal aspects, namely BPRS behavior or activities that deviate from or violate regulations, internal BPRS regulations, and Sharia Principles, and organizational behavior, namely BPRS behavior or activities that deviate from or contradict generally applicable standards.
The main objective of Compliance Risk Management is to ensure that the Risk Management process can minimize the possibility of negative impacts from BPRS behavior that deviates from or violates generally applicable standards and/or regulations, internal BPRS regulations, and Sharia Principles.
Sources of Compliance Risk include among others:

a. Legal Behavior
As a legal subject, BPRS can engage in legal behavior consisting of errors that can be interpreted broadly to include 3 (three) elements, namely intent, negligence, and accountability. Legal behavior carried out by BPRS can include violations of public law, including among others regulations of the Financial Services Authority, or private law, including among others agreements with third parties.

b. Organizational Behavior
The Board of Directors as the representative of the organization must establish ways to achieve organizational objectives implemented in the form of organizational behavior. In this regard, the Board of Directors has the authority to influence the performance of the BPRS organization. There are several factors influencing the Board of Directors' decisions in conducting business related to Compliance Risk, including among others business profile factors, economic factors, psychological factors, and sociological factors.

c. Weakness in Legal Aspects
Weakness in legal aspects can occur in agreements made by BPRS regarding the validity conditions and content of agreements with third parties. BPRS's weak position in making agreements with third parties can result in among others financial losses. Weakness in legal aspects can lead to litigation processes in court.

d. Supporting Regulations for BPRS Products and Activities In conducting business activities, BPRS must refer to regulations. In the event that there are BPRS products and activities not yet supported by regulations, this can cause legal Risks for BPRS.

The impact of Compliance Risk can be direct losses and indirect losses. Direct losses are financial losses that directly impact profit or loss, including among others decreased profits and business losses, and decreased asset values. Indirect losses are losses that are difficult to calculate financially and do not directly impact profit or loss, including among others inefficient work processes, and lost opportunities to obtain profits.

B. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and DPS for Compliance Risk, in addition to implementing supervision as referred to in Chapter I letter A, BPRS adds the implementation, namely:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board

a. The Board of Directors and Board of Commissioners must ensure that Risk Management for Compliance Risk is carried out in an integrated manner with other Risk Managements that can impact BPRS's Compliance Risk profile.

b. The Board of Directors and Board of Commissioners must ensure that every compliance issue that arises can be resolved effectively by the relevant work unit and that monitoring is conducted on corrective actions taken.

c. The Board of Directors has the authority and responsibility to:

Ensure that Risk Management is carried out in an integrated manner with other Risk Managements present in BPRS's Compliance Risk profile, such as compliance with BPRS financing regulations related to Credit Risk.
Ensure that every compliance issue that arises can be resolved effectively by the relevant work unit and that monitoring is conducted on corrective actions taken.
Ensure that the Compliance Risk Management function has been applied independently, reflected among others by the separation of functions between work units that identify, measure, monitor, and control Compliance Risk and work units that conduct and settle transactions with Compliance Risk exposure.

d. Board of Directors members overseeing the compliance function play an important role in Risk Management for Compliance Risk with responsibilities at least as referred to in the Financial Services Authority Regulation regarding the implementation of corporate governance for Sharia Rural Financing Banks and the Financial Services Authority Circular Letter regarding the implementation of the compliance function for Sharia Rural Financing Banks.

e. Board of Directors members overseeing the compliance function must submit reports on the implementation of their duties to the Financial Services Authority as referred to in the Financial Services Authority Regulation regarding the implementation of corporate governance for Sharia Rural Financing Banks, the Financial Services Authority Circular Letter regarding the implementation of the compliance function for Sharia Rural Financing Banks, and other related regulations.

f. The Board of Commissioners is responsible for approving and periodically evaluating BPRS's Compliance Risk Management policies, including Compliance Risk tolerance limits, at least 1 (one) time in 1 (one) year or whenever there are changes that significantly affect BPRS's business activities.

g. The DPS is responsible for evaluating policies and strategies for Risk Management for Compliance Risk related to the fulfillment of Sharia Principles, such as the preparation of financing agreements in accordance with Sharia Principles and the settlement of disputes through religious courts or outside religious courts, namely through arbitration or alternative dispute resolution.

h. The DPS is responsible for periodically evaluating BPRS's Compliance Risk Management policies related to the fulfillment of Sharia Principles 1 (one) time in 1 (one) year or whenever there are changes that significantly affect BPRS's business activities.

Human Resources
Employees in the Compliance Unit are not allowed to be placed in positions vulnerable to conflicts of interest in implementing compliance function responsibilities.
Compliance Risk Management Organization

a. BPRS must have an adequate Compliance Risk Management function with clear authority and responsibilities for each work unit or unit implementing the Compliance Risk Management function.

b. BPRS must have an independent Compliance Unit with duties, authorities, and responsibilities at least as referred to in the Financial Services Authority Regulation regarding the implementation of corporate governance for Sharia Rural Financing Banks and the Financial Services Authority Circular Letter regarding the implementation of the compliance function for Sharia Rural Financing Banks.

C. Risk Management Policies, Risk Management Procedures, and Risk Limit Determination
In implementing Risk Management policies and procedures and Risk limit determination for Compliance Risk, in addition to implementing Risk Management policies and procedures and Risk limit determination, BPRS adds the implementation:

Risk Management Strategy
The formulation of strategies for Compliance Risk refers to the general scope of implementation as referred to in Chapter I item B.1.
Policies and Procedures

a. BPRS has an adequate compliance work plan.

b. BPRS ensures the effectiveness of the implementation of Risk Management for Compliance Risk, especially in the formulation of policies and procedures to be in accordance with generally applicable standards, and/or regulations, internal BPRS regulations, and Sharia Principles, including among others related to:

accuracy of limit determination;
policies to exclude the execution of transactions exceeding limits;
implementation of compliance checking policies through periodic procedures;
timely communication of policies to all employees at every organizational level;
adequacy of controls over the development of new products and/or activities; and
adequacy of reports and data systems, especially in controlling the accuracy, completeness, and integrity of data.

Risk Limit Determination

a. The determination of limits for Compliance Risk refers to the general scope of implementation as referred to in Chapter I item B.4.

b. BPRS must comply with regulations, internal BPRS regulations, and Sharia Principles. This requires BPRS to have no tolerance for Compliance Risk and to take quick and precise steps in handling Compliance Risk.

D. Process of Identifying, Measuring, Monitoring, and Controlling Risk, and Risk Management Information System

Identification of Compliance Risk
BPRS must identify and analyze several factors that can increase Compliance Risk exposure and quantitatively impact BPRS's profit or loss and capital, such as:
a. BPRS business activities, namely the type and complexity of BPRS business activities including new products and/or activities; b. BPRS non-compliance, namely the volume and materiality of BPRS's non-compliance with regulations, internal BPRS regulations, Sharia Principles, and healthy business ethics practices; and
c. litigation, namely the volume and materiality of litigation claims.
Measurement of Compliance Risk
In measuring Compliance Risk, BPRS uses among others parameters such as the type, significance, and frequency of violations of regulations, internal BPRS regulations, and Sharia Principles or BPRS's compliance track record, behavior underlying violations, and violations of generally applicable standards. In addition, to measure Compliance Risk regarding weaknesses in legal aspects, BPRS can among others use parameters such as the cancellation of agreements caused by agreement weaknesses, potential losses due to litigation claims, and the occurrence of changes in regulations causing BPRS to be out of alignment with those regulations.
Monitoring of Compliance Risk

a. In implementing the Compliance Risk Management function, continuous monitoring of Compliance Risk must be conducted against all Compliance Risk exposures.

b. The Risk Management Committee or Operational Risk Manager prepares periodic progress reports on Compliance Risk, including factors causing Compliance Risk, submitted to Board of Directors members overseeing the Risk Management function and the Risk Management Committee if any.

Control of Compliance Risk
BPRS must ensure the effectiveness of the control system:
a. capable of monitoring deviant decision-making that can identify and measure increases in the frequency and volume of Risk exposure; b. responsive to deviations from internal BPRS regulations; and
c. responsive to deviations in BPRS's internal control system.
Risk Management Information System
The implementation of the Risk Management information system for Compliance Risk refers to the general scope of implementation as referred to in Chapter I item C.5.

E. Internal Control System
In implementing Compliance Risk Management, in addition to implementing internal controls as referred to in Chapter I letter D, BPRS must have an internal control system for Compliance Risk, including among others to ensure BPRS's responsiveness to deviations from generally applicable standards, and/or regulations, internal BPRS regulations, and Sharia Principles.

CHAPTER V
LIQUIDITY RISK

Liquidity Risk is the Risk resulting from BPRS's inability to meet maturing obligations from cash flow funding sources and/or high-quality liquid assets that can be pledged, without disrupting BPRS's activities and/or financial conditions, including Risks resulting from changes in the rate of return paid by BPRS to customers, due to changes in the rate of return received by BPRS from fund disbursement, which can affect the behavior of BPRS's third-party fund customers (Rate of Return Risk).
Liquidity Risk can be inherent in financing activities, fund disbursement, and funding activities.
Liquidity Risk is also called Second Tier Risk because it is often caused by other Risks, including among others Credit Risk and Reputational Risk. This Risk is also closely related to external factors including among others macroeconomic conditions and policies affecting the availability of funding sources and/or market liquidity.
The main objective of Liquidity Risk Management is to minimize the possibility of BPRS's inability to obtain cash flow funding sources. BPRS needs to ensure daily fund sufficiency in both normal conditions and crisis conditions in meeting obligations in a timely manner from various available funding sources.
The implementation of Risk Management for Liquidity Risk must be integrated with the overall implementation of Risk Management. In implementing Risk Management for Liquidity Risk, BPRS needs to evaluate the Liquidity Risk profile faced in relation to capital adequacy.
Sources of Liquidity Risk can stem from BPRS's inability to obtain cash flow funding sources, which can be caused among others by:
a. inability to generate cash flows from productive assets or from the sale of assets including liquid assets; and/or b. inability to generate cash flows from fund gathering, interbank transactions, and received loans.
BPRS's inability to obtain funding to meet maturing obligations will decrease public trust, thereby further increasing Liquidity Risk, and subsequently can affect other financial aspects that can threaten the continuity of BPRS's business.
The interconnection of Liquidity Risk with other Risks includes among others:

a. Reputational Risk
Negative public opinion regarding BPRS's liquidity or financial conditions can trigger fund providers to demand BPRS provide higher returns on funds invested in BPRS. In the event public opinion worsens, there is a possibility for depositors to withdraw funds, thereby affecting BPRS's liquidity.

b. Strategic Risk
Strategies and policies established by BPRS can significantly impact BPRS's liquidity position. For example, BPRS's strategy to increase the financing portfolio or to conduct new activities can increase Liquidity Risk if BPRS does not obtain adequate funding sources to finance those activities. Therefore, BPRS needs to consider the impact of BPRS's strategies or policies on BPRS's funding capacity.

c. Credit Risk
BPRS's Liquidity Risk can increase with increasing Credit Risk, which among others is caused by the growth of untested assets or financing or BPRS's lack of adequate experience, thereby worsening asset quality and increasing the potential for financing failure. If Credit Risk increases, Liquidity Risk also increases because BPRS must increase funding costs to maintain the funding sources BPRS needs to anticipate potential losses from non-performing financing.

d. Operational Risk
In the event of changes to BPRS products and/or activities, BPRS must adjust systems so that all transactions can be handled well. Significant problems can occur if the system for processing transactions fails, causing transaction delays. In the event customers experience difficulty conducting transactions, customers may close accounts, thereby causing Liquidity Risk for BPRS. Operational Risk caused by BPRS employees, such as fraud, can also increase Liquidity Risk if significant operational losses occur.

e. Compliance Risk
Compliance Risk can affect Liquidity Risk in the event of compliance violations of regulations impacting BPRS's Liquidity Risk.

B. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and DPS for Liquidity Risk, in addition to implementing supervision as referred to in Chapter I letter A, BPRS adds the implementation, namely:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board

a. The Board of Directors and Board of Commissioners are responsible for ensuring that the implementation of Risk Management for Liquidity Risk is in accordance with strategic objectives, scale, business characteristics, and BPRS's Liquidity Risk profile, including ensuring the integration of the implementation of Risk Management for Liquidity Risk with other Risks that can impact BPRS's liquidity position.

b. The Board of Directors must formulate policies and strategies for determining profit-sharing ratios for third-party fund customers by considering historical bank income data, market returns, and/or market interest rates, and approved by the Board of Commissioners.

c. The Board of Directors ensures that the implementation of Risk Management is effective, including among others monitoring developments and issues in BPRS's business activities related to Liquidity Risk.

d. In Liquidity Risk management, the Board of Directors has authority and responsibility at least covering:

monitoring BPRS's liquidity position and Liquidity Risk based on current adequacy and evaluation of funding strategy implementation, especially in unfavorable market conditions;
conducting periodic evaluations of BPRS's liquidity position and Liquidity Risk;
conducting immediate evaluations of liquidity conditions and BPRS's Risk profile in the event of significant changes, including among others the following conditions:
a) increase in funding costs; b) increase in asset or liability concentration; c) increase in liquidity gap; d) limitation of alternative funding sources; e) material breach of limits; and/or f) changes in market conditions that can cause problems in the future;
adjusting Risk Management policies and strategies for Liquidity Risk as needed based on evaluation results of Liquidity Risk; and
submitting reports to the Board of Commissioners regarding Liquidity Risk and the implementation of policies and procedures for Risk Management for Liquidity Risk, including among others evaluations of policies, strategies, procedures, and liquidity conditions both periodically and in the event of significant changes.

e. The Board of Commissioners is responsible for approving and periodically evaluating BPRS's Liquidity Risk Management policies, including Liquidity Risk tolerance limits, at least 1 (one) time in 1 (one) year or whenever there are changes that significantly affect BPRS's business activities.

significantly affecting the business activities of BPRS. f. The DPS is responsible for conducting periodic evaluations of the BPRS's Liquidity Risk Management policies related to the fulfillment of Sharia Principles 1 (one) time within 1 (one) year or whenever there are changes that significantly affect the business activities of BPRS.

Human Resources
The adequacy of Human Resources for Liquidity Risk refers to the general scope of implementation as referred to in Chapter I item A.2.
Liquidity Risk Management Organization
The adequacy of the Liquidity Risk Management organization refers to the general scope of implementation as referred to in Chapter I item A.3.

C. Risk Management Policies, Risk Management Procedures, and Risk Limit Determination
In implementing Risk Management policies and procedures and determining Risk Limits for Liquidity Risk, in addition to implementing the Risk Management policies and procedures and Risk Limit determination as referred to in Chapter I letter B, BPRS adds the implementation of:

Risk Management Strategy
BPRS formulates strategies for Liquidity Risk with reference to the scope as referred to in Chapter I item B.1.
Policies and Procedures
a. Liquidity Risk Management policies and procedures must be formulated in accordance with the vision, mission, business strategy, capital adequacy, human resource capabilities, and the level of Risk to be taken by BPRS. b. Liquidity Risk Management policies and procedures include at least:

Policies regarding Human Resources and organizations related to the management of Liquidity Risk, including the responsibilities of each unit or function involved, such as the Board of Directors, Board of Commissioners, and internal audit.
Liquidity management policies and procedures that cover at least:
a) asset and liability composition; b) the level of liquid assets that BPRS must maintain; c) diversification and stability of funding sources; d) liquidity management across various funding sources; e) Daily Liquidity Risk Management; f) Liquidity Risk limits; and g) assessment of liquidity factors in accordance with regulations regarding the system for assessing the health level of Sharia-based microfinance banks.

c. Determination of indicators that serve as early warning indicators for Liquidity Risk as a tool for identifying problems and determining Liquidity Risk mitigation. Early warning indicators include internal indicators and external indicators. Internal indicators include, for example, deteriorating asset quality, increased concentration on certain assets and funding sources, repeated breaches of limits, overall increase in funding costs, and/or increasingly worsening cash flow positions as a result of significant maturity mismatch, especially on a short-term scale. External indicators include, for example, negative public information regarding BPRS, increased withdrawal of deposits before maturity, and/or limited access to obtain long-term funding.

d. Liquidity Risk measurement methods must be adjusted to BPRS's fund management strategy so that they can accurately reflect BPRS's Liquidity Risk profile.

e. Risk Management information systems and other systems that are adequately necessary for the identification, measurement, monitoring, and control of Liquidity Risk, including liquidity reporting.

f. Emergency funding plans, including those explaining the approach and strategy in facing crisis conditions that impact BPRS's Liquidity Risk. Policies regarding emergency funding plans must cover at least BPRS's action plans in liquidity crisis situations and the methods used to obtain funding in such situations.

g. Liquidity Risk Management policies and procedures that have been approved by the Board of Commissioners must be communicated and implemented well by BPRS units handling functional activities with Liquidity Risk exposure. Furthermore, Liquidity Risk Management policies must be evaluated and updated periodically with changes in liquidity conditions, vision, mission, and business strategy, as well as overall capital capabilities. BPRS must also have clear policies regarding funding responsibilities, reporting, and pricing policies.

Risk Limit Determination
a. Risk Limit determination must be established and implemented consistently by paying attention to at least the following:

periodic funding needs or excess liquidity; and
potential liquidity shortages that occur based on past experience.
Limit determination must be evaluated and adjusted in the event of significant overall market condition changes.

b. Policies, procedures, and processes for determining Liquidity Risk Limits must be documented in writing and completely so as to facilitate audit trails.

c. The level of Risk to be taken by BPRS is reflected, for example, in the composition of assets and liabilities and the gapping strategy performed by BPRS.

d. Risk Tolerance for Liquidity Risk must reflect the level of Liquidity Risk to be taken by BPRS, which is determined, for example, by the composition of liquid instruments and funding sources owned by BPRS to support BPRS's current and future strategies.

Example:
After comparing historical data, economic and market conditions, and peer groups, BPRS A sets the level of Risk to be taken and Risk Tolerance for Liquidity Risk by setting several parameters as follows:

Parameter	Risk Appetite	Risk Tolerance
Ratio of liquid assets to total assets	20%	15%
Ratio of liquid assets to current liabilities	40%	20%
Ratio of total financing to total third-party funds excluding banks	90%	95%

Note: This table is only an example and cannot immediately be used as a basis for determining the level of Risk to be taken or Risk Tolerance for each BPRS.

D. Risk Identification, Measurement, Monitoring, and Control Processes, and Risk Management Information Systems In implementing Risk Management through the processes of risk identification, measurement, monitoring, and control, as well as Risk Management information systems for Liquidity Risk, in addition to implementing the processes as referred to in Chapter I letter C, BPRS adds the implementation of:

Liquidity Risk Identification
a. BPRS must carefully identify and analyze all sources of Liquidity Risk, including:

BPRS products and activities that can affect the sources and uses of funds, both in asset and liability positions and administrative accounts; and
Other risks that can increase Liquidity Risk, such as Credit Risk, Compliance Risk, and Operational Risk.

b. Analysis is conducted to determine the amount and trend of liquidity needs and available funding sources to meet those needs.

c. BPRS must analyze exposure to other risks that can increase Liquidity Risk. Generally, Liquidity Risk is often caused by weaknesses or problems arising from other risks, so risk identification must include the connection between Liquidity Risk and other risks.

d. BPRS must analyze the possible impact of applying various different scenarios on liquidity positions depending on cash flow patterns under various conditions.

e. BPRS can apply various scenarios used to assess:

BPRS's cash flows and liquidity positions in normal conditions;
BPRS scenarios during a crisis, which are reflected, for example, by the non-renewal of most of BPRS's liabilities; and
banking system scenarios during a crisis, which are reflected, for example, by the condition that most or all of the banking system faces liquidity problems.

f. In applying these scenarios, BPRS makes assumptions regarding future liquidity needs, both short-term and long-term, as well as BPRS's ability to obtain liquidity based on existing sources.

Liquidity Risk Measurement
a. BPRS has measurement tools that can quantify Liquidity Risk accurately and comprehensively in a timely manner.

b. Liquidity Risk measurement includes:

assessment of deposit structure based on type, tenor, rate of return, fund owners, and concentration of fund ownership;
assessment of all cash inflows and outflows, including funding needs to meet commitments on administrative account transactions, to identify the possibility of future funding shortages;
assessment of BPRS's ability to obtain liquidity in the market, both in normal conditions and in crisis conditions; and
assessment of liquid assets that can be converted into cash, especially in crisis conditions, i.e., when BPRS cannot meet all obligations using positive cash flows owned and loans.

c. Liquidity calculations can be performed by compiling cash flows based on maturity or by estimation using assumptions based on BPRS's past experience.

d. If cash flow projections are based on statistical data estimates, the accuracy and precision of those estimates must be periodically reassessed. In addition, the assumptions and variables used in the projections must be evaluated according to changes in market conditions, competitive factors among BPRSs, and changes in BPRS customer behavior.

Liquidity Risk Monitoring
a. Liquidity Risk monitoring conducted by BPRS pays attention to early warning indicators to know the potential increase in BPRS's Liquidity Risk.

b. BPRS assesses the stability and trend of community fund deposits and formulates worst-case scenarios based on observations of the largest withdrawal trends that have occurred during the observation period, especially for BPRSs that have experienced very large fund withdrawals.

c. BPRS collects data and monitors liquidity positions periodically (daily, weekly, monthly, and other periods) and potential losses caused by Liquidity Risk, for example, by managing the maturity of liquidity positions.

d. BPRS must periodically evaluate the factors causing the emergence of Liquidity Risk and their connection with potential losses.

e. For the purpose of monitoring Liquidity Risk exposure, the Risk Management Committee (SKMR) or Risk Management Unit (PEMR) must compile reports on losses caused by Liquidity Risk factors and submit them to the Board of Directors and the Risk Management Committee, if any.

Liquidity Risk Control
a. Liquidity Risk control is carried out through funding strategies, daily liquidity position and Liquidity Risk management, and emergency funding plans.

b. Funding strategies include strategies for diversifying funding sources and tenors, linked to the characteristics and business plans of BPRS.

c. BPRS must identify and monitor key factors affecting the ability to obtain funds, including identifying and monitoring alternative funding sources and market access that can strengthen BPRS's capacity to survive in crisis conditions.

d. The management of liquidity positions and daily Liquidity Risk aims to meet obligations promptly throughout the day (intra-day) in both normal and crisis conditions, prioritizing immediate obligations.

e. BPRS has an emergency funding plan to avoid liquidity difficulties that could cause BPRS to fail to make payments to other parties. Emergency funding plans must include accurate assumptions and estimates, including:

determination of deposit stability and cash outflows based on statistical estimates;
the possibility of counterparty (bank and non-bank) failure to meet obligations on time; and
the possibility of withdrawal of administrative account transactions.

f. BPRS periodically evaluates emergency funding plans to determine the amount of funds that can be obtained from regular funding sources.

Risk Management Information Systems
a. Risk Management information systems for Liquidity Risk must provide complete, accurate, current, and comprehensive information and reports regarding liquidity conditions, maturity profiles of BPRS's liabilities, and projected cash flows. These information systems must be designed and developed in accordance with changes in internal and external conditions.

b. Risk Management information systems for Liquidity Risk must be able to meet reporting obligations to the Financial Services Authority (OJK) and must be able to provide information at least regarding:

cash flows from assets, liabilities, and administrative accounts;
compliance with policies, strategies, and Risk Management procedures for Liquidity Risk, including limits and liquidity ratios;
risk profile reports and liquidity trends for BPRS's needs in a timely manner;
information that can be used for Liquidity Risk measurement purposes; and
other information related to Liquidity Risk, such as the concentration of funding sources, assets and liabilities, and unstable administrative account receivables and payables.

c. The Risk Management Committee (SKMR) or Risk Management Unit (PEMR) must analyze the reports generated and subsequently submit the results of the analysis periodically as needed by BPRS to the Board of Directors, the Risk Management Committee, if any, and the Internal Audit Unit (SKAI) or Internal Audit Unit (PEAI). The frequency of report submission can be increased if the analysis results indicate that BPRS has significant potential liquidity difficulties.

d. The effectiveness and reliability of reports generated by the Risk Management information system for Liquidity Risk must be periodically re-tested according to the latest liquidity gap position.

E. Internal Control System

BPRS must have an adequate internal control system to ensure the integrity, effectiveness, and fairness of the Risk Management process for Liquidity Risk.
Internal control over the implementation of Risk Management for Liquidity Risk conducted by the Internal Audit Unit (SKAI) or Internal Audit Unit (PEAI) includes at least:
a. active supervision by the Board of Directors, Board of Commissioners, and DPS; b. policies, procedures, and determination of Liquidity Risk Limits;
c. the process of risk identification, measurement, monitoring, and control, as well as Risk Management systems for Liquidity Risk; and
d. a comprehensive internal control system for Liquidity Risk.
BPRS must evaluate the implementation of Risk Management for Liquidity Risk, which includes:
a. compliance with liquidity management policies and procedures; b. the adequacy of systems and procedures for identifying, measuring, monitoring, and controlling Liquidity Risk, including the adequacy of methods, assumptions, and indicators for Liquidity Risk measurement;
c. the effectiveness of the process of implementing the identification, measurement, monitoring, and control of Liquidity Risk periodically;
d. the performance of Liquidity Risk measurement models, for example, based on the comparison between Liquidity Risk measurement results and actual values; and e. the integrity of Risk Management information system reports.
Weaknesses identified in internal controls and the results of the evaluation of Liquidity Risk Management implementation must be immediately reported to the Board of Directors for follow-up.

CHAPTER VI
REPUTATION RISK

Reputation Risk is the Risk arising from a decrease in the level of trust of stakeholders stemming from negative perceptions of BPRS.
The main objective of implementing Risk Management for Reputation Risk is to anticipate and minimize the impact of losses from BPRS's Reputation Risk.
Reputation Risk is not a standalone Risk, but rather a second-tier risk, i.e., a Risk that occurs because it is triggered by other Risks such as Credit Risk, Liquidity Risk, or Operational Risk. Thus, in assessing Reputation Risk, it is necessary to understand the connection between Reputation Risk and other Risks.
For example, weaknesses in BPRS's information technology that cause customer transaction failures are Operational Risks that can cause Reputation Risk in the form of negative media coverage of BPRS's services. However, in certain cases, Reputation Risk can occur without being preceded by other Risks, for example, negative reporting due to misunderstandings with customers or information manipulation by business competitors.
Reputation Risk can originate from various BPRS business activities as follows:
a. events that have harmed BPRS's reputation, for example, negative media coverage, violations of business ethics, and customer complaints; or b. other things that can cause Reputation Risk, for example, weaknesses in governance, corporate culture, and BPRS business practices.
BPRS's Reputation Risk can also be caused by the influence of reputation events on members of the Board of Directors, members of the Board of Commissioners, DPS, shareholders, and/or parties associated with BPRS. BPRS must also pay attention to the frequency and significance of customer complaints. Furthermore, business partners can also play a role in increasing BPRS's Reputation Risk. Cooperation conducted by BPRS with business partners experiencing reputation disturbances can impact BPRS's operational activities, especially if the business partners in question support BPRS's operational activities, such as IT service providers that continuously operate BPRS's core banking applications.
BPRS must implement Reputation Risk Management appropriate to the scale and complexity of the business. Reputation Risk Management not only mitigates the downside aspects of BPRS's reputation but is also part of BPRS's overall efforts to build BPRS's reputation to increase competitiveness.
Reputation is greatly influenced by several factors in BPRS's business, including:
a. managerial and leadership aspects and the application of governance; b. other Risks, so BPRS needs to pay attention to the level and exposure of BPRS to Risks other than Reputation Risk, especially Credit Risk, Operational Risk, and Liquidity Risk; and
c. the development of stakeholder needs and the business environment.
By considering the interconnection between Risk, building reputation, and addressing issues related to BPRS's reputation, BPRS is enabled to make improvements in other aspects that can enhance BPRS's reputation.

B. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board In the implementation of Risk Management through active supervision by the Board of Directors, Board of Commissioners, and DPS for Reputation Risk, in addition to implementing supervision as referred to in Chapter I letter A, BPRS adds the implementation of:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board
a. The Board of Directors and Board of Commissioners must pay attention to the implementation of Risk Management for Reputation Risk by relevant units, such as public relations (PR) and other relevant business units.

b. The Board of Directors and Board of Commissioners must understand the Reputation Risk inherent in specific BPRS activities, especially those that can significantly affect financial conditions, and implement approval and evaluation of policies in controlling Reputation Risk.

c. The Board of Directors and Board of Commissioners must behave professionally and maintain business ethics so as to serve as examples for all elements of the BPRS organization in efforts to build and maintain reputation.

d. The Board of Directors must ensure that BPRS has a policy to calculate the impact of Reputation Risk on BPRS's capital.

e. The Board of Directors must ensure that BPRS has work units, employees, or functions with the authority and responsibility to provide comprehensive information to customers and other BPRS stakeholders regarding BPRS's business activities in controlling Reputation Risk.

f. The Board of Commissioners is responsible for conducting approval and periodic evaluation of BPRS's Reputation Risk Management policies, including Reputation Risk tolerance limits, at least 1 (one) time within 1 (one) year or whenever there are changes that significantly affect BPRS's business activities.

g. The DPS is responsible for conducting periodic evaluation of BPRS's Reputation Risk Management policies related to the fulfillment of Sharia Principles 1 (one) time within 1 (one) year or whenever there are changes that significantly affect BPRS's business activities.

Human Resources
The adequacy of Human Resources for Reputation Risk refers to the general scope of implementation as referred to in Chapter I item A.2.
Reputation Risk Management Organization
a. Regarding the Reputation Risk Management organization, all employees, including business unit management and BPRS support activity staff, must become part of the Reputation Risk Management implementation structure, given that reputation is the result of all BPRS business activities. The role of business unit management is to identify Reputation Risk occurring in their business or activities and to act as front liners in building and preventing Reputation Risk, especially regarding customer relations.

b. Work units implementing Risk Management for Reputation Risk are responsible for:

performing public relations functions and following up on negative reporting or other events that affect BPRS's reputation and can cause BPRS losses; and
communicating information needed by BPRS stakeholders, including investors, customers, associations, and the community.

C. Risk Management Policies, Risk Management Procedures, and Risk Limit Determination
In implementing Risk Management policies and procedures and determining Risk Limits for Reputation Risk, in addition to implementing the Risk Management policies and procedures and Risk Limit determination as referred to in Chapter I letter B, BPRS adds the implementation of:

Risk Management Strategy
The formulation of Risk Management strategies for Reputation Risk refers to the general scope of implementation as referred to in Chapter I item B.1.
Policies and Procedures
a. BPRS must have written policies and procedures that meet the principles of transparency and improvement of customer and other stakeholder service quality to control Reputation Risk. These policies must be in line with regulations regarding consumer protection.

b. BPRS must have and implement appropriate communication policies when facing news or publications that are

negative or prevention of information that tends to be counterproductive, among others by applying effective media usage strategies to respond to negative news.

c. BPRS must have special protocols for reputation management during crises so that it can immediately anticipate increases in Reputational Risk.

d. BPRS must carry out procedures to control Reputational Risk related to Reputational Risk experiences that materially affect the financial condition of the BPRS.

Setting Risk Limits
a. Reputational Risk limits generally are not limits that can be quantified financially. For example: limits on the time to follow up on customer complaints and waiting time limits in queues to receive services. The aforementioned examples relate to risk mitigation in handling customer complaints and mitigating reputational risk arising from customer complaints.

b. The setting of the level of Risk to be taken and Risk tolerance for Reputational Risk refers to the general scope of implementation as referred to in Chapter I item B.4.

Example:
After comparing historical data, economic and market conditions, and peer groups, BPRS A sets the level of Risk to be taken and Risk tolerance for Reputational Risk by setting several parameters as follows:

Parameter	Risk Appetite	Risk Tolerance
Number of customer complaints	10	13
Number of negative news reports regarding parties associated with the BPRS	1 news in mass media	3 news in mass media

Note: This table is only an example and therefore cannot immediately serve as the basis for determining the level of Risk to be taken or Risk tolerance for each BPRS.

D. Process of Identification, Measurement, Monitoring, and Control of Risk, as well as Risk Management Information Systems

In implementing Risk Management through the processes of identification, measurement, monitoring, and control of Risk, as well as Risk Management information systems for Reputational Risk, in addition to carrying out the processes referred to in Chapter I letter C, BPRS must add the implementation of:

Identification and Measurement of Reputational Risk
a. BPRS must identify Reputational Risk inherent in specific functional activities such as financing (fund disbursement), operations, services, information technology, and Human Resources.

b. BPRS records and accounts for every incident related to Reputational Risk, including the amount of potential losses caused by the said incident in a data administration system. The recording and accounting of such data are compiled into a statistical data set that can be used to project potential losses in a certain period and specific functional activities.

c. BPRS can use several information sources to identify and measure the impact of Reputational Risk, including mass media news, BPRS websites and social network analysis results, customer complaints through customer service, and customer satisfaction questionnaires.

Monitoring of Reputational Risk
BPRS monitors Reputational Risk continuously based on past loss experiences caused by Reputational Risk. The implementation of monitoring for Reputational Risk refers to the general scope of implementation as referred to in Chapter I item C.3.
Control of Reputational Risk
a. BPRS must immediately follow up on and resolve customer complaints and legal lawsuits that can increase exposure to Reputational Risk.

b. BPRS must develop reliable mechanisms for carrying out effective Reputational Risk control actions. Generally, Reputational Risk control can be done through 2 (two) things:

prevention of incidents that cause Reputational Risk, which is generally done through a series of activities as follows:

a) social and environmental responsibility (corporate social responsibility), which is a series of activities carried out by BPRS for community empowerment in the form of economic or social activities that are expected to build a positive reputation from stakeholders towards the BPRS; and

b) routine communication or education to stakeholders to form a positive reputation from stakeholders.

recovery of BPRS reputation after an incident causing Reputational Risk occurs, which is all follow-up actions by BPRS to restore reputation and prevent a decline in BPRS reputation.

c. Mitigation of Reputational Risk or incidents causing Reputational Risk is carried out by considering the materiality of the problem and costs. Nevertheless, Reputational Risk can be accepted as long as it still aligns with the level of Risk to be taken.

d. In controlling Reputational Risk that is greater in the future, the prevention and recovery actions of Reputational Risk that have been carried out need to be followed by improvements in control weaknesses and procedures that trigger Reputational Risk.

Risk Management Information System
a. BPRS must have procedures and mechanisms for reporting Reputational Risk or incidents causing Reputational Risk, both in written form and in electronic system form, including discussions in the Board of Directors and/or Board of Commissioners meetings of the BPRS.

b. BPRS must have an early warning system mechanism to provide signals to the Board of Directors and/or Board of Commissioners so that follow-up and mitigation actions can be taken as needed.

E. Internal Control System

BPRS must resolve customer complaints and legal lawsuits that can increase exposure to Reputational Risk, among others, by communicating continuously with opposing parties (banks and non-banks) and conducting bilateral negotiations with customers to avoid litigation and legal claims.
BPRS can cooperate with third parties, such as the use of outsourcing, to control Reputational Risk by considering the costs and benefits of using outsourcing.
The implementation of the internal control system for Reputational Risk refers to the general scope of implementation as referred to in Chapter I letter D.

CHAPTER VII
STRATEGIC RISK

Strategic Risk is Risk due to the inaccuracy of the BPRS in making and/or implementing a strategic decision, as well as the BPRS's failure to anticipate changes in the business environment.
Strategic Risk is important because the BPRS's weakness in managing Strategic Risk can lower the BPRS's competitive position in the industry and has the potential to trigger the overall failure of the BPRS's business.
Strategic Risk can originate from weaknesses in the strategy formulation process and inaccuracy in strategy formulation, inadequate management information systems, inadequate results of internal and external environment analysis, setting strategic objectives that are too aggressive, inaccuracy in strategy implementation, and failure to anticipate changes in the business environment.
The implementation of Strategic Risk Management aims to ensure that the Risk Management process can minimize the possibility of negative impacts from inaccurate strategic decision-making and failure to anticipate changes in the business environment.
In formulating strategies to minimize Strategic Risk, the following must be considered:

a. External factors, including local economic conditions, technological development, competitive conditions or competitors, and customer preferences.

b. Internal factors, including vision, mission, corporate culture, financial conditions, Human Resources, and infrastructure at the BPRS.

The BPRS's consideration of external and internal factors and their alignment with the BPRS's vision and mission must be formulated into strategies established by the BPRS in conducting business as per the BPRS's business plan. In addition, the BPRS needs to consider changes in business strategy in the implementation of Strategic Risk Management, including additions or changes in main business focus and organizational changes related to the expansion of office networks and products and/or activities.

B. Active Supervision by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board

In implementing Risk Management through active supervision by the Board of Directors, Board of Commissioners, and DPS for Strategic Risk, in addition to carrying out supervision as referred to in Chapter I letter A, BPRS must add the implementation of:

Authority and Responsibilities of the Board of Directors, Board of Commissioners, and Sharia Supervisory Board

a. The Board of Directors and Board of Commissioners must understand the Strategic Risk inherent in specific BPRS activities, especially those that can significantly affect the financial condition of the BPRS, and carry out approval and evaluation of policies in controlling Strategic Risk.

b. The Board of Directors must formulate the BPRS's business plan and have it approved by the Board of Commissioners, which covers matters as referred to in the Financial Services Authority Regulation regarding the business plan of rural credit banks and Sharia people's financing banks, and communicate it to employees at every organizational level.

c. The DPS must evaluate the strategic plan and business plan of the BPRS related to the fulfillment of Sharia Principles.

d. The Board of Directors is responsible for ensuring that the established strategic objectives align with the vision and mission, corporate culture, business direction, and BPRS Risk tolerance, providing approval for the strategic plan and any changes, and conducting periodic evaluations.

e. The Board of Directors must ensure that the structure, corporate culture, infrastructure, financial conditions, manpower and managerial competence including Executive Officials, as well as systems and controls are suitable and adequate to support the implementation of the established strategy.

f. The Board of Directors must monitor internal conditions (BPRS weaknesses and strengths) and the development of external conditions that directly or indirectly affect the business strategy established by the BPRS.

g. The Board of Directors must establish work units or employees or functions that have the authority and responsibility to support the formulation and monitoring of strategy implementation, including the BPRS's strategic plan and business plan.

h. The Board of Directors is responsible for ensuring that Risk Management for Strategic Risk has been implemented effectively and consistently at all relevant operational levels. In the event that the Board of Directors delegates part of its responsibility to officials, such delegation does not eliminate the Board of Directors' obligation as the main party responsible.

i. The Board of Commissioners is responsible for carrying out periodic approval and evaluation of the BPRS's Strategic Risk Management policies, including strategic Risk tolerance limits, at least once (1) in one (1) year or whenever there are changes that significantly affect the BPRS's business activities.

j. The DPS is responsible for carrying out periodic evaluation of the BPRS's Strategic Risk Management policies related to the fulfillment of Sharia Principles, at least once (1) in one (1) year or whenever there are changes that significantly affect the BPRS's business activities.

Human Resources

Adequacy of Human Resources for Strategic Risk refers to the general scope of implementation as referred to in Chapter I item A.2.

Strategic Risk Management Organization

a. All business units and support units are responsible for assisting the Board of Directors in formulating plans and implementing strategies effectively.

b. Business units and support units are responsible for ensuring at least:

Strategic Risk Management practices and controls in business units are consistent with the overall Strategic Risk Management framework; and
business units and support units have policies, procedures, and resources to support the effectiveness of the Strategic Risk Management framework.

c. The Board of Directors leads the change programs required for the implementation of the established strategy.

d. Work units, employees, or functions at the BPRS that perform strategic planning functions are responsible for assisting the Board of Directors in managing Strategic Risk and facilitating change management in the sustainable development of the company.

e. SKMR or PEMR is responsible for the Strategic Risk Management process at least covering:

coordinating with all business units in the process of formulating the strategic plan;
monitoring and evaluating the development of strategic plan implementation, providing input regarding opportunities and choices available for the continuous development and improvement of strategy; and
ensuring that all strategic issues and influences on the achievement of strategic objectives are followed up in a timely manner.

C. Risk Management Policies, Risk Management Procedures, and Setting of Risk Limits

In implementing Risk Management policies and procedures and setting Risk limits for Strategic Risk, in addition to carrying out Risk Management policies and procedures and setting Risk limits as referred to in Chapter I letter B, BPRS adds the implementation of:

Risk Management Strategy

a. BPRS must evaluate its competitive position in the industry in formulating Risk Management strategy, at least including:

analysis of external factors covering business, economic, and banking industry environmental conditions at the location where the BPRS operates, including the impact of environmental changes on the BPRS's business, products, technology, and office network;
measuring the BPRS's strengths and weaknesses related to competitive position, the BPRS's business position in the banking industry, financial performance, organizational structure and Risk Management functions, infrastructure for current and future business needs, managerial capability, as well as the availability and limitations of BPRS resources; and
analysis of all available strategy alternatives after considering the BPRS's strategic objectives and Risk tolerance. The depth and scope of analysis must align with the scale and complexity of the BPRS's business activities.

b. BPRS must establish the strategic plan and business plan in writing, implement these policies, and conduct evaluations and adjustments in the event of deviations from targets due to significant external and internal changes. In the event of a long-term strategy implementation plan, the BPRS must have adequate managerial succession plans to support the effectiveness of the implementation of the said strategy.

c. The BPRS's business plan must state reasons in the form of assumptions related to the established targets.

d. BPRS must have sufficient resources to support the implementation of the strategic plan.

Policies and Procedures

a. BPRS must have policies and procedures to formulate and approve the strategic plan. The aforementioned strategic plan must be evaluated periodically and adjusted in the event of deviations from targets to be achieved as a result of external and internal environmental changes.

b. BPRS must have adequate procedures to identify and respond to changes in the business environment.

c. BPRS must have procedures to measure the progress achieved from the realization of the BPRS's business plan and performance according to the established schedule.

Setting Risk Limits

a. Strategic Risk limits generally relate to limits on deviations from the established strategic plan, such as budget deviation limits and completion time target deviation limits.

b. The setting of the level of Risk to be taken and Risk tolerance for Strategic Risk refers to the general scope of implementation as referred to in Chapter I item B.4.

Example:
After comparing historical data, economic and market conditions, and peer groups, BPRS A sets the level of Risk to be taken and Risk tolerance for Strategic Risk by setting parameters as follows:

Parameter	Risk Appetite	Risk Tolerance
Ratio of realization of main financial indicator targets according to the business plan	100%	90%

Note: This table is only an example and therefore cannot immediately serve as the basis for determining the level of Risk to be taken or Risk tolerance for each BPRS.

D. Process of Identification, Measurement, Monitoring, and Control of Risk, as well as Risk Management Information Systems

In implementing Risk Management through the processes of identification, measurement, monitoring, and control of Risk, as well as Risk Management information systems for Strategic Risk, in addition to carrying out the processes referred to in Chapter I letter C, BPRS adds the implementation of:

Identification of Strategic Risk

a. BPRS must identify and account for performance changes as a result of the non-realization or ineffectiveness of the implementation of the BPRS's established business strategy or business plan, especially those that are significant to the BPRS's capital.

b. BPRS must conduct Risk analysis, especially regarding strategies that require many resources and/or are high risk, such as strategies to enter new market segments, acquisition strategies, or diversification strategies in the form of products and/or activities.

Measurement of Strategic Risk

a. In the process of measuring Strategic Risk, BPRS can use parameters such as the level of complexity of the BPRS's business strategy, the BPRS's business position in the banking industry, and the achievement of the BPRS's business plan.

b. BPRS can conduct trials on strategy implementation to identify any events or changes in the business environment that can have a negative impact on the fulfillment of initial assumptions from the strategic plan and measure the potential negative impact of said events on BPRS business performance, both financially and non-financially.

c. Trial results must provide feedback to the strategy planning process.

d. In the event that trial results show a Risk level higher than the BPRS's Risk tolerance or the BPRS's ability to absorb Risk, the BPRS develops a worst-case emergency plan, contingency plan, or strategy to mitigate Risk.

Monitoring of Strategic Risk

a. BPRS monitors Strategic Risk continuously by analyzing past loss experiences caused by Strategic Risk or deviations in strategy plan implementation.

b. Strategic issues arising from operational and business environment changes that have a negative impact on the business condition or financial condition of the BPRS must be reported to the Board of Directors in a timely manner, accompanied by an analysis of the impact on Strategic Risk and necessary corrective actions.

Control of Strategic Risk

a. BPRS must have systems and controls to monitor BPRS performance, including financial performance, by monitoring realization compared to targets to be achieved and ensuring that the level of Risk to be taken remains within Risk tolerance limits.

This copy is consistent with the original
Legal Director 1
Legal Department signed
Yuliana

b. The aforementioned system is evaluated periodically by the Board of Directors to ensure the continuous suitability of the system.

Risk Management Information System

a. BPRS must ensure that the Risk Management information system for Strategic Risk owned is adequate to support the process of strategic planning and decision-making and is evaluated periodically.

b. Work units, employees, or functions at the BPRS that perform Strategic Risk Management functions are responsible for analyzing realization reports against targets in the BPRS's business plan and submitting them to the Board of Directors in a timely manner.

E. Internal Control System

The adequacy of the internal control system in the implementation of Risk Management for Strategic Risk refers to the general scope of implementation as referred to in Chapter I letter D.

Determined in Jakarta on the date of 27 June 2019 CHIEF EXECUTIVE OF BANKING SUPERVISOR FINANCIAL SERVICES AUTHORITY REPUBLIC OF INDONESIA, signed HERU KRISTIYANA

APPENDIX II
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 10 /SEOJK.03/2019 REGARDING IMPLEMENTATION OF RISK MANAGEMENT FOR SHARIA PEOPLE'S FINANCING BANKS

CHAPTER I
PROCEDURES FOR ASSESSING BPRS RISK PROFILE
A. GENERAL PRINCIPLES OF BPRS RISK PROFILE ASSESSMENT

BPRS needs to pay attention to general principles as a foundation in conducting BPRS Risk Profile assessment as follows:

Risk-Oriented

The assessment of the BPRS Risk Profile is based on the BPRS Risk and the impact it causes on the overall performance of the BPRS. This is done by identifying internal and external factors that can increase Risk or affect the financial performance of the BPRS currently and in the future. Thus, BPRS is expected to be able to detect the root causes of BPRS problems more early and take preventive and corrective steps effectively and efficiently.

Proportionality

The use of parameters in each pillar of the BPRS Risk Profile assessment is done by considering the characteristics and complexity of the BPRS's business activities. The Risk Profile assessment parameters in this Financial Services Authority Circular Letter are minimum standards that must be used in assessing the Risk Profile. In addition, BPRS can use additional parameters according to the characteristics and complexity of business activities in assessing the Risk Profile so that it can reflect the BPRS's condition better.

Significance and Materiality

The assessment of the BPRS Risk Profile needs to pay attention to the significance and materiality of each pillar and assessment parameter for each type of Risk in concluding the assessment results and setting the Risk rating. The determination of significance and materiality is based on analysis supported by adequate data and information regarding Risk and the financial performance of the BPRS.

Comprehensive and Structured

The assessment process is carried out thoroughly and systematically and is focused on the main problems of the BPRS. Analysis is carried out in an integrated manner, i.e., by considering the interrelationships between Risks. Analysis must be supported by key facts and relevant ratios to show the problems faced by the BPRS.

B. STEPS FOR ASSESSING BPRS RISK PROFILE

The Risk Profile assessment that results in a Risk rating is carried out according to the stages of Risk Management implementation as referred to in Article 21 paragraph (5) and paragraph (6) of POJK MR BPRS. The aforementioned assessment is carried out through 4 (four) stages as follows:

Step 1 Assessment and setting of Inherent Risk level Step 2 Assessment and setting of Risk Management Implementation Quality (KPMR) level Step 3 Setting of Risk level for each type of Risk Step 4 Setting of Risk rating

Step 1: Assessment and Setting of Inherent Risk Level

Inherent Risk assessment is an assessment of Risk inherent in BPRS business activities, both those that can be quantified and those that cannot be quantified, which have the potential to affect the BPRS's financial position.
The characteristics of inherent Risk for Sharia Microfinance Banks (BPRS) are determined by internal and external factors, including business strategy, business characteristics, complexity of BPRS products and activities, the banking industry condition, and macroeconomic conditions.
The assessment of inherent Risk is conducted by considering both quantitative and qualitative parameters.
The description of parameter rankings presented in the appendix of this Financial Services Authority Circular is indicative and serves as a general reference. In the event of a discrepancy between actual conditions and the existing ranking descriptions, it is permissible to determine rankings based on general assessment principles of the Risk profile as referred to in letter A.
In determining the level of inherent Risk for each type of Risk, a comprehensive analysis of all pillars and parameters must be conducted, including considering the interrelationships between pillars and parameters. This is necessary to obtain an inherent Risk level that objectively reflects the Risk in BPRS, through the determination of the significance and materiality of the pillars and parameters that most influence BPRS inherent Risk.
The determination of the level of inherent Risk is individual, meaning it is not influenced by the quality of Risk Management implementation or Risk mitigation conducted by BPRS. The level of inherent Risk is categorized into rank 1 (very low), rank 2 (low), rank 3 (moderate), rank 4 (high), and rank 5 (very high).
BPRS assigns rankings to each inherent Risk parameter as follows:

a. Credit Risk

In accordance with the explanation of Article 3 paragraph (1) letter a of the BPRS Risk Management POJK, Credit Risk is the Risk resulting from the failure of customers or other parties to fulfill their obligations to BPRS, including Risk resulting from BPRS sharing in the business losses of customers financed through profit-sharing financing, whether using the net revenue sharing method or the profit and loss sharing method (Investment Risk). Credit Risk can also result from concentrated fund disbursements, including among customers, geographical regions, products, types of financing, or specific business fields. This Risk is commonly referred to as financing concentration Risk and is taken into account in the assessment of inherent Risk.

Asset portfolio composition pillar and financing concentration level

In this pillar, BPRS assesses the composition of owned assets and the level of concentration of specific asset components related to the attached Credit Risk, by analyzing and ranking at least the following parameters:

a) Parameter ratio of productive assets to total assets

In this parameter, BPRS assesses the composition of owned productive assets compared to total assets.

(1) The definition of productive assets is BPRS fund disbursements in Rupiah to generate income, in the form of financing, placements with Bank Indonesia, and placements with other banks.

(2) The definition of total assets is the total assets on the BPRS financial position report.

The higher the percentage composition, the higher the Risk for BPRS because the larger the likelihood of BPRS experiencing fund disbursement Risk, including financing, due to counterparty (bank and non-bank) failure to fulfill obligations.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	< 95%
2	>95%, productive asset components have low Credit Risk exposure
3	>95%, productive asset components have moderate Credit Risk exposure
4	>95%, productive asset components have high Credit Risk exposure
5	>95%, productive asset components have very high Credit Risk exposure

Note:
BPRS with a ratio ≤ 95% may receive a worse rank than 1, for example, if BPRS has productive assets with higher Credit Risk exposure, such as fund placements in other BPRS with KPMM ratios below regulations and/or BPRS financing disbursed to high-risk economic sectors with high levels of problematic financing.

b) Parameter ratio of financing to total productive assets

In this parameter, BPRS assesses the composition of financing compared to total productive assets.

(1) The definition of financing is all financing to Banks and third parties that are not Banks.

(2) The definition of total productive assets is BPRS fund disbursements in Rupiah to generate income, in the form of financing, placements with Bank Indonesia, and placements with other banks.

The higher the percentage composition, the higher the Risk for BPRS because the larger the likelihood of BPRS experiencing Credit Risk due to customer and/or other party failure to fulfill obligations to BPRS.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	< 75%
2	>75%, financing schemes are mostly or entirely simple, and financing types are not diverse
3	>75%, financing schemes are mostly or entirely simple, and financing types are diverse
4	>75%, financing schemes are mostly or entirely complex, and financing types are not diverse
5	>75%, financing schemes are mostly or entirely complex, and financing types are diverse

Note:

BPRS with a ratio ≤75% may receive a worse rank than 1, in cases where the BPRS financing portfolio has riskier financing schemes and types, for example, working capital financing for plantations with more complex terms and conditions, or working capital financing for construction businesses requiring comprehensive financing analysis.
Simple financing schemes include, for example, salary-deducted employee financing with simple financing analysis, terms, and conditions.
The diversity of financing types refers to the variety of financing types or products marketed by BPRS, considering the size and scale of BPRS operations.
Other considerations for ranking determination include the scope or ability of BPRS to monitor and collect financing.

c) Parameter ratio of the 25 largest debtors to total financing

In this parameter, BPRS assesses the concentration of the financing portfolio to the 25 largest debtors compared to total financing.

(1) The definition of the 25 largest debtors is 25 non-bank debtors based on the same Customer Identification File (CIF), with the largest financing balances.

(2) The definition of total financing is all financing to third parties that are not banks.

The higher the concentration percentage, the higher the Risk for BPRS because the larger the likelihood of BPRS experiencing Credit Risk due to large financing concentration among the 25 debtors, meaning that if the 25 debtors default simultaneously, BPRS could suffer significant losses.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	< 20%
2	>20%, market share has not changed for a very long period
3	>20%, market share has not changed for a long period
4	>20%, market share has not changed for a fairly long period
5	>20%, market share has not changed for a short period

Note:

BPRS with a ratio < 20% may receive a worse rank than 1, in cases where the 25 largest debtors of the BPRS in question come from market shares that change quickly. Market share refers to the economic sector and business types of the 25 largest debtors.
The time period related to market share (very long/long/fairly long/short) is determined by considering, among other things, the duration of BPRS operations, financing duration, for example, a Mortgage with a 10 (ten) year financing tenor is considered short for a BPRS that has only operated for 5 (five) years because it has not yet proven successful in managing the financing from initial disbursement to maturity.
Other considerations for ranking determination include: the lower BPRS's understanding of the economic sector of the 25 largest debtors and the higher level of problematic financing in the relevant economic sector compared to the total financing balances of the 25 largest debtors, the worse the Risk ranking.

d) Parameter ratio of financing per economic sector to total financing

In this parameter, BPRS assesses the concentration of financing from 3 (three) economic sectors dominating the BPRS financing portfolio, compared to total financing.

(1) The definition of financing per economic sector is financing to third parties that are not banks based on economic sector categories as referred to in regulations regarding monthly reports for Sharia Microfinance Banks.

(2) The definition of total financing is all financing to third parties that are not banks.

The higher the concentration percentage, the higher the Risk for BPRS because the larger the likelihood of BPRS experiencing Credit Risk due to large financing concentration among 3 (three) economic sectors, meaning that if financing from these three economic sectors defaults simultaneously, BPRS could suffer significant losses.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	< 85%
2	>85% financing from the 3 (three) largest economic sectors has not changed for a very long period
3	>85% financing from the 3 (three) largest economic sectors has not changed for a long period
4	>85% financing from the 3 (three) largest economic sectors has not changed for a fairly long period
5	>85% financing from the 3 (three) largest economic sectors has not changed for a short period

Note:

For BPRS with smaller size and business volume with financing portfolios of less than 3 (three) economic sectors, or larger BPRS with financing portfolios dominated by more than 3 (three) economic sectors, the number of economic sectors evaluated can be adjusted to the conditions of each BPRS.
BPRS with a ratio < 85% may receive a worse rank than 1, in cases where financing to the 3 (three) largest economic sectors of the BPRS in question is provided with financing schemes and types with higher Credit Risk.
The time period related to the target market (very long/long/fairly long/short) is determined by considering, among other things, the duration of BPRS operations, financing duration, for example, a Mortgage with a 10 (ten) year financing tenor is considered short for a BPRS that has only operated for 5 (five) years because it has not yet proven successful in managing the financing from initial disbursement to maturity.
Other considerations for ranking determination include: the lower BPRS's understanding of the economic sector financed and the higher level of problematic financing in the 3 (three) largest economic sectors compared to the total financing balances of the 3 (three) largest economic sectors, the worse the Risk ranking.

e) Parameter ratio of profit-sharing financing to total financing

In this parameter, BPRS assesses the concentration of profit-sharing financing dominating the BPRS financing portfolio compared to total financing.

(1) The definition of profit-sharing financing is financing to third parties that are not banks with profit-sharing agreements (e.g., mudarabah and musyarakah), whether using the profit and loss sharing method or net revenue sharing method.

(2) The definition of total financing is financing to third parties that are not banks.

The higher the concentration percentage, the higher the Risk for BPRS because the larger the likelihood of BPRS experiencing Credit Risk due to concentration of profit-sharing financing, meaning that if the relevant profit-sharing financing defaults, BPRS could suffer significant losses.

The determination of parameter rankings for this parameter is based on the following indicative descriptions:

Rank	Description
1	≤10%
2	>10%, profit-sharing financing schemes are mostly or entirely simple, and profit-sharing financing types are not diverse
3	>10%, profit-sharing financing schemes are mostly or entirely simple, and profit-sharing financing types are diverse
4	>10%, profit-sharing financing schemes are mostly or entirely complex, and profit-sharing financing types are not diverse
5	>10%, profit-sharing financing schemes are mostly or entirely complex, and profit-sharing financing types are diverse

Note:

BPRS with a ratio ≤10% may receive a worse rank than 1, in cases where the BPRS profit-sharing financing portfolio has riskier profit-sharing financing schemes and types, for example, profit-sharing financing in the form of working capital for plantations with more complex terms and conditions, or profit-sharing financing in the form of working capital for construction businesses requiring comprehensive financing analysis.
Simple profit-sharing financing schemes include, for example, profit-sharing financing to customers with small business scales with simple profit-sharing financing analysis, terms, and conditions.
The diversity of profit-sharing financing types refers to the variety of profit-sharing financing types or products marketed by BPRS, considering the size and scale of BPRS operations.
Other considerations for ranking determination include the scope or ability of BPRS to monitor and collect profit-sharing financing.

Asset quality pillar

In this pillar, BPRS assesses the quality of owned assets, related to the attached Credit Risk, by analyzing and ranking at least the following parameters:

a) Parameter ratio of problematic productive assets to total productive assets

In this parameter, BPRS assesses the amount of problematic productive assets compared to total productive assets.

(1) The definition of problematic productive assets is BPRS fund disbursements in Rupiah to generate income, in the form of financing, placements with Bank Indonesia, and placements with other banks, with fair, doubtful, and loss quality.

(2) The definition of total productive assets is BPRS fund disbursements in Rupiah to generate income, in the form of financing, placements with Bank Indonesia, and placements with other banks.

The higher the percentage of problematic productive assets, the higher the Risk faced by BPRS because the larger the likelihood of BPRS experiencing losses.

b) Parameter ratio of net problematic financing to total financing (NPF net)

In this parameter, BPRS assesses the amount of problematic financing in nominal terms net, compared to total financing.

(1) The definition of net problematic financing is all financing to third parties that are not banks with fair, doubtful, and loss quality, after being reduced by the formation of productive asset write-off provisions (PPAP).

(2) The definition of total financing is all financing to third parties that are not banks.

The higher the percentage of net problematic financing, the higher the Risk faced by BPRS because the larger the likelihood of BPRS experiencing losses.

c) Parameter ratio of low-quality financing to total financing

In this parameter, BPRS assesses the amount of financing assessed to have low quality, compared to total financing.

(1) The definition of low-quality financing is all financing to third parties that are not banks with quality other than performing, and restructured financing with performing quality.

(2) The definition of total financing is all financing to third parties that are not banks.

The higher the percentage of low-quality financing, the higher the Risk faced by BPRS because the larger the likelihood of BPRS experiencing losses.

d) Parameter ratio of low-quality profit-sharing financing to total financing

In this parameter, BPRS assesses the amount of profit-sharing financing assessed to have low quality compared to total financing.

(1) The definition of low-quality profit-sharing financing is all financing to third parties that are not banks with profit-sharing agreements with quality other than performing, including restructured financing with performing quality.

(2) The definition of total financing is all financing to third parties that are not banks.

The higher the percentage of low-quality profit-sharing financing, the higher the Risk faced by BPRS because the larger the likelihood of BPRS experiencing losses.

e) Parameter ratio of problematic profit-sharing financing to total financing

In this parameter, BPRS assesses the amount of problematic profit-sharing financing compared to total financing.

(1) The definition of problematic profit-sharing financing is all financing to third parties that are not banks with profit-sharing agreements with fair, doubtful, and loss quality.

(2) The definition of total financing is all financing to third parties that are not banks.

The higher the percentage of problematic profit-sharing financing, the higher the Risk faced by BPRS because the larger the likelihood of BPRS experiencing losses.

f) Parameter ratio of low-quality profit-sharing financing to total profit-sharing financing

In this parameter, BPRS assesses the amount of profit-sharing financing assessed to have low quality compared to total profit-sharing financing.

(2) The definition of total profit-sharing financing is all financing to third parties that are not banks with profit-sharing agreements.

The higher the percentage of low-quality profit-sharing financing, the higher the Risk faced by BPRS because the larger the likelihood of BPRS experiencing losses.

g) Parameter ratio of problematic profit-sharing financing to total profit-sharing financing

In this parameter, BPRS assesses the amount of problematic profit-sharing financing compared to total profit-sharing financing.

(1) The definition of problematic profit-sharing financing is all financing to third parties that are not banks with profit-sharing agreements with fair, doubtful, and loss quality.

(2) The definition of total profit-sharing financing is all financing to third parties that are not banks with profit-sharing agreements.

The higher the percentage of problematic profit-sharing financing, the higher the Risk faced by BPRS because the larger the likelihood of BPRS experiencing losses.

The determination of parameter rankings in the asset quality pillar is based on the following indicative descriptions:

Rank	Description
1	Problematic productive assets/total productive assets ≤ 7%<br>Net problematic financing/total financing ≤ 5%<br>Low-quality financing/total financing ≤ 7%<br>Low-quality profit-sharing financing/total financing ≤ 6%<br>Problematic profit-sharing financing/total financing ≤ 1%<br>Low-quality profit-sharing financing/total profit-sharing financing ≤ 10 %<br>Problematic profit-sharing financing/total profit-sharing financing ≤ 3 %
2	Ratios above the rank 1 threshold, with financing conditions having good quality, indicated by:<br>1. Restructured financing is not significant<br>2. Decline in financing quality from Performing Financing to Non-Performing Financing is not significant<br>3. High-risk economic sectors are not significant<br>4. Number of performing financing overdue >7 days is not significant<br>5. Problematic productive asset components are mostly placements in other banks<br>6. Restructured profit-sharing financing is not significant<br>7. Project or business prospects financed by profit-sharing financing are very good
3	Ratios above the rank 1 threshold, with financing conditions having fairly good quality, but with potential decline, indicated by:<br>1. Restructured financing is fairly significant<br>2. Decline in financing quality from Performing Financing to Non-Performing Financing is fairly significant<br>3. High-risk economic sectors are fairly significant<br>4. Number of performing financing overdue >7 days is fairly significant<br>5. Problematic productive asset components are mostly placements in other banks<br>6. Restructured profit-sharing financing is not significant<br>7. Project or business prospects financed by profit-sharing financing are fairly good
4	Ratios above the rank 1 threshold, with financing conditions having poor quality, indicated by:<br>1. Restructured financing is significant<br>2. Decline in financing quality from Performing Financing to Non-Performing Financing is significant<br>3. High-risk economic sectors are significant<br>4. Number of performing financing overdue >7 days is significant<br>5. Problematic productive asset components are mostly financing<br>6. Restructured profit-sharing financing is not significant<br>7. Project or business prospects financed by profit-sharing financing are good
5	Ratios above the rank 1 threshold, with financing conditions having bad quality, indicated by:<br>1. Restructured financing is very significant<br>2. Decline in financing quality from Performing Financing to Non-Performing Financing is very significant<br>3. High-risk economic sectors are very significant<br>4. Number of performing financing overdue >7 days is very significant<br>5. Problematic productive asset components are mostly financing<br>6. Restructured profit-sharing financing is not significant<br>7. No prospects for projects or businesses financed by profit-sharing financing

Note:

BPRS with asset quality ratios below the rank 1 threshold may receive a worse rank than 1, in cases where productive asset conditions are riskier, for example, low NPF resulting mostly from restructuring results and collateral takeovers.
Determining the significance of restructuring, decline in financing quality, high-risk economic sectors, and performing financing overdue >7 days considers, among other things, the amount of restructuring/decline in financing quality/high-risk economic sectors/financing overdue >7 days against the total financing portfolio nominal, and the impact on BPRS financial conditions (e.g., profit decline due to increased provisions due to financing quality decline).
The definition of high-risk economic sectors is related to the possibility of financing from the relevant economic sector experiencing a decline in financing quality caused by various conditions, such as the impact of current economic conditions on the relevant economic sector, for example, the coal mining industry sector for exporter customers due to the decline in coal commodity prices.

Pillar of lending strategy
In this pillar, the BPRS assesses the strategy established by the BPRS in disbursing funds, from the perspective of financing portfolio growth linked to the embedded credit risk, which is done by analyzing and ranking at least the following financing growth parameters. In this parameter, the BPRS assesses the achievement of financing growth to third-party non-banks and the customer's economic sector that contributes to the aforementioned financing growth, compared to the achievement of financing growth in the industry. The greater the positive difference between the BPRS's financing growth and the industry's financing growth, and the greater the financing disbursed to the economic sector dominated by the BPRS, the lower the BPRS's Risk, as it indicates the success of the strategy established by the BPRS and the BPRS's ability to understand the financed customers.

The determination of the parameter ranking is based on the following indicative descriptions:

Ranking	Description
1	• Financing growth above the industry average, and<br>• Disbursed entirely to the economic sector dominated by the BPRS.
2	• Financing growth above the industry average, and<br>• Disbursed largely to the economic sector dominated by the BPRS.
3	• Financing growth above or equal to the industry average, and<br>• Disbursed partially or not at all to the economic sector dominated by the BPRS,<br>OR<br>• Financing growth below the industry average, and<br>• Disbursed entirely to the economic sector dominated by the BPRS.
4	• Financing growth below the industry average, and<br>• Disbursed largely to the economic sector dominated by the BPRS.
5	• Financing growth below the industry average, and<br>• Disbursed partially or not at all to the economic sector dominated by the BPRS.

Note:

Industry average data may use data/information as published by BI, OJK, ASBISINDO, BPS, or other accountable sources. In the event that the industry average data source is delayed, industry year to year (YoY) and year to date (YtD) data, or the latest available data for the last month, may be used.

Pillar of external factors
In this pillar and parameter, the BPRS assesses external factors linked to the embedded credit risk, including changes in regional economic conditions, technological changes and developments, regulations, and customer business cycles, which can affect the customer's ability to repay financing, thereby affecting credit risk, including causing losses to the BPRS. The higher the impact of external factors on the customer's ability to repay financing, the higher the Risk for the BPRS. The determination of the parameter ranking for this pillar is based on the following indicative descriptions:

Definition of the economic sector dominated by the BPRS is an economic sector that has been financed by the BPRS for at least 1 (one) year with financing quality classified as 'Lancar' (Current/Performing).

Ranking	Description
1	There is a change in external factors, but it does not impact the customer's ability to repay financing.
2	There is a change in external factors, which impacts the customer's ability to repay financing, resulting in financing arrears but not causing a downgrade in financing quality.
3	There is a change in external factors, which impacts the customer's business performance, resulting in financing arrears but not downgrading the customer's financing quality to NPF (Non-Performing Financing).
4	There is a change in external factors, which causes a downgrade in the customer's financing quality to NPF (Non-Performing Financing).
5	There is a change in external factors, which causes customer bankruptcy.

b. Operational Risk
As explained in Article 3 paragraph (1) letter b of POJK MR BPRS, Operational Risk is Risk caused by, among other things, the inadequacy and/or malfunction of internal processes, human resource errors, system failures, and/or external issues affecting BPRS operations.

Pillar of business and institutional complexity
In this pillar, the BPRS assesses the level of business complexity carried out and the institutional schemes and activities conducted by the BPRS, linked to the embedded operational risk, which is done by analyzing and ranking at least the following parameters:
a) Parameter of business scale and organizational structure In this parameter, the BPRS assesses the size of the BPRS's business scale and the completeness of the BPRS's organizational structure. The larger the BPRS's business scale not supported by the completeness of the organizational structure, the higher the Risk for the BPRS, as there is a greater likelihood of the BPRS experiencing Operational Risk due to the inadequacy and/or malfunction of internal processes. The determination of the parameter ranking is based on the following indicative descriptions:

Ranking	Description
1	• BPRS business scale is small or medium; and<br>• BPRS organizational structure is fully complete according to regulations.
2	• BPRS business scale is large; and<br>• BPRS organizational structure is fully complete according to BPRS governance regulations.
3	• BPRS business scale is small or medium; and<br>• There is incompleteness in the BPRS organizational structure.
4	• BPRS business scale is large; and<br>• There is incompleteness in the BPRS organizational structure in functions that are not significant.
5	• BPRS business scale is small, medium, or large; and<br>• There is incompleteness in the BPRS organizational structure in significant functions.

Note:

Definition of small is a BPRS with core capital < 15 Billion.
Definition of medium is a BPRS with core capital ≥ 15 Billion up to < 50 Billion.
Definition of large is a BPRS with core capital ≥ 50 Billion.
Definition of not significant includes vacancies in sections supporting governance functions.
Definition of significant is a vacancy in the position of the Board of Directors, Board of Commissioners, and/or Sharia Supervisory Board (DPS).

b) Parameter of office network and span of control In this parameter, the BPRS assesses the number of networks and branch office locations, as well as the span of control of the head office over branch offices. The greater the number of office networks with an excessively large span of control and located in areas with difficult access, the higher the Risk for the BPRS, as there is a greater likelihood of the BPRS experiencing Operational Risk due to the inadequacy and/or malfunction of internal processes. The determination of the parameter ranking is based on the following indicative descriptions:

Ranking	Office Network	Span of Control and Office Location
1	The BPRS does not have a network of branch offices and/or cash offices.	Small span of control and branch office locations are easily accessible.
2	• The BPRS has a number of branch office networks of 1 ≤ x < 5; and<br>• Has cash offices.	Small span of control but there are branch office locations that are difficult to access.
3	• The BPRS has a number of branch office networks of 5 < x < 10; and<br>• Has cash offices.	Large span of control and branch office locations are easily accessible.
4	• The BPRS has a number of branch office networks of 10 < x < 15; and<br>• Has cash offices.	Large span of control and there are branch office locations that are difficult to access.
5	• The BPRS has a number of branch office networks of > 15; and<br>• Has cash offices.	Large span of control and there are branch office locations that are difficult to access.

Note:
Other considerations for determining the ranking include that the more difficult it is to access branch offices, the worse the Risk ranking, for example, there are branch offices that can only be accessed by specific transportation means with limited departure schedules.

c) Parameter of product diversity and/or activities In this parameter, the BPRS assesses the diversity and complexity of the types of products and/or activities managed. The higher the diversity and complexity of the types of products and/or activities managed by the BPRS, the higher the Risk for the BPRS, as there is a greater likelihood of the BPRS experiencing Operational Risk as a result of the inadequacy and/or malfunction of internal processes. The determination of the parameter ranking is based on the following indicative descriptions:

Ranking	Description
1	The BPRS has products/activities that are part of the main business activities.
2	The BPRS has products/activities that are part of the main business activities; and<br>• Foreign currency exchange; and/or<br>• Third-party cooperation services that do not require high competence and do not involve technology (e.g., electronic money marketing agents based on cards).
3	The BPRS has products/activities that are part of the main business activities and carries out third-party cooperation services involving third-party technology (e.g., electronic money agents based on servers).
4	The BPRS carries out business activities as a provider of technology-based services, for example as an ATM card issuer/publisher, or internet banking provider.
5	The BPRS carries out business activities that are not in accordance with regulations regarding products and activities of Sharia banks and Sharia business units (among other things, products and/or activities are not reported or have not obtained approval from OJK or BI).

Note:
The main business activities referred to are fund collection, fund disbursement, and/or placement in other banks (including payment points).

d) Parameter of corporate actions
In this parameter, the BPRS assesses the corporate actions carried out, including mergers, consolidations, takeovers, head office relocation, and the issuance of new products and/or activities. The more diverse the corporate actions carried out, especially corporate actions with high operational risk such as mergers, consolidations, takeovers, head office relocation, and the issuance of new products and/or activities carried out in a short period close to the reporting period, the higher the Risk for the BPRS, as there is a greater likelihood of the BPRS experiencing Operational Risk due to the inadequacy and/or malfunction of internal processes. The determination of the parameter ranking is based on the following indicative descriptions:

Ranking	Description
1	• The BPRS is not in the process of merger, consolidation, and takeover;<br>• The BPRS is not in the process of head office relocation; and<br>• The BPRS is not in the process of issuing products and/or carrying out new activities.
2	• The BPRS is not in the process of merger, consolidation, and takeover;<br>• There is a process of relocating the BPRS head office; and/or<br>• The BPRS is in the process of developing products and/or new activities (which only require reporting to OJK).
3	• The BPRS is not in the process of merger, consolidation, and takeover;<br>• There is a process of relocating the BPRS head office; and/or<br>• The BPRS issues products and/or carries out new activities (requiring OJK approval) in cooperation with third parties (no investment costs – BPRS capital expenditure); and/or<br>• The BPRS carries out merger, consolidation, and takeover in a very long period before the assessment period.<br>• The takeover process does not affect business strategy and company culture.
4	• There is a process of relocating the BPRS head office; and/or<br>• The BPRS issues products and/or carries out new activities (requiring OJK approval) that require investment costs – BPRS capital expenditure; and/or<br>• The BPRS carries out merger, consolidation, and takeover in a long period before the assessment period.<br>• The takeover process affects business strategy and company culture.
5	• There is a process of relocating the BPRS head office; and/or<br>• The BPRS issues products and/or carries out new activities (requiring OJK approval) that require investment costs – BPRS capital expenditure; and/or<br>• The BPRS carries out merger, consolidation, and takeover in a short period before the assessment period.<br>• The takeover process affects business strategy and company culture.

Note:

A very long period is defined as mergers, consolidations, and takeovers having been carried out more than 1 (one) year before the assessment period.
A long period is defined as mergers, consolidations, and takeovers having been carried out less than 1 year before the assessment period.
A short period is defined as mergers, consolidations, and takeovers having been carried out in the assessment period.

Pillar of Human Resources
In this pillar, the BPRS assesses the Human Resources (HR) available at the BPRS, linked to the embedded operational risk, which is done by analyzing and ranking at least the following parameters:
a) Parameter of HR quantity and quality adequacy In this parameter, the BPRS assesses the adequacy of HR quantity and quality compared to organizational needs. The more adequate the quantity and quality of HR available at the BPRS in meeting organizational needs, the lower the Risk for the BPRS, as there is a lower likelihood of the BPRS experiencing Operational Risk due to human error. The determination of the parameter ranking is based on the following indicative descriptions:

Ranking	Description
1	The quantity and quality of BPRS HR are very adequate.
2	The quantity and quality of BPRS HR are adequate.
3	The quantity and quality of BPRS HR are fairly adequate.
4	The quantity and quality of BPRS HR are less adequate.
5	The quantity and quality of BPRS HR are inadequate.

Note:

Quantity is viewed from the number of HR compared to organizational needs, while quality is viewed from the competence and integrity of HR required by the organization.
Definition:
Very adequate means HR quantity compared to organizational needs is fully met, and HR quality, i.e., competence and integrity, matches organizational requirements.
Adequate means all positions are filled, but the number of HR is lower than organizational needs, although there are no dual roles, and HR quality, i.e., competence and integrity, matches organizational requirements.
Fairly adequate means HR quantity compared to organizational needs is met, but there are dual roles, and HR quality, i.e., competence and integrity, matches organizational requirements.
Less adequate means HR quantity compared to organizational needs is met, but there are dual roles, and HR quality, i.e., competence matches organizational requirements, but there are deviations (fraud).
Inadequate means HR quantity compared to organizational needs is not met, indicated by the existence of dual roles and/or vacant positions, and HR quality, i.e., competence does not match organizational requirements, and there are deviations (fraud).
Other considerations for meeting organizational needs include that some functions require specific educational backgrounds (e.g., accounting), while other functions can be more flexible (e.g., financing analysts and customer service).

b) Parameter of operational issues due to human error In this parameter, the BPRS assesses the frequency and impact of operational issues caused by human error. The higher the frequency and impact of operational issues caused by human error, the higher the Risk for the BPRS, as there is a higher likelihood of the BPRS experiencing Operational Risk due to human error. The determination of the parameter ranking is based on the following indicative descriptions:

Ranking	Description
1	No human error occurs at the BPRS.
2	• Human error occurs at the BPRS; however,<br>• It has no financial impact on the BPRS.
3	• Human error occurs at the BPRS; and<br>• Reduces profits but does not cause the BPRS to record a negative profit.
4	• Human error occurs at the BPRS; and<br>• Causes the BPRS to record a negative profit, resulting in a decrease in capital ratios but still in accordance with KPMM regulations.
5	• Human error occurs at the BPRS; and<br>• Causes the BPRS to record a negative profit, resulting in a decrease in capital ratios below KPMM regulations.

Pillar of Information Technology (IT) Governance
In this pillar, the BPRS assesses the compliance of IT governance with the IT Governance Standards (SPTI) and the implementation of fundamental changes in the BPRS's IT governance. The more the BPRS's IT governance complies with SPTI and the absence of fundamental changes in the BPRS's IT governance, the lower the Risk for the BPRS, as there is a lower likelihood of Operational Risk occurring due to system failure. The determination of the parameter ranking is based on the following indicative descriptions:

Ranking	Description
1	• The BPRS's IT complies with OJK Regulations regarding standards for IT governance for rural credit banks and Sharia financing banks; and<br>• The BPRS is not currently in the process of making fundamental changes to IT governance.
2	• The BPRS's IT is largely in accordance with OJK Regulations regarding standards for IT governance for rural credit banks and Sharia financing banks; and<br>• The BPRS is not currently in the process of making fundamental changes to IT governance.
3	• The BPRS's IT is largely in accordance with OJK Regulations regarding standards for IT governance for rural credit banks and Sharia financing banks; and<br>• The BPRS is currently in the process of making fundamental changes to IT governance.
4	• The BPRS's IT is largely not in accordance with OJK Regulations regarding standards for IT governance for rural credit banks and Sharia financing banks; and<br>• The BPRS is not currently in the process of making fundamental changes to IT governance.
5	• The BPRS's IT is largely not in accordance with OJK Regulations regarding standards for IT governance for rural credit banks and Sharia financing banks; and<br>• The BPRS is currently in the process of making fundamental changes to IT governance.

Pillar of Fraud (Deviation)
In this pillar and parameter, the BPRS assesses the frequency and impact of deviations occurring at the BPRS, whether deviations originating from external parties or internal parties. The higher the frequency and impact of deviations at the BPRS, the higher the Risk for the BPRS, as there is a greater likelihood of Operational Risk occurring due to human error. The determination of the parameter ranking is based on the following indicative descriptions:

Ranking	Description
1	There are no indications of fraud (deviation) at the BPRS.
2	• There are indications of fraud (deviation) at the BPRS with low frequency; and<br>• Has not yet/had no financial impact.
3	• There are indications of fraud (deviation) at the BPRS with high frequency; and<br>• Reduces profits but does not cause the BPRS to record a negative profit and does not cause capital ratios to decrease.
4	• There are significant indications of fraud (deviation) at the BPRS; and<br>• Reduces profits or the BPRS records a negative profit, resulting in a decrease in capital ratios but still in accordance with OJK Regulations regarding minimum capital provision obligations and minimum core capital fulfillment for Sharia financing banks.
5	• There are very significant indications of fraud (deviation) at the BPRS; and<br>• The BPRS records a negative profit, resulting in a decrease in capital ratios below the provisions of OJK Regulations regarding minimum capital provision obligations and minimum core capital fulfillment for Sharia financing banks.

Pillar of external factors
In this pillar and parameter, the BPRS assesses the frequency and materiality of external factors impacting BPRS operational activities. The aforementioned external factors may include, among other things, natural disasters, riots, government policies, and crime. The higher the frequency and materiality of external factors impacting BPRS operational activities, the higher the Risk for the BPRS, as there is a greater likelihood of Operational Risk occurring due to external factors. The determination of the parameter ranking is based on the following indicative descriptions:

Ranking	Description
1	No external factors are present.
2	• There are external factors; however,<br>• They have no financial impact on the BPRS.
3	• There are external factors; and<br>• Reduce profits but do not cause the BPRS to record a negative profit.
4	• There are external factors; and<br>• The BPRS records a negative profit, resulting in a decrease in capital ratios but still in accordance with the provisions of OJK Regulations regarding minimum capital provision obligations and minimum core capital fulfillment for Sharia financing banks.
5	• There are external factors; and<br>• The BPRS records a negative profit, resulting in a decrease in capital ratios below the provisions of OJK Regulations regarding minimum capital provision obligations and minimum core capital fulfillment for Sharia financing banks.

c. Compliance Risk
As explained in Article 3 paragraph (1) letter c of POJK MR BPRS, Compliance Risk is Risk resulting from the BPRS not complying with and/or not implementing regulations and other provisions as well as Sharia Principles, including Risk resulting from weaknesses in legal aspects. Compliance Risk can be caused by, among other things, legal behavior comprising 3 (three) elements: intent, negligence, and accountability, and organizational behavior influenced by business profile factors, economic factors, psychological factors, and sociological factors.

Pillar of violations of regulations, internal BPRS regulations, and Sharia Principles
In this pillar, the BPRS assesses the type, significance, frequency, and follow-up of violations committed, linked to the embedded Compliance Risk. The aforementioned violations include, among other things, violations regarding authority regulations, such as those from the Financial Services Authority (OJK), Bank Indonesia, Deposit Insurance Agency (LPS), Financial Transaction Reports and Analysis Center (PPATK), and the Ministry of Finance, which is done by analyzing and ranking at least the following parameters:
a) Parameter of the type, significance, and frequency of violations committed In this parameter, the BPRS assesses the type, significance, and frequency of regulation violations committed by the BPRS. The higher the frequency of significant violations committed by the BPRS, the higher the Compliance Risk for the BPRS.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	No violations of regulatory provisions, internal BPRS regulations, and Shariah Principles during the assessment period.
2	- Violations of regulatory provisions, internal BPRS regulations, and Shariah Principles with light sanctions; and<br>- Low frequency of violations.
3	- Violations of regulatory provisions, internal BPRS regulations, and Shariah Principles with light sanctions; and<br>- Medium frequency of violations.
4	- Violations of regulatory provisions, internal BPRS regulations, and Shariah Principles with light sanctions and high frequency of violations; and/or<br>- Suspected violations of the Sharia Banking Law, including Article 63, committed by BPRS officials or employees.
5	- Violations of regulatory provisions, internal BPRS regulations, and Shariah Principles with heavy sanctions and significant violation types; and/or<br>- Suspected violations of the Sharia Banking Law, including Article 63, committed by the Board of Directors and/or Board of Commissioners of the BPRS.

Notes:

The determination of low, medium, and high violation frequencies is linked to and compared with the business volume of the BPRS.
Light sanction violation types include, among others, reporting violations with sanctions in the form of written reprimands and/or fines.
Heavy sanction and significant violation types include, among others, BMPD violations, fulfillment of minimum management personnel, and capital.

b) Parameter for the significance of follow-up actions on violation findings In this parameter, the BPRS assesses the follow-up actions taken by the BPRS regarding findings of violations of regulations committed by the BPRS. The more frequent the recurrence of violations, the higher the Compliance Risk for the BPRS. The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	No recurring violations, and violations in previous periods have been fully followed up.
2	Recurring violations in 2 (two) previous periods of the same type but with a high decrease in frequency compared to the previous period.
3	Recurring violations in 2 (two) previous periods of the same type but with a medium decrease in frequency compared to the previous period.
4	Recurring violations in 2 (two) previous periods of the same type but with a low decrease in frequency compared to the previous period.
5	- Recurring violations in 2 (two) previous periods of the same type with a higher frequency than the previous period; and/or<br>- Recurring violations that are significant, such as violations of BMPD provisions, minimum management personnel, and capital.

Notes:

High decrease in frequency means a decrease in the frequency of similar violations of at least 75% from the previous violation frequency.
Medium decrease in frequency means a decrease in the frequency of similar violations of at least 50% from the previous violation frequency.
Low decrease in frequency means a decrease in the frequency of similar violations of at least 25% from the previous violation frequency.
Higher frequency means an increase in the frequency of similar violations compared to the frequency of the previous period.

Pillar of weaknesses in legal aspects
In this pillar, the BPRS assesses legal weaknesses occurring in the BPRS linked to inherent Compliance Risk, specifically legal aspect weaknesses, by analyzing and ranking at least the following parameters:

a) Parameter for weaknesses in agreements
In this parameter, the BPRS assesses agreements conducted by the BPRS, linked to the fulfillment of valid agreement conditions and weaknesses in agreement clauses that are detrimental to the BPRS. The lower the fulfillment of valid agreement conditions and the more weaknesses in agreement clauses conducted by the BPRS, the higher the Compliance Risk for the BPRS, particularly from the legal aspect.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	• Financing or other cooperation agreements that meet the conditions for valid agreements; and<br>- No weaknesses in agreement clauses.
2	- Financing or other cooperation agreements that meet the conditions for valid agreements; and/or<br>- Weaknesses in agreement clauses that cause the clauses in the agreement to be unenforceable but are not likely to cause legal lawsuits and material losses.
3	- Financing or other cooperation agreements that meet the conditions for valid agreements; and/or<br>- Weaknesses in agreement clauses that are likely to cause legal lawsuits and/or material losses.
4	- Financing or other cooperation agreements that do not meet the conditions for valid agreements; and/or<br>- Weaknesses in agreement clauses that are likely to cause legal lawsuits and/or very material losses.
5	1. Financing or other cooperation not supported by written agreements.

Notes:

The conditions for valid agreements as referred to in the Civil Code are mutual consent of those who bind themselves, capacity to make an agreement, a specific object, and a lawful cause.
Weaknesses in agreements include, for example, financing agreements accompanied by collateral agreements that do not meet regulations governing debt guarantees, or agreements between the BPRS and IT service providers that do not consider guidelines as referred to in the Financial Services Authority Regulation regarding IT service standards for BPRS, thereby creating Legal Aspect Weakness Risk that can harm the BPRS.

b) Parameter for litigation related to the nominal amount of claims or demands or estimated losses suffered by the BPRS due to claims or demands In this parameter, the BPRS assesses the possibility of claims or estimated losses due to claims and their financial impact on the BPRS. Litigation can occur due to claims or demands from third parties against the bank or claims or demands filed against third parties, either through court or out of court. Such claims or demands generally incur costs that can harm the BPRS's condition. The higher the financial impact of losses due to claims or demands or estimated losses due to claims or demands suffered by the BPRS, the higher the Compliance Risk for the BPRS, particularly from the legal aspect.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	No claims/demands or no estimated losses suffered by the BPRS due to claims/demands.
2	Nominal amount of claims/demands or estimated losses due to claims/demands with a value not significant compared to the BPRS's capital.
3	Nominal amount of claims/demands or estimated losses due to claims/demands with a value less significant compared to the BPRS's capital.
4	Nominal amount of claims/demands or estimated losses due to claims/demands with a value quite significant compared to the BPRS's capital.
5	Nominal amount of claims/demands or estimated losses due to claims/demands that cause capital to decrease below regulations as stipulated in Financial Services Authority Regulations regarding minimum capital provision requirements and minimum core capital fulfillment for Shariah Microfinance Banks.

Note:

Nominal amount of claims/demands is the size of the nominal amount of claims/demands filed.
Estimated losses are the estimated losses that the BPRS may suffer due to claims/demands.

c) Parameter for litigation related to losses suffered due to final and binding court decisions In this parameter, the BPRS assesses losses suffered by the BPRS due to final and binding court decisions. The higher the losses suffered by the BPRS, the higher the Compliance Risk for the BPRS, particularly from the legal aspect.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	No losses due to final and binding court decisions during the assessment period.
2	Losses due to final and binding court decisions, with a value not significant compared to the BPRS's capital during the assessment period.
3	Losses due to final and binding court decisions, with a value less significant compared to the BPRS's capital during the assessment period.
4	Losses due to final and binding court decisions, with a value quite significant compared to the BPRS's capital during the assessment period.
5	Losses due to final and binding court decisions during the assessment period that cause capital to decrease below regulations as stipulated in Financial Services Authority Regulations regarding minimum capital provision requirements and minimum core capital fulfillment for Shariah Microfinance Banks.

d. Liquidity Risk
In accordance with the explanation of Article 3 paragraph (1) letter d of POJK MR BPRS, Liquidity Risk is the Risk due to the inability of the BPRS to meet maturing obligations from cash flow funding sources and/or high-quality liquid assets that can be pledged, without disrupting BPRS activities and/or financial conditions, including Risk due to changes in the yield rates paid by the BPRS to customers, due to changes in the yield rates received by the BPRS from fund disbursement, which can affect the behavior of third-party fund customers of the BPRS (Rate of Return Risk). Liquidity Risk can stem from external factors, such as the level of competition in obtaining funding sources, funding market volatility, or changes in regulatory provisions impacting the BPRS's liquidity position. Liquidity Risk can also stem from internal factors, generally originating from business strategies that can impact Liquidity Risk, unstable funding sources, and BPRS administrative account transactions that impact Liquidity Risk.

Pillar of asset and liability composition and concentration
In this pillar, the BPRS assesses the composition of asset and liability portfolios held and the level of concentration of certain asset and liability components linked to inherent Liquidity Risk, by analyzing and ranking at least the following parameters:

a) Parameter for the ratio of liquid assets to total assets In this parameter, the BPRS assesses the composition of liquid assets held, compared to total assets. (1) Definition of liquid assets is all liquid assets used to meet liquidity needs for third-party fund withdrawals and maturing obligations, consisting of cash (Rupiah and foreign currency), and placements in other banks (checking accounts and set-off savings). (2) Definition of total assets is the amount of assets according to the BPRS's financial position report. The lower the composition percentage, the higher the Risk for the BPRS because the BPRS is potentially exposed to Liquidity Risk due to the BPRS not having adequate liquid assets.

b) Parameter for the ratio of liquid assets to current liabilities In this parameter, the BPRS assesses the amount of liquid assets held, compared to current liabilities to determine the ability of the held liquid assets to meet the BPRS's current liabilities. (1) Definition of liquid assets is all liquid assets used to meet liquidity needs for third-party fund withdrawals and maturing obligations, consisting of cash (Rupiah and foreign currency), and placements in other banks (checking accounts and set-off savings). (2) Definition of current liabilities is all obligations that do not have a maturity date and/or have a maturity date of not more than 1 (one) year, consisting of immediate obligations and deposits (savings and time deposits). The lower the ratio percentage, the higher the Risk for the BPRS because the BPRS is potentially exposed to Liquidity Risk due to the BPRS not having adequate liquid assets to meet current liabilities.

The determination of parameter rankings for the ratio of liquid assets to total assets and the ratio of liquid assets to current liabilities is based on the following indicative descriptions:

Rank	Liquid Assets / Total Assets	Liquid Assets / Current Liabilities
1	>15%	>20%
2	Liquid asset composition is lower than 15% of total assets and liquid asset composition is lower than 20% of current liabilities, but still adequate to cover maturing obligations.
3	Liquid asset composition is lower than 15% of total assets and liquid asset composition is lower than 20% of current liabilities, but sufficiently adequate to cover maturing obligations.
4	Liquid asset composition is lower than 15% of total assets and liquid asset composition is lower than 20% of current liabilities, and is inadequate to cover maturing obligations.
5	• Liquid asset composition is lower than 15% of total assets and liquid asset composition is lower than 20% of current liabilities, and is inadequate to cover maturing obligations; and/or<br>• Ratio of liquid assets to current liabilities meets BDPI criteria.

c) Parameter for the ratio of financing to total non-bank third-party funds (Financing to Deposit Ratio (FDR)) In this parameter, the BPRS assesses the amount of financing, compared to total non-bank third-party funds. (1) Definition of financing is all financing to third parties who are not banks. (2) Definition of total non-bank third-party funds is all funding obtained by the BPRS from third parties who are not banks, consisting of savings and time deposits. The higher the ratio percentage, the higher the Risk for the BPRS because the BPRS is exposed to Liquidity Risk as the financing funding source comes from non-bank third parties, which can be withdrawn at any time by the fund owners.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	<90%
2	FDR is higher than 90% and non-performing financing is not significant.
3	FDR is higher than 90% but non-performing financing is less significant.
4	FDR is higher than 90% but non-performing financing is quite significant.
5	FDR is higher than 90% and non-performing financing is very significant.

Note:
BPRS with ratios that:

Non-performing financing is not significant means the BPRS has NPF Net ≤ 5%
Non-performing financing is less significant means the BPRS has 5% < NPF Net ≤ 6%
Non-performing financing is quite significant means the BPRS has 6% < NPF Net ≤ 7%
Non-performing financing is very significant means the BPRS has NPF Net > 7%

d) Parameter for the ratio of the 25 largest depositors and savers to total third-party funds In this parameter, the BPRS assesses the concentration of the 25 largest depositors and savers, compared to total third-party funds collected. (1) Definition of the 25 largest depositors and savers is the 25 non-bank depositors and savers based on the same CIF with the largest deposit and savings amounts at the relevant BPRS. (2) Definition of total third-party funds is all funding obtained by the BPRS from third parties who are not banks, consisting of savings and time deposits. The higher the ratio percentage, the higher the Risk for the BPRS because the BPRS is exposed to Liquidity Risk as the collected third-party funds are concentrated among the 25 largest depositors and savers, in the event of simultaneous withdrawals by the 25 largest depositors and savers.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	<25%
2	Composition of the 25 largest depositors and savers is more than 25% and all are old customers.
3	Composition of the 25 largest depositors and savers is more than 25% and the majority are old customers.
4	Composition of the 25 largest depositors and savers is more than 25% and the majority are new customers.
5	Composition of the 25 largest depositors and savers is more than 25% but all are new customers.

Note:

All are old customers means all 25 largest depositors and savers are old customers.
The majority are old customers means ≥ 50% of the 25 largest depositors and savers are old customers.
The majority are new customers means ≥ 50% of the 25 largest depositors and savers are new customers.
All are new customers means all 25 largest depositors and savers are new customers (depositors and savers who newly opened accounts at the time of the assessment period).

e) Parameter for the ratio of non-core funding to total funding In this parameter, the BPRS assesses the concentration of non-core funding, compared to total funding. (1) Definition of non-core funding is funding that the BPRS considers relatively unstable or tends not to remain in the BPRS under normal and crisis conditions, including:
(a) Third-party funds with nominal amounts above LPS regulations; (b) All inter-BPRS transactions; and/or (c) Loans that, based on the BPRS's assessment, have a high possibility of being withdrawn unilaterally at any time by the lender. (2) Definition of total funding is all funding obtained by the BPRS from both third-party funds and received loans. The higher the ratio percentage, the higher the Risk for the BPRS because the BPRS is exposed to Liquidity Risk due to high funding with characteristics that do not remain in the BPRS, in the event of withdrawals of such funds at any time.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	<10%
2	Non-core funding ratio is greater than 10% of total funding, but not significant and can still be managed by the BPRS.
3	Non-core funding ratio is greater than 10% of total BPRS funding and is quite significant.
4	Non-core funding ratio is greater than 10%, and significant so that it almost dominates BPRS funding.
5	Non-core funding ratio is very large and dominates BPRS funding.

f) Parameter for the ratio of non-core deposits to total third-party funds In this parameter, the BPRS assesses the concentration of non-core deposits compared to total third-party funds. (1) Definition of non-core deposits is savings and time deposits with nominal amounts above LPS regulations. (2) Definition of total third-party funds is all funding obtained by the BPRS from non-bank third parties, consisting of savings and time deposits. The higher the ratio percentage, the higher the Risk for the BPRS because the higher the likelihood of the BPRS experiencing Liquidity Risk due to high third-party funds with characteristics that do not remain in the BPRS, making it more risky in the event of withdrawals of such funds at any time.

The determination of parameter rankings for this parameter is based on the following indicative descriptions:

Rank	Description
1	<5%
2	Non-core deposit ratio is greater than 5% of total third-party funds, but not significant and can still be managed by the BPRS.
3	Non-core deposit ratio is greater than 5% of total BPRS third-party funds and is quite significant.
4	Non-core deposit ratio is greater than 5% and significant so that it almost dominates BPRS third-party funds.
5	Non-core deposit ratio is very large and dominates BPRS funding.

g) Parameter for the ratio of receivable-based financing to profit-sharing-based financing In this parameter, the BPRS assesses the concentration of receivable-based financing compared to profit-sharing-based financing. (1) Definition of receivable-based financing is financing to banks and non-bank third parties that have fixed yields, including murabahah, istishna, and ijarah (including musyarakah mutanaqisah). (2) Definition of profit-sharing-based financing is financing to banks and non-bank third parties that have unstable yields, including mudarabah and musyarakah. The lower the ratio percentage, the higher the Risk for the BPRS because the larger the BPRS portfolio consists of profit-sharing-based financing.

The determination of parameter rankings for this parameter is based on the following indicative descriptions:

Rank	Description
1	≥4.7x
2	Ratio of receivable-based financing is less than 4.7x but dominates BPRS financing.
3	Ratio of receivable-based financing is less than 4.7x and almost dominates BPRS financing.
4	Ratio of receivable-based financing is less than 4.7x and less dominates BPRS financing.
5	Ratio of receivable-based financing is very small and does not dominate BPRS financing.

Pillar of vulnerability in funding needs and access to funding sources
In this pillar, the BPRS assesses the BPRS's funding needs in normal and crisis situations, the BPRS's ability to meet such funding needs which is possible with access to owned funding sources, by analyzing and ranking at least the following parameters:

a) Parameter for assessing BPRS funding needs in normal and crisis situations, and the BPRS's ability to meet funding needs, for example by looking at the fairness of the yield rates of obtained funding sources. The higher the funding needs not accompanied by the BPRS's ability to meet such needs, the greater the likelihood of the BPRS experiencing Liquidity Risk.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	• BPRS is very capable of meeting obligations and cash flow needs under normal and crisis conditions; and/or<br>- BPRS cash flows from assets and liabilities can offset each other very well across all time scales.
2	• BPRS is capable of meeting obligations and cash flow needs under normal and crisis conditions; and/or<br>- BPRS cash flows from assets and liabilities can offset each other across the majority of time scales.
3	• BPRS is sufficiently capable of meeting obligations and cash flow needs under normal and crisis conditions (100%); and/or<br>- BPRS cash flows from assets and liabilities can offset each other sufficiently.
4	• BPRS is less capable of meeting obligations and cash flow needs under normal and crisis conditions; and/or<br>- BPRS cash flow mismatch (mismatch) across various time scales is considerable.
5	• BPRS is unable to meet obligations and cash flow needs under normal and crisis conditions; and/or<br>- BPRS cash flows cannot offset each other.

well matched). with good. well (100%), especially in the short term. significant.
Note:

The determination of ratings 1, 2, 4, and 5 considers deviations in the percentage of obligation fulfillment and cash flow needs under normal and crisis conditions with a reference of 100% (rating 3).
Crisis conditions can be interpreted as conditions where BPRS's funding needs exceed the average funding needs under normal conditions.
b) Assessment parameters regarding how broad or how large the BPRS's funding commitments are that can be used if needed.
The larger the funding access owned by the BPRS, the lower the Liquidity Risk for the BPRS.
The determination of the parameter rating is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description BPRS Access to funding sources very adequate, proven by the BPRS's very good reputation, bank loans that can be drawn at any time very adequate, and there is commitment/ liquidity support from controlling shareholders/ parent company BPRS Access to funding sources adequate, proven by the BPRS's good reputation, bank loans that can be drawn at any time adequate, and there is commitment/ liquidity support from controlling shareholders/ parent company BPRS Access to funding sources fairly adequate, proven by the BPRS's fairly good reputation, bank loans that can be drawn at any time fairly adequate, and there is commitment/ support liquidity from controlling shareholders/ parent company BPRS Access to funding sources less adequate, proven by the BPRS's deteriorating reputation, bank loans that can be drawn at any time less adequate, and commitment/ liquidity support from controlling shareholders/ parent company BPRS Access to funding sources inadequate, proven by the BPRS's poor reputation so that the BPRS has difficulty obtaining funding, no bank loans that can be drawn at any time, and no commitment/ support liquidity from

parent/intra-group
BPRS. parent/intra-group
BPRS. parent/intra-group
BPRS that is fairly adequate.
BPRS that is very limited. controlling shareholders/ parent company parent/intra-group BPRS.
Note:

Commitments and support can be proven with documents/statement letters.
Definition:
BPRS Access to funding sources is very adequate, meaning the BPRS has a very good reputation, there are
loan facilities from other banks and other parties from at least 3 (three) funding sources that can be drawn at any time.
BPRS Access to funding sources is adequate, meaning the BPRS has a good reputation, there are loan
facilities from other banks and other parties from 2 (two) funding sources that can be drawn at any time.
BPRS Access to funding sources is fairly adequate, meaning the BPRS has a fairly good reputation, there are
loan facilities from other banks and other parties from 1 (one) funding source that can be drawn at any time.
BPRS Access to funding sources is less adequate, meaning the obtained funds are insufficient
against the amount of funds needed with a ratio < 100%.
BPRS Access to funding sources is inadequate, meaning the BPRS does not have funding source facilities from other
banks or other parties.
There is liquidity commitment/support from Controlling Shareholders/parent company/intra-group BPRS,
meaning the liquidity commitment/support from Controlling Shareholders/parent company/intra-group BPRS is more than expected with liquidity support capability > 100%.
There is liquidity commitment/support from Controlling Shareholders/parent company/intra-group BPRS
that is fairly adequate, meaning the liquidity commitment/support from Controlling Shareholders/ parent company/intra-group BPRS is as expected with liquidity support capability of 100%.
Liquidity commitment/support from Controlling Shareholders/parent company/intra-group BPRS that
is very limited, meaning the liquidity commitment/support from Controlling Shareholders/parent company/intra-group BPRS is not as expected with liquidity support capability < 100%.

e. Reputational Risk
As explained in Article 3 paragraph (1) letter e of POJK MR BPRS, Reputational Risk is the Risk resulting from a decrease in the level of trust of stakeholders stemming from negative perceptions of the BPRS. Reputational risk can stem from various BPRS business activities, including events that have harmed the BPRS's reputation, such as negative media coverage, violations of business ethics, and customer complaints.

Pillar of reputation influence of parties associated with the BPRS
In this pillar, the BPRS assesses the credibility of the BPRS and parties associated with the BPRS, including the frequency and impact of negative reporting and reputation events, which is done by analyzing and assigning ratings to at least the following parameters:
a) Parameter of BPRS and associated parties' credibility In this parameter, the BPRS assesses the credibility of the BPRS and parties associated with the BPRS, including members of the Board of Directors, Board of Commissioners, DPS, shareholders, and related companies of the BPRS, and their impact on the BPRS, which is assessed from negative media coverage in mass media and other media. The higher the breadth and impact of negative reporting on the BPRS and parties associated with the BPRS, the higher the Risk the BPRS has because the BPRS is exposed to Reputational Risk due to such negative reporting. The determination of the parameter rating is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description No negative reporting regarding the BPRS including members of the Board of Directors, Board of Commissioners, DPS, shareholders, and related companies of the BPRS, in mass media (between other print and electronic) and other media that can be accessed by the public. There is negative reporting regarding the BPRS including members of the Board of Directors, Board of Commissioners, DPS, shareholders, and related companies of the BPRS, in mass media (between other print and electronic) and other media that can be accessed by the public, but the scale of its influence is not material and can be mitigated well. There is negative reporting regarding the BPRS including members of the Board of Directors, Board of Commissioners, DPS, shareholders, and related companies of the BPRS, in mass media (between other print and electronic) and other media that can be accessed by the public, with a scale of influence fairly material to BPRS performance but still controllable. There is negative reporting regarding the BPRS including members of the Board of Directors, Board of Commissioners, DPS, shareholders, and related companies of the BPRS, in mass media (between other print and electronic) and other media that can be accessed by the public, with a scale of influence that is material to BPRS performance and requires special attention. There is negative reporting regarding the BPRS including members of the Board of Directors, Board of Commissioners, DPS, shareholders, and related companies of the BPRS, in mass media (between other print and electronic) and other media that can be accessed by the public, with a scale of influence that is very material to BPRS performance, so that requires immediate follow-up. b) Parameter of the significance and materiality of the impact caused by reputation events In this parameter, the BPRS assesses the significance and materiality of reputation events that occur at the BPRS. The higher the significance and materiality of reputation events occurring at the BPRS, the higher the Risk the BPRS has because the BPRS is exposed to Reputational Risk due to negative perceptions. The determination of the parameter rating is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description No reputation events.

There are
reputation events with low frequency; but
do not affect
the reputation of the BPRS.
There are
reputation events with low frequency; and
affect
fairly material on the reputation of the BPRS relatively against the size and scale of the BPRS business.
There are
reputation events with frequency fairly high; but
do not affect
the reputation of the BPRS.
There are
reputation events with frequency that is high; and
affect
materially on the reputation of the BPRS relative to the size and scale of the BPRS business. or
there are
reputation events with frequency that is very high; but
not all
affect materially on the reputation of the BPRS relative to the size and scale of the BPRS business.
affect
very material on the reputation of the BPRS relative to the size and scale of the BPRS business.
Note:
Reputation events can be, for example, bankruptcy, business failure, financial scandals, material violations/legal actions that occur at the owner/related company and impact the bank's Reputational Risk.

Pillar of the frequency and significance of customer complaints
In this pillar, the BPRS assesses the frequency and significance of customer complaints against the BPRS, including the administration and follow-up upon receipt of customer complaints, which is done by analyzing and assigning ratings to at least the following parameters:

a) Parameter of customer complaint administration and follow-up In this parameter, the BPRS assesses the administration of customer complaints received and the resolution of customer complaints through follow-up actions taken. What is meant by administration is recording and appointing responsible officers. The more adequate the administration of customer complaints accompanied by the resolution of customer complaints through adequate follow-up, the lower the Risk the BPRS has because the smaller the likelihood of the BPRS being exposed to Reputational Risk due to such customer complaints. The determination of the parameter rating is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description • Customer complaints are administered in an orderly and informative manner (exists, complete, routine); and/or

All
complaints have been resolved.
Customer
complaints are administered with fairly orderly and informative manner (mostly exists, mostly complete, mostly routine); and/or
Most
complaints have been resolved.
Customer
complaints are administered with fairly orderly and informative manner (mostly exists, mostly complete, mostly routine); and/or
A small portion
of complaints have been resolved.
Customer
complaints are administered with less orderly and informative manner (a small portion exists, a small portion complete, a small portion routine); and/or
A small portion
of complaints have been resolved.
No administration regarding customer complaints and/or none are resolved.
Note:
What is meant by "most" is at least 50%
What is meant by "a small portion" is less than 50%

b) Parameter of the significance and materiality of customer complaints In this parameter, the BPRS assesses the significance and materiality of customer complaints received by the BPRS. The higher the significance and materiality of customer complaints, the higher the Risk the BPRS has because the BPRS is exposed to Reputational Risk due to such customer complaints. The determination of the parameter rating is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description Frequency of customer complaints is very minimal and very not material.
Frequency of customer complaints is minimal and not material.
Frequency of customer complaints is fairly high and fairly material.
Frequency of customer complaints is high and material.
Frequency of customer complaints is very high and very material and/or caused by violations of banking regulations.
Note:

The assessment of the frequency level of customer complaints is linked to the number of customers and/or business volume of each BPRS
The assessment of the materiality of customer complaints is linked to the number of customers or BPRS accounts, among others
it can be in the form of the impact of losing customers or core depositors.

Pillar of violations of business ethics
In this pillar, the BPRS assesses the transparency carried out by the BPRS, both transparency of financial information as well as transparency of BPRS products and services, which is done by analyzing and assigning ratings to at least the following parameters:

a) Parameter of financial information transparency In this parameter, the BPRS assesses the provision of the BPRS's financial information in a complete, accurate, current, and holistic manner to all interested parties in accordance with the provisions of laws and regulations. The more complete, accurate, current, and holistic the financial information provided, the smaller the likelihood of the BPRS being exposed to Reputational Risk due to violations of business ethics. The determination of the parameter rating is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description Reports and financial information provided by the BPRS to all parties who have an interest in the BPRS are complete, accurate, current, and holistic in accordance with the provisions of laws and regulations. Reports and financial information provided by the BPRS to all parties who have an interest in the BPRS are complete, accurate, current, but not holistic. Reports and financial information provided by the BPRS to all parties who have an interest in the BPRS are less complete and there is still information provided that does not match the provisions of laws and regulations, but does not result in assessments that the BPRS does not provide information and financial reports in accordance with the provisions of laws and regulations, and results in the actual financial condition of the BPRS not being known.

assessments that are not in accordance with the actual financial condition. not in accordance with the actual financial condition. b) Parameter of BPRS product and service transparency In this parameter, the BPRS assesses the complexity of products and services managed that require special understanding from customers or BPRS business partners, as well as the implementation of providing information needed to obtain such understanding. The higher the need for special understanding from customers or BPRS business partners not accompanied by the implementation of providing the needed information, the more the BPRS is exposed to Reputational Risk due to violations of business ethics. The determination of the parameter rating is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description BPRS products and services have a simple scheme, and do not require special understanding from customers or BPRS business partners, and the BPRS provides information regarding product specifications and BPRS products and services have a complex scheme, and require special understanding from customers or BPRS business partners, and the BPRS provides information regarding product specifications and BPRS There are BPRS products and services that have a complex scheme, and require special understanding from customers or BPRS business partners, but the BPRS has not fully provided information regarding There are BPRS products and services that have a complex scheme, and require special understanding from customers or BPRS business partners, but the BPRS does not provide information regarding specifications BPRS products and services to customers or BPRS business partners clearly and completely. specifications products and BPRS services to customers or BPRS business partners clearly and completely. specifications products and BPRS services to customers or BPRS business partners clearly and completely. products and BPRS services to customers or BPRS business partners clearly and completely. BPRS provides information that is incorrect to customers or BPRS business partners regarding specifications products and BPRS services. f. Strategic Risk As explained in Article 3 paragraph (1) letter f of POJK MR BPRS, Strategic Risk is the Risk resulting from inappropriateness in the making and/or implementation of a strategic decision as well as the BPRS's failure to anticipate changes in the business environment. Strategic risk can stem from the establishment of strategies that are not aligned with the vision and mission of the BPRS, non-comprehensive strategic environment analysis, misalignment of strategic plans across strategic levels, as well as failure to anticipate changes in the business environment including changes in technology, changes in macroeconomic conditions, dynamics of competition in the market, and changes in relevant authority policies.

Pillar of business strategy establishment
In this pillar and parameter, the BPRS assesses the selection of strategies based on the level of Risk and success of the type/choice of business strategies and market shares established, including the use of the BPRS's existing business strategies and market shares that have been chosen so far. The higher the level of Risk of the business strategy and market share chosen by the BPRS, the higher the Risk of the BPRS's strategic risk. The determination of the parameter rating is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description • No new products/activities owned by the BPRS, strategy choices suitable for the resources owned with a high level of success of the strategy; and/or

The BPRS conducts
business activities in market segments/sectors economic and customers that are already known/existing before, including no strategy for office network development.
The BPRS has
several new strategies but still in the main business and the BPRS's competencies (there are several new products/activities) and suitable for the resources owned with a level of success of the strategy that is fairly high; and/or
The BPRS conducts
business activities in market segments/sectors economic and customers that are already known/existing before, with market shares that are increasingly broad.
The BPRS has
several new strategies including new products/activities that are classified as high risk among others requiring HR with special skills and/or more complex IT infrastructure with a level of success of the BPRS's strategy classified as moderate; and/or
Most of the BPRS's
business activities are in market segments/sectors economic and customers that are already known/existing before, there is expansion of market shares and new customers but without through office network development strategies.
The majority of strategies
of the BPRS shift to new strategies with new products/activities that are classified as high risk among others requiring HR with special skills and/or more complex IT infrastructure with a level of success that cannot yet be ensured; and/or
Most of the
BPRS's business activities are in market segments/sectors economic and new customers, including through office network development strategies.
The BPRS changes
business strategies to enter new products/activities that are classified as high risk among others requiring HR with special skills and/or more complex IT infrastructure that is not main business and the BPRS's competencies with a level of success that cannot yet be ensured;
All of the BPRS's
business activities are in market segments/sectors economic and new customers, including through office network development strategies; and/or
The BPRS is new
operating.

Pillar of business plan formulation
In this pillar and parameter, the BPRS assesses the BPRS's considerations in carrying out the formulation of plans and business models that consider external factors (regional economic conditions, changes in regulations, technological developments, changes in the level of competition/competition, consumer preferences for products or services offered by the BPRS, political conditions, and the level of saturation) and internal factors (vision and mission of the BPRS, BPRS's financial conditions related to capital, funding sources, and key financial performance ratios, as well as BPRS infrastructure including BPRS HR, organization including internal control systems, and IT), which is done by analyzing and assigning ratings to at least the following parameters:
a) Parameter of consideration of external and internal factors in formulating plans and business models In this parameter, the BPRS assesses the basis for consideration in formulating plans and business models to be implemented. The more external factors and internal factors that are considered in formulating the BPRS's plans and business models, and the higher the level of responsiveness of the BPRS to changes in external factors, the lower the Risk of the BPRS's strategic risk. The determination of the parameter rating is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description • Formulation of strategy (plans and business models) of the BPRS has considered all factors that

Formulation
of strategy (plans and business models) of the BPRS has considered all factors that
Formulation
of strategy (plans and business models) of the BPRS has considered most of the factors that
Formulation
of strategy (plans and business models) of the BPRS only considers some factors that
Formulation
of strategy (plans and business models) of the BPRS has not considered the BPRS's business environment either external factors or internal factors; and/or
The BPRS does not
respond to changes in external factors i.e. does not make changes in business plans that are needed. that affect the BPRS's business environment either external factors or internal factors comprehensively; and/or
The level of speed
of the BPRS's response to changes in external factors is classified as high, changes are made in business plans if needed in a timely manner. that affect the BPRS's business environment either external factors or internal factors, but there are some weaknesses; and/or
The level of speed
of the BPRS's response to changes in external factors is classified as medium, changes are made in business plans if needed but do not require long time. that affect the BPRS's business environment either external factors or internal factors, but there are some weaknesses; and/or
The level of speed
of the BPRS's response to changes in external factors is classified as low, changes are made in business plans if needed but require quite long time. that affect the BPRS's business environment either external factors or internal factors, and there are weaknesses that are classified as very significant; and/or
The level of speed
of the BPRS's response to changes in external factors is classified as very low, changes are made in business plans if needed but require very long time. external factors or internal factors; and/or
The BPRS does not
respond to changes in external factors i.e. does not make changes in business plans that are needed.
Note:
The level of response speed is indicated, among others, by the implementation of discussions and formulation of action plans against the aforementioned external changes. b) Parameter of the BPRS's competitive advantage and threats from competitors In this parameter, the BPRS assesses the competitive advantages owned and the level of threats from competitors. The higher the competitive advantages owned by the BPRS accompanied by a low level of threats from competitors, the lower the Risk of the BPRS's strategic risk.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	The BPRS has stable competitive advantages and there are no threats from competitors.
2	The BPRS has moderate competitive advantages but there are threats from competitors that do not affect the BPRS (example: financing growth and third-party funds (DPK) are still above target).
3	The BPRS has moderate competitive advantages and there are threats from competitors that affect the BPRS (example: there is a deviation in the achievement of financing growth and DPK but it is still considered low).
4	The BPRS lacks competitive advantages, and/or there are significant threats from competitors that impact the financial performance of the BPRS (example: there is a deviation in the achievement of financing growth and DPK that is considered moderate).
5	The BPRS does not have competitive advantages, and/or there are very significant threats from competitors that have a significant impact on the financial performance of the BPRS (example: there is a deviation in the achievement of financing growth and DPK that is considered high).

Pillar of business target achievement
In this pillar, the BPRS assesses the realization of the business plan compared to the established targets, as well as the level of success in implementing strategic decisions established by the BPRS, which is done by analyzing and ranking at least the following parameters:

a) Parameter comparing the realization and target of key financial indicators in accordance with the provisions of the BPRS business plan, specifically for capital factors, asset quality, financing, liquidity, financing disbursement to MSMEs, and profitability. The targets established in the BPRS business plan include targets that are quantitative (financial report performance, namely balance sheet and income statement, fund mobilization and disbursement, and capital which includes ratios, core capital fulfillment, capital addition plan fulfillment) and targets that are qualitative (organizational development, IT, HR, implementation of new business activities or new products/services, and office network).

The higher the deviation below the BPRS target, the higher the Risk the BPRS has because the BPRS is exposed to strategic Risk due to the BPRS's inability to achieve the established targets.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	• Realization above quantitative targets or there is a deviation of at most 5% from the target; and<br>• Most or all qualitative targets are met.
2	• Low deviation compared to quantitative targets; and<br>• Most qualitative targets are met.
3	• Moderate deviation compared to quantitative targets; and<br>• Most qualitative targets are met.
4	• High deviation compared to quantitative targets; and<br>• A small portion of qualitative targets are met.
5	• Very high deviation compared to quantitative targets; and<br>• A small portion of qualitative targets are met or no targets are met.

Note:

Deviation greater than 5% may receive a lower Risk ranking in the event of external conditions causing the same condition in target achievement across the industry.
The determination of low/moderate/high/very high deviation can be based on deviation in the BPRS peer group (e.g., BPRS with similar conditions, BPRS in the same operational region, BPRS with the same scale and business complexity) or compared with the historical trends of the respective BPRS.

b) Parameter of the track record of the BPRS's success in implementing strategic decisions related to product/ new activity development, changes in business targets, strategic investments, merger, consolidation, and acquisition plans, as well as the achievement of business targets. The shortest evaluation period for the track record is the last 5 (five) years.

The higher the level of success of the BPRS in implementing strategic decisions, the lower the strategic Risk of the BPRS.

The determination of parameter rankings is based on the following indicative descriptions:

Rank	Description
1	Historically, the BPRS has a very good track record in implementing strategic decisions related to the four track record assessment factors.
2	Historically, the BPRS has a good track record in implementing strategic decisions related to the four track record assessment factors.
3	Historically, the BPRS has a fairly good track record in implementing strategic decisions related to the four track record assessment factors.
4	Historically, the BPRS has a poor track record in implementing strategic decisions related to the four track record assessment factors.
5	Historically, the BPRS has a bad track record in implementing strategic decisions related to the four track record assessment factors.

Note:
Track record assessment factors include among others:

achievement of newly developed products;
level of success of strategic decisions related to changes in business plans that have been carried out;
level of success of strategic investments, mergers, consolidations, and acquisitions that have been carried out; and
trend of business plan achievement levels.
After ranking each parameter for each type of Risk, the BPRS determines the inherent Risk level for each type of Risk based on the parameter ranking that is assessed as most significant and materially affecting the BPRS's financial position.
The determination of the inherent Risk level for each type of Risk refers to the inherent Risk level determination matrix as referred to in the Inherent Risk Level Determination Matrix.

Step 2: Assessment and Determination of the Level of Risk Management Implementation (KPMR)

The assessment of the KPMR level aims to assess the adequacy of the Risk control system.
The implementation of Risk Management by BPRS varies greatly according to the scale, complexity, and level of Risk that can be tolerated by the BPRS. Therefore, the assessment of the KPMR level needs to be adjusted to the characteristics, complexity, and business scale of the BPRS.
The assessment of the KPMR level is conducted by considering qualitative parameters.
The parameter ranking descriptions presented in this Financial Services Authority Circular are indicative and serve as a general reference. In the event of a difference between actual conditions and the existing ranking descriptions, it is possible to adjust the relevant rankings based on Risk considerations.
The determination of KPMR parameter rankings is conducted through comprehensive analysis considering the interconnection between one assessment parameter and other parameters, and is not influenced by the inherent Risk owned by the BPRS.
The determination of the KPMR level for each type of Risk is categorized into rank 1 (very adequate), rank 2 (adequate), rank 3 (fairly adequate), rank 4 (inadequate), and rank 5 (not adequate).
The BPRS provides rankings for each inherent KPMR parameter as follows:

a. Credit Risk

1 - Very Adequate	2 - Adequate	3 - Fairly Adequate	4 - Inadequate	5 - Not Adequate
1. Has the Board of Directors prepared Credit Risk Management policies, implemented them consistently, and updated them periodically?	• The Board of Directors has prepared Credit Risk Management policies;<br>• conducts business activities based on the established Credit Risk Management policies;<br>• The Board of Directors updates the Credit Risk Management policies in the event of changes in regulatory provisions, changes in business, and the results of Risk Management policy evaluations by the Board of Commissioners; and<br>• the implemented Credit Risk Management policies have proven to mitigate Credit Risk.	• The Board of Directors has prepared Credit Risk Management policies;<br>• conducts business activities based on the established Credit Risk Management policies; and<br>• The Board of Directors updates the Credit Risk Management policies in the event of changes in regulatory provisions, changes in business, and the results of Risk Management policy evaluations by the Board of Commissioners.	• The Board of Directors has prepared Credit Risk Management policies;<br>• conducts business activities based on the established Credit Risk Management policies; and<br>• The Board of Directors updates the Credit Risk Management policies in the event of changes in regulatory provisions, changes in business, and the results of Risk Management policy evaluations by the Board of Commissioners.	• The Board of Directors has prepared Credit Risk Management policies;<br>• conducts business activities based on the established Credit Risk Management policies; and<br>• The Board of Directors does not update the Credit Risk Management policies in the event of changes in regulatory provisions, changes in business, and the results of Risk Management policy evaluations by the Board of Commissioners.	• The Board of Directors has prepared Credit Risk Management policies;<br>• does not conduct business activities based on the established Credit Risk Management policies; and<br>• The Board of Directors does not update the Credit Risk Management policies in the event of changes in regulatory provisions, changes in business, and the results of Risk Management policy evaluations by the Board of Commissioners.<br>• The Board of Directors has not prepared Credit Risk Management policies.
2. Does the Board of Directors have the ability to take necessary actions to mitigate Credit Risk, and communicate Credit Risk Management policies to all levels of the BPRS organization?	• The Board of Directors takes necessary actions to mitigate Risk when implementing Credit Risk Management policies;<br>• The Board of Directors communicates Credit Risk Management policies; and<br>• all levels of the BPRS organization are able to understand the implemented Credit Risk Management policies.	• The Board of Directors takes necessary actions to mitigate Risk when implementing Credit Risk Management policies;<br>• The Board of Directors communicates Credit Risk Management policies; and<br>• not all levels of the BPRS organization are able to understand the implemented Credit Risk Management policies but it does not cause significant impact.	• The Board of Directors takes necessary actions to mitigate Risk when implementing Credit Risk Management policies;<br>• The Board of Directors communicates Credit Risk Management policies; and<br>• not all levels of the BPRS organization are able to understand the implemented Credit Risk Management policies and it causes significant impact.	• The Board of Directors takes necessary actions to mitigate Risk when implementing Credit Risk Management policies;<br>• The Board of Directors does not communicate Credit Risk Management policies; and<br>• The Board of Directors does not take necessary actions to mitigate Risk when implementing Credit Risk Management policies;<br>• The Board of Directors does not communicate Credit Risk Management policies; and<br>• all levels of the BPRS organization are unable to understand the implemented Credit Risk Management policies.	• The Board of Directors does not communicate Credit Risk Management policies; and<br>• all levels of the BPRS organization are unable to understand the implemented Credit Risk Management policies.
3. Has the Board of Directors implemented HR management policies in the implementation of Credit Risk Management?	• There is alignment of HR qualifications with positions and job fields;<br>• There are efforts to consistently improve HR competence; and<br>• The level of HR performance standard fulfillment in work units carrying out financing functions is in accordance with duties and responsibilities.	• There is misalignment of HR qualifications with positions and job fields but it does not cause significant impact;<br>• There are efforts to consistently improve HR competence; and<br>• The level of HR performance standard fulfillment in work units carrying out financing functions is in accordance with duties and responsibilities.	• There is misalignment of HR qualifications with positions and job fields but it does not cause significant impact;<br>• There are efforts to improve HR competence but not consistently; and<br>• The level of HR performance standard fulfillment in work units carrying out financing functions is in accordance with duties and responsibilities.	• There is misalignment of HR qualifications with positions and job fields and it causes significant impact;<br>• There are efforts to improve HR competence but not consistently; and<br>• The level of HR performance standard fulfillment in work units carrying out financing functions is not in accordance with duties and responsibilities but it does not cause significant impact.	• There is misalignment of HR qualifications with positions and job fields and it causes significant impact;<br>• There are no efforts to improve HR competence; and<br>• The level of HR performance standard fulfillment in work units carrying out financing functions is not in accordance with duties and responsibilities and it causes significant impact.
4. Has the Board of Commissioners given approval for the Credit Risk Management policies prepared by the Board of Directors and conducted periodic evaluations?	• The Board of Commissioners has given approval for the Credit Risk Management policies;<br>• The Board of Commissioners has conducted evaluations of the Credit Risk Management policies;<br>• The Board of Commissioners has given approval for the Credit Risk Management policies;<br>• The Board of Commissioners has conducted evaluations of the Credit Risk Management policies; and<br>• evaluations are conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities; and<br>• the evaluations conducted are relevant to the needs for adjusting Credit Risk Management policies.	• The Board of Commissioners has given approval for the Credit Risk Management policies;<br>• The Board of Commissioners has conducted evaluations of the Credit Risk Management policies; and<br>• evaluations are conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities.	• The Board of Commissioners has given approval for the Credit Risk Management policies;<br>• The Board of Commissioners has conducted evaluations of the Credit Risk Management policies; and<br>• evaluations are conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities.	• The Board of Commissioners has given approval for the Credit Risk Management policies; and<br>• The Board of Commissioners does not conduct evaluations of the Credit Risk Management policies.	• The Board of Commissioners has not given approval for the Credit Risk Management policies; and<br>• The Board of Commissioners does not conduct evaluations of the Credit Risk Management policies.
5. Has the Board of Commissioners conducted evaluations of the Board of Directors' accountability for the implementation of Credit Risk Management policies periodically and ensured follow-up on the results of said evaluations?	• The Board of Commissioners has conducted evaluations of the implementation of Credit Risk Management policies by the Board of Directors;<br>• evaluations by the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that significantly affect BPRS business activities;<br>• The Board of Commissioners has ensured follow-up on evaluation results in every reporting period; and<br>• the evaluations provided are relevant to the implementation of Credit Risk Management policies to support BPRS performance improvement.	• The Board of Commissioners has conducted evaluations of the implementation of Credit Risk Management policies by the Board of Directors;<br>• evaluations by the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that significantly affect BPRS business activities; and<br>• The Board of Commissioners has ensured follow-up on evaluation results in every reporting period.	• The Board of Commissioners has conducted evaluations of the implementation of Credit Risk Management policies by the Board of Directors;<br>• evaluations by the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that significantly affect BPRS business activities; and<br>• The Board of Commissioners has not ensured follow-up on evaluation results in every reporting period.	• The Board of Commissioners has conducted evaluations of the implementation of Credit Risk Management policies by the Board of Directors;<br>• evaluations by the Board of Commissioners are not conducted periodically; and<br>• The Board of Commissioners has not ensured follow-up on evaluation results in every reporting period.	• The Board of Commissioners has not conducted evaluations of the implementation of Credit Risk Management policies by the Board of Directors.
6. Has the Sharia Supervisory Board (DPS) conducted evaluations of Credit Risk Management policies related to the fulfillment of Sharia Principles?	• The DPS has conducted very adequate evaluations of Credit Risk Management policies related to the fulfillment of Sharia Principles;<br>• evaluations are conducted by the DPS periodically at least 1 (one) time in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities; and<br>• the evaluations provided are relevant to the needs for adjusting Credit Risk Management policies.	• The DPS has provided adequate evaluations of Credit Risk Management policies related to the fulfillment of Sharia Principles; and<br>• evaluations are conducted by the DPS periodically at least 1 (one) time in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities.	• The DPS has provided fairly adequate evaluations of Credit Risk Management policies related to the fulfillment of Sharia Principles; and<br>• evaluations are not conducted by the DPS periodically at least 1 (one) time in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities.	• The DPS provides inadequate evaluations of Credit Risk Management policies related to the fulfillment of Sharia Principles.	• The DPS does not provide evaluations of Credit Risk Management policies related to the fulfillment of Sharia Principles.
7. Has the DPS conducted evaluations of the Board of Directors' accountability for the implementation of Credit Risk Management policies related to the fulfillment of Sharia Principles?	• The DPS has conducted very adequate evaluations of the Board of Directors' accountability for the implementation of Credit Risk Management policies related to the fulfillment of Sharia Principles;<br>• evaluations are conducted by the DPS every semester or more; and<br>• the evaluations provided are relevant to the needs for adjusting Credit Risk Management policies.	• The DPS has conducted adequate evaluations of the Board of Directors' accountability for the implementation of Credit Risk Management policies related to the fulfillment of Sharia Principles;<br>• evaluations are conducted by the DPS every semester or more.	• The DPS has conducted fairly adequate evaluations of the Board of Directors' accountability for the implementation of Credit Risk Management policies related to the fulfillment of Sharia Principles; and<br>• evaluations are conducted by the DPS every semester or more.	• The DPS has conducted inadequate evaluations of the Board of Directors' accountability for the implementation of Credit Risk Management policies related to the fulfillment of Sharia Principles; and<br>• evaluations are conducted by the DPS every semester or more.	• The DPS does not conduct evaluations of the Board of Directors' accountability for the implementation of Credit Risk Management policies related to the fulfillment of Sharia Principles.
8. Does the BPRS have an adequate organization handling financing functions and Credit Risk Management functions?	• Has work units handling financing functions completely and there are no overlapping positions that could cause poor governance.<br>• Work units handling financing functions have carried out their duties and authorities in accordance with established guidelines; and<br>• Has SKMR or PEMR and is able to carry out its functions to mitigate Credit Risk.	• Has work units handling financing functions but not completely and there are no overlapping positions that could cause poor governance.<br>• Work units handling financing functions have carried out their duties and authorities in accordance with established guidelines; and<br>• Has SKMR or PEMR and is able to carry out its functions to mitigate Credit Risk.	• Has work units handling financing functions but not completely and there are overlapping positions but it does not cause poor governance.<br>• Work units handling financing functions have carried out their duties and authorities in accordance with established guidelines; and<br>• Has SKMR or PEMR but is not able to carry out its functions to mitigate Credit Risk.	• Has work units handling financing functions but not completely and there are overlapping positions that could cause poor governance.<br>• Work units handling financing functions have carried out their duties and authorities in accordance with established guidelines; and<br>• Has SKMR or PEMR but is not able to carry out its functions to mitigate Credit Risk.	• Has work units handling financing functions but not completely and there are overlapping positions that could cause poor governance.<br>• Work units handling financing functions do not carry out their duties and authorities in accordance with established guidelines; and<br>• Has SKMR or PEMR but is not able to carry out its functions to mitigate Credit Risk.
9. Does the BPRS have adequate Credit Risk Management policies prepared by considering vision, mission, business scale and complexity, and adequacy of...	• Has Credit Risk Management policies;<br>• There is alignment between the substance of Credit Risk Management policies...	• Has Credit Risk Management policies;<br>• There is insignificant misalignment between the substance of Credit Risk Management policies...	• Has Credit Risk Management policies;<br>• There is insignificant misalignment between the substance of Credit Risk Management policies...	• Has Credit Risk Management policies;<br>• There is significant misalignment between the substance of Credit Risk Management policies...	• Does not have Credit Risk Management policies.

(Note: The source text ends abruptly at item 9, column 5. The translation reflects the available text exactly as provided.)

1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Less Adequate 5 - Inadequate

SDM? with Risk Management provisions for BPRS, including having a Risk Management strategy, healthy financing criteria, and the establishment of an information system for Risk Management for Credit Risk; and

there is alignment between Credit Risk Management policies with the vision, mission, business scale, and business complexity, as well as the adequacy of Human Resources in establishing Credit Risk Management policies with BPRS Risk Management provisions, including having a Risk Management strategy, healthy financing criteria, and the establishment of an information system for Risk Management for Credit Risk; and
there is alignment between Credit Risk Management policies with the vision, mission, business scale, and business complexity, as well as the adequacy of Human Resources in establishing Credit Risk Management policies with BPRS Risk Management provisions, including having a Risk Management strategy, healthy financing criteria, and the establishment of an information system for Risk Management for Credit Risk; and
there is misalignment between Credit Risk Management policies with the vision, mission, business scale, and business complexity, as well as the adequacy of Human Resources in establishing Credit Risk Management policies with BPRS Risk Management provisions, including having a Risk Management strategy, healthy financing criteria, and the establishment of an information system for Risk Management for Credit Risk; and
there is misalignment between Credit Risk Management policies with the vision, mission, business scale, and business complexity, as well as the adequacy of Human Resources in establishing Credit Risk Management policies with BPRS Risk Management provisions, including having a Risk Management strategy, healthy financing criteria, and the establishment of an information system for Risk Management for Credit Risk, but does not cause significant impact.

1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Less Adequate 5 - Inadequate

Does the BPRS:

have Credit Risk Management procedures and the establishment of Credit Risk limits set by the Board of Directors;
implement Credit Risk Management procedures and the establishment of Credit Risk limits consistently for all activities; and
conduct evaluation and updating of Credit Risk Management procedures and the establishment of Credit Risk limits
have Credit Risk Management procedures and the establishment of Credit Risk limits set by the Board of Directors at least covering clear and well-documented levels of delegation of authority and accountability to facilitate audit trail requirements for internal control purposes;
implement Credit Risk Management procedures and the establishment of Credit Risk limits in every functional activity consistently; and
conduct evaluation and updating of Credit Risk Management procedures and the establishment of Credit Risk limits in the event of significant business changes and/or changes in statutory regulations.
have Credit Risk Management procedures and the establishment of Credit Risk limits set by the Board of Directors at least covering clear and well-documented levels of delegation of authority and accountability to facilitate audit trail requirements for internal control purposes;
implement Credit Risk Management procedures and the establishment of Credit Risk limits in every functional activity consistently; and
do not conduct evaluation and updating of Credit Risk Management procedures and the establishment of Credit Risk limits in the event of significant business changes and/or changes in statutory regulations, but does not cause significant impact.
have Credit Risk Management procedures and the establishment of Credit Risk limits set by the Board of Directors at least covering clear and well-documented levels of delegation of authority and accountability to facilitate audit trail requirements for internal control purposes;
implement Credit Risk Management procedures and the establishment of Credit Risk limits in every functional activity consistently; and
do not conduct evaluation and updating of Credit Risk Management procedures and the establishment of Credit Risk limits in the event of significant business changes and/or changes in statutory regulations, and causes significant impact.
have Credit Risk Management procedures and the establishment of Credit Risk limits set by the Board of Directors at least covering clear and well-documented levels of delegation of authority and accountability to facilitate audit trail requirements for internal control purposes;
do not implement Credit Risk Management procedures and the establishment of Credit Risk limits in every functional activity consistently; and
do not conduct evaluation and updating of Credit Risk Management procedures and the establishment of Credit Risk limits in the event of significant business changes and/or changes in statutory regulations.

1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Less Adequate 5 - Inadequate

Has the BPRS established policies and procedures for the issuance of products and/or implementation of new activities that cover the identification and mitigation of Credit Risk in accordance with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units?

have policies and procedures regarding the issuance of products and/or new activities that have Credit Risk exposure;
apply policies and procedures in the event of the issuance of products or implementation of new activities; and
there is consistency between the policies and procedures for products and/or new activities with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units.
have policies and procedures regarding the issuance of products and/or new activities that have Credit Risk exposure;
apply policies and procedures in the event of the issuance of products or implementation of new activities; and
there is insignificant inconsistency between the policies and procedures for products and/or new activities with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units.
have policies and procedures regarding the issuance of products and/or new activities that have Credit Risk exposure;
apply policies and procedures in the event of the issuance of products or implementation of new activities; and
there is significant inconsistency between the policies and procedures for products and/or new activities with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units.
have policies and procedures regarding the issuance of products and/or new activities that have Credit Risk exposure;
do not apply policies and procedures in the event of the issuance of products or implementation of new activities; and
there is significant inconsistency between the policies and procedures for products and/or new activities with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units.
do not have policies and procedures regarding the issuance of products and/or new activities with Credit Risk exposure.

1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Less Adequate 5 - Inadequate

Has the BPRS implemented the Credit Risk Management process inherent in BPRS business activities related to Credit Risk?

has implemented the Credit Risk Management process including the identification, measurement, monitoring, and control of Credit Risk against BPRS business activities related to Credit Risk at least covering the latest financial condition or financial reports, cash flow projections, and other documents that can be used to analyze the condition and credibility of customers;
the application of Credit Risk Management is done very adequately; and
the application of Credit Risk Management is done consistently.
has implemented the Credit Risk Management process including the identification, measurement, monitoring, and control of Credit Risk against BPRS business activities related to Credit Risk at least covering the latest financial condition or financial reports, cash flow projections, and other documents that can be used to analyze the condition and credibility of customers;
the application of Credit Risk Management is done adequately; and
the application of Credit Risk Management is done fairly consistently.
has implemented the Credit Risk Management process including the identification, measurement, monitoring, and control of Credit Risk against BPRS business activities related to Credit Risk at least covering the latest financial condition or financial reports, cash flow projections, and other documents that can be used to analyze the condition and credibility of customers;
the application of Credit Risk Management is done adequately; and
the application of Credit Risk Management is not done consistently but does not cause significant impact.
has implemented the Credit Risk Management process but not entirely covering the identification, measurement, monitoring, and control of Credit Risk against BPRS business activities related to Credit Risk at least covering the latest financial condition or financial reports, cash flow projections, and other documents that can be used to analyze the condition and credibility of customers;
the application of Credit Risk Management is inadequate; and
the application of Credit Risk Management is not done consistently so as to cause significant impact.
does not implement the Credit Risk Management process including the identification, measurement, monitoring, and control of Credit Risk against BPRS business activities related to Credit Risk.

1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Less Adequate 5 - Inadequate

Does the BPRS have an information system for Risk Management that supports the Board of Directors in decision-making related to Credit Risk and has been reported to the Board of Directors periodically?

has an information system for Risk Management that reflects Credit Risk;
data in the Risk Management information system is complete, accurate, current, and whole;
the Risk Management information system supports the Board of Directors in decision-making; and
the Risk Management information system strongly supports the Board of Commissioners (SKMR) or Internal Audit (PEMR) in preparing reports to the Board of Directors every semester.
has an information system for Risk Management that reflects Credit Risk;
data in the Risk Management information system is fairly complete, accurate, current, and whole;
the Risk Management information system supports the Board of Directors in decision-making; and
the Risk Management information system fairly supports the Board of Commissioners (SKMR) or Internal Audit (PEMR) in preparing reports to the Board of Directors every semester.
has an information system for Risk Management that reflects Credit Risk;
data in the Risk Management information system is less complete, accurate, current, and whole;
the Risk Management information system does not fully support the Board of Directors in decision-making; and
the Risk Management information system less supports the Board of Commissioners (SKMR) or Internal Audit (PEMR) in preparing reports to the Board of Directors every semester.
has an information system for Risk Management that reflects Credit Risk;
data in the Risk Management information system is not complete, accurate, current, and whole;
the Risk Management information system does not fully support the Board of Directors in decision-making; and
the Risk Management information system does not support the Board of Commissioners (SKMR) or Internal Audit (PEMR) in preparing reports to the Board of Directors every semester.
does not have an information system for Risk Management that reflects Credit Risk.

1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Less Adequate 5 - Inadequate

Has the Internal Audit (SKAI) or Internal Audit (PEAI) conducted periodic audits on the implementation of Credit Risk Management, submitted internal audit result reports, and ensured follow-up on examination findings?

SKAI or PEAI has conducted internal audits on the implementation of Credit Risk Management, provided recommendations, and reported internal audit results to the president director;
internal audits conducted by SKAI or PEAI cover the implementation of Credit Risk Management policies and procedures by considering regulations and BPRS conditions; and
internal audit findings used as recommendations have been followed up.
SKAI or PEAI has conducted internal audits on the implementation of Credit Risk Management, provided recommendations, and reported internal audit results to the president director;
internal audits conducted by SKAI or PEAI cover the implementation of Credit Risk Management policies and procedures by considering regulations and BPRS conditions; and
internal audit findings used as recommendations are not fully followed up but do not cause significant impact.
SKAI or PEAI has conducted internal audits on the implementation of Credit Risk Management, provided recommendations, and reported internal audit results to the president director;
internal audits conducted by SKAI or PEAI cover the implementation of Credit Risk Management policies and procedures by considering regulations and BPRS conditions; and
internal audit findings used as recommendations are not fully followed up and cause significant impact.
SKAI or PEAI has conducted internal audits on the implementation of Credit Risk Management, provided recommendations, and reported internal audit results to the president director;
internal audits conducted by SKAI or PEAI are not in accordance with the scope of implementation of Credit Risk Management policies and procedures; and
internal audit findings used as recommendations are not followed up.
SKAI or PEAI does not conduct internal audits on the implementation of Credit Risk Management.

1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Less Adequate 5 - Inadequate

Has the internal control system for Credit Risk been implemented by all levels of the BPRS organization?

all levels of the BPRS organization related to activities with Credit Risk exposure have implemented internal control functions by considering Risk Management policies, Risk Management procedures, and the establishment of Credit Risk limits;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Credit Risk exposure;
the Board of Commissioners (SKMR) or Internal Audit (PEMR) is separate from units related to activities with Credit Risk exposure; and
the Internal Audit (SKAI) or Internal Audit (PEAI) is separate from units related to activities with Credit Risk exposure.
all levels of the BPRS organization related to activities with Credit Risk exposure have implemented internal control functions but not entirely considering Risk Management policies, Risk Management procedures, and the establishment of Credit Risk limits and do not cause significant impact;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Credit Risk exposure;
the Board of Commissioners (SKMR) or Internal Audit (PEMR) is separate from units related to activities with Credit Risk exposure; and
the Internal Audit (SKAI) or Internal Audit (PEAI) is separate from units related to activities with Credit Risk exposure.
all levels of the BPRS organization related to activities with Credit Risk exposure have implemented internal control functions but not entirely considering Risk Management policies, Risk Management procedures, and the establishment of Credit Risk limits and cause significant impact;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Credit Risk exposure;
the Board of Commissioners (SKMR) or Internal Audit (PEMR) is separate from units related to activities with Credit Risk exposure; and
the Internal Audit (SKAI) or Internal Audit (PEAI) is separate from units related to activities with Credit Risk exposure.
not all levels of the BPRS organization related to activities with Credit Risk exposure have implemented internal control functions by considering Risk Management policies, Risk Management procedures, and the establishment of Credit Risk limits and cause very significant impact;
there is no clarity of authority and responsibility from each level of the BPRS organization related to activities with Credit Risk exposure;
the Board of Commissioners (SKMR) or Internal Audit (PEMR) is separate from units related to activities with Credit Risk exposure; and
the Internal Audit (SKAI) or Internal Audit (PEAI) is separate from units related to activities with Credit Risk exposure.
all levels of the BPRS organization related to activities with Credit Risk exposure do not implement internal control functions;
there is no clarity of authority and responsibility from each level of the BPRS organization related to activities with Credit Risk exposure;
the Board of Commissioners (SKMR) or Internal Audit (PEMR) is not separate from units related to activities with Credit Risk exposure; and
the Internal Audit (SKAI) or Internal Audit (PEAI) is not separate from units related to activities with Credit Risk exposure.

b. Operational Risk Assessment

1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Less Adequate 5 - Inadequate

Has the Board of Directors established Operational Risk Management policies, implemented them consistently, and updated them periodically?

The Board of Directors has established Operational Risk Management policies;
business activities are carried out based on the established Operational Risk Management policies;
The Board of Directors updates Operational Risk Management policies in the event of changes in statutory regulations, business changes, and the results of the Board of Commissioners' evaluation of Operational Risk Management policies; and
the Operational Risk Management policies implemented are proven to mitigate the occurrence of Operational Risk.
The Board of Directors has established Operational Risk Management policies;
business activities are carried out based on the established Operational Risk Management policies; and
The Board of Directors updates Operational Risk Management policies in the event of changes in statutory regulations, business changes, and the results of the Board of Commissioners' evaluation of Operational Risk Management policies.
The Board of Directors has established Operational Risk Management policies;
business activities are carried out based on the established Operational Risk Management policies; and
The Board of Directors does not update Operational Risk Management policies in the event of changes in statutory regulations, business changes, and the results of the Board of Commissioners' evaluation of Operational Risk Management policies.
The Board of Directors has established Operational Risk Management policies;
business activities are not carried out based on the established Operational Risk Management policies; and
The Board of Directors does not update Operational Risk Management policies in the event of changes in statutory regulations, business changes, and the results of the Board of Commissioners' evaluation of Operational Risk Management policies.
The Board of Directors does not establish Operational Risk Management policies.

1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Less Adequate 5 - Inadequate

Has the Board of Directors had the ability to take necessary actions in mitigating Operational Risk, and communicated Operational Risk Management policies to all levels of the BPRS organization?

The Board of Directors takes necessary actions to mitigate Risk when implementing Operational Risk Management policies;
The Board of Directors communicates Operational Risk Management policies; and
all levels of the BPRS organization are able to understand the Operational Risk Management policies applied.
The Board of Directors takes necessary actions to mitigate Risk when implementing Operational Risk Management policies;
The Board of Directors communicates Operational Risk Management policies; and
not all levels of the BPRS organization are able to understand the Operational Risk Management policies applied but do not cause significant impact.
The Board of Directors takes necessary actions to mitigate Risk when implementing Operational Risk Management policies;
The Board of Directors communicates Operational Risk Management policies; and
not all levels of the BPRS organization are able to understand the Operational Risk Management policies applied and cause significant impact.
The Board of Directors takes necessary actions to mitigate Risk when implementing Operational Risk Management policies;
The Board of Directors does not communicate Operational Risk Management policies; and
all levels of the BPRS organization are not able to understand the Operational Risk Management policies applied.
The Board of Directors does not take necessary actions to mitigate Risk when implementing Operational Risk Management policies;
The Board of Directors does not communicate Operational Risk Management policies; and
all levels of the BPRS organization are not able to understand the Operational Risk Management policies applied.

1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Less Adequate 5 - Inadequate

Has the Board of Commissioners given approval for the Operational Risk Management policies established by the Board of Directors and conducted periodic evaluations?

The Board of Commissioners has given approval for the Operational Risk Management policies;
The Board of Commissioners has conducted evaluations of the Operational Risk Management policies; and
evaluations are conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or whenever necessary in the event of
The Board of Commissioners has given approval for the Operational Risk Management policies;
The Board of Commissioners has conducted evaluations of the Operational Risk Management policies; and
evaluations are conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or whenever necessary.
The Board of Commissioners has given approval for the Operational Risk Management policies;
The Board of Commissioners has conducted evaluations of the Operational Risk Management policies; and
evaluations are not conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or whenever necessary.
The Board of Commissioners has given approval for the Operational Risk Management policies; and
The Board of Commissioners does not conduct evaluations of the Operational Risk Management policies.
The Board of Commissioners does not give approval for the Operational Risk Management policies; and
The Board of Commissioners does not conduct evaluations of the Operational Risk Management policies.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate in case there are changes that affect the business activities of the BPRS significantly; and

evaluations
conducted are relevant to the needs for adjusting Operational Risk Management policies. in case there are changes that affect the business activities of the BPRS significantly. there are changes that affect the business activities of the BPRS significantly.

Has the Board of
Commissioners conducted an evaluation of the accountability of the Board of Directors regarding the implementation of Operational Risk Management policies on a periodic basis and ensured follow-up on the results

The Board of
Commissioners has conducted an evaluation of the implementation of Operational Risk Management policies by the Board of Directors;
evaluations by
the Board of
Commissioners are conducted periodically every semester based on
The Board of
Commissioners has conducted an evaluation of the implementation of Operational Risk Management policies by the Board of Directors;
evaluations by
the Board of
Commissioners are conducted periodically every semester based on
The Board of
Commissioners has conducted an evaluation of the implementation of Operational Risk Management policies by the Board of Directors;
evaluations by
the Board of
Commissioners are conducted periodically every semester based on
The Board of
Commissioners has conducted an evaluation of the implementation of Operational Risk Management policies by the Board of Directors;
evaluations by
the Board of
Commissioners are not conducted periodically; and
The Board of
Commissioners
Board of Directors does not conduct an evaluation of the implementation of Operational Risk Management policies by the Board of Directors.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate the evaluation in question? reports submitted by the Board of Directors or more in case there are changes that affect the business activities of the BPRS significantly;

The Board of
Commissioners has ensured follow-up on the results of evaluations in each reporting period; and
evaluations
provided are relevant to the implementation of Operational Risk Management policies to support the improvement of BPRS performance. reports submitted by the Board of Directors or more in case there are changes that affect the business activities of the BPRS significantly; and
The Board of
Commissioners has ensured follow-up on the results of evaluations in each reporting period. reports submitted by the Board of Directors or more in case there are changes that affect the business activities of the BPRS significantly; and
The Board of
Commissioners does not ensure follow-up on the results of evaluations in each reporting period. does not ensure follow-up on the results of evaluations in each reporting period.

Has the DPS conducted
an evaluation of the policies

The DPS has
conducted an evaluation that is very adequate
The DPS has
conducted an evaluation that is adequate
The DPS has
conducted an evaluation that is fairly adequate The DPS conducts an evaluation that is inadequate regarding the policies The DPS does not conduct an evaluation of the policies

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate Operational Risk Management related to compliance with Sharia Principles? regarding the policies Operational Risk Management related to compliance with Sharia Principles;

evaluations
are conducted by the DPS periodically at least 1 (one) times in 1 (one) year or whenever there are changes that affect the business activities of the BPRS significantly; and
evaluations
provided are relevant to the needs for adjusting policies Operational Risk Management related to compliance with Sharia Principles; and
evaluations
are conducted by the DPS periodically at least 1 (one) times in (one) 1 year year or whenever there are changes that affect the business activities of the BPRS significantly. regarding the policies Operational Risk Management related to compliance with Sharia Principles; and
evaluations are
not conducted by the DPS periodically at least 1 (one) times in 1 (one) year year or whenever there are changes that affect the business activities of the BPRS significantly. Operational Risk Management related to compliance with Sharia Principles. Operational Risk Management related to compliance with Sharia Principles.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate Operational Risk Management.
6. Has the DPS conducted
an evaluation of the accountability of the Board of Directors regarding the implementation of Operational Risk Management policies related to compliance with Sharia Principles?

The DPS has
conducted an evaluation that is very adequate of the accountability of the Board of Directors regarding the implementation of Operational Risk Management policies related to compliance with Sharia Principles;
evaluations
are conducted by the DPS every semester or more; and
evaluations
provided are relevant to the needs for adjusting policies Operational Risk
The DPS has
conducted an evaluation that is adequate of the accountability of the Board of Directors regarding the implementation of Operational Risk Management policies related to compliance with Sharia Principles; and
evaluations
are conducted by the DPS every semester or more.
The DPS has
conducted an evaluation that is fairly adequate of the accountability of the Board of Directors regarding the implementation of Operational Risk Management policies related to compliance with Sharia Principles; and
evaluations
are conducted by the DPS every semester or more.
The DPS has
conducted an evaluation that is inadequate of the accountability of the Board of Directors regarding the implementation of Operational Risk Management policies related to compliance with Sharia Principles; and
evaluations
are conducted by the DPS every semester or more.
The DPS does not conduct an evaluation of the accountability of the Board of Directors regarding the implementation of Operational Risk Management policies related to compliance with Sharia Principles.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate Operational.
7. Has the BPRS
had sufficient organization that handles operational functions and Operational Risk Management functions?

has a working unit
that handles operational functions, namely fund collection and disbursement completely and without dual roles that could cause the non-implementation of good governance;
working units
that handle operational functions have executed their duties and authority according to the guidelines established; and
has SKMR or PEMR and
is able to execute
has a working unit
that handles operational functions, namely fund collection and disbursement but not completely and without dual roles that could cause the non-implementation of good governance;
working units
that handle operational functions have executed their duties and authority according to the guidelines established; and
has SKMR
or PEMR and is able to execute
has a working unit
that handles operational functions, namely fund collection and disbursement but not completely and has dual roles but not causing the non-implementation of good governance;
working units
that handle operational functions have executed their duties and authority according to the guidelines established; and
has SKMR
or PEMR but not able to
has a working unit
that handles operational functions, namely fund collection and disbursement but not completely and has dual roles that could cause the non-implementation of good governance;
working units
that handle operational functions have executed their duties and authority according to the guidelines established; and
has SKMR
or PEMR but not able to
has a working unit
that handles operational functions, namely fund collection and disbursement but not completely and has dual roles that could cause the non-implementation of good governance;
working units
that handle operational functions do not execute their duties and authority according to the guidelines established; and
has SKMR
or PEMR but not able to

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate its functions to mitigate Operational Risk. its functions to mitigate Operational Risk. execute its functions to mitigate Operational Risk. execute its functions to mitigate Operational Risk. execute its functions to mitigate Operational Risk.
8. Has the Board of Directors
implemented human resource management policies in the implementation of Operational Risk Management?

there is
correspondence of human resource qualifications with positions and fields of work;
there are efforts
to improve human resource competency consistently; and
the level
of fulfillment of human resource performance standards in working units that perform operational functions according to tasks and responsibilities.
there is
inconsistency of human resource qualifications with positions and fields of work but not providing significant impact;
there are efforts
to improve human resource competency consistently; and
the level
of fulfillment of human resource performance standards in working units that perform operational functions according to tasks and responsibilities.
there is
inconsistency of human resource qualifications with positions and fields of work but not providing significant impact;
there are efforts
to improve human resource competency but not consistently; and
the level
of fulfillment of human resource performance standards in working units that perform operational functions according to tasks and responsibilities.
there is
inconsistency of human resource qualifications with positions and fields of work and providing significant impact;
there are efforts
to improve human resource competency but not consistently; and
the level
of fulfillment of human resource performance standards in working units that perform operational functions is not consistent with tasks and responsibilities but not
there is
inconsistency of human resource qualifications with positions and fields of work and providing significant impact;
there are no
efforts to improve human resource competency; and
the level
of fulfillment of human resource performance standards in working units that perform operational functions is not consistent with tasks and responsibilities and providing significant impact.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate providing significant impact. significant impact.
9. Has the BPRS
had adequate Operational Risk
Management policies and formulated by considering vision, mission, scale of business and complexity of business, as well as human resource sufficiency?

has
Operational Risk
Management policies;
there is
correspondence between the substance of Operational Risk Management policies with BPRS Risk Management regulations regarding transaction settlement, accounting, principles of knowing customers and employees; and
there is
consistency between
Operational Risk
Management policies with vision, mission, scale of business, and complexity
has
Operational Risk
Management policies;
there is
inconsistency that is not significant between the substance of Operational Risk Management policies with BPRS Risk Management regulations regarding transaction settlement, accounting, principles of knowing customers and employees; and
there is
consistency between
Operational Risk
Management policies with vision, mission,
has
Operational Risk
Management policies;
there is
inconsistency that is not significant between the substance of Operational Risk Management policies with BPRS Risk Management regulations regarding transaction settlement, accounting, principles of knowing customers and employees; and
there is
inconsistency between
Operational Risk
Management policies with vision, mission,
has
Operational Risk
Management policies;
there is
inconsistency that is significant between the substance of Operational Risk Management policies with BPRS Risk Management regulations regarding transaction settlement, accounting, principles of knowing customers and employees; and
there is
inconsistency between
Operational Risk
Management policies with vision, mission, scale of business, and do not have Operational Risk Management policies.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate business, as well as human resource sufficiency in establishing Operational Risk Management policies. scale of business, and complexity of business, as well as human resource sufficiency in establishing Operational Risk Management policies. scale of business, and complexity of business, as well as human resource sufficiency in establishing Operational Risk Management policies, but not causing significant impact. complexity of business, as well as human resource sufficiency in establishing Operational Risk Management policies, and causing significant impact.
10. Has the BPRS:

has Operational Risk
Management procedures and the establishment of Operational Risk limits established by the Board of Directors;
implements
Operational Risk
Management procedures and the establishment of Operational Risk limits consistently for all activities; and
conducts
evaluation and updating of Operational Risk
Management procedures and the establishment of Operational Risk limits periodically?
has Operational Risk
Management procedures and the establishment of Operational Risk limits established by the Board of Directors at least including levels of delegation of authority and accountability that are clear and well documented so as to facilitate audit trail needs for internal control purposes;
implements
Operational Risk
Management procedures and the establishment of Operational Risk limits in every functional activity consistently; and
conducts
evaluation and updating of Operational Risk
Management procedures and the establishment of Operational Risk limits in case there are significant business changes and/or regulatory audit trail needs for internal control purposes;
implements
Operational Risk
Management procedures and the establishment of Operational Risk limits in every functional activity consistently; and
does not conduct
evaluation and updating of Operational Risk
Management procedures and the establishment of Operational Risk limits in case there are significant business changes and/or regulatory audit trail needs for internal control purposes;
implements
Operational Risk
Management procedures and the establishment of Operational Risk limits in every functional activity consistently; and
does not conduct
evaluation and updating of Operational Risk
Management procedures and the establishment of Operational Risk limits in case there are significant business changes and/or regulatory audit trail needs for internal control purposes;
does not
implement
Operational Risk
Management procedures and the establishment of Operational Risk limits in every functional activity consistently; and
does not conduct
evaluation and updating of Operational Risk
Management procedures and the establishment of Operational Risk limits in case there are significant business changes and/or regulatory

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate legislation. legislation, but not causing significant impact. legislation, and causing significant impact. legislation, and causing significant impact. regulations legislation, and causing significant impact.
11. Has the BPRS
had policies and procedures for the issuance of products and/or implementation of new activities that include identification and mitigation of Operational Risk in accordance with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units?

has
policies and procedures regarding the issuance of products and/or new activities that have Operational Risk exposure;
implements
policies and procedures in case there is the issuance of products or implementation of new activities; and
there is
correspondence between policies and procedures for products and/or new activities with
has
policies and procedures regarding the issuance of products and/or new activities that have Operational Risk exposure;
implements
policies and procedures in case there is the issuance of products or implementation of new activities; and
there is
inconsistency that is not significant between policies and procedures for products and/or new activities with
has
policies and procedures regarding the issuance of products and/or new activities that have Operational Risk exposure;
implements
policies and procedures in case there is the issuance of products or implementation of new activities; and
there is
inconsistency that is significant between policies and procedures for products and/or
has
policies and procedures regarding the issuance of products and/or new activities that have Operational Risk exposure;
does not implement
policies and procedures in case there is the issuance of products or implementation of new activities; and
there is
inconsistency that is significant between policies and procedures for products and/or do not have policies and procedures regarding the issuance of products and/or new activities exposure of Operational Risk.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units. and/or new activities with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units. new activities with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units. new activities with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units.
12. Has the BPRS
implemented
Operational Risk Management processes embedded in the business activities of the BPRS?

has
implemented
Operational Risk Management processes including identification, measurement, monitoring, and control of Operational Risk against all business activities of the BPRS at least by considering the number and frequency of system failures, failures in relationships with customers, accounting errors, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;
implementation
of Operational Risk
Management is conducted very adequately; and
implementation
of Operational Risk
Management is conducted consistently.
has
implemented
Operational Risk Management processes including identification, measurement, monitoring, and control of Operational Risk against all business activities of the BPRS at least by considering the number and frequency of system failures, failures in relationships with customers, accounting errors, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;
implementation
of Operational Risk
Management is conducted adequately; and
implementation
of Operational Risk
Management is not conducted consistently.
has
implemented
Operational Risk Management processes including identification, measurement, monitoring, and control of Operational Risk against all business activities of the BPRS at least by considering the number and frequency of system failures, failures in relationships with customers, accounting errors, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;
implementation
of Operational Risk
Management is conducted adequately; and
implementation
of Operational Risk
Management is not conducted consistently but not causing significant impact.
has
implemented
Operational Risk Management processes but not completely including identification, measurement, monitoring, and control of Operational Risk against all business activities of the BPRS at least by considering the number and frequency of system failures, failures in relationships with customers, accounting errors, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;
implementation
of Operational Risk
Management is inadequate; and
implementation
of Operational Risk
Management is not conducted consistently and causing significant impact. do not implement Operational Risk Management processes including identification, measurement, monitoring, and control of Operational Risk against all business activities of the BPRS.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate accounting, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;

implementation
of Operational Risk
Management is conducted very adequately; and
implementation
of Operational Risk
Management is conducted consistently. accounting, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;
implementation
of Operational Risk
Management is conducted adequately; and
implementation
of Operational Risk
Management is not conducted consistently. accounting, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;
implementation
of Operational Risk
Management is conducted adequately; and
implementation
of Operational Risk
Management is not conducted consistently but not causing significant impact. in relationships with customers, accounting errors, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;
implementation
of Operational Risk
Management is inadequate; and
implementation
of Operational Risk
Management is not conducted consistently and causing significant impact.

Has the BPRS
had an information system for Operational Risk Management that supports the Board of Directors in decision-making regarding Operational Risk and has been reported to the Board of Directors periodically?

has
an Operational Risk
Management information system that reflects
Operational Risk;
data in the
Operational Risk
Management information system is complete, accurate, current, and intact;
Operational Risk
Management information system supports the Board of Directors in decision-making; and
Operational Risk
Management information system very strongly supports SKMR or PEMR in preparing reports to the Board of Directors every semester.
has
an Operational Risk
Management information system that reflects
Operational Risk;
data in the
Operational Risk
Management information system is fairly complete, accurate, current, and intact;
Operational Risk
Management information system supports the Board of Directors in decision-making; and
Operational Risk
Management information system fairly supports
SKMR or PEMR in preparing reports to the Board of Directors every semester.
has
an Operational Risk
Management information system that reflects
Operational Risk;
data in the
Operational Risk
Management information system is less complete, accurate, current, and intact;
Operational Risk
Management information system does not fully support the Board of Directors in decision-making; and
Operational Risk
Management information system less supports
SKMR or PEMR in preparing reports to the Board of Directors every semester.
has
an Operational Risk
Management information system that reflects
Operational Risk;
data in the
Operational Risk
Management information system is not complete, accurate, current, and intact;
Operational Risk
Management information system does not fully support the Board of Directors in decision-making; and
Operational Risk
Management information system does not support SKMR or PEMR in preparing reports to the Board of Directors every semester. do not have an Operational Risk Management information system that reflects Operational Risk.

Has the BPRS
had policies and procedures for IT management?

has
policies and procedures for IT management that have been established by
has
policies and procedures for IT management that have been established by
has
policies and procedures for IT management that have been established by
has
policies and procedures for IT management that have been established by do not have policies and procedures for IT management that have been

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

Board of Directors:

has carried out operational activities in accordance with IT management policies and procedures; and
has IT security aspects in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks.

Board of Directors:

has carried out operational activities but not fully in accordance with IT management policies and procedures and does not cause significant impact; and
has IT security aspects in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks.

Board of Directors:

has carried out operational activities but not fully in accordance with IT management policies and procedures and causes significant impact; and
has IT security aspects in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks.

Board of Directors:

has carried out operational activities but not fully in accordance with IT management policies and procedures and causes significant impact; and
has IT security aspects but not in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks.

determined by the Board of Directors.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

15. Has the BPRS taken mitigation steps for Risk related to external events?

has, among others, backups, backup power sources, alternative communication networks, and disaster recovery centers in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks;
has a disaster recovery plan in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks;
has conducted tests on the disaster recovery plan in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks.
has, among others, backups, backup power sources, alternative communication networks, and disaster recovery centers in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks;
has a disaster recovery plan in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks;
has conducted tests on the disaster recovery plan but not fully in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks.
has, among others, backups, backup power sources, alternative communication networks, and disaster recovery centers in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks;
has a disaster recovery plan but not fully in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks and does not cause significant impact;
has conducted tests on the disaster recovery plan but not fully in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks.
has, among others, backups, backup power sources, alternative communication networks, and disaster recovery centers in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks;
has a disaster recovery plan but not fully in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks and causes significant impact;
has conducted tests on the disaster recovery plan but not fully in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks.
does not have, among others, backups, backup power sources, alternative communication networks, and disaster recovery centers in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks;
has a disaster recovery plan but not fully in accordance with the Financial Services Authority Regulation regarding standards for IT management for rural credit banks and Sharia economic banks.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

16. Has the Internal Audit Unit (SKAI) or Internal Audit Team (PEAI) conducted periodic audits on the implementation of Operational Risk Management, submitted internal audit reports, and ensured follow-up on inspection findings?

SKAI or PEAI has conducted internal audits on the implementation of Operational Risk Management, provided recommendations, and reported internal audit results to the Chief Director;
internal audits conducted by SKAI or PEAI include the implementation of Operational Risk Management policies and procedures, considering regulations and BPRS conditions; and
internal audit findings made into recommendations have been followed up.
SKAI or PEAI has conducted internal audits on the implementation of Operational Risk Management, provided recommendations, and reported internal audit results to the Chief Director;
internal audits conducted by SKAI or PEAI include the implementation of Operational Risk Management policies and procedures, considering regulations and BPRS conditions; and
internal audit findings made into recommendations have not been fully followed up but do not cause significant impact.
SKAI or PEAI has conducted internal audits on the implementation of Operational Risk Management, provided recommendations, and reported internal audit results to the Chief Director;
internal audits conducted by SKAI or PEAI include the implementation of Operational Risk Management policies and procedures, considering regulations and BPRS conditions; and
internal audit findings made into recommendations have not been fully followed up and cause significant impact.
SKAI or PEAI has conducted internal audits on the implementation of Operational Risk Management, provided recommendations, and reported internal audit results to the Chief Director;
internal audits conducted by SKAI or PEAI are not in accordance with the scope of implementation of Operational Risk Management policies and procedures, considering regulations and BPRS conditions; and
internal audit findings made into recommendations have not been followed up.
SKAI or PEAI has not conducted internal audits on the implementation of Operational Risk Management.

17. Has the internal control system against Operational Risk been implemented by all levels of the BPRS organization?

all levels of the BPRS organization related to activities with Operational Risk exposure have implemented internal control functions, considering Risk Management policies, Risk Management procedures, and the establishment of Operational Risk limits;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Operational Risk exposure;
SKMR or PEMR is separate from units related to activities with Operational Risk exposure; and
SKAI or PEAI is separate from units related to activities with Operational Risk exposure.
all levels of the BPRS organization related to activities with Operational Risk exposure have implemented internal control functions but not fully considering Risk Management policies, Risk Management procedures, and the establishment of Operational Risk limits and do not have significant impact;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Operational Risk exposure;
SKMR or PEMR is separate from units related to activities with Operational Risk exposure; and
SKAI or PEAI is separate from units related to activities with Operational Risk exposure.
all levels of the BPRS organization related to activities with Operational Risk exposure have implemented internal control functions but not fully considering Risk Management policies, Risk Management procedures, and the establishment of Operational Risk limits and have significant impact;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Operational Risk exposure;
SKMR or PEMR is separate from units related to activities with Operational Risk exposure; and
SKAI or PEAI is separate from units related to activities with Operational Risk exposure.
not all levels of the BPRS organization related to activities with Operational Risk exposure have implemented internal control functions considering Risk Management policies, Risk Management procedures, and the establishment of Operational Risk limits and have very significant impact;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Operational Risk exposure;
SKMR or PEMR is separate from units related to activities with Operational Risk exposure; and
SKAI or PEAI is separate from units related to activities with Operational Risk exposure.
all levels of the BPRS organization related to activities with Operational Risk exposure have not implemented internal control functions;
there is no clarity of authority and responsibility from each level of the BPRS organization related to activities with Operational Risk exposure;
SKMR or PEMR is not separate from units related to activities with Operational Risk exposure; and
SKAI or PEAI is not separate from units related to activities with Operational Risk exposure.

c. Compliance Risk

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

1. Has the Board of Directors formulated Compliance Risk Management policies, implemented them consistently, and updated them periodically?

The Board of Directors has formulated Compliance Risk Management policies;
The Board of Directors conducts business activities based on the established Compliance Risk Management policies;
The Board of Directors updates Compliance Risk Management policies when necessary, including changes in legislation, internal BPRS regulations, Sharia Principles, business changes, and the results of Risk Management policy evaluations by the Board of Commissioners; and
the implemented Compliance Risk Management policies have proven to mitigate Compliance Risk.
The Board of Directors has formulated Compliance Risk Management policies;
The Board of Directors conducts business activities based on the established Compliance Risk Management policies; and
The Board of Directors updates Compliance Risk Management policies when necessary, including changes in legislation, internal BPRS regulations, Sharia Principles, business changes, and the results of Risk Management policy evaluations by the Board of Commissioners.
The Board of Directors has formulated Compliance Risk Management policies;
The Board of Directors conducts business activities based on the established Compliance Risk Management policies; and
The Board of Directors does not update Compliance Risk Management policies when necessary, including changes in legislation, internal BPRS regulations, Sharia Principles, business changes, and the results of Risk Management policy evaluations by the Board of Commissioners.
The Board of Directors has formulated Compliance Risk Management policies;
The Board of Directors does not conduct business activities based on the established Compliance Risk Management policies; and
The Board of Directors does not update Compliance Risk Management policies when necessary, including changes in legislation, internal BPRS regulations, Sharia Principles, business changes, and the results of Risk Management policy evaluations by the Board of Commissioners.
The Board of Directors has not formulated Compliance Risk Management policies.

2. Does the Board of Directors have the ability to take necessary actions to mitigate Compliance Risk, and communicate Compliance Risk Management policies to all levels of the BPRS organization?

The Board of Directors takes necessary actions to mitigate Risk when implementing Compliance Risk Management policies;
The Board of Directors communicates Compliance Risk Management policies; and
all levels of the BPRS organization are able to understand the implemented Compliance Risk Management policies.
The Board of Directors takes necessary actions to mitigate Risk when implementing Compliance Risk Management policies;
The Board of Directors communicates Compliance Risk Management policies; and
not all levels of the BPRS organization are able to understand the implemented Compliance Risk Management policies but do not cause significant impact.
The Board of Directors takes necessary actions to mitigate Risk when implementing Compliance Risk Management policies;
The Board of Directors communicates Compliance Risk Management policies; and
not all levels of the BPRS organization are able to understand the implemented Compliance Risk Management policies and cause significant impact.
The Board of Directors takes necessary actions to mitigate Risk when implementing Compliance Risk Management policies;
The Board of Directors does not communicate Compliance Risk Management policies; and
all levels of the BPRS organization are unable to understand the implemented Compliance Risk Management policies.
The Board of Directors does not take necessary actions to mitigate Risk when implementing Compliance Risk Management policies;
The Board of Directors does not communicate Compliance Risk Management policies; and
all levels of the BPRS organization are unable to understand the implemented Compliance Risk Management policies.

3. Has the Board of Commissioners given approval for the Compliance Risk Management policies formulated by the Board of Directors and conducted periodic evaluations?

The Board of Commissioners has given approval for the Compliance Risk Management policies;
The Board of Commissioners has conducted evaluations of the Compliance Risk Management policies; and
evaluations are conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or ad hoc when there are changes affecting BPRS business activities significantly; and
the evaluations provided are relevant to the need for adjusting Compliance Risk Management policies.
The Board of Commissioners has given approval for the Compliance Risk Management policies;
The Board of Commissioners has conducted evaluations of the Compliance Risk Management policies; and
evaluations are conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or ad hoc when there are changes affecting BPRS business activities significantly.
The Board of Commissioners has given approval for the Compliance Risk Management policies;
The Board of Commissioners has conducted evaluations of the Compliance Risk Management policies; and
evaluations are not conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or ad hoc when there are changes affecting BPRS business activities significantly.
The Board of Commissioners has given approval for the Compliance Risk Management policies; and
The Board of Commissioners does not conduct evaluations of the Compliance Risk Management policies.
The Board of Commissioners does not give approval for the Compliance Risk Management policies; and
The Board of Commissioners does not conduct evaluations of the Compliance Risk Management policies.

4. Has the Board of Commissioners conducted evaluations of the Board of Directors' accountability for the implementation of Compliance Risk Management policies periodically and ensured follow-up on the results of said evaluations?

The Board of Commissioners has conducted evaluations of the implementation of Compliance Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors when there are changes affecting BPRS business activities significantly;
The Board of Commissioners has ensured follow-up on evaluation results in each reporting period; and
evaluations provided are relevant to the implementation of Compliance Risk Management policies to support BPRS performance improvement.
The Board of Commissioners has conducted evaluations of the implementation of Compliance Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors when there are changes affecting BPRS business activities significantly; and
The Board of Commissioners has ensured follow-up on evaluation results in each reporting period.
The Board of Commissioners has conducted evaluations of the implementation of Compliance Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors when there are changes affecting BPRS business activities significantly; and
The Board of Commissioners does not ensure follow-up on evaluation results in each reporting period.
The Board of Commissioners has conducted evaluations of the implementation of Compliance Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are not conducted periodically; and
The Board of Commissioners does not ensure follow-up on evaluation results in each reporting period.
The Board of Commissioners does not conduct evaluations of the implementation of Compliance Risk Management policies by the Board of Directors.

5. Has the DPS conducted evaluations of Compliance Risk Management policies related to the fulfillment of Sharia Principles?

DPS has conducted very adequate evaluations of Compliance Risk Management policies related to the fulfillment of Sharia Principles;
evaluations are conducted by DPS periodically at least 1 (one) time in 1 (one) year or ad hoc when there are changes affecting BPRS business activities significantly; and
evaluations provided are relevant to the need for adjusting Compliance Risk Management policies.
DPS has conducted adequate evaluations of Compliance Risk Management policies related to the fulfillment of Sharia Principles; and
evaluations are conducted by DPS periodically at least 1 (one) time in 1 (one) year or ad hoc when there are changes affecting BPRS business activities significantly.
DPS has conducted fairly adequate evaluations of Compliance Risk Management policies related to the fulfillment of Sharia Principles; and
evaluations are not conducted by DPS periodically at least 1 (one) time in 1 (one) year or ad hoc when there are changes affecting BPRS business activities significantly.
DPS has conducted inadequate evaluations of Compliance Risk Management policies related to the fulfillment of Sharia Principles.
DPS does not conduct evaluations of Compliance Risk Management policies related to the fulfillment of Sharia Principles.

6. Has DPS conducted evaluations of the Board of Directors' accountability for the implementation of Compliance Risk Management policies related to the fulfillment of Sharia Principles?

DPS has conducted very adequate evaluations of the Board of Directors' accountability for the implementation of Compliance Risk Management policies related to the fulfillment of Sharia Principles;
evaluations are conducted by DPS every semester or more; and
evaluations provided are relevant to the need for adjusting policies.
DPS has conducted adequate evaluations of the Board of Directors' accountability for the implementation of Compliance Risk Management policies related to the fulfillment of Sharia Principles; and
evaluations are conducted by DPS every semester or more.
DPS has conducted fairly adequate evaluations of the Board of Directors' accountability for the implementation of Compliance Risk Management policies related to the fulfillment of Sharia Principles; and
evaluations are conducted by DPS every semester or more.
DPS has conducted inadequate evaluations of the Board of Directors' accountability for the implementation of Compliance Risk Management policies related to the fulfillment of Sharia Principles; and
evaluations are conducted by DPS every semester or more.
DPS does not conduct evaluations of the Board of Directors' accountability for the implementation of Compliance Risk Management policies related to the fulfillment of Sharia Principles.

Assessment

1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Less Adequate 5 - Not Adequate

Compliance Risk Management

7. Has the BPRS established sufficient organization to handle the compliance function and Compliance Risk Management function?

1 - Very Adequate
- Has a Compliance Work Unit (SKP) or Compliance Executive (PE);
- The SKP or Compliance Executive has executed its duties and authority as per the established guidelines; and
- Has a Compliance Risk Management Unit (SKMR) or Compliance Risk Management Executive (PEMR) capable of executing its function to mitigate Compliance Risk.
2 - Adequate
- Has a Compliance Work Unit (SKP) or Compliance Executive (PE);
- The SKP or Compliance Executive has executed its duties and authority as per the established guidelines, but there are weaknesses causing insignificant impact; and
- Has a SKMR or PEMR capable of executing its function to mitigate Compliance Risk.
3 - Fairly Adequate
- Has a Compliance Work Unit (SKP) or Compliance Executive (PE);
- The SKP or Compliance Executive has executed its duties and authority as per the established guidelines, but there are weaknesses causing insignificant impact; and
- Has a SKMR or PEMR but is not capable of executing its function to mitigate Compliance Risk.
4 - Less Adequate
- Has a Compliance Work Unit (SKP) or Compliance Executive (PE);
- The SKP or Compliance Executive has executed its duties and authority as per the established guidelines, but there are weaknesses causing significant impact; and
- Has a SKMR or PEMR but is not capable of executing its function to mitigate Compliance Risk.
5 - Not Adequate
- Has a Compliance Work Unit (SKP) or Compliance Executive (PE);
- The SKP or Compliance Executive has not executed its duties and authority as per the established guidelines; and
- Has a SKMR or PEMR but is not capable of executing its function to mitigate Compliance Risk.

8. Has the Board of Directors implemented Human Resources management policies in the implementation of Compliance Risk Management?

1 - Very Adequate
- There is alignment of HR qualifications with positions and job fields;
- There are consistent efforts to improve HR competence; and
- The level of HR performance standards fulfillment in work units executing the compliance function is consistent with duties and responsibilities.
2 - Adequate
- There is misalignment of HR qualifications with positions and job fields, but it does not cause significant impact;
- There are consistent efforts to improve HR competence; and
- The level of HR performance standards fulfillment in work units executing the compliance function is consistent with duties and responsibilities.
3 - Fairly Adequate
- There is misalignment of HR qualifications with positions and job fields, but it does not cause significant impact;
- There are efforts to improve HR competence, but not consistently; and
- The level of HR performance standards fulfillment in work units executing the compliance function is consistent with duties and responsibilities.
4 - Less Adequate
- There is misalignment of HR qualifications with positions and job fields, causing significant impact;
- There are efforts to improve HR competence, but not consistently; and
- The level of HR performance standards fulfillment in work units executing the compliance function is inconsistent with duties and responsibilities, but does not cause significant impact.
5 - Not Adequate
- There is misalignment of HR qualifications with positions and job fields, causing significant impact;
- There are no efforts to improve HR competence; and
- The level of HR performance standards fulfillment in work units executing the compliance function is inconsistent with duties and responsibilities, causing significant impact.

9. Has the Board of Directors formulated internal policies supporting the execution of the compliance function, paying attention to statutory regulations, internal BPRS regulations, and Sharia Principles, and are there reward and punishment policies for internal BPRS personnel?

1 - Very Adequate
- Has formulated internal policies to support the execution of the compliance function;
- Pays attention to statutory regulations, internal BPRS regulations, and Sharia Principles to execute the compliance function, including understanding new regulations issued and relevant to the BPRS; and
- Has reward and punishment policies for internal BPRS personnel.
2 - Adequate
- Has formulated internal policies to support the execution of the compliance function;
- Pays attention to statutory regulations, internal BPRS regulations, and Sharia Principles to execute the compliance function, including understanding new regulations issued and relevant to the BPRS; and
- Has reward and punishment policies for internal BPRS personnel, but they do not run optimally.
3 - Fairly Adequate
- Has formulated internal policies to support the execution of the compliance function;
- Pays attention to statutory regulations, internal BPRS regulations, and Sharia Principles to execute the compliance function, including understanding new regulations issued and relevant to the BPRS; and
- Does not have reward and punishment policies for internal BPRS personnel.
4 - Less Adequate
- Has formulated internal policies to support the execution of the compliance function;
- Pays attention to statutory regulations, internal BPRS regulations, and Sharia Principles to execute the compliance function, including understanding new regulations issued and relevant to the BPRS; and
- Does not have reward and punishment policies for internal BPRS personnel.
5 - Not Adequate
- Has formulated internal policies to support the execution of the compliance function;
- Does not pay attention to statutory regulations, internal BPRS regulations, and Sharia Principles to execute the compliance function and does not understand new regulations issued and relevant to the BPRS; and
- Does not have reward and punishment policies for internal BPRS personnel.

10. Does the BPRS have adequate Compliance Risk Management policies formulated considering vision, mission, business scale, and business complexity, as well as HR sufficiency?

1 - Very Adequate
- Has Compliance Risk Management policies;
- There is alignment between the substance of Compliance Risk Management policies and BPRS Risk Management regulations, including regarding zero tolerance for violations; and
- There is harmony between Compliance Risk Management policies and vision, mission, business scale, and business complexity, as well as HR sufficiency in establishing Compliance Risk Management policies.
2 - Adequate
- Has Compliance Risk Management policies;
- There is insignificant misalignment between the substance of Compliance Risk Management policies and BPRS Risk Management regulations, including regarding zero tolerance for violations; and
- There is harmony between Compliance Risk Management policies and vision, mission, business scale, and business complexity, as well as HR sufficiency in establishing Compliance Risk Management policies.
3 - Fairly Adequate
- Has Compliance Risk Management policies;
- There is insignificant misalignment between the substance of Compliance Risk Management policies and BPRS Risk Management regulations, including regarding zero tolerance for violations; and
- There is disharmony between Compliance Risk Management policies and vision, mission, business scale, and business complexity, as well as HR sufficiency in establishing Compliance Risk Management policies, but it does not cause significant impact.
4 - Less Adequate
- Has Compliance Risk Management policies;
- There is significant misalignment between the substance of Compliance Risk Management policies and BPRS Risk Management regulations, including regarding zero tolerance for violations; and
- There is disharmony between Compliance Risk Management policies and vision, mission, business scale, and business complexity, as well as HR sufficiency in establishing Compliance Risk Management policies, causing significant impact.
5 - Not Adequate
- Does not have Compliance Risk Management policies.

11. Does the BPRS:

Have Compliance Risk Management procedures and Compliance Risk limit setting established by the Board of Directors;
Execute Compliance Risk Management procedures and Compliance Risk limit setting consistently for all activities; and
Conduct evaluation and updating of Compliance Risk Management procedures and Compliance Risk limit setting periodically?
1 - Very Adequate
- Has Compliance Risk Management procedures and Compliance Risk limit setting established by the Board of Directors, at least including clear levels of delegation of authority and accountability, and well-documented to facilitate audit trails for internal control purposes;
- Executes Compliance Risk Management procedures and Compliance Risk limit setting in every functional activity consistently; and
- Conducts evaluation and updating of Compliance Risk Management procedures and Compliance Risk limit setting when there are significant business changes and/or statutory regulations, internal BPRS regulations, and Sharia Principles.
2 - Adequate
- Has Compliance Risk Management procedures and Compliance Risk limit setting established by the Board of Directors, at least including clear levels of delegation of authority and accountability, and well-documented to facilitate audit trails for internal control purposes;
- Executes Compliance Risk Management procedures and Compliance Risk limit setting in every functional activity consistently; and
- Does not conduct evaluation and updating of Compliance Risk Management procedures and Compliance Risk limit setting when there are significant business changes and/or statutory regulations, internal BPRS regulations, and Sharia Principles, but does not cause significant impact.
3 - Fairly Adequate
- Has Compliance Risk Management procedures and Compliance Risk limit setting established by the Board of Directors, at least including clear levels of delegation of authority and accountability, and well-documented to facilitate audit trails for internal control purposes;
- Executes Compliance Risk Management procedures and Compliance Risk limit setting in every functional activity consistently; and
- Does not conduct evaluation and updating of Compliance Risk Management procedures and Compliance Risk limit setting when there are significant business changes and/or statutory regulations, internal BPRS regulations, and Sharia Principles, causing significant impact.
4 - Less Adequate
- Has Compliance Risk Management procedures and Compliance Risk limit setting established by the Board of Directors, at least including clear levels of delegation of authority and accountability, and well-documented to facilitate audit trails for internal control purposes;
- Does not execute Compliance Risk Management procedures and Compliance Risk limit setting in every functional activity consistently; and
- Does not conduct evaluation and updating of Compliance Risk Management procedures and Compliance Risk limit setting when there are significant business changes and/or statutory regulations, internal BPRS regulations, and Sharia Principles, causing significant impact.
5 - Not Adequate
- Does not have Compliance Risk Management procedures and Compliance Risk limit setting established by the Board of Directors.

12. Has the BPRS established policies and procedures for issuing products and/or executing new activities that include identification and mitigation of Compliance Risk in accordance with Financial Services Authority (OJK) Regulations regarding products and activities of Sharia banks and Sharia business units?

1 - Very Adequate
- Has policies and procedures regarding the issuance of products and/or new activities that have Compliance Risk exposure;
- Applies policies and procedures when there is the issuance of products or execution of new activities; and
- There is alignment between product and/or new activity policies and procedures with Financial Services Authority (OJK) Regulations regarding products and activities of Sharia banks and Sharia business units.
2 - Adequate
- Has policies and procedures regarding the issuance of products and/or new activities that have Compliance Risk exposure;
- Applies policies and procedures when there is the issuance of products or execution of new activities; and
- There is insignificant misalignment between product and/or new activity policies and procedures with Financial Services Authority (OJK) Regulations regarding products and activities of Sharia banks and Sharia business units.
3 - Fairly Adequate
- Has policies and procedures regarding the issuance of products and/or new activities that have Compliance Risk exposure;
- Applies policies and procedures when there is the issuance of products or execution of new activities; and
- There is significant misalignment between product and/or new activity policies and procedures with Financial Services Authority (OJK) Regulations regarding products and activities of Sharia banks and Sharia business units.
4 - Less Adequate
- Has policies and procedures regarding the issuance of products and/or new activities that have Compliance Risk exposure;
- Does not apply policies and procedures when there is the issuance of products or execution of new activities; and
- There is significant misalignment between product and/or new activity policies and procedures with Financial Services Authority (OJK) Regulations regarding products and activities of Sharia banks and Sharia business units.
5 - Not Adequate
- Does not have policies and procedures regarding the issuance of products and/or new activities.

13. Has the BPRS executed the Compliance Risk Management process embedded in BPRS business activities?

1 - Very Adequate
- Has executed the Compliance Risk Management process including identification, measurement, monitoring, and control of Compliance Risk against all BPRS business activities, at least considering BPRS business activities, non-compliance, and litigation processes;
- Implementation of Compliance Risk Management is very adequate; and
- Implementation of Compliance Risk Management is consistent.
2 - Adequate
- Has executed the Compliance Risk Management process including identification, measurement, monitoring, and control of Compliance Risk against all BPRS business activities, at least considering BPRS business activities, non-compliance, and litigation processes;
- Implementation of Compliance Risk Management is adequate; and
- Implementation of Compliance Risk Management is fairly consistent.
3 - Fairly Adequate
- Has executed the Compliance Risk Management process including identification, measurement, monitoring, and control of Compliance Risk against all BPRS business activities, at least considering BPRS business activities, non-compliance, and litigation processes;
- Implementation of Compliance Risk Management is adequate; and
- Implementation of Compliance Risk Management is not consistent, but does not cause significant impact.
4 - Less Adequate
- Has executed the Compliance Risk Management process but not entirely including identification, measurement, monitoring, and control of Compliance Risk against all BPRS business activities, at least considering BPRS business activities, non-compliance, and litigation processes;
- Implementation of Compliance Risk Management is not adequate; and
- Implementation of Compliance Risk Management is not consistent, causing significant impact.
5 - Not Adequate
- Does not execute the Compliance Risk Management process including identification, measurement, monitoring, and control of Compliance Risk against all BPRS business activities, at least considering BPRS business activities, non-compliance, and litigation processes.

14. Does the BPRS have an information system for Compliance Risk Management that supports the Board of Directors in decision-making regarding Compliance Risk and has been reported to the Board of Directors periodically?

1 - Very Adequate
- Has an information system for Compliance Risk Management that reflects Compliance Risk;
- Data in the Compliance Risk Management information system is complete, accurate, current, and whole;
- The Compliance Risk Management information system supports the Board of Directors in decision-making, including reflecting developments of new statutory regulations; and
- The Compliance Risk Management information system strongly supports the SKMR or PEMR in preparing reports to the Board of Directors every semester.
2 - Adequate
- Has an information system for Compliance Risk Management that reflects Compliance Risk;
- Data in the Compliance Risk Management information system is fairly complete, accurate, current, and whole;
- The Compliance Risk Management information system supports the Board of Directors in decision-making, including reflecting developments of new statutory regulations; and
- The Compliance Risk Management information system fairly supports the SKMR or PEMR in preparing reports to the Board of Directors every semester.
3 - Fairly Adequate
- Has an information system for Compliance Risk Management that reflects Compliance Risk;
- Data in the Compliance Risk Management information system is less complete, accurate, current, and whole;
- The Compliance Risk Management information system does not fully support the Board of Directors in decision-making; and
- The Compliance Risk Management information system less supports the SKMR or PEMR in preparing reports to the Board of Directors every semester.
4 - Less Adequate
- Has an information system for Compliance Risk Management that reflects Compliance Risk;
- Data in the Compliance Risk Management information system is not complete, accurate, current, and whole;
- The Compliance Risk Management information system does not fully support the Board of Directors in decision-making; and
- The Compliance Risk Management information system does not support the SKMR or PEMR in preparing reports to the Board of Directors every semester.
5 - Not Adequate
- Does not have an information system for Compliance Risk Management that reflects Compliance Risk.

15. Has the Internal Audit Unit (SKAI) or Internal Audit Executive (PEAI) executed periodic audits on the implementation of Compliance Risk Management, submitted internal audit result reports, and ensured follow-up on inspection findings?

1 - Very Adequate
- SKAI or PEAI has executed periodic internal audits on the implementation of Compliance Risk Management, provided recommendations, and reported internal audit results to the President Director;
- Internal audits executed by SKAI or PEAI include the implementation of Compliance Risk Management policies and procedures considering regulations and BPRS conditions; and
- Internal audit findings made as recommendations have been followed up.
2 - Adequate
- SKAI or PEAI has executed periodic internal audits on the implementation of Compliance Risk Management, provided recommendations, and reported internal audit results to the President Director;
- Internal audits executed by SKAI or PEAI include the implementation of Compliance Risk Management policies and procedures considering regulations and BPRS conditions; and
- Internal audit findings made as recommendations are not fully followed up, but do not cause significant impact.
3 - Fairly Adequate
- SKAI or PEAI has executed periodic internal audits on the implementation of Compliance Risk Management, provided recommendations, and reported internal audit results to the President Director;
- Internal audits executed by SKAI or PEAI include the implementation of Compliance Risk Management policies and procedures considering regulations and BPRS conditions; and
- Internal audit findings made as recommendations are not fully followed up, causing significant impact.
4 - Less Adequate
- SKAI or PEAI has executed periodic internal audits on the implementation of Compliance Risk Management, provided recommendations, and reported internal audit results to the President Director;
- Internal audits executed by SKAI or PEAI are not in accordance with the scope of implementation of Compliance Risk Management policies and procedures considering regulations and BPRS conditions; and
- Internal audit findings made as recommendations are not followed up.
5 - Not Adequate
- SKAI or PEAI does not execute periodic internal audits on the implementation of Compliance Risk Management.

16. Has the internal control system regarding Compliance Risk been executed by all levels of the BPRS organization?

1 - Very Adequate
- All levels of the BPRS organization related to activities with Compliance Risk exposure have executed internal control functions by paying attention to Risk Management policies, Risk Management procedures, and Compliance Risk limit setting;
- There is clarity of authority and responsibility from each level of the BPRS organization related to activities with Compliance Risk exposure;
- SKMR or PEMR is separated from units in the BPRS related to activities with Compliance Risk exposure.
2 - Adequate
- All levels of the BPRS organization related to activities with Compliance Risk exposure have executed internal control functions, but do not fully pay attention to Risk Management policies, Risk Management procedures, and Compliance Risk limit setting, and do not have significant impact;
- There is clarity of authority and responsibility from each level of the BPRS organization related to activities with Compliance Risk exposure.
3 - Fairly Adequate
- All levels of the BPRS organization related to activities with Compliance Risk exposure have executed internal control functions, but do not fully pay attention to Risk Management policies, Risk Management procedures, and Compliance Risk limit setting, and have significant impact;
- There is clarity of authority and responsibility from each level of the BPRS organization related to activities with Compliance Risk exposure.
4 - Less Adequate
- Not all levels of the BPRS organization related to activities with Compliance Risk exposure have executed internal control functions by paying attention to Risk Management policies, Risk Management procedures, and Compliance Risk limit setting, and have very significant impact;
- There is no clarity of authority and responsibility from each level of the BPRS organization related to activities with Compliance Risk exposure.
5 - Not Adequate
- All levels of the BPRS organization related to activities with Compliance Risk exposure do not execute internal control functions;
- There is no clarity of authority and responsibility from each level of the BPRS organization related to activities with Compliance Risk exposure;
- SKMR or PEMR is not separated from units in the BPRS related to activities with Compliance Risk exposure.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate compliance;

SKMR or PEMR
separate from units at BPRS that are related to activities that have Compliance Risk exposure; and
SKAI or PEAI
separate from units at BPRS that are related to activities that have Compliance Risk exposure. related to activities that have Compliance Risk exposure;
SKMR or PEMR
separate from units at BPRS that are related to activities that have Compliance Risk exposure; and
SKAI or PEAI
separate from units at BPRS that are related to activities that have Compliance Risk exposure. with activities that have Compliance Risk exposure;
SKMR or PEMR
separate from units at BPRS that are related to activities that have Compliance Risk exposure; and
SKAI or PEAI
separate from units at BPRS that are related to activities that have Compliance Risk exposure. related to activities that have Compliance Risk exposure;
SKMR or PEMR
separate from units at BPRS that are related to activities that have Compliance Risk exposure; and
SKAI or PEAI
separate from units at BPRS that are related to activities that have Compliance Risk exposure. that have Compliance Risk exposure; and
SKAI or PEAI
not separate from units at BPRS that are related to activities that have Compliance Risk exposure.

d. Liquidity Risk
Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

Has the Board of Directors
prepared a
Liquidity Risk Management policy, implemented it consistently, and conducted periodic updates?

The Board of Directors has
prepared a
Liquidity Risk Management policy;
The Board of
Directors conducts business activities based on the established Liquidity Risk Management policy;
The Board of
Directors conducts updates to the
Liquidity Risk Management policy in the event of changes in regulatory provisions, business changes, and policy evaluation results
The Board of Directors has
prepared a
Liquidity Risk Management policy;
The Board of
Directors conducts business activities based on the established Liquidity Risk Management policy; and
The Board of
Directors conducts updates to the
Liquidity Risk Management policy in the event of changes in regulatory provisions, business changes, and evaluation results
The Board of Directors has
prepared a
Liquidity Risk Management policy;
The Board of
Directors conducts business activities based on the established Liquidity Risk Management policy; and
The Board of
Directors does not conduct updates to the
Liquidity Risk Management policy in the event of changes in regulatory provisions, business changes, and evaluation results
The Board of Directors has
prepared a
Liquidity Risk Management policy;
The Board of
Directors does not conduct business activities based on the established Liquidity Risk Management policy; and
The Board of
Directors does not conduct updates to the
Liquidity Risk Management policy in the event of changes in regulatory provisions, business changes, and evaluation results The Board of Directors does not prepare a Liquidity Risk Management policy.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate Risk Management by the Board of Commissioners; and

the
Liquidity Risk Management policy implemented proven to mitigate the occurrence of Liquidity Risk. policy Risk Management by the Board of Commissioners. policy Risk Management by the Board of Commissioners. policy Risk Management by the Board of Commissioners.

Has the Board of Directors
had the ability to take the necessary actions to mitigate Liquidity Risk, and conduct communication of the Liquidity Risk Management policy to all levels of the BPRS organization?

The Board of
Directors takes the necessary actions to mitigate Risk when implementing the Liquidity Risk Management policy;
The Board of
Directors communicates the
Liquidity Risk Management policy; and
all levels
of the BPRS organization are able to understand the Liquidity Risk Management policy
The Board of
Directors takes the necessary actions to mitigate Risk when implementing the Liquidity Risk Management policy;
The Board of
Directors communicates the
Liquidity Risk Management policy; and
not all levels
of the BPRS organization are able to understand the Liquidity Risk Management policy
The Board of
Directors takes the necessary actions to mitigate Risk when implementing the Liquidity Risk Management policy;
The Board of
Directors communicates the
Liquidity Risk Management policy; and
not all levels
of the BPRS organization are able to understand the Liquidity Risk Management policy
The Board of
Directors takes the necessary actions to mitigate Risk when implementing the Liquidity Risk Management policy;
The Board of
Directors does not communicate the
Liquidity Risk Management policy; and
all levels
of the BPRS organization are not able to understand the Liquidity Risk Management policy
The Board of
Directors does not take the necessary actions to mitigate Risk when implementing the Liquidity Risk Management policy;
The Board of
Directors does not communicate the
Liquidity Risk Management policy; and
all levels
of the BPRS organization are not able to understand the Liquidity Risk Management policy

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate Liquidity Risk implemented.
Liquidity Risk implemented but does not cause significant impact.
Liquidity Risk implemented and causes significant impact.
Liquidity Risk implemented.
Liquidity Risk implemented.
3. Has the Board of
Commissioners given approval for the
Liquidity Risk Management policy prepared by the Board of Directors and conducted periodic evaluations?

The Board of Commissioners
has given approval for the
Liquidity Risk Management policy;
The Board of Commissioners
has conducted evaluations of the
Liquidity Risk Management policy;
evaluations
are conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or as needed in the event of changes that affect
The Board of Commissioners
has given approval for the
Liquidity Risk Management policy;
The Board of Commissioners
has conducted evaluations of the
Liquidity Risk Management policy; and
evaluations
are conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or as needed in the event of changes that affect
The Board of Commissioners
has given approval for the
Liquidity Risk Management policy;
The Board of Commissioners
has conducted evaluations of the
Liquidity Risk Management policy; and
evaluations are
not conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or as needed in the event of changes that affect
The Board of Commissioners
has given approval for the
Liquidity Risk Management policy; and
The Board of Commissioners
does not conduct evaluations of the
Liquidity Risk Management policy.
The Board of Commissioners
does not give approval for the
Liquidity Risk Management policy; and
The Board of Commissioners
does not conduct evaluations of the
Liquidity Risk Management policy.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate BPRS business activities significantly; and

evaluations
given are relevant to the needs for adjusting the Liquidity Risk Management policy.
BPRS business activities significantly.
BPRS business activities significantly.

Has the Board of
Commissioners conducted evaluations of the Board of Directors' accountability for the implementation of the Liquidity Risk Management policy periodically and ensured follow-up on the results of the said evaluation?

The Board of Commissioners
has conducted evaluations of the implementation of the Liquidity Risk Management policy by the Board of Directors;
evaluations by
the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that affect
The Board of Commissioners
has conducted evaluations of the implementation of the Liquidity Risk Management policy by the Board of Directors;
evaluations by
the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that affect
The Board of Commissioners
has conducted evaluations of the implementation of the Liquidity Risk Management policy by the Board of Directors;
evaluations by
the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that affect
The Board of Commissioners
has conducted evaluations of the implementation of the Liquidity Risk Management policy by the Board of Directors;
evaluations by
the Board of Commissioners are not conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that The Board of Commissioners does not conduct evaluations of the implementation of the Liquidity Risk Management policy by the Board of Directors.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate BPRS business activities significantly;

The Board of Commissioners
has ensured follow-up on evaluation results in each reporting period; and
evaluations
given are relevant to the implementation of the Liquidity Risk Management policy to support BPRS performance improvement.
BPRS business activities significantly; and
The Board of Commissioners
has ensured follow-up on evaluation results in each reporting period.
BPRS business activities significantly; and
The Board of Commissioners
does not ensure follow-up on evaluation results in each reporting period. affect BPRS business activities significantly; and
The Board of Commissioners
does not ensure follow-up on evaluation results in each reporting period.

Has the DPS conducted
evaluations of the
Liquidity Risk Management policy related to compliance with Shariah Principles?

The DPS has
conducted very adequate evaluations of the
Liquidity Risk
Management policy related to compliance with
Shariah Principles;
The DPS has
conducted adequate evaluations of the
Liquidity Risk
Management policy related to compliance with
Shariah Principles;
The DPS has
conducted evaluations that are fairly adequate of the Liquidity Risk Management policy related to compliance with Shariah Principles; The DPS conducts evaluations that are inadequate of the Liquidity Risk Management policy related to compliance with Shariah Principles. The DPS does not conduct evaluations of the Liquidity Risk Management policy related to compliance with Shariah Principles.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

evaluations
are conducted by the DPS periodically at least 1 (one) time in 1 year or as needed in the event of changes that affect BPRS business activities significantly; and
evaluations
given are relevant to the needs for adjusting the Liquidity Risk Management policy. and
evaluations
are conducted by the DPS periodically at least 1 (one) time in 1 year or as needed in the event of changes that affect BPRS business activities significantly. and
evaluations are
not conducted by the DPS periodically at least 1 (one) time in 1 year or as needed in the event of changes that affect BPRS business activities significantly.

Has the DPS conducted
evaluations of the Board of Directors' accountability for the implementation of the Liquidity Risk Management

The DPS has
conducted very adequate evaluations of the Board of Directors' accountability for the implementation
The DPS has
conducted evaluations that are adequate of the Board of Directors' accountability for the implementation of the policy
The DPS has
conducted evaluations that are fairly adequate of the Board of Directors' accountability for the implementation
The DPS has
conducted evaluations that are inadequate of the Board of Directors' accountability for the implementation The DPS does not conduct evaluations of the Board of Directors' accountability for the implementation of the Liquidity Risk Management

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate Liquidity Risk policy related to compliance with Shariah Principles? Liquidity Risk Management policy related to compliance with Shariah Principles;

evaluations
are conducted by the DPS every semester or more; and
evaluations
given are relevant to the needs for adjusting the Liquidity Risk Management policy.
Liquidity Risk
Management policy related to compliance with
Shariah Principles; and
evaluations
are conducted by the DPS every semester or more.
Liquidity Risk
Management policy related to compliance with
Shariah Principles; and
evaluations
are conducted by the DPS every semester or more.
Liquidity Risk
Management policy related to compliance with
Shariah Principles; and
evaluations
are conducted by the DPS every semester or more.
Liquidity Risk
Management policy related to compliance with
Shariah Principles.

Does the BPRS have
sufficient organization to handle the liquidity function and the Liquidity Risk Management function?

has a working unit
that handles the liquidity function;
the working unit
that handles the liquidity function has implemented its duties and authorities according to
has a working unit
that handles the liquidity function but is incomplete;
the working unit
that handles the liquidity function has implemented its duties and authorities
has a working unit
that handles the liquidity function;
the working unit
that handles the liquidity function has implemented its duties and authorities according to
has a working unit
that handles the liquidity function but is incomplete;
the working unit
that handles the liquidity function has implemented its duties and authorities
has a working unit
that handles the liquidity function but is incomplete;
the working unit
that handles the liquidity function does not implement its duties and authorities

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate established guidelines; and

has an SKMR
or PEMR that is able to implement its function to mitigate Liquidity Risk. according to established guidelines; and
has an SKMR
or PEMR that is able to implement its function to mitigate Liquidity Risk. established guidelines; and
has an SKMR
or PEMR that is not able to implement its function to mitigate Liquidity Risk. according to established guidelines; and
has an SKMR
or PEMR that is not able to implement its function to mitigate Liquidity Risk. according to established guidelines; and
has an SKMR
or PEMR that is not able to implement its function to mitigate Liquidity Risk.

Has the Board of
Directors implemented
HR management policies in the application of
Liquidity Risk
Management?

there is
alignment of HR qualifications with positions and fields of work;
there are efforts
to improve
HR competence consistently; and
the level
of fulfillment of HR performance standards in the working unit that implements the liquidity function according to tasks and responsibilities.
there is
misalignment of HR qualifications with positions and fields of work but does not provide significant impact;
there are efforts
to improve
HR competence consistently; and
the level
of fulfillment of HR performance standards in the working unit that implements the liquidity function
there is
misalignment of HR qualifications with positions and fields of work but does not provide significant impact;
there are efforts
to improve
HR competence but not consistent; and
the level
of fulfillment of HR performance standards in the working unit that implements the liquidity function
there is
misalignment of HR qualifications with positions and fields of work and provides significant impact;
there are efforts
to improve
HR competence but not consistent; and
the level
of fulfillment of HR performance standards in the working unit that implements the liquidity function
there is
misalignment of HR qualifications with positions and fields of work and provides significant impact;
there are no efforts
to improve
HR competence; and
the level
of fulfillment of HR performance standards in the working unit that implements the liquidity function

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate according to tasks and responsibilities. according to tasks and responsibilities. not according to tasks and responsibilities but does not provide significant impact. not according to tasks and responsibilities and provides significant impact.
9. Does the BPRS have
a
Liquidity Risk Management policy that is adequate, including assessment of market conditions, handling of Liquidity Concentration Risk issues, prevention of dependence on certain funding sources, and prepared by considering vision, mission, business scale and business complexity, as well as

has
Liquidity Risk Management policy;
there is
alignment between the substance of the
Liquidity Risk Management policy with the
Liquidity Risk Management provisions of the BPRS, including early warning indicators for Liquidity Risk, periodic funding needs or excess liquidity, and potential shortage
has
Liquidity Risk Management policy;
there is
misalignment that is not significant between the substance of the Liquidity Risk Management policy with the Liquidity Risk Management provisions of the BPRS, including early warning indicators for Liquidity Risk, periodic funding needs or excess liquidity, and
has
Liquidity Risk Management policy;
there is
misalignment that is not significant between the substance of the Liquidity Risk Management policy with the Liquidity Risk Management provisions of the BPRS, including early warning indicators for Liquidity Risk, periodic funding needs or excess liquidity, and
has
Liquidity Risk Management policy;
there is
significant misalignment between the substance of the Liquidity Risk Management policy with the Liquidity Risk Management provisions of the BPRS, including early warning indicators for Liquidity Risk, periodic funding needs or excess liquidity, and potential not have Liquidity Risk Management policy.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate HR sufficiency? Liquidity Risk that occurs based on past experience; and

there is
harmony between the
Liquidity Risk Management policy with vision, mission, business scale, and business complexity, and HR sufficiency in establishing Liquidity Risk Management policy. potential shortage Liquidity Risk that occurs based on past experience; and
there is
harmony between the
Liquidity Risk Management policy with vision, mission, business scale, and business complexity, and HR sufficiency in establishing Liquidity Risk Management policy. potential shortage Liquidity Risk that occurs based on past experience; and
there is
disharmony between the
Liquidity Risk Management policy with vision, mission, business scale, and business complexity, and HR sufficiency in establishing Liquidity Risk Management policy, but does not cause significant impact. shortage Liquidity Risk that occurs based on past experience; and
there is
disharmony between the
Liquidity Risk Management policy with vision, mission, business scale, and business complexity, and HR sufficiency in establishing Liquidity Risk Management policy, and causes significant impact.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate
10. Does the BPRS:

have
Liquidity Risk Management procedures and
Liquidity Risk limit setting established by the Board of Directors;
implement
Liquidity Risk Management procedures and
Liquidity Risk limit setting consistently for all activities; and
conduct
evaluations and updates to
Liquidity Risk Management procedures and
Liquidity Risk limit setting periodically?
has
Liquidity Risk Management procedures and
Liquidity Risk limit setting established by the Board of Directors at least including degree of delegation of authority and accountability that are clear and well documented so as to facilitate audit trail needs for internal control;
implements
Liquidity Risk Management procedures and
Liquidity Risk limit setting in every functional activity consistently
has
Liquidity Risk Management procedures and
Liquidity Risk limit setting established by the Board of Directors at least including degree of delegation of authority and accountability that are clear and well documented so as to facilitate audit trail needs for internal control;
implements
Liquidity Risk Management procedures and
Liquidity Risk limit setting in every functional activity consistently
has
Liquidity Risk Management procedures and
Liquidity Risk limit setting established by the Board of Directors at least including degree of delegation of authority and accountability that are clear and well documented so as to facilitate audit trail needs for internal control;
implements
Liquidity Risk Management procedures and
Liquidity Risk limit setting in every functional activity consistently
has
Liquidity Risk Management procedures and
Liquidity Risk limit setting established by the Board of Directors at least including degree of delegation of authority and accountability that are clear and well documented so as to facilitate audit trail needs for internal control;
does not
implement
Liquidity Risk Management procedures and
Liquidity Risk limit setting in every functional activity not have Liquidity Risk Management procedures and Liquidity Risk limit setting established

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate consistent; and

conducting evaluation and updating Liquidity Risk Management procedures and setting Liquidity Risk limits in the event of significant business changes and/or changes in statutory regulations.
consistent; and
not conducting evaluation and updating Liquidity Risk Management procedures and setting Liquidity Risk limits in the event of significant business changes and/or changes in statutory regulations, but not causing significant impact.
consistent; and
not conducting evaluation and updating Liquidity Risk Management procedures and setting Liquidity Risk limits in the event of significant business changes and/or changes in statutory regulations and causing significant impact.
functionally consistent; and
not conducting evaluation and updating Liquidity Risk Management procedures and setting Liquidity Risk limits in the event of significant business changes and/or changes in statutory regulations and causing significant impact.

Has the BPRS established policies and procedures for the issuance of products and/or implementation of new activities that cover

having policies and procedures regarding the issuance of products and/or new activities that have Liquidity Risk exposure;
having policies and procedures regarding the issuance of products and/or new activities that have Liquidity Risk exposure;
having policies and procedures regarding the issuance of products and/or new activities that have Liquidity Risk exposure;
having policies and procedures regarding the issuance of products and/or new activities that have Liquidity Risk exposure;
not having policies and procedures regarding the issuance of products and/or activities with identified Liquidity Risk exposure and mitigation of Liquidity Risk in accordance with the Financial Services Authority Regulation regarding products and activities of Sharia banks and Sharia business units?

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate

implementing policies and procedures in the event of product issuance or new activity implementation; and
there is consistency between the policies and procedures for new products and/or activities with the Financial Services Authority Regulation regarding products and activities of Sharia banks and Sharia business units.
implementing policies and procedures in the event of product issuance or new activity implementation; and
there is insignificant inconsistency between the policies and procedures for new products and/or activities with the Financial Services Authority Regulation regarding products and activities of Sharia banks and Sharia business units.
implementing policies and procedures in the event of product issuance or new activity implementation; and
there is significant inconsistency between the policies and procedures for new products and/or activities with the Financial Services Authority Regulation regarding products and activities of Sharia banks and Sharia business units.
not implementing policies and procedures in the event of product issuance or new activity implementation; and
there is significant inconsistency between the policies and procedures for new products and/or activities with the Financial Services Authority Regulation regarding products and activities of Sharia banks and Sharia business units.
liquidity.

Has the BPRS implemented a Liquidity Risk Management process embedded in BPRS business activities related to Liquidity Risk?

has implemented Liquidity Risk Management processes including identification, measurement, monitoring, and control of Liquidity Risk towards BPRS business activities related to Liquidity Risk at least including assessment of deposit structure, all cash inflows and outflows including funding needs, the BPRS's ability to obtain liquidity, and liquid assets that can be converted, especially in crisis conditions;
application of Liquidity Risk Management is done very adequately; and
application of Liquidity Risk Management is done consistently.
has implemented Liquidity Risk Management processes including identification, measurement, monitoring, and control of Liquidity Risk towards BPRS business activities related to Liquidity Risk at least including assessment of deposit structure, all cash inflows and outflows including funding needs, the BPRS's ability to obtain liquidity, and liquid assets that can be converted, especially in crisis conditions;
application of Liquidity Risk Management is done adequately; and
application of Liquidity Risk Management is done fairly consistently.
has implemented Liquidity Risk Management processes including identification, measurement, monitoring, and control of Liquidity Risk towards BPRS business activities related to Liquidity Risk at least including assessment of deposit structure, all cash inflows and outflows including funding needs, the BPRS's ability to obtain liquidity, and liquid assets that can be converted, especially in crisis conditions;
application of Liquidity Risk Management is done adequately; and
application of Liquidity Risk Management is not done consistently, but measurement, monitoring, and control of Liquidity Risk towards BPRS business activities related to Liquidity Risk at least including assessment of deposit structure, all cash inflows and outflows including funding needs, the BPRS's ability to obtain liquidity, and liquid assets that can be converted, especially in crisis conditions;
application of Liquidity Risk Management is not adequate; and
application of Liquidity Risk Management is not done consistently so as to cause significant impact.
has implemented Liquidity Risk Management processes but not entirely including identification, measurement, monitoring, and control of Liquidity Risk towards BPRS business activities related to Liquidity Risk.
does not implement Liquidity Risk Management processes including identification, measurement, monitoring, and control of Liquidity Risk towards BPRS business activities related to Liquidity Risk.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate consistent. not causing significant impact. not done consistently causing significant impact.

Does the BPRS have a Risk Management information system that supports the Board of Directors in decision-making regarding Liquidity Risk and has been reported to the Board of Directors periodically?

has a Risk Management information system that reflects Liquidity Risk;
data in the Risk Management information system is complete, accurate, current, and whole;
Risk Management information system supports the Board of Directors in decision-making; and
Risk Management information system strongly supports SKMR or PEMR in preparing reports to the Board of Directors every semester.
has a Risk Management information system that reflects Liquidity Risk;
data in the Risk Management information system is fairly complete, accurate, current, and whole;
Risk Management information system supports the Board of Directors in decision-making; and
Risk Management information system fairly supports SKMR or PEMR in preparing reports to the Board of Directors every semester.
has a Risk Management information system that reflects Liquidity Risk;
data in the Risk Management information system is less complete, accurate, current, and whole;
Risk Management information system does not fully support the Board of Directors in decision-making; and
Risk Management information system less supports SKMR or PEMR in preparing reports to the Board of Directors every semester.
has a Risk Management information system that reflects Liquidity Risk;
data in the Risk Management information system is not complete, accurate, current, and whole;
Risk Management information system does not fully support the Board of Directors in decision-making; and
Risk Management information system does not support SKMR or PEMR in preparing reports to the Board of Directors every semester.
not having a Risk Management information system that reflects Liquidity Risk.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate Board of Directors every semester.
Board of Directors every semester. reports to the Board of Directors every semester.
Board of Directors every semester.

Has SKAI or PEAI conducted periodic audits on the implementation of Liquidity Risk Management, submitted internal audit reports, and ensured follow-up on inspection findings?

SKAI or PEAI has conducted internal audits on the implementation of Liquidity Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI include the implementation of Liquidity Risk Management policies and procedures considering regulations and BPRS conditions; and
SKAI or PEAI has conducted internal audits on the implementation of Liquidity Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI include the implementation of Liquidity Risk Management policies and procedures considering regulations and BPRS conditions; and
SKAI or PEAI has conducted internal audits on the implementation of Liquidity Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI include the implementation of Liquidity Risk Management policies and procedures considering regulations and BPRS conditions; and
SKAI or PEAI has conducted internal audits on the implementation of Liquidity Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI are not in accordance with the scope of implementation of Liquidity Risk Management policies and procedures; and
internal audit findings made as recommendations have been followed up.
SKAI or PEAI has conducted internal audits on the implementation of Liquidity Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI include the implementation of Liquidity Risk Management policies and procedures considering regulations and BPRS conditions; and
SKAI or PEAI has conducted internal audits on the implementation of Liquidity Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI include the implementation of Liquidity Risk Management policies and procedures considering regulations and BPRS conditions; and
SKAI or PEAI has conducted internal audits on the implementation of Liquidity Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI are not in accordance with the scope of implementation of Liquidity Risk Management policies and procedures; and
internal audit findings made as recommendations are not fully followed up but do not cause significant impact.
SKAI or PEAI has conducted internal audits on the implementation of Liquidity Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI include the implementation of Liquidity Risk Management policies and procedures considering regulations and BPRS conditions; and
SKAI or PEAI has conducted internal audits on the implementation of Liquidity Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI are not in accordance with the scope of implementation of Liquidity Risk Management policies and procedures; and
internal audit findings made as recommendations are not fully followed up and cause significant impact.
SKAI or PEAI does not conduct internal audits on the implementation of Liquidity Risk Management, provide recommendations, and report internal audit results to the President Director.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate

internal audit findings made as recommendations have been followed up.
internal audit findings made as recommendations are not fully followed up but do not cause significant impact.
internal audit findings made as recommendations are not fully followed up and cause significant impact.
recommendations are not followed up.

Has the internal control system regarding Liquidity Risk been implemented by all levels of the BPRS organization?

all levels of the BPRS organization related to activities with Liquidity Risk exposure have implemented internal control functions by considering Risk Management policies, Risk Management procedures, and setting Liquidity Risk limits;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Liquidity Risk exposure;
SKMR or PEMR is separate from units related to activities with Liquidity Risk exposure; and
SKAI or PEAI is separate from units related to activities with Liquidity Risk exposure.
all levels of the BPRS organization related to activities with Liquidity Risk exposure have implemented internal control functions but do not fully consider Risk Management policies, Risk Management procedures, and setting Liquidity Risk limits and do not cause significant impact;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Liquidity Risk exposure;
SKMR or PEMR is separate from units related to activities with Liquidity Risk exposure; and
SKAI or PEAI is separate from units related to activities with Liquidity Risk exposure.
all levels of the BPRS organization related to activities with Liquidity Risk exposure have implemented internal control functions but do not fully consider Risk Management policies, Risk Management procedures, and setting Liquidity Risk limits and cause significant impact;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Liquidity Risk exposure;
SKMR or PEMR is separate from units related to activities with Liquidity Risk exposure; and
SKAI or PEAI is separate from units related to activities with Liquidity Risk exposure.
not all levels of the BPRS organization related to activities with Liquidity Risk exposure have implemented internal control functions by considering Risk Management policies, Risk Management procedures, and setting Liquidity Risk limits and cause very significant impact;
there is no clarity of authority and responsibility from each level of the BPRS organization related to activities with Liquidity Risk exposure;
SKMR or PEMR is separate from units related to activities with Liquidity Risk exposure; and
SKAI or PEAI is separate from units related to activities with Liquidity Risk exposure.
all levels of the BPRS organization related to activities with Liquidity Risk exposure do not implement internal control functions;
there is no clarity of authority and responsibility from each level of the BPRS organization related to activities with Liquidity Risk exposure;
SKMR or PEMR is not separate from units related to activities with Liquidity Risk exposure; and
SKAI or PEAI is not separate from units related to activities with Liquidity Risk exposure.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate responsibility from each level of the BPRS organization related to activities with Liquidity Risk exposure;

SKMR or PEMR is separate from units related to activities with Liquidity Risk exposure; and
SKAI or PEAI is separate from units related to activities with Liquidity Risk exposure.
cause significant impact;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Liquidity Risk exposure;
SKMR or PEMR is separate from units related to activities with Liquidity Risk exposure; and
SKAI or PEAI is separate from units related to activities with Liquidity Risk exposure.
cause significant impact;
there is clarity of authority and responsibility from each level of the BPRS organization related to activities with Liquidity Risk exposure;
SKMR or PEMR is separate from units related to activities with Liquidity Risk exposure; and
SKAI or PEAI is separate from units related to activities with Liquidity Risk exposure.
cause very significant impact;
there is no clarity of authority and responsibility from each level of the BPRS organization related to activities with Liquidity Risk exposure;
SKMR or PEMR is separate from units related to activities with Liquidity Risk exposure; and
SKAI or PEAI is separate from units related to activities with Liquidity Risk exposure.
exposure to Liquidity Risk;
SKMR or PEMR is not separate from units related to activities with Liquidity Risk exposure; and
SKAI or PEAI is not separate from units related to activities with Liquidity Risk exposure.

e. Reputation Risk
Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate

Has the Board of Directors formulated Reputation Risk Management policies, implemented them consistently, and updated them periodically?

The Board of Directors has formulated Reputation Risk Management policies;
The Board of Directors conducts business activities based on the established Reputation Risk Management policies;
The Board of Directors updates Reputation Risk Management policies in the event of changes in statutory regulations, business changes, and evaluation results of the policies by the Board of Commissioners; and
the implemented Reputation Risk Management policies have proven to mitigate Reputation Risk.
The Board of Directors has formulated Reputation Risk Management policies;
The Board of Directors conducts business activities based on the established Reputation Risk Management policies; and
The Board of Directors updates Reputation Risk Management policies in the event of changes in statutory regulations, business changes, and evaluation results of the policies by the Board of Commissioners.
The Board of Directors has formulated Reputation Risk Management policies;
The Board of Directors conducts business activities based on the established Reputation Risk Management policies; and
The Board of Directors does not update Reputation Risk Management policies in the event of changes in statutory regulations, business changes, and evaluation results of the policies by the Board of Commissioners.
The Board of Directors has formulated Reputation Risk Management policies;
The Board of Directors does not conduct business activities based on the established Reputation Risk Management policies; and
The Board of Directors does not update Reputation Risk Management policies in the event of changes in statutory regulations, business changes, and evaluation results of the policies by the Board of Commissioners.
The Board of Directors does not formulate Reputation Risk Management policies.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate policies by the Board of Commissioners; and

the implemented Reputation Risk Management policies have proven to mitigate Reputation Risk.
and evaluation results of the policies by the Board of Commissioners. business changes, and evaluation results of the policies by the Board of Commissioners. and evaluation results of the policies by the Board of Commissioners.

Has the Board of Directors had the ability to take necessary actions to mitigate Reputation Risk, and communicated Reputation Risk Management policies to all levels of the BPRS organization?

The Board of Directors takes necessary actions to mitigate Risk when implementing Reputation Risk Management policies;
The Board of Directors communicates Reputation Risk Management policies; and
all levels of the BPRS organization are able to understand the implemented Reputation Risk Management policies.
The Board of Directors takes necessary actions to mitigate Risk when implementing Reputation Risk Management policies;
The Board of Directors communicates Reputation Risk Management policies; and
not all levels of the BPRS organization are able to understand the implemented Reputation Risk Management policies but do not cause significant impact.
The Board of Directors takes necessary actions to mitigate Risk when implementing Reputation Risk Management policies;
The Board of Directors communicates Reputation Risk Management policies; and
not all levels of the BPRS organization are able to understand the implemented Reputation Risk Management policies and cause significant impact.
The Board of Directors takes necessary actions to mitigate Risk when implementing Reputation Risk Management policies;
The Board of Directors does not communicate Reputation Risk Management policies; and
all levels of the BPRS organization are unable to understand the implemented Reputation Risk Management policies.
The Board of Directors does not take necessary actions to mitigate Risk when implementing Reputation Risk Management policies;
The Board of Directors does not communicate Reputation Risk Management policies; and
all levels of the BPRS organization are unable to understand the implemented Reputation Risk Management policies.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate implemented. implemented but do not cause significant impact. organization are able to understand the implemented Reputation Risk Management policies and cause significant impact. implemented. implemented.

Has the Board of Commissioners given approval for the Reputation Risk Management policies formulated by the Board of Directors and conducted periodic evaluations?

The Board of Commissioners has given approval for the Reputation Risk Management policies;
The Board of Commissioners has conducted evaluations of the Reputation Risk Management policies;
evaluations are conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities; and
the evaluations conducted are relevant to the need for adjusting Reputation Risk Management policies.
The Board of Commissioners has given approval for the Reputation Risk Management policies;
The Board of Commissioners has conducted evaluations of the Reputation Risk Management policies; and
evaluations are conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities.
The Board of Commissioners has given approval for the Reputation Risk Management policies;
The Board of Commissioners has conducted evaluations of the Reputation Risk Management policies; and
evaluations are not conducted by the Board of Commissioners periodically at least 1 (one) time in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities.
The Board of Commissioners has given approval for the Reputation Risk Management policies; and
The Board of Commissioners does not conduct evaluations of the Reputation Risk Management policies.
The Board of Commissioners does not give approval for the Reputation Risk Management policies; and
The Board of Commissioners does not conduct evaluations of the Reputation Risk Management policies.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate year or ad hoc in the event of changes that significantly affect BPRS business activities; and

the evaluations conducted are relevant to the need for adjusting Reputation Risk Management policies.
year or ad hoc in the event of changes that significantly affect BPRS business activities. periodically at least 1 (one) time in 1 (one) year or ad hoc in the event of changes that significantly affect BPRS business activities.

Has the Board of Commissioners conducted periodic evaluations of the Board of Directors' accountability for the implementation of Reputation Risk Management policies and ensured follow-up on the evaluation results?

The Board of Commissioners has conducted evaluations of the implementation of Reputation Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that significantly affect BPRS business activities;
The Board of Commissioners has ensured follow-up on evaluation results in every reporting period; and
the evaluations provided are relevant to the implementation of Reputation Risk Management policies to support BPRS performance improvement.
The Board of Commissioners has conducted evaluations of the implementation of Reputation Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that significantly affect BPRS business activities; and
The Board of Commissioners has ensured follow-up on evaluation results in every reporting period.
The Board of Commissioners has conducted evaluations of the implementation of Reputation Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that significantly affect BPRS business activities; and
The Board of Commissioners does not ensure follow-up on evaluation results in every reporting period.
The Board of Commissioners has conducted evaluations of the implementation of Reputation Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are not conducted periodically; and
The Board of Commissioners does not ensure follow-up on evaluation results in every reporting period.
The Board of Commissioners does not conduct evaluations of the implementation of Reputation Risk Management policies by the Board of Directors.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate reports submitted by the Board of Directors in the event of changes that significantly affect BPRS business activities;

The Board of Commissioners has ensured follow-up on evaluation results in every reporting period; and
the evaluations provided are relevant to the implementation of Reputation Risk Management policies to support BPRS performance improvement.
reports submitted by the Board of Directors in the event of changes that significantly affect BPRS business activities; and
The Board of Commissioners has ensured follow-up on evaluation results in every reporting period.
reports submitted by the Board of Directors in the event of changes that significantly affect BPRS business activities; and
The Board of Commissioners does not ensure follow-up on evaluation results in every reporting period.
follow-up on evaluation results in every reporting period.

Has the DPS conducted evaluations of the Reputation Risk Management policies related to

DPS has conducted very adequate evaluations of the policies;
DPS has conducted adequate evaluations of the policies;
DPS has conducted fairly adequate evaluations of the policies;
DPS conducted less adequate evaluations of the policies; DPS did not conduct evaluations of the policies related to

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Very Inadequate Reputation Risk Management policies related to Reputation Risk Management policies related to Reputation Risk Management policies related to Reputation Risk Management policies related to Reputation Risk Management policies related to

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate related to the fulfillment of Shariah Principles? Reputation Risk Management related to the fulfillment of Shariah Principles;

evaluation
is conducted by the DPS periodically at least 1 (one) time in 1 (one) year or whenever there are changes that affect the business activities of the BPRS significantly; and
the evaluation provided is relevant to
the needs of adjusting
Reputation Risk Management policies.
Reputation Risk Management related to the fulfillment of Shariah Principles; and
evaluation
is conducted by the DPS periodically at least 1 (one) time in 1 (one) year or whenever there are changes that affect the business activities of the BPRS significantly. Reputation Risk Management related to the fulfillment of Shariah Principles; and
evaluation is not
conducted by the DPS periodically at least 1 (one) time in 1 (one) year or whenever there are changes that affect the business activities of the BPRS significantly. related to the fulfillment of Shariah Principles. fulfillment of Shariah Principles.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate
6. Has the DPS conducted
evaluation of the Board of Directors' accountability regarding the implementation of Reputation Risk Management policies related to the fulfillment of Shariah Principles?

The DPS has conducted
a very adequate evaluation of the Board of Directors' accountability regarding the implementation of Reputation Risk Management policies related to the fulfillment of Shariah Principles;
evaluation
is conducted by the DPS every semester or more; and
the evaluation provided is relevant to
the needs of adjusting
Reputation Risk Management policies.
The DPS has conducted
an adequate evaluation of the Board of Directors' accountability regarding the implementation of Reputation Risk Management policies related to the fulfillment of Shariah Principles; and
evaluation
is conducted by the DPS every semester or more.
The DPS has conducted
a fairly adequate evaluation of the Board of Directors' accountability regarding the implementation of Reputation Risk Management policies related to the fulfillment of Shariah Principles; and
evaluation
is conducted by the DPS every semester or more.
The DPS has conducted
an inadequate evaluation of the Board of Directors' accountability regarding the implementation of Reputation Risk Management policies related to the fulfillment of Shariah Principles; and
evaluation
is conducted by the DPS every semester or more.
The DPS does not conduct evaluation of the Board of Directors' accountability regarding the implementation of Reputation Risk Management policies related to the fulfillment of Shariah Principles.

Does the BPRS have

has a working unit
has a working unit
has a working unit
has a working unit
has a working unit
that handles

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate sufficiency of organization that handles reputation functions and Reputation Risk Management functions? handles reputation functions;

the working unit
handling reputation functions has executed its duties and authorities in accordance with the established guidelines; and
has SKMR or PEMR capable
of executing its function to mitigate Reputation Risk. handles reputation functions but is incomplete;
the working unit
handling reputation functions has executed its duties and authorities in accordance with the established guidelines; and
has SKMR or PEMR capable
of executing its function to mitigate Reputation Risk. handles reputation functions;
the working unit handling
reputation functions has executed its duties and authorities in accordance with the established guidelines; and
has SKMR
or PEMR but is not able to execute its function to mitigate Reputation Risk. handles reputation functions but is incomplete;
the working unit
handling reputation functions has executed its duties and authorities in accordance with the established guidelines; and
has SKMR
or PEMR but is not able to execute its function to mitigate Reputation Risk. handles reputation functions but is incomplete;
the working unit
handling reputation functions does not execute its duties and authorities in accordance with the established guidelines; and
has SKMR
or PEMR but is not able to execute its function to mitigate Reputation Risk.

Has the Board of Directors
implemented human resource management policies in the application of Reputation Risk Management?

there is
alignment of human resource qualifications with positions and fields of work;
there are efforts to
improve human resource competency consistently;
there is
misalignment of human resource qualifications with positions and fields of work but does not provide a significant impact;
there are efforts
there is
misalignment of human resource qualifications with positions and fields of work but does not provide a significant impact;
there is
misalignment of human resource qualifications with positions and fields of work and provides a significant impact;
there are efforts
there is
misalignment of human resource qualifications with positions and fields of work and provides a significant impact;
there are no efforts

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate and

the level of
fulfillment of human resource performance standards in the working unit executing reputation functions in accordance with tasks and responsibilities. improvement of human resource competency consistently; and
the level of
fulfillment of human resource performance standards in the working unit executing reputation functions in accordance with tasks and responsibilities.
there are efforts to
improve human resource competency but not consistently; and
the level of
fulfillment of human resource performance standards in the working unit executing reputation functions in accordance with tasks and responsibilities. improvement of human resource competency but not consistently; and
the level of
fulfillment of human resource performance standards in the working unit executing reputation functions is not in accordance with tasks and responsibilities but does not provide a significant impact. improvement of human resource competency; and
the level of
fulfillment of human resource performance standards in the working unit executing reputation functions is not in accordance with tasks and responsibilities and provides a significant impact.

Does the BPRS have
Reputation Risk Management policies that are adequate, including implementing transparency principles and improving service quality

has
Reputation Risk Management policies;
there is
alignment between the substance of
Reputation Risk Management policies with
has
Reputation Risk Management policies;
there is
misalignment that is not significant between the substance of policies
has
Reputation Risk Management policies;
there is
misalignment that is not significant between the substance of policies
has
Reputation Risk Management policies;
there is
misalignment that is significant between the substance of policies Reputation Risk Management policies does not have Reputation Risk Management policies.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate of customers, and is formulated by considering vision, mission, business scale and business complexity, as well as human resource sufficiency? Financial Services Authority Regulations regarding the application of Risk Management for Shariah financing banks including policies to prevent the occurrence of Reputation Risk, and improving service quality customers; and

there is
harmony between
Reputation Risk Management policies with vision, mission, business scale, and business complexity, as well as human resource sufficiency in setting Reputation Risk Management policies Reputation Risk Management policies with Financial Services Authority Regulations regarding the application of Risk Management for Shariah financing banks including policies to prevent the occurrence of Reputation Risk, and improving service quality customers; and
there is
harmony between
Reputation Risk Management policies with vision, mission, business scale, and business complexity, as well as human resource sufficiency business in Reputation Risk Management policies with Financial Services Authority Regulations regarding the application of Risk Management for Shariah financing banks including policies to prevent the occurrence of Reputation Risk, and improving service quality customers; and
there is
misalignment between
Reputation Risk Management policies with vision, mission, business scale, and business complexity, as well Reputation Risk Management policies with Financial Services Authority Regulations regarding the application of Risk Management for Shariah financing banks including policies to prevent the occurrence of Reputation Risk, and improving service quality customers; and
there is
misalignment between
Reputation Risk Management policies with vision, mission, business scale, and business complexity, as well as human resource sufficiency business in setting Reputation Risk Management policies, but does not cause a significant impact. Reputation Risk Management policies, and causes a significant impact.

Does the BPRS:

has Reputation Risk Management procedures
and the establishment of Reputation Risk limits established by the Board of Directors;
implements
Reputation Risk Management procedures and the establishment of Reputation Risk limits consistently for all activities; and
conducts
evaluation and
has Reputation Risk Management procedures
and the establishment of Reputation Risk limits established by the Board of Directors at least including degree of delegation of authority and accountability that is clear and well documented so as to facilitate audit trail requirements for requirements
has Reputation Risk Management procedures
and the establishment of Reputation Risk limits established by the Board of Directors at least including degree of delegation of authority and accountability that is clear and well documented so as to facilitate audit trail requirements for requirements
has
Reputation Risk Management procedures and the establishment of Reputation Risk limits established by the Board of Directors at least including degree of delegation of authority and accountability that is clear and well documented so as to facilitate audit trail requirements for requirements
has Reputation Risk Management procedures
and the establishment of Reputation Risk limits established by the Board of Directors at least including degree of delegation of authority and accountability that is clear and well documented so as to facilitate audit trail requirements for requirements does not have Reputation Risk Management procedures and the establishment of Reputation Risk limits established

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate updating of Reputation Risk Management procedures and the establishment of Reputation Risk limits periodically? internal controls;

implements
Reputation Risk Management procedures and the establishment of Reputation Risk limits in every functional activity consistently; and
conducts
evaluation and updating of
Reputation Risk Management procedures and the establishment of Reputation Risk limits in the event of significant business changes and/or regulations legislation. internal controls;
implements
Reputation Risk Management procedures and the establishment of Reputation Risk limits in every functional activity consistently; and
does not conduct
evaluation and updating of
Reputation Risk Management procedures and the establishment of Reputation Risk limits in the event of significant business changes and/or regulations legislation, but does not audit trail for internal controls;
implements
Reputation Risk Management procedures and the establishment of Reputation Risk limits in every functional activity consistently; and
does not conduct
evaluation and updating of
Reputation Risk Management procedures and the establishment of Reputation Risk limits in the event of significant business changes and/or regulations legislation audit trail for internal controls;
does not
implement
Reputation Risk Management procedures and the establishment of Reputation Risk limits in every functional activity consistently; and
does not conduct
evaluation and updating of
Reputation Risk Management procedures and the establishment of Reputation Risk limits in the event of significant business changes and/or regulations legislation and causes

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate cause a significant impact. legislation, and causes a significant impact. causes a significant impact.
11. Has the BPRS had policies
and procedures for the issuance of products and/or implementation of new activities covering identification and mitigation of Reputation Risk in accordance with Financial Services Authority Regulations regarding products and activities of Shariah banks and Shariah business units?

has
policies and procedures regarding the issuance of products and/or new activities that have Reputation Risk exposure;
implements
policies and procedures in the event of the issuance of products or implementation of new activities; and
there is
alignment between policies and procedures for products and/or new activities with Financial Services Authority Regulations regarding products and activities of Shariah banks and Shariah business units.
has
policies and procedures regarding the issuance of products and/or new activities that have Reputation Risk exposure;
implements
policies and procedures in the event of the issuance of products or implementation of new activities; and
there is
misalignment that is not significant between policies and procedures for products and/or new activities with Financial Services Authority
has
policies and procedures regarding the issuance of products and/or new activities that have Reputation Risk exposure;
implements
policies and procedures in the event of the issuance of products or implementation of new activities; and
there is
misalignment that is significant between policies and procedures for products and/or new activities with Financial Services Authority Regulations regarding products and activities of Shariah banks and Shariah business units.
has
policies and procedures regarding the issuance of products and/or new activities that have Reputation Risk exposure;
does not implement
policies and procedures in the event of the issuance of products or implementation of new activities; and
there is
misalignment that is significant between policies and procedures for products and/or new activities with Financial Services Authority Regulations regarding products and activities of Shariah banks and Shariah business units. does not have policies and procedures regarding the issuance of products and/or new activities exposure to Reputation Risk.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate Shariah banks and Shariah business units.
Financial Services Authority Regulations regarding products and activities of Shariah banks and Shariah business units. with Financial Services Authority Regulations regarding products and activities of Shariah banks and Shariah business units. regarding products and activities of Shariah banks and Shariah business units.
12. Has the BPRS implemented
the Reputation Risk Management process that is inherent in the business activities of the BPRS?

has
implemented the Reputation Risk Management process including identification, measurement, monitoring, and control of Reputation Risk against all business activities of the BPRS including against the number of complaints from customers submitted as well as regarding negative news about the BPRS;
implementation
of Reputation Risk Management is conducted very adequately; and
implementation
of Reputation Risk Management is conducted consistently.
has
implemented the Reputation Risk Management process including identification, measurement, monitoring, and control of Reputation Risk against all business activities of the BPRS including against the number of complaints from customers submitted as well as regarding negative news about the BPRS;
implementation
of Reputation Risk Management is conducted adequately; and
implementation
of Reputation Risk Management is conducted fairly consistently.
has
implemented the Reputation Risk Management process including identification, measurement, monitoring, and control of Reputation Risk against all business activities of the BPRS including against the number of complaints from customers submitted as well as regarding negative news about the BPRS;
implementation
of Reputation Risk Management is conducted adequately; and
implementation
of Reputation Risk Management is not conducted consistently, but does not cause a significant impact.
has
implemented the Reputation Risk Management process but not comprehensively including identification, measurement, monitoring, and control of Reputation Risk against all business activities of the BPRS including against the number of complaints from customers submitted as well as regarding negative news about the BPRS;
implementation
of Reputation Risk Management is not adequate; and
implementation
of Reputation Risk Management is not conducted consistently so as to cause a significant impact. not implement Reputation Risk Management process including identification, measurement, monitoring, and control of Reputation Risk against all business activities of the BPRS.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate
13. Has the BPRS had an information system
for Reputation Risk Management that supports the Board of Directors in decision-making related to Reputation Risk as well as has been reported to the Board of Directors periodically?

has
Reputation Risk Management information system that reflects Reputation Risk;
data on the
Reputation Risk Management information system is complete, accurate, current, and integrity;
Reputation Risk Management information system
has
Reputation Risk Management information system that reflects Reputation Risk;
data on the
Reputation Risk Management information system is fairly complete, accurate, current, and integrity;
Reputation Risk Management information system
has
Reputation Risk Management information system that reflects Reputation Risk;
data on the
Reputation Risk Management information system is less complete, accurate, current, and integrity;
Reputation Risk Management
information system
has
Reputation Risk Management information system that reflects Reputation Risk;
data on the
Reputation Risk Management information system is incomplete, accurate, current, and integrity;
Reputation Risk Management information system
does not have
Reputation Risk Management information system that reflects Reputation Risk.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate supports the Board of Directors in decision-making; and

Reputation Risk Management information system
very supports the SKMR or PEMR in preparing reports to the Board of Directors every semester. supports the Board of Directors in decision-making; and
Reputation Risk Management information system
fairly supports the SKMR or PEMR in preparing reports to the Board of Directors every semester.
Reputation Risk Management information system is not fully supports the Board of Directors in decision-making; and
Reputation Risk Management information
system less supports the SKMR or PE
Reputation Risk Management information system in preparing reports to the Board of Directors every semester. is not fully supports the Board of Directors in decision-making; and
Reputation Risk Management information system
does not support the SKMR or PEMR in preparing reports to the Board of Directors every semester.

Has the SKAI or PEAI conducted
audit periodically on the application of Reputation Risk Management, submitting internal audit result reports, and ensuring follow-up

SKAI or PEAI has
conducted internal audit on the application of Reputation Risk Management, providing recommendations, and reporting the results of internal audit to the Principal Director;
internal audit has
been conducted by
SKAI or PEAI including implementation of policies and procedures for Reputation Risk Management by considering regulations as well as conditions of the BPRS; and
internal audit findings that are
made into recommendations have been followed up.
SKAI or PEAI has
conducted internal audit on the application of Reputation Risk Management, providing recommendations, and reporting the results of internal audit to the Principal Director;
internal audit has
been conducted by
SKAI or PEAI including implementation of policies and procedures for Reputation Risk Management by considering regulations as well as conditions of the BPRS; and
internal audit findings
that are made into recommendations are not fully followed up but do not cause a significant impact.
SKAI or PEAI has
conducted internal audit on the application of Reputation Risk Management, providing recommendations, and reporting the results of internal audit to the Principal Director;
internal audit has
been conducted by SKAI or
PEAI including implementation of policies and procedures for Reputation Risk Management by considering regulations as well as conditions of the BPRS; and
internal audit findings
that are made into recommendations are not fully followed up and cause a significant impact.
SKAI or PEAI has
conducted internal audit on the application of Reputation Risk Management, providing recommendations, and reporting the results of internal audit to the Principal Director;
internal audit has
been conducted by
SKAI or PEAI but is not in accordance with the scope of implementation of policies and procedures for Reputation Risk Management; and
internal audit findings that are made into
recommendations are not followed up.
SKAI or PEAI does not conduct internal audit on the application of Reputation Risk Management.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate action on inspection findings?
15. Has the internal control system
against Reputation Risk

all levels
of BPRS organization related to activities
all levels
of BPRS organization related to activities
all levels
of BPRS organization related to activities
not all levels
of BPRS organization related to
all levels
of BPRS organization related to activities

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

reputation has been implemented by all levels of BPRS organization? who have exposure to Reputational Risk have implemented internal control functions by paying attention to Risk Management policies, Risk Management procedures, and the establishment of Reputational Risk limits;

there is clarity
of authority and responsibility of each level of BPRS organization related to activities that have exposure to Reputational Risk;
SKMR or PEMR
separate from units related to activities that have exposure to Reputational Risk have implemented internal control functions but do not fully pay attention to Risk Management policies, Risk Management procedures, and the establishment of Reputational Risk limits and do not have significant impact;
there is clarity
of authority and responsibility of each level of BPRS organization related to activities that have exposure to Reputational Risk; who have exposure to Reputational Risk have implemented internal control functions but do not fully pay attention to Risk Management policies, Risk Management procedures, and the establishment of Reputational Risk limits and have significant impact;
there is
clarity of authority and responsibility of each level of BPRS organization related to activities that have exposure to Reputational Risk; activities that have exposure to Reputational Risk have implemented internal control functions by paying attention to Risk Management policies, Risk Management procedures, and the establishment of Reputational Risk limits;
there is no
clearness of authority and responsibility of each level of BPRS organization related to activities that have exposure to Reputational Risk;
SKMR or PEMR
separate from units that have exposure to
Reputational Risk do not implement internal control functions;
there is no
clearness of authority and responsibility of each level of BPRS organization related to activities that have exposure to Reputational Risk;
SKMR or PEMR
are not separate from units related to activities that have exposure to Reputational Risk; and
SKAI or PEAI
are not separate from units that

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate who have exposure to Reputational Risk; and

SKAI or PEAI
separate from units related to activities that have exposure to Reputational Risk.
SKMR or PEMR
separate from units related to activities that have exposure to Reputational Risk; and
SKAI or PEAI
separate from units related to activities that have exposure to Reputational Risk.
Reputational Risk;
SKMR or
PEMR separate from units related to activities that have exposure to Reputational Risk; and
SKAI or PEAI
separate from units related to activities that have exposure to Reputational Risk. related to activities that have exposure to Reputational Risk;
SKAI or PEAI
separate from units related to activities that have exposure to Reputational Risk. related to activities that have exposure to Reputational Risk.

f. Strategic Risk
Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

Has the Board of Directors
prepared strategic
Risk Management policies, implemented them consistently, and performed periodic updates?

The Board of Directors has
prepared strategic
Risk Management policies;
The Board of
Directors conducts business activities based on strategic Risk Management policies that have been established;
The Board of
Directors performs updates against strategic Risk Management policies in the event of changes in regulatory legislation, business changes, and evaluation results
The Board of Directors has
prepared strategic
Risk Management policies;
The Board of
Directors conducts business activities based on strategic Risk Management policies that have been established; and
The Board of Directors performs
updates against strategic Risk Management policies in the event of changes in regulatory legislation, business changes, and evaluation results
The Board of Directors has
prepared strategic
Risk Management policies;
The Board of
Directors conducts business activities based on strategic Risk Management policies that have been established; and
The Board of Directors does
not perform updates against strategic Risk Management policies in the event of changes in regulatory legislation,
The Board of Directors has
prepared strategic
Risk Management policies;
The Board of Directors does
not conduct business activities based on strategic Risk Management policies that have been established; and
The Board of Directors does
not perform updates against strategic Risk Management policies in the event of changes in regulatory legislation, business changes, The Board of Directors does not prepare strategic Risk Management policies.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate strategic Risk Management policies by the Board of Commissioners; and

strategic Risk Management
policies that are implemented prove to mitigate the occurrence of Strategic Risk. strategic Risk Management policies by the Board of Commissioners. business changes, and evaluation results strategic Risk Management policies by the Board of Commissioners. and evaluation results strategic Risk Management policies by the Board of Commissioners.

Has the Board of Directors
had the ability to take necessary actions to mitigate Strategic Risk, and communicate strategic Risk Management policies to all levels of BPRS organization?

The Board of Directors takes
necessary actions to mitigate Risk when implementing strategic Risk Management policies;
The Board of
Directors communicates strategic Risk Management policies; and
all levels of
BPRS organization are able to understand strategic Risk Management policies that are applied.
The Board of Directors takes
necessary actions to mitigate Risk when implementing strategic Risk Management policies;
The Board of
Directors communicates strategic Risk Management policies; and
not all levels of
BPRS organization are able to understand strategic Risk Management policies that are applied but do not cause significant impact.
The Board of
Directors takes necessary actions to mitigate
Risk when implementing strategic Risk Management policies;
The Board of
Directors communicates strategic Risk Management policies; and
not all levels
The Board of Directors takes
necessary actions to mitigate Risk when implementing strategic Risk Management policies;
The Board of Directors does
not communicate strategic Risk Management policies; and
all levels of
BPRS organization are unable to understand strategic Risk Management policies that are applied.
The Board of Directors does
not take necessary actions to mitigate Risk when implementing strategic Risk Management policies;
The Board of Directors does
not communicate strategic Risk Management policies; and all levels of BPRS organization are unable to understand

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate strategic Risk Management policies that are applied. strategic Risk Management policies that are applied but do not cause significant impact. BPRS organization are able to understand strategic Risk Management policies that are applied and cause significant impact. strategic Risk Management policies that are applied. strategic Risk Management policies that are applied.
3. Has the Board of Commissioners
provided approval for the strategic
Risk Management policies prepared by the Board of Directors and performed periodic evaluations?

The Board of Commissioners
has provided approval for strategic Risk Management policies;
The Board of Commissioners
has performed evaluation against strategic Risk Management policies;
evaluation is performed
by the Board of
Commissioners periodically at least 1 (one) time in 1 (one)
The Board of Commissioners
has provided approval for strategic Risk Management policies;
The Board of Commissioners
has performed evaluation against strategic Risk Management policies; and
evaluation is performed
by the Board of
Commissioners periodically at least 1 (one) time in 1 (one)
The Board of Commissioners
has provided approval for strategic Risk
Management policies;
The Board of Commissioners
has performed evaluation against strategic Risk Management policies; and
evaluation is not
performed by the Board of Commissioners
The Board of Commissioners
has provided approval for strategic Risk Management policies; and
The Board of Commissioners
does not perform evaluation against strategic Risk Management policies.
The Board of Commissioners
does not provide approval for strategic Risk Management policies; and
The Board of Commissioners
does not perform evaluation against strategic Risk Management policies.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate year or whenever there are changes that affect BPRS business activities significantly; and

the evaluation
provided is relevant to the need for adjustment of strategic Risk Management policies. year or whenever there are changes that affect BPRS business activities significantly. periodically at least 1 (one) time in 1 (one) year or whenever in the event of changes that affect BPRS business activities significantly.

Has the Board of Commissioners
performed evaluation against the Board of Directors' accountability for the implementation of strategic Risk Management policies periodically and ensured follow-up on the results of the aforementioned evaluation?

The Board of Commissioners
has performed evaluation against the implementation of strategic Risk Management policies by the Board of Directors;
evaluation by
the Board of Commissioners is performed periodically every semester or more based on
The Board of Commissioners
has performed evaluation against the implementation of strategic Risk Management policies by the Board of Directors;
evaluation by
the Board of Commissioners is performed periodically every semester or more based on
The Board of Commissioners
has performed evaluation against the implementation of strategic Risk Management policies by the Board of Directors;
evaluation by
the Board of Commissioners is performed periodically every semester or more
The Board of Commissioners
has performed evaluation against the implementation of strategic Risk Management policies by the Board of Directors;
evaluation by
the Board of Commissioners is not performed periodically every semester or more The Board of Commissioners does not perform evaluation against the implementation of strategic Risk Management policies by the Board of Directors.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate follow-up on the results of the aforementioned evaluation? reports submitted by the Board of Directors in the event of changes that affect BPRS business activities significantly;

The Board of Commissioners
has ensured follow-up on the results of evaluation in every reporting period; and
the evaluation
provided is relevant to the implementation of strategic Risk Management policies to support BPRS performance improvement. reports submitted by the Board of Directors in the event of changes that affect BPRS business activities significantly; and
The Board of Commissioners
has ensured follow-up on the results of evaluation in every reporting period. reports submitted by the Board of Directors in the event of changes that affect BPRS business activities significantly; and
The Board of Commissioners
does not ensure follow-up on the results of evaluation in every reporting period. reports submitted by the Board of Directors in the event of changes that affect BPRS business activities significantly; and
The Board of Commissioners
does not ensure follow-up on the results of evaluation in every reporting period.

Has the DPS performed
evaluation against strategic
Risk Management policies related to
Sharia Principle compliance?

DPS has
performed very adequate evaluation against strategic Risk Management policies related to Sharia Principle compliance;
evaluation
is performed by
DPS periodically at least 1 (one) time in 1
(one) year or whenever in the event of changes that affect BPRS business activities significantly; and
evaluation
provided is relevant to the need for adjustment of strategic Risk Management policies.
DPS has
performed adequate evaluation against strategic Risk Management policies related to Sharia Principle compliance; and
evaluation
is performed by
DPS periodically at least 1 (one) time in 1
(one) year or whenever in the event of changes that affect BPRS business activities significantly.
DPS has
performed fairly adequate evaluation against strategic Risk Management policies related to Sharia Principle compliance; and
evaluation is
not performed by
DPS periodically at least 1 (one) time in 1
(one) year or whenever in the event of changes that affect BPRS business activities significantly.
DPS performs evaluation that is inadequate evaluation against strategic Risk Management policies related to Sharia Principle compliance. DPS does not perform evaluation against strategic Risk Management policies related to Sharia Principle compliance.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate
6. Has the DPS performed
evaluation against the Board of Directors' accountability for the implementation of strategic Risk Management policies related to Sharia Principle compliance?

DPS has
performed very adequate evaluation against the Board of Directors' accountability for the implementation of strategic Risk Management policies related to Sharia Principle compliance;
evaluation
is performed by
DPS every semester or more; and
evaluation
provided is relevant to the need for adjustment of strategic Risk Management policies.
DPS has
performed adequate evaluation against the Board of Directors' accountability for the implementation of strategic Risk Management policies related to Sharia Principle compliance; and
evaluation
is performed by
DPS every semester or more.
DPS has
performed fairly adequate evaluation against the Board of Directors' accountability for the implementation of strategic Risk Management policies related to Sharia Principle compliance; and
evaluation
is performed by
DPS every semester or more.
DPS has
performed inadequate evaluation against the Board of Directors' accountability for the implementation of strategic Risk Management policies related to Sharia Principle compliance; and
evaluation
is performed by
DPS every semester or more.
DPS does not perform evaluation against the Board of Directors' accountability for the implementation of strategic Risk Management policies related to Sharia Principle compliance.

Does BPRS have
adequate organization handling strategic functions and strategic Risk Management functions?

has a working
unit that handles strategic functions;
working units that
handle strategic functions have implemented tasks and authority in accordance with established guidelines; and
has SKMR
or PEMR capable of implementing its functions to mitigate Strategic Risk.
has a working
unit that handles strategic functions but is incomplete;
working units that
handle strategic functions have implemented tasks and authority in accordance with established guidelines; and
has SKMR
or PEMR capable of implementing its functions to mitigate Strategic Risk.
has a working
unit that handles strategic functions;
working units that
handle strategic functions have implemented tasks and authority in accordance with established guidelines; and
has SKMR
or PEMR that are not capable of implementing its functions to mitigate Strategic Risk.
has a working
unit that handles strategic functions but is incomplete;
working units that
handle strategic functions have implemented tasks and authority in accordance with established guidelines; and
has SKMR
or PEMR that are not capable of implementing its functions to mitigate Strategic Risk.
has a working
unit that handles strategic functions but is incomplete;
working units that
handle strategic functions do not implement tasks and authority in accordance with established guidelines; and
has SKMR
or PEMR that are not capable of implementing its functions to mitigate Strategic Risk.

Has the Board of Directors
implemented human resource management policies in the application of strategic Risk Management?

there is
qualification consistency between human resources and positions and fields of work;
there are efforts
for human resource competency improvement consistently; and
there is
qualification inconsistency between human resources and positions and fields of work but does not provide significant impact;
there are efforts
for
there is
qualification inconsistency between human resources and positions and fields of work but does not provide significant impact;
there are efforts
for
there is
qualification inconsistency between human resources and positions and fields of work and provides significant impact;
there are efforts
for
there is
qualification inconsistency between human resources and positions and fields of work and provides significant impact;
there are no
efforts

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

the level of
human resource performance standard compliance in working units that perform strategic functions in accordance with tasks and responsibilities. human resource competency improvement consistently; and
the level of
human resource performance standard compliance in working units that perform strategic functions in accordance with tasks and responsibilities. human resource competency improvement but not consistently; and
the level of
human resource performance standard compliance in working units that perform strategic functions in accordance with tasks and responsibilities but does not provide significant impact. human resource competency improvement; and
the level of
human resource performance standard compliance in working units that perform strategic functions is not in accordance with tasks and responsibilities and provides significant impact.

Does BPRS have
adequate strategic
Risk Management policies and prepared by considering vision, mission, business scale and business complexity, as well as

has
strategic Risk Management policies;
there is
consistency between the substance of strategic Risk Management policies with Risk Management regulations
has
strategic Risk Management policies;
there is
inconsistency that is not significant between the substance of strategic Risk Management policies with
has
strategic Risk Management policies;
there is
inconsistency that is not significant between the substance of strategic Risk Management policies
has
strategic Risk Management policies;
there is
significant inconsistency between the substance of strategic Risk Management policies with regulations not have strategic Risk Management policies.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate human resource adequacy? BPRS including BPRS annual achievement targets contained in BPRS business plans; and

there is
harmony between strategic Risk Management policies with vision, mission, business scale, and business complexity, and human resource adequacy in establishing strategic Risk Management policies. Risk Management regulations BPRS including BPRS annual achievement targets contained in BPRS business plans; and
there is
harmony between strategic Risk Management policies with vision, mission, business scale, and business complexity, and human resource adequacy in establishing strategic Risk Management policies. with Risk Management regulations BPRS including BPRS annual achievement targets contained in BPRS business plans; and
there is
inharmoniousness between strategic Risk Management policies with vision, mission, business scale, and business complexity, and human resource adequacy in establishing strategic Risk Management policies but does not cause significant impact. Risk Management regulations BPRS including BPRS annual achievement targets contained in BPRS business plans; and
there is
inharmoniousness between strategic Risk Management policies with vision, mission, business scale, and business complexity, and human resource adequacy in establishing strategic Risk Management policies and causing significant impact.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate
10. Does BPRS:

have strategic
Risk Management procedures and establishment of Strategic Risk limits that are established by the Board of Directors;
implement
strategic Risk Management procedures and establishment of Strategic Risk limits strategically for all activities; and
perform
evaluation and updates against strategic Risk Management procedures and establishment of Strategic Risk limits periodically?
have strategic
Risk Management procedures and establishment of Strategic Risk limits that are established by the Board of Directors at least including delegation levels of authority and accountability that are clear and well-documented so as to facilitate audit trail needs for internal control purposes;
implement
strategic Risk Management procedures and establishment of Strategic Risk limits in every activity
have strategic
Risk Management procedures and establishment of Strategic Risk limits that are established by the Board of Directors at least including delegation levels of authority and accountability that are clear and well-documented so as to facilitate audit trail needs for internal control purposes;
implement
strategic Risk Management procedures and establishment of Strategic Risk limits in every activity
have
strategic Risk Management procedures and establishment of Strategic Risk limits that are established by the Board of Directors at least including delegation levels of authority and accountability that are clear and well-documented so as to facilitate audit trail needs for internal control purposes;
implement
strategic Risk Management procedures and establishment of Strategic Risk limits
have strategic
Risk Management procedures and establishment of Strategic Risk limits that are established by the Board of Directors at least including delegation levels of authority and accountability that are clear and well-documented so as to facilitate audit trail needs for internal control purposes;
do not
implement strategic Risk Management procedures and establishment of Strategic Risk limits in every not have strategic Risk Management procedures and establishment of Strategic Risk limits that are established

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate functionally consistently; and

conducts evaluation and updating of Strategic Risk Management procedures and setting of Strategic Risk limits in the event of significant business changes and/or changes in statutory regulations.
functionally consistently; and
does not conduct evaluation and updating of Strategic Risk Management procedures and setting of Strategic Risk limits in the event of significant business changes and/or changes in statutory regulations, but does not cause significant impact.
functionally consistently; and
does not conduct evaluation and updating of Strategic Risk Management procedures and setting of Strategic Risk limits in the event of significant business changes and/or changes in statutory regulations and causes significant impact.
functionally consistently; and
does not conduct evaluation and updating of Strategic Risk Management procedures and setting of Strategic Risk limits in the event of significant business changes and/or changes in statutory regulations and causes significant impact.

Has the BPRS established policies and procedures for the issuance of products and/or implementation of new activities that include identification and mitigation of Strategic Risks in accordance with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units?

has policies and procedures regarding the issuance of products and/or new activities that have Strategic Risk exposure;
implements policies and procedures in the event of product issuance or new activity implementation; and
there is consistency between the policies and procedures for new products and/or activities with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units.
has policies and procedures regarding the issuance of products and/or new activities that have Strategic Risk exposure;
implements policies and procedures in the event of product issuance or new activity implementation; and
there is insignificant inconsistency between the policies and procedures for new products and/or activities with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units.
has policies and procedures regarding the issuance of products and/or new activities that have Strategic Risk exposure;
implements policies and procedures in the event of product issuance or new activity implementation; and
there is significant inconsistency between the policies and procedures for new products and/or activities with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units.
has policies and procedures regarding the issuance of products and/or new activities that have Strategic Risk exposure;
does not implement policies and procedures in the event of product issuance or new activity implementation; and
there is significant inconsistency between the policies and procedures for new products and/or activities with Financial Services Authority Regulations regarding products and activities of Sharia banks and Sharia business units.
does not have policies and procedures regarding the issuance of products and/or new activities that have Strategic Risk exposure.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

Has the BPRS implemented the Strategic Risk Management process embedded in the BPRS business activities?

has implemented the Strategic Risk Management process including identification, measurement, monitoring, and control of Strategic Risks against all BPRS business activities, including the realization of BPRS achievement targets;
implementation of Strategic Risk Management is very adequate; and
implementation of Strategic Risk Management is consistent.
has implemented the Strategic Risk Management process including identification, measurement, monitoring, and control of Strategic Risks against all BPRS business activities, including the realization of BPRS achievement targets;
implementation of Strategic Risk Management is adequate; and
implementation of Strategic Risk Management is fairly consistent.
has implemented the Strategic Risk Management process including identification, measurement, monitoring, and control of Strategic Risks against all BPRS business activities, including the realization of BPRS achievement targets;
implementation of Strategic Risk Management is adequate; and
implementation of Strategic Risk Management is not consistent.
has implemented the Strategic Risk Management process but not comprehensively including identification, measurement, monitoring, and control of Strategic Risks against all BPRS business activities, including the realization of BPRS achievement targets;
implementation of Strategic Risk Management is inadequate; and
implementation of Strategic Risk Management is not consistent, causing significant impact.
does not implement the Strategic Risk Management process including identification, measurement, monitoring, and control of Strategic Risks.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

Does the BPRS have a Risk Management Information System that supports the Board of Directors in decision-making regarding Strategic Risks and has been reported to the Board of Directors periodically?

has a Risk Management Information System that reflects Strategic Risks;
data in the Risk Management Information System is complete, accurate, current, and whole;
Risk Management Information System supports the Board of Directors in decision-making; and
Risk Management Information System strongly supports the Risk Management Committee (SKMR) or Sharia Supervisory Board (PEMR) in preparing reports to the Board of Directors every semester.
has a Risk Management Information System that reflects Strategic Risks;
data in the Risk Management Information System is fairly complete, accurate, current, and whole;
Risk Management Information System supports the Board of Directors in decision-making; and
Risk Management Information System fairly supports the Risk Management Committee (SKMR) or Sharia Supervisory Board (PEMR) in preparing reports to the Board of Directors every semester.
has a Risk Management Information System that reflects Strategic Risks;
data in the Risk Management Information System is less complete, accurate, current, and whole;
Risk Management Information System does not fully support the Board of Directors in decision-making; and
Risk Management Information System less supports the Risk Management Committee (SKMR) or Sharia Supervisory Board (PEMR) in preparing reports to the Board of Directors every semester.
has a Risk Management Information System that reflects Strategic Risks;
data in the Risk Management Information System is not complete, accurate, current, and whole;
Risk Management Information System does not fully support the Board of Directors in decision-making; and
Risk Management Information System does not support the Risk Management Committee (SKMR) or Sharia Supervisory Board (PEMR) in preparing reports to the Board of Directors every semester.
does not have a Risk Management Information System that reflects Strategic Risks.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

Has the Internal Audit Unit (SKAI) or Sharia Supervisory Board (PEAI) conducted periodic audits on the implementation of Strategic Risk Management, submitted internal audit reports, and ensured follow-up on examination findings?

SKAI or PEAI has conducted internal audits on the implementation of Strategic Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI include the implementation of policies and procedures for Strategic Risk Management considering the regulations and conditions of the BPRS; and
internal audit findings made as recommendations have been followed up.
SKAI or PEAI has conducted internal audits on the implementation of Strategic Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI include the implementation of policies and procedures for Strategic Risk Management considering the regulations and conditions of the BPRS; and
internal audit findings made as recommendations are not fully followed up but do not cause significant impact.
SKAI or PEAI has conducted internal audits on the implementation of Strategic Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI include the implementation of policies and procedures for Strategic Risk Management considering the regulations and conditions of the BPRS; and
internal audit findings made as recommendations are not fully followed up and cause significant impact.
SKAI or PEAI has conducted internal audits on the implementation of Strategic Risk Management, provided recommendations, and reported internal audit results to the President Director;
internal audits conducted by SKAI or PEAI are not in accordance with the scope of implementation of policies and procedures for Strategic Risk Management considering the regulations and conditions of the BPRS; and
internal audit findings made as recommendations are not followed up.
SKAI or PEAI does not conduct internal audits on the implementation of Strategic Risk Management.

Assessment
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

Has the internal control system regarding Strategic Risks been implemented by all levels of the BPRS organization?

all levels of the BPRS organization related to activities with Strategic Risk exposure have implemented internal control functions by considering Strategic Risk Management policies, procedures, and setting of Strategic Risk limits;
there is clarity of authority and responsibility of each level of the BPRS organization related to activities with Strategic Risk exposure;
Risk Management Committee (SKMR) or Sharia Supervisory Board (PEMR) is separate from units related to activities with Strategic Risk exposure; and
Internal Audit Unit (SKAI) or Sharia Supervisory Board (PEAI) is separate from units related to activities with Strategic Risk exposure.
all levels of the BPRS organization related to activities with Strategic Risk exposure have implemented internal control functions but do not fully consider Strategic Risk Management policies, procedures, and setting of Strategic Risk limits and do not have significant impact;
there is clarity of authority and responsibility of each level of the BPRS organization related to activities with Strategic Risk exposure;
Risk Management Committee (SKMR) or Sharia Supervisory Board (PEMR) is separate from units related to activities with Strategic Risk exposure; and
Internal Audit Unit (SKAI) or Sharia Supervisory Board (PEAI) is separate from units related to activities with Strategic Risk exposure.
all levels of the BPRS organization related to activities with Strategic Risk exposure have implemented internal control functions but do not fully consider Strategic Risk Management policies, procedures, and setting of Strategic Risk limits and have significant impact;
there is clarity of authority and responsibility of each level of the BPRS organization related to activities with Strategic Risk exposure;
Risk Management Committee (SKMR) or Sharia Supervisory Board (PEMR) is separate from units related to activities with Strategic Risk exposure; and
Internal Audit Unit (SKAI) or Sharia Supervisory Board (PEAI) is separate from units related to activities with Strategic Risk exposure.
not all levels of the BPRS organization related to activities with Strategic Risk exposure have implemented internal control functions by considering Strategic Risk Management policies, procedures, and setting of Strategic Risk limits;
there is no clarity of authority and responsibility of each level of the BPRS organization related to activities with Strategic Risk exposure;
Risk Management Committee (SKMR) or Sharia Supervisory Board (PEMR) is separate from units related to activities with Strategic Risk exposure; and
Internal Audit Unit (SKAI) or Sharia Supervisory Board (PEAI) is separate from units related to activities with Strategic Risk exposure.
all levels of the BPRS organization related to activities with Strategic Risk exposure do not implement internal control functions;
there is no clarity of authority and responsibility of each level of the BPRS organization related to activities with Strategic Risk exposure;
Risk Management Committee (SKMR) or Sharia Supervisory Board (PEMR) is not separate from units related to activities with Strategic Risk exposure; and
Internal Audit Unit (SKAI) or Sharia Supervisory Board (PEAI) is not separate from units related to activities with Strategic Risk exposure.

After assigning ratings to each parameter of the Risk Management Quality Level (KPMR) for each type of Risk, the BPRS determines the KPMR level for each type of Risk based on the parameter rating that is most material and significantly affects Risk mitigation at the BPRS. The determination of the KPMR level for each type of Risk refers to the KPMR Level Determination Matrix as referred to in the Strategic Risk Management Implementation Quality Matrix.

Step 3: Determination of Risk Level for Each Type of Risk

Based on the assessment of Inherent Risk and KPMR for each Risk, the Risk Level is subsequently determined. The Risk Level is the Risk embedded in BPRS activities after considering the KPMR. The Risk Level can be determined based on the Risk Level Determination Matrix as follows:

Risk Level Determination Matrix
Risk Level
Inherent Risk Level
Quality of Risk Management Implementation Level 1 (Very Adequate) 2 (Adequate) 3 (Fairly Adequate) 4 (Inadequate) 5 (Not Adequate) (Very Low) (limited review, follow-up plan reported semi-annually) (Low) 1 2 (limited review, follow-up plan reported semi-annually) (limited review, follow-up plan reported quarterly) (Medium) 2 2 (limited review, follow-up plan reported semi-annually) (limited review, follow-up plan reported quarterly) (comprehensive review, follow-up plan reported quarterly) (High) 2 (limited review, follow-up plan reported quarterly) (limited review, follow-up plan reported quarterly) (comprehensive review, follow-up plan reported quarterly) (comprehensive review, follow-up plan reported monthly) (Very High) (limited review, follow-up plan reported quarterly) (limited review, follow-up plan reported monthly) (limited review, follow-up plan reported monthly) (comprehensive review, follow-up plan reported monthly) (ongoing supervision, requires more in-depth monitoring)

Note:
In the event that the assessment results require review and follow-up by the BPRS, the BPRS submits the review results and follow-up plan immediately after the assessment is conducted.

The Risk Level Determination Matrix is essentially used as an indicative reference to map the Risk Level resulting from the combination of Inherent Risk Level and KPMR Level. In the event that the matrix cannot adequately describe the BPRS's Risk Level, a comprehensive and structured analysis can be used to adjust the Risk Level as long as it is believed to more accurately represent the Risk Level at the BPRS.

Step 4: Determination of Risk Rating

Based on the determination of the Risk Level as referred to in Step 3, the Risk Rating is determined by considering the significance of each Risk.
The determination of Risk Rating consists of 5 (five) ratings, namely Rating 1, Rating 2, Rating 3, Rating 4, and Rating 5. A smaller Risk Rating order reflects a lower Risk. In determining the Risk Rating, reference is made to the Risk Rating Determination Matrix.
In considering the materiality and significance of Risks to the overall BPRS Risk Profile, generally Credit Risk, Operational Risk, and Compliance Risk are the main Risks at the BPRS, so the BPRS Risk Rating is largely determined by the assessment results of these Risks. However, as a reference to test the materiality or significance of a Risk to the BPRS Risk Profile, including risks other than those mentioned above, the following must be considered:
a. Risk exposure or volume and its significance to the overall BPRS Risk Profile; and b. the impact of problems caused by such Risk on the BPRS's financial performance.

CHAPTER II
RISK RATING DETERMINATION MATRIX
Risk Rating Explanation
1 (Very Low)
BPRS Risk Profiles included in this rating generally have characteristics as follows:
a. Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Inherent Risk are classified as very low during a certain period in the future. b. KPMR is very adequate. In the event of minor weaknesses, such weaknesses can be ignored. 2 (Low) BPRS Risk Profiles included in this rating generally have characteristics as follows:
a. Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Inherent Risk are classified as low during a certain period in the future. b. KPMR is adequate. In the event of minor weaknesses, such weaknesses require management attention. 3 (Medium) BPRS Risk Profiles included in this rating generally have characteristics as follows:
a. Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Inherent Risk are classified as medium during a certain period in the future. b. KPMR is fairly adequate. Although minimum requirements are met, there are several weaknesses requiring management attention and improvement. 4 (High) BPRS Risk Profiles included in this rating generally have characteristics as follows:
a. Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Inherent Risk are classified as high during a certain period in the future. b. KPMR is inadequate. There are significant weaknesses in various aspects of Risk Management requiring immediate corrective action. 5 (Very High) BPRS Risk Profiles included in this rating generally have characteristics as follows:
a. Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Inherent Risk are classified as very high during a certain period in the future. b. KPMR is not adequate. There are significant weaknesses in various aspects of Risk Management, the resolution of which is beyond management's capabilities.

INHERENT RISK LEVEL DETERMINATION MATRIX FOR CREDIT RISK Risk Level Definition of Risk Level Credit Risk is classified as very low during a certain period in the future. Examples of BPRS characteristics included in the very low Risk Level include:
a. financing portfolio is dominated by very low Credit Risk exposure; b. financing exposure is very well diversified;
c. financing has very good quality;
d. financing strategy is classified as stable; and e. financing portfolio is relatively unaffected by changes in external factors. 2 (Low) Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Credit Risk are classified as low during a certain period in the future. Examples of BPRS characteristics included in the low Risk Level include:
a. financing portfolio is dominated by low Credit Risk exposure; b. financing exposure is well diversified;
c. financing has good quality;
d. financing strategy is classified as relatively stable; and e. financing portfolio is less affected by changes in external factors. 3 (Medium) Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Credit Risk are classified as medium during a certain period in the future. Examples of BPRS characteristics included in the medium Risk Level include:
a. financing portfolio is dominated by medium Credit Risk exposure; b. there is fairly significant financing concentration;

Risk Level Definition of Risk Level
c. financing has fairly good quality, but there is potential for decline;
d. financing strategy is generally fairly stable; and e. financing portfolio is fairly affected by changes in external factors. 4 (High) Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Credit Risk are classified as high during a certain period in the future. Examples of BPRS characteristics included in the high Risk Level include:
a. financing portfolio is dominated by high Credit Risk exposure; b. there is significant financing concentration;
c. financing has less good quality;
d. there are significant changes in financing strategy; and e. financing portfolio is affected by changes in external factors. 5 (Very High) Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Credit Risk are classified as very high during a certain period in the future. Examples of BPRS characteristics included in the very high Risk Level include:
a. financing portfolio is dominated by very high Credit Risk exposure; b. there is very significant financing concentration;
c. financing has poor quality;
d. there are very significant changes in financing strategy; and e. financing portfolio is very affected by changes in external factors.

INHERENT RISK LEVEL DETERMINATION MATRIX FOR OPERATIONAL RISK

Risk Level	Definition of Risk Level
Very Low	Operational risk is classified as very low over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Very Low Risk level include:<br>a. BPRS business has very simple characteristics, products and services are not varied, business mechanisms are very simple, transaction volume is low, organizational structure is not complex, and there are no significant corporate actions;<br>b. Human resources (HR), both in terms of quantity and quality sufficiency, are very adequate and historical data on losses due to human error is not significant;<br>c. Information technology (IT) is very adequate and there are no significant changes in the IT system;<br>d. The frequency and materiality of deviations (fraud) are very low and losses are not significant compared to BPRS transaction volume or revenue; and<br>e. The threat of business disruption due to external events is very low.
2 (Low)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Operational risk are classified as low over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Low Risk level include:<br>a. BPRS business has simple characteristics, products and services are relatively less varied, business mechanisms are simple, transaction volume is relatively low, organizational structure is less complex, and corporate actions are less significant;<br>b. Human resources (HR), both in terms of quantity and quality sufficiency, are adequate and historical data on losses due to human error is less significant;<br>c. Information technology (IT) is adequate and there are no significant changes in the IT system;<br>d. The frequency and materiality of deviations (fraud) are low and losses are less significant compared to BPRS transaction volume or revenue; and<br>e. The threat of business disruption due to external events is low.
3 (Medium)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Operational risk are classified as medium over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Medium Risk level include:<br>a. BPRS business has fairly complex characteristics, products and services are fairly varied, business mechanisms are fairly complex, transaction volume is fairly high, organizational structure is fairly complex, and corporate actions are fairly significant;<br>b. Human resources (HR), both in terms of quantity and quality sufficiency, are fairly adequate and historical data on losses due to human error is fairly significant;<br>c. Information technology (IT) is fairly adequate and there is a process of significant change in the IT system;<br>d. The frequency and materiality of deviations (fraud) are fairly high and losses are fairly significant compared to BPRS transaction volume or revenue; and<br>e. The threat of business disruption due to external events is fairly high.
4 (High)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Operational risk are classified as high over a certain period in the future.<br><br>Examples of BPRS characteristics included in the High Risk level include:<br>a. BPRS business has complex characteristics, products and services are varied, business mechanisms are complex, transaction volume is high, organizational structure is complex, and corporate actions are significant;<br>b. Human resources (HR), both in terms of quantity and quality sufficiency, are less adequate and historical data on losses due to human error is significant;<br>c. Information technology (IT) is less adequate and there are no significant changes in the IT system;<br>d. The frequency and materiality of deviations (fraud) are high and losses are significant compared to BPRS transaction volume or revenue; and<br>e. The threat of business disruption due to external events is high.
5 (Very High)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Operational risk are classified as very high over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Very High Risk level include:<br>a. BPRS business has very complex characteristics, products and services are very varied, business mechanisms are very complex, transaction volume is very high, organizational structure is very complex, and corporate actions are very significant;<br>b. Human resources (HR), both in terms of quantity and quality sufficiency, are inadequate and historical data on losses due to human error is very significant;<br>c. Information technology (IT) is inadequate and there are very significant changes in the IT system;<br>d. The frequency and materiality of deviations (fraud) are very high and losses are very significant compared to BPRS transaction volume or revenue; and<br>e. The threat of business disruption due to external events is very high.

INHERENT RISK LEVEL DETERMINATION MATRIX FOR COMPLIANCE RISK

Risk Level	Definition of Risk Level
Very Low	Compliance risk is classified as very low over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Very Low Risk level include:<br>a. There are no violations of laws and regulations, internal BPRS regulations, and Sharia Principles;<br>b. BPRS compliance track record is very good;<br>c. BPRS has implemented all applicable financial standards and codes of ethics;<br>d. There is no litigation process at the BPRS or there is a litigation process but the frequency and/or financial impact of insignificant lawsuits do not disturb the financial condition of the BPRS and do not have a major impact on the reputation of the BPRS;<br>e. Agreements made by the BPRS are very adequate; and<br>f. All BPRS activities and products comply with laws and regulations, internal BPRS regulations, and Sharia Principles.
2 (Low)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Compliance risk are classified as low over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Low Risk level include:<br>a. There are violations of laws and regulations, internal BPRS regulations, and Sharia Principles that are relatively minor and can be immediately corrected by the BPRS;<br>b. BPRS compliance track record is good;<br>c. BPRS has implemented almost all applicable financial standards and codes of ethics;<br>d. There is a litigation process at the BPRS but the frequency and/or financial impact of the lawsuits are less significant in disturbing the financial condition of the BPRS and do not have a major impact on the reputation of the BPRS;<br>e. Agreements made by the BPRS are adequate; and<br>f. There are BPRS activities and products that are not yet regulated in laws and regulations, internal BPRS regulations, and Sharia Principles with an insignificant amount.
3 (Medium)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Compliance risk are classified as medium over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Medium Risk level include:<br>a. There are violations of laws and regulations, internal BPRS regulations, and Sharia Principles that are fairly significant and require management attention;<br>b. BPRS compliance track record is fairly good;<br>c. There are minor violations of applicable financial standards and codes of ethics;<br>d. There is a litigation process at the BPRS with a frequency and/or financial impact of lawsuits that are fairly significant in disturbing the financial condition of the BPRS and impacting the reputation of the BPRS;<br>e. Agreements made by the BPRS are fairly adequate; and<br>f. There are BPRS activities and products that are not yet regulated in laws and regulations, internal BPRS regulations, and Sharia Principles with a fairly significant amount.
4 (High)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Compliance risk are classified as high over a certain period in the future.<br><br>Examples of BPRS characteristics included in the High Risk level include:<br>a. There are violations of laws and regulations, internal BPRS regulations, and Sharia Principles that are significant and require immediate corrective action;<br>b. BPRS compliance track record is less good;<br>c. There are significant violations of applicable financial standards and codes of ethics;<br>d. There is a litigation process at the BPRS with a frequency and/or financial impact of lawsuits that are significant so that in the event the BPRS loses, compensation for the lawsuit can disturb the financial condition of the BPRS and have a major impact on the reputation of the BPRS;<br>e. Agreements made by the BPRS are less adequate; and<br>f. There are BPRS activities and products that are not yet regulated in laws and regulations, internal BPRS regulations, and Sharia Principles with a significant amount.
5 (Very High)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Compliance risk are classified as very high over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Very High Risk level include:<br>a. There are violations of laws and regulations, internal BPRS regulations, and Sharia Principles that are very significant and require immediate correction;<br>b. BPRS compliance track record is not good;<br>c. There are very significant violations of applicable financial standards and codes of ethics;<br>d. There is a litigation process at the BPRS by BPRS customers in a frequency and/or financial impact that is very significant so that in the event the BPRS is defeated in a court decision, this condition can disturb the financial condition of the BPRS and have a very major impact on the reputation of the BPRS;<br>e. Agreements made by the BPRS are inadequate; and<br>f. There are BPRS activities and products that are not yet regulated in laws and regulations, internal BPRS regulations, and Sharia Principles with a very significant amount.

INHERENT RISK LEVEL DETERMINATION MATRIX FOR LIQUIDITY RISK

Risk Level	Definition of Risk Level
Very Low	Liquidity risk is classified as very low over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Very Low Risk level include:<br>a. Having high-quality liquid assets that are very adequate to cover maturing obligations;<br>b. Sources and concentration of unstable funding are not significant;<br>c. Very able to meet obligations and cash flow needs under normal and crisis conditions;<br>d. Cash flows from assets and liabilities can offset each other very well; and<br>e. Access to funding sources is very adequate, evidenced by a very good reputation, very adequate standby financing, and liquidity support from the BPRS group.
2 (Low)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Liquidity risk are classified as low over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Low Risk level include:<br>a. Having high-quality liquid assets that are adequate to cover maturing obligations;<br>b. Sources and concentration of unstable funding are less significant;<br>c. Able to meet obligations and cash flow needs under normal and crisis conditions;<br>d. Cash flows from assets and liabilities can offset each other well; and<br>e. Access to funding sources is adequate, evidenced by a good reputation, adequate standby financing, and liquidity support from the BPRS group.
3 (Medium)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Liquidity risk are classified as medium over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Medium Risk level include:<br>a. Having high-quality liquid assets that are fairly adequate to cover maturing obligations;<br>b. Sources and concentration of unstable funding are fairly significant;<br>c. Fairly able to meet obligations and cash flow needs under normal and crisis conditions;<br>d. Cash flows from assets and liabilities can offset each other fairly well; and<br>e. Access to funding sources is fairly adequate, evidenced by a fairly good reputation, and standby financing and liquidity support from the BPRS group are fairly adequate.
4 (High)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Liquidity risk are classified as high over a certain period in the future.<br><br>Examples of BPRS characteristics included in the High Risk level include:<br>a. Having high-quality liquid assets that are less adequate to cover maturing obligations;<br>b. Sources and concentration of unstable funding are significant;<br>c. Less able to meet obligations and cash flow needs under normal and crisis conditions;<br>d. Cash flows from assets and liabilities cannot offset each other at some time scales; and<br>e. Access to funding sources is less adequate, evidenced by a declining reputation, and standby financing and liquidity support from the BPRS group are very limited.
5 (Very High)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Liquidity risk are classified as very high over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Very High Risk level include:<br>a. Poor quality of liquid assets and volume of liquid assets are very inadequate to meet maturing obligations;<br>b. Sources and concentration of unstable funding are very significant;<br>c. Unable to meet obligations and cash flow needs under normal and crisis conditions;<br>d. Cash flows from assets and liabilities cannot offset each other at almost all time scales; and<br>e. Access to funding sources is inadequate, evidenced by a deteriorating reputation, so that the BPRS has difficulty in obtaining funding, there is no standby financing and liquidity support from the BPRS group.

INHERENT RISK LEVEL DETERMINATION MATRIX FOR REPUTATION RISK

Risk Level	Definition of Risk Level
Very Low	Reputation risk is classified as very low over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Very Low Risk level include:<br>a. There are no reputation events;<br>b. Violations or potential violations of business ethics are very minimal and the BPRS has a reputation as a company that highly upholds business ethics;<br>c. BPRS products and services have a simple schema and are easy for customers to understand;<br>d. There is no negative news regarding the BPRS; and<br>e. The frequency of customer complaints is very minimal and very immaterial.
2 (Low)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Reputation risk are classified as low over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Low Risk level include:<br>a. There are reputation events with low frequency and no impact on the BPRS reputation;<br>b. Violations or potential violations of business ethics are minimal and the BPRS has a reputation as a company that upholds business ethics;<br>c. BPRS products and services are complex so they require special customer understanding and the BPRS provides clear and complete information regarding the products and services;<br>d. The frequency of negative news about the BPRS is minimal, the negative news is immaterial, and the scope of the news is relatively small relative to the scale of the BPRS; and<br>e. The frequency of customer complaints is minimal and immaterial.
3 (Medium)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Reputation risk are classified as medium over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Medium Risk level include:<br>a. There are reputation events, with a fairly large impact scale but still controllable;<br>b. Violations or potential violations of business ethics occur with a fairly significant impact scale and require attention;<br>c. BPRS products and services are fairly complex so they require special customer understanding to a certain extent but the BPRS has not fully provided clear and complete information regarding the products and services;<br>d. The frequency of negative news about the BPRS is fairly high, the negative news is fairly material, and the scope of the news is fairly wide relative to the scale of the BPRS; and<br>e. The frequency of customer complaints is fairly high and fairly material.
4 (High)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Reputation risk are classified as high over a certain period in the future.<br><br>Examples of BPRS characteristics included in the High Risk level include:<br>a. There are reputation events, with a material impact scale and requiring special attention;<br>b. Violations or potential violations of business ethics occur with a material impact scale and require special attention;<br>c. BPRS products and services are complex so they require special customer understanding but the BPRS does not fully provide clear and complete information regarding the products and services;<br>d. The frequency of negative news about the BPRS is high, the negative news is material, and the scope of the news is relatively large relative to the scale of the BPRS; and<br>e. The frequency of customer complaints is high and material.
5 (Very High)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Reputation risk are classified as very high over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Very High Risk level include:<br>a. There are reputation events with a very material impact scale and requiring immediate follow-up;<br>b. Violations or potential violations of business ethics occur with a very material impact scale and requiring immediate follow-up;<br>c. BPRS products and services are very complex and require special customer understanding, and the BPRS provides incorrect information regarding the products and services;<br>d. The frequency of negative news about the BPRS is very high, the negative news is very material, and the scope of the news is relatively very large relative to the scale of the BPRS; and<br>e. The frequency of customer complaints is very high and very material.

INHERENT RISK LEVEL DETERMINATION MATRIX FOR STRATEGIC RISK

Risk Level	Definition of Risk Level
Very Low	Strategic risk is classified as very low over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Very Low Risk level include:<br>a. External and internal factors have been considered in the business plan formulation, and the BPRS business plan is aligned with the BPRS vision and mission;<br>b. BPRS strategy is classified as conservative or low risk;<br>c. The BPRS continues existing strategies with a high level of strategy success; and<br>d. Achievement of the BPRS business plan is very good.
2 (Low)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Strategic risk are classified as low over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Low Risk level include:<br>a. External and internal factors have been considered in the business plan formulation, but the BPRS business plan is not fully aligned with the BPRS vision and mission;<br>b. BPRS strategy is low risk but has an increasing trend;<br>c. The BPRS continues existing strategies or has some new strategies but is still within the main business and BPRS competence; and<br>d. Achievement of the BPRS business plan is good.
3 (Medium)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Strategic risk are classified as medium over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Medium Risk level include:<br>a. External and internal factors are not fully considered in the business plan formulation, and the BPRS business plan is not fully aligned with the BPRS vision and mission but does not cause significant impact;<br>b. BPRS strategy is medium risk;<br>c. The level of BPRS strategy success is classified as medium because there are threats from competitors; and<br>d. Achievement of the BPRS business plan is fairly good.
4 (High)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Strategic risk are classified as high over a certain period in the future.<br><br>Examples of BPRS characteristics included in the High Risk level include:<br>a. External and internal factors are not fully considered in the business plan formulation, and the BPRS business plan is not fully aligned with the BPRS vision and mission and causes fairly significant impact;<br>b. BPRS strategy is classified as medium risk but has an increasing trend;<br>c. Implementing strategies to enter new businesses or markets with an uncertain level of success; and<br>d. Achievement of the BPRS business plan is less good.
5 (Very High)	Considering the business activities conducted by the BPRS, the potential losses faced by the BPRS from Strategic risk are classified as very high over a certain period in the future.<br><br>Examples of BPRS characteristics included in the Very High Risk level include:<br>a. External and internal factors are not considered in the business plan formulation and the BPRS business plan is not fully aligned with the BPRS vision and mission and causes very significant impact;<br>b. BPRS strategy is classified as high risk;<br>c. The majority of BPRS strategies shift to new areas that are not the main business and BPRS competence; and<br>d. Achievement of the BPRS business plan is not good.

RISK MANAGEMENT IMPLEMENTATION QUALITY ASSESSMENT MATRIX FOR CREDIT RISK

Risk Management Implementation Quality Level (KPMR)	Definition of Risk Management Implementation Quality Level (KPMR)
Very Adequate	Credit Risk Management Implementation is very adequate. Although there are minor weaknesses, they are not significant and can be ignored.

Examples of BPRS characteristics included in the "Very Adequate" KPMR level include:

The Board of Directors and Board of Commissioners have very good awareness and understanding of Credit Risk Management.
The Credit Risk Management culture is very strong and has been internalized very well at all organizational levels.
The execution of duties by the Board of Directors, Board of Commissioners, and Sharia Supervisory Board (DPS) as a whole is very adequate.
The Credit Risk Management function is independent, has clear duties and responsibilities, and has operated very well.
Human resources are very adequate, both in terms of quantity and competence in the Credit Risk Management function.
Delegation of authority is controlled and monitored regularly and has operated very well.
Credit risk strategy is very good and very aligned with the level of risk to be taken and credit risk tolerance.
Risk Management policies and procedures and the setting of credit risk limits are very adequate and available for all areas of Credit Risk Management, aligned with implementation, and understood very well by employees.
The formulation of the level of risk to be taken and risk tolerance is very adequate and has aligned with the strategic objectives and overall BPRS business strategy.
The Credit Risk Management process is very adequate in identifying, measuring, monitoring, and controlling credit risk.
The fund disbursement process in general is very adequate, starting from financing applications to the handling of non-performing assets. There is a dual control function in the financing process that is independent and operates well.
The Credit Risk Management information system is very good, producing comprehensive and integrated credit risk reporting to the Board of Directors and Board of Commissioners.
The internal control system is very effective in supporting the implementation of Credit Risk Management.
The implementation of Risk Management is reviewed by a function performing independent review, and the results of said review have been submitted to the Board of Directors and Board of Commissioners.

Risk Management Implementation Quality Level (KPMR)	Definition of Risk Management Implementation Quality Level (KPMR)
Adequate	Credit Risk Management Implementation is adequate. Although there are several minor weaknesses, they can be resolved in normal business activities.

Examples of BPRS characteristics included in the "Adequate" KPMR level include:

The Board of Directors and Board of Commissioners have good awareness and understanding of Credit Risk Management.
The Credit Risk Management culture is strong and has been internalized well at all organizational levels.
The execution of duties by the Board of Directors, Board of Commissioners, and DPS as a whole is adequate. There are some weaknesses that are not significant and can be repaired immediately.
The Credit Risk Management function is independent, has clear duties and responsibilities, and has operated well. There are minor weaknesses, but they can be resolved in normal business activities.
Human resources are adequate, both in terms of quantity and competence in the Credit Risk Management function.
Delegation of authority is controlled and monitored regularly and has operated well.
Credit risk strategy is good and aligned with the level of risk to be taken and credit risk tolerance.
Risk Management policies and procedures and the setting of credit risk limits are adequate and available for all areas of Credit Risk Management, aligned with implementation, and understood well by employees.
The formulation of the level of risk to be taken and risk tolerance is adequate and has aligned with the strategic objectives.
The Credit Risk Management process is adequate in identifying, measuring, monitoring, and controlling credit risk.
The fund disbursement process in general is adequate, starting from financing applications to the handling of non-performing assets. The dual control function in the financing process operates independently. There are minor weaknesses in one or more aspects of fund disbursement that can be easily repaired and do not disrupt the process as a whole.
The Credit Risk Management information system is good, including credit risk reporting to the Board of Directors and Board of Commissioners. There are minor weaknesses that can be easily repaired.
The internal control system is effective in supporting the implementation of Credit Risk Management.

Risk Management Implementation Quality Level (KPMR)	Definition of Risk Management Implementation Quality Level (KPMR)
Fairly Adequate	Credit Risk Management Implementation is fairly adequate. Although minimum requirements are met, there are several weaknesses.

Examples of BPRS characteristics included in the "Fairly Adequate" KPMR level include:

The Board of Directors and Board of Commissioners have fairly good awareness and understanding of Credit Risk Management.
The Credit Risk Management culture is fairly strong and has been internalized fairly well but is not always implemented consistently.
The execution of duties by the Board of Directors, Board of Commissioners, and DPS as a whole is fairly adequate. There are some weaknesses in some assessment aspects that need attention.
The Credit Risk Management function has operated fairly well, but there are some fairly significant weaknesses that need to be resolved immediately.
Human resources are fairly adequate, both in terms of quantity and competence in the Credit Risk Management function.
Delegation of authority is fairly good, but control and monitoring are not always implemented well.
Credit risk strategy is fairly good and fairly aligned with the level of risk to be taken and credit risk tolerance.
Risk Management policies and procedures and the setting of credit risk limits are fairly adequate but not always consistent with implementation and/or not understood well by employees.
The formulation of the level of risk to be taken and risk tolerance is fairly adequate but not always aligned with strategic objectives and overall BPRS business strategy.
The Credit Risk Management process is fairly adequate in identifying, measuring, monitoring, and controlling credit risk.
The fund disbursement process and dual control function are fairly good. There are weaknesses in one or more aspects of fund disbursement that need attention.
The Credit Risk Management information system meets minimum expectations but there are some weaknesses, including credit risk reporting to the Board of Directors and Board of Commissioners, which require attention.
The internal control system is fairly effective in supporting the implementation of Credit Risk Management.

Risk Management Implementation Quality Level (KPMR)	Definition of Risk Management Implementation Quality Level (KPMR)
Inadequate	Credit Risk Management Implementation is inadequate. There are significant weaknesses in various aspects of Credit Risk Management that require immediate corrective action.

Examples of BPRS characteristics included in the "Inadequate" KPMR level include:

The awareness and understanding of the Board of Directors and Board of Commissioners regarding Credit Risk Management is weak.
The Credit Risk Management culture is not strong and has not been internalized at every work unit level.
The execution of duties by the Board of Directors, Board of Commissioners, and DPS as a whole is inadequate and there are weaknesses in some assessment aspects that need to be repaired immediately.
Significant weaknesses in the Credit Risk Management function that need to be repaired immediately.
Human resources are inadequate, both in terms of quantity and competence in the Credit Risk Management function.
Delegation of authority is weak, not controlled, and not monitored well.
Credit risk strategy is not good and not aligned with the level of risk to be taken and credit risk tolerance.
Significant weaknesses in Risk Management policies and procedures and the setting of credit risk limits.
The formulation of the level of risk to be taken and risk tolerance is inadequate and not aligned with strategic objectives and overall BPRS business strategy.
The Credit Risk Management process is inadequate in identifying, measuring, monitoring, and controlling credit risk.
The fund disbursement process and dual control function are not good. There are some weaknesses that need to be repaired immediately.
Significant weaknesses in the Credit Risk Management information system, including credit risk reporting to the Board of Directors and Board of Commissioners, which need to be repaired immediately.
The internal control system is not effective in supporting the implementation of Credit Risk Management.

Risk Management Implementation Quality Level (KPMR)	Definition of Risk Management Implementation Quality Level (KPMR)
Very Inadequate	Credit Risk Management Implementation is very inadequate. There are significant weaknesses in various aspects of Credit Risk Management, and the resolution of these weaknesses is beyond the capability of the BPRS.

Examples of BPRS characteristics included in the "Very Inadequate" KPMR level include:

The awareness and understanding of the Board of Directors and Board of Commissioners regarding Credit Risk Management is very weak.
The Credit Risk Management culture is not strong and is not internalized at every organizational level.
The execution of duties by the Board of Directors, Board of Commissioners, and DPS as a whole is not adequate. There are significant weaknesses in almost all assessment aspects, and the resolution of these weaknesses is beyond the capability of the BPRS.
Very significant weaknesses in the Credit Risk Management function that need to be repaired immediately.
Human resources are not adequate, both in terms of quantity and competence in the Credit Risk Management function.
Delegation of authority is very weak, not controlled, and not monitored well.
Credit risk strategy is not good and not aligned with the level of risk to be taken and credit risk tolerance.
Very significant weaknesses in Risk Management policies and procedures and the setting of credit risk limits.
The formulation of the level of risk to be taken and risk tolerance is not adequate and not aligned with strategic objectives and overall BPRS business strategy.
The Credit Risk Management process is not adequate in identifying, measuring, monitoring, and controlling credit risk.
The fund disbursement process and dual control function are not good. There are some weaknesses that need to be repaired immediately.
Very significant weaknesses in the Credit Risk Management information system, including credit risk reporting to the Board of Directors and Board of Commissioners, which need to be repaired immediately.
The internal control system is not effective in supporting the implementation of Credit Risk Management.

RISK MANAGEMENT IMPLEMENTATION QUALITY ASSESSMENT MATRIX FOR OPERATIONAL RISK

Risk Management Implementation Quality Level (KPMR)	Definition of Risk Management Implementation Quality Level (KPMR)
Very Adequate	Operational Risk Management Implementation is very adequate. Although there are minor weaknesses, they are not significant and can be ignored.

Examples of BPRS characteristics included in the "Very Adequate" risk level include:

The Board of Directors and Board of Commissioners have very good awareness and understanding of Operational Risk Management.
The Operational Risk Management culture is very strong and has been internalized very well at all organizational levels.
The execution of duties by the Board of Directors, Board of Commissioners, and DPS as a whole is very adequate.
The Operational Risk Management function is independent, has clear duties and responsibilities, and has operated very well.
Human resources are very adequate, both in terms of quantity and competence in the Operational Risk Management function.
Delegation of authority is controlled and monitored regularly and has operated very well.
Operational risk strategy is very good and very aligned with the level of risk to be taken and operational risk tolerance.
Risk Management policies and procedures and the setting of operational risk limits are very adequate and available for all areas of Operational Risk Management, aligned with implementation, and understood very well by employees.
The formulation of the level of risk to be taken and risk tolerance is very adequate and has aligned with the strategic objectives and overall BPRS business strategy.
The Operational Risk Management process is very adequate in identifying, measuring, monitoring, and controlling operational risk.
Business Continuity Management (BCM) is very reliable and very well-tested.
The Operational Risk Management information system is very good, producing comprehensive and integrated operational risk reporting to the Board of Directors and Board of Commissioners.
The internal control system is very effective in supporting the implementation of Operational Risk Management.
The implementation of Risk Management is reviewed by a function performing independent review, and the results of said review have been submitted to the Board of Directors and Board of Commissioners.

Risk Management Implementation Quality Level (KPMR)	Definition of Risk Management Implementation Quality Level (KPMR)
Adequate	Operational Risk Management Implementation is adequate. There are several minor weaknesses that can be resolved in normal business activities.

Examples of BPRS characteristics included in the "Adequate" KPMR level include:

The Board of Directors and Board of Commissioners have good awareness and understanding of Operational Risk Management.
The Operational Risk Management culture is strong and has been internalized well at all organizational levels.
The execution of duties by the Board of Directors, Board of Commissioners, and DPS as a whole is adequate. There are some weaknesses but they are not significant and can be repaired immediately.
The Operational Risk Management function is independent, has clear duties and responsibilities, and has operated well. There are minor weaknesses, but they can be resolved in normal business activities.
Human resources are adequate, both in terms of quantity and competence in the Operational Risk Management function.
Delegation of authority is controlled and monitored regularly and has operated well.
Operational risk strategy is good and aligned with the level of risk to be taken and operational risk tolerance.
Risk Management policies and procedures and the setting of operational risk limits are adequate and available for all areas of Operational Risk Management, aligned with implementation, and understood well by employees, although there are minor weaknesses.
The formulation of the level of risk to be taken and risk tolerance is adequate and has aligned with strategic objectives.
The Operational Risk Management process is adequate in identifying, measuring, monitoring, and controlling operational risk.
Business Continuity Management (BCM) is reliable and well-tested.
The Operational Risk Management information system is good, including operational risk reporting to the Board of Directors and Board of Commissioners. There are minor weaknesses that can be easily repaired.
The internal control system is effective in supporting the implementation of Operational Risk Management.

Risk Management Implementation Quality Level (KPMR)	Definition of Risk Management Implementation Quality Level (KPMR)
Fairly Adequate	Operational Risk Management Implementation is fairly adequate. Although minimum requirements are met, there are several weaknesses.

Examples of BPRS characteristics included in the "Fairly Adequate" KPMR level include:

The Board of Directors and Board of Commissioners have fairly good awareness and understanding of Operational Risk Management.
The Operational Risk Management culture is fairly strong and has been internalized fairly well but is not always implemented consistently.
The execution of duties by the Board of Directors, Board of Commissioners, and DPS as a whole is fairly adequate and there are some weaknesses that need to be repaired immediately.
The Operational Risk Management function has operated fairly well, but there are some weaknesses that need management attention.
Human resources are fairly adequate in terms of quantity and competence in the Operational Risk Management function.
Delegation of authority is fairly good, but control and monitoring are not always implemented well.
Operational risk strategy is fairly good and fairly aligned with the level of risk to be taken and operational risk tolerance.
Risk Management policies and procedures and the setting of operational risk limits are fairly adequate but less consistent with implementation and/or not understood well by employees.
The formulation of the level of risk to be taken and risk tolerance is fairly adequate but not always aligned with strategic objectives and overall BPRS business strategy.
The Operational Risk Management process is fairly adequate in identifying, measuring, monitoring, and controlling operational risk.
Business Continuity Management (BCM) is fairly reliable and fairly well-tested.
The Risk Management Information System meets minimum expectations but there are some weaknesses, including operational risk reporting to the Board of Directors and Board of Commissioners, which require attention.
The internal control system is fairly effective in supporting the implementation of Operational Risk Management.

Risk Management Implementation Quality Level (KPMR)	Definition of Risk Management Implementation Quality Level (KPMR)
Inadequate	Operational Risk Management Implementation is inadequate. There are significant weaknesses in various aspects of Operational Risk Management that require immediate corrective action.

Examples of BPRS characteristics included in the "Inadequate" KPMR level include:

The Board of Directors and Board of Commissioners have weak awareness and understanding of Operational Risk Management.
The Operational Risk Management culture is not strong and has not been internalized at every work unit level.
The execution of duties by the Board of Directors, Board of Commissioners, and DPS as a whole is inadequate and there are fairly significant weaknesses in some assessment aspects that need to be repaired immediately.
Significant weaknesses in the Operational Risk Management function that need to be repaired immediately.
Human resources are inadequate in terms of quantity and competence in the Operational Risk Management function.
Delegation of authority is weak, not controlled, and not monitored well.
Operational risk strategy is not good and not aligned with the level of risk to be taken and operational risk tolerance.
Significant weaknesses in Risk Management policies and procedures and the setting of operational risk limits.
The formulation of the level of risk to be taken and risk tolerance is inadequate and not aligned with strategic objectives and overall BPRS business strategy.
The Operational Risk Management process is inadequate in identifying, measuring, monitoring, and controlling operational risk.
Business Continuity Management (BCM) is not reliable and not well-tested.
Significant weaknesses in the Operational Risk Management information system, including reporting to the Board of Directors and Board of Commissioners, which require immediate repair.
The internal control system is not effective in supporting the implementation of Operational Risk Management.

Risk Management Implementation Quality Level (KPMR)	Definition of Risk Management Implementation Quality Level (KPMR)
Very Inadequate	Operational Risk Management Implementation is very inadequate. There are significant weaknesses in various aspects of Operational Risk Management, and the resolution of these weaknesses is beyond the capability of the BPRS.

Examples of BPRS characteristics included in the "Very Inadequate" KPMR level include:

The Board of Directors and Board of Commissioners have very weak awareness and understanding of Operational Risk Management.
The Operational Risk Management culture is not strong and is not internalized at every organizational level.
The execution of duties by the Board of Directors, Board of Commissioners, and DPS is not adequate and there are significant weaknesses in almost all assessment aspects, and the resolution of these weaknesses is beyond the capability of the BPRS.
Very significant weaknesses in the Operational Risk Management function that need to be repaired immediately.
Human resources are not adequate in terms of quantity and competence in the Operational Risk Management function.
Delegation of authority is very weak, not controlled, and not monitored well.
Operational risk strategy is not good and not aligned with the level of risk to be taken and operational risk tolerance.
Very significant weaknesses in Risk Management policies and procedures and the setting of operational risk limits.
The formulation of the level of risk to be taken and risk tolerance is not adequate and not aligned with strategic objectives and overall BPRS business strategy.
The Operational Risk Management process is not adequate in identifying, measuring, monitoring, and controlling operational risk.
Business Continuity Management (BCM) is not reliable and not well-tested.
Very significant weaknesses in the Operational Risk Management information system, including operational risk reporting to the Board of Directors and Board of Commissioners, which need to be repaired immediately.
The internal control system is not effective in supporting the implementation of Operational Risk Management.

Implementation of Risk Management for Sharia Rural Financing Banks

Assessment

Compliance Risk Management

7. Has the BPRS established sufficient organization to handle the compliance function and Compliance Risk Management function?

8. Has the Board of Directors implemented Human Resources management policies in the implementation of Compliance Risk Management?

9. Has the Board of Directors formulated internal policies supporting the execution of the compliance function, paying attention to statutory regulations, internal BPRS regulations, and Sharia Principles, and are there reward and punishment policies for internal BPRS personnel?

10. Does the BPRS have adequate Compliance Risk Management policies formulated considering vision, mission, business scale, and business complexity, as well as HR sufficiency?

11. Does the BPRS:

13. Has the BPRS executed the Compliance Risk Management process embedded in BPRS business activities?

14. Does the BPRS have an information system for Compliance Risk Management that supports the Board of Directors in decision-making regarding Compliance Risk and has been reported to the Board of Directors periodically?

15. Has the Internal Audit Unit (SKAI) or Internal Audit Executive (PEAI) executed periodic audits on the implementation of Compliance Risk Management, submitted internal audit result reports, and ensured follow-up on inspection findings?

16. Has the internal control system regarding Compliance Risk been executed by all levels of the BPRS organization?

INHERENT RISK LEVEL DETERMINATION MATRIX FOR OPERATIONAL RISK

INHERENT RISK LEVEL DETERMINATION MATRIX FOR COMPLIANCE RISK

INHERENT RISK LEVEL DETERMINATION MATRIX FOR LIQUIDITY RISK

INHERENT RISK LEVEL DETERMINATION MATRIX FOR REPUTATION RISK

INHERENT RISK LEVEL DETERMINATION MATRIX FOR STRATEGIC RISK

RISK MANAGEMENT IMPLEMENTATION QUALITY ASSESSMENT MATRIX FOR CREDIT RISK

RISK MANAGEMENT IMPLEMENTATION QUALITY ASSESSMENT MATRIX FOR OPERATIONAL RISK

Lineage: In force

Similar documents from other regulators