To:
The Board of Directors of Rural Banks at their place.

COPY
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 1 /SEOJK.03/2019 CONCERNING THE IMPLEMENTATION OF RISK MANAGEMENT FOR RURAL BANKS

In connection with the establishment of the Financial Services Authority Regulation Number 13/POJK.03/2015 concerning the Implementation of Risk Management for Rural Banks (State Gazette of the Republic of Indonesia Year 2015 Number 272, Supplement to the State Gazette of the Republic of Indonesia Number 5761), which is hereinafter abbreviated as POJK MR BPR, it is necessary to regulate the implementation of the aforementioned Financial Services Authority Regulation in this Financial Services Authority Circular as follows:

I. GENERAL PROVISIONS

This Financial Services Authority Circular aims to provide standards for the implementation of Risk Management for Rural Banks (BPR) as a minimum reference in the implementation of Risk Management, including the formulation of policies and guidelines for the implementation of Risk Management for BPR, while still referring to POJK MR BPR.
In the event that a BPR already has policies and guidelines for the implementation of Risk Management but they are not yet in accordance with the standards for the implementation of Risk Management, the BPR must adjust its policies and guidelines for the implementation of Risk Management to the standards for the implementation of Risk Management for BPR as referred to in Appendix I which forms an integral part of this Financial Services Authority Circular.
Policies and guidelines for the Implementation of Risk Management can be developed by BPR adjusted to the complexity of the business, the development of conditions and potential problems faced, while still referring to the standards for the implementation of Risk Management as stated in Appendix I which forms an integral part of this Financial Services Authority Circular.

II. IMPLEMENTATION OF RISK MANAGEMENT

Standard guidelines for the implementation of Risk Management for BPR function to ensure that all Risks faced by BPR are identified, measured, monitored, and controlled appropriately.
BPR's Risk Management implementation guidelines must at least cover:
a. General Risk Management implementation covers at least 4 (four) pillars as follows:
1. Supervision by the Board of Directors and Board of Commissioners;
2. Adequacy of policies, procedures, and limits;
3. Adequacy of processes and systems; and
4. Comprehensive internal control system.
  b. Risk Management implementation for each type of Risk, including the implementation of Risk Management for all types of Risk, namely Credit Risk, Operational Risk, Compliance Risk, Liquidity Risk, Reputation Risk, and Strategic Risk, while still referring to the types of Risk that must be managed by each BPR based on core capital, total assets, office network, and business activities carried out by the BPR.
  c. Assessment of Risk Management implementation in the form of a Risk Profile assessment which includes an assessment of Inherent Risk and an assessment of the quality of Risk Management implementation which reflects the BPR's Risk control system.
In order to implement effective Risk Management, BPR must take preparation, development, and/or improvement steps which at least include the following:
a. conducting diagnosis and analysis regarding the organization, policies, procedures, limits, and guidelines as well as the development of systems related to the implementation of Risk Management; b. formulating an improvement plan according to the reference in the standard guidelines for the implementation of Risk Management for BPR in case there is still a mismatch between the BPR's internal guidelines and the standard guidelines for the implementation of Risk Management for BPR;
c. socializing the guidelines for the implementation of Risk Management to employees so that they understand Risk Management practices, and developing a Risk culture (risk culture) among all employees at every level of the BPR organization; and
d. ensuring that the Internal Audit Working Unit or officials responsible for carrying out the internal audit function participate in monitoring the process of formulating guidelines for the implementation of Risk Management and the implementation of said Risk Management.

III. STAGES OF RISK MANAGEMENT IMPLEMENTATION

According to Article 3 of POJK MR BPR, the obligation to implement Risk Management is regulated based on BPR classification considering core capital, total assets, office network, and business activities carried out by the BPR. Referring to Article 22 of POJK MR BPR regarding the obligation to submit the first Risk Profile report, the stages of Risk Management implementation for each BPR classification are as follows:

BPRs having core capital of at least Rp50,000,000,000.00 (fifty billion rupiah) are required to implement Risk Management for all types of Risk, namely Credit Risk, Operational Risk, Compliance Risk, Liquidity Risk, Reputation Risk, and Strategic Risk, with implementation stages as follows:
a. implementing at least 3 (three) Risks, namely Credit Risk, Operational Risk, and Compliance Risk no later than the second semester of 2018; and b. implementing 6 (six) Risks, namely Credit Risk, Operational Risk, Compliance Risk, Liquidity Risk, Reputation Risk, and Strategic Risk no later than the second semester of 2020.
BPRs having core capital of at least Rp15,000,000,000.00 (fifteen billion rupiah) and less than Rp50,000,000,000.00 (fifty billion rupiah) are required to implement Risk Management at least for Credit Risk, Operational Risk, Compliance Risk, and Liquidity Risk, with implementation stages as follows:
a. implementing at least 2 (two) Risks, namely Credit Risk and Operational Risk no later than the second semester of 2019; and b. implementing at least 4 (four) Risks, namely Credit Risk, Operational Risk, Compliance Risk, and Liquidity Risk no later than the second semester of 2021.
BPRs having core capital of less than Rp15,000,000,000.00 (fifteen billion rupiah) are required to implement Risk Management at least for Credit Risk, Operational Risk, and Compliance Risk, with implementation stages as follows:
a. implementing at least 1 (one) Risk, namely Credit Risk no later than the second semester of 2019; and b. implementing at least 3 (three) Risks, namely Credit Risk, Operational Risk, and Compliance Risk no later than the second semester of 2021.
BPRs having core capital of at least Rp50,000,000,000.00 (fifty billion rupiah) but having total assets of less than Rp300,000,000,000.00 (three hundred billion rupiah) and meeting the conditions:
a. having less than 10 (ten) branch offices; and b. not carrying out activities as issuers of Automated Teller Machine cards or debit cards, are required to implement Risk Management at least for Credit Risk, Operational Risk, Compliance Risk, and Liquidity Risk, with implementation stages as follows:
a. implementing at least 2 (two) Risks, namely Credit Risk and Operational Risk no later than the second semester of 2019; and b. implementing at least 4 (four) Risks, namely Credit Risk, Operational Risk, Compliance Risk, and Liquidity Risk no later than the second semester of 2021.
BPRs having core capital of less than Rp50,000,000,000.00 (fifty billion rupiah) but having total assets of at least Rp300,000,000,000.00 (three hundred billion rupiah) and meeting the conditions:
a. having at least 10 (ten) branch offices; and/or b. carrying out activities as issuers of Automated Teller Machine cards or debit cards, are required to implement Risk Management for all types of Risk, namely Credit Risk, Operational Risk, Compliance Risk, Liquidity Risk, Reputation Risk, and Strategic Risk, with implementation stages as follows:
a. implementing at least 3 (three) Risks, namely Credit Risk, Operational Risk, and Compliance Risk no later than the second semester of 2018; and b. implementing 6 (six) Risks, namely Credit Risk, Operational Risk, Compliance Risk, Liquidity Risk, Reputation Risk, and Strategic Risk no later than the second semester of 2020.

IV. REPORTING

Risk Profile Report
a. According to Article 22 paragraph (1) of POJK MR BPR, BPRs are required to submit a Risk Profile report every semester to the Financial Services Authority. The Risk Profile report contains an assessment of the implementation of Risk Management for the types of Risk as referred to in Section III which consists of:
1. Inherent Risk Assessment
  a) What is meant by Inherent Risk is Risk inherent in the BPR's business activities, both those that can be quantified and those that cannot be quantified, which have a significant impact on the financial condition of the BPR. b) Inherent Risk is determined by internal and external factors. Internal factors that can affect Inherent Risk include human resource competence and adequacy of information technology used. Meanwhile, external factors that can affect Inherent Risk include government regulations and natural conditions. c) Assessment of Inherent Risk is conducted by paying attention to parameters that are quantitative as well as qualitative. Quantitative parameters consist of ratios, such as Non-Performing Loan ratio or the comparison between total non-performing loans to total credit granted and Loan to Deposit ratio or the comparison between total credit granted to total funds from third parties other than banks. Qualitative parameters include diversity of BPR products/services and credibility of parties associated with the BPR. The aforementioned parameters or indicators can be given indicative ratings as contained in Appendix II which forms an integral part of this Financial Services Authority Circular, to help determine the level of Inherent Risk. d) In conducting Inherent Risk assessment, the assessment is conducted against Risks inherent in an activity, without considering the control functions established by the BPR for each type of Risk. e) Determination of the level of Inherent Risk for each type of Risk is conducted based on comprehensive analysis of all parameters and pillars, including considering the significance of interconnection between parameters and between pillars. f) Determination of the level of Inherent Risk for each type of Risk is categorized into:
  (1) Rating 1 (very low);
  (2) Rating 2 (low);
  (3) Rating 3 (medium);
  (4) Rating 4 (high); and
  (5) Rating 5 (very high).
2. Quality of Risk Management Implementation Assessment
  a) What is meant by Quality of Risk Management Implementation (KPMR) is the adequacy of the Risk control system covering all pillars of Risk Management implementation, referring to Appendix I which forms an integral part of this Financial Services Authority Circular. b) BPR's Risk Management implementation varies greatly according to characteristics, complexity, and the level of Risk to be taken and tolerated by the BPR. c) Assessment of KPMR is conducted by paying attention to parameters or indicators that are qualitative. Some examples of KPMR parameters or indicators in BPRs are approval by the Board of Commissioners of Credit Risk Management policies formulated by the Board of Directors and periodic evaluation of said policies. d) Parameter rating determination is conducted through comprehensive analysis of assessment parameters by paying attention to the interconnection between one assessment parameter and another parameter. e) Determination of the KPMR level for each type of Risk is categorized into:
  (1) Rating 1 (very adequate);
  (2) Rating 2 (adequate);
  (3) Rating 3 (fairly adequate);
  (4) Rating 4 (less adequate); and
  (5) Rating 5 (inadequate).
3. Determination of Risk Level for Each Type of Risk
  Based on the assessment of Inherent Risk and KPMR for each type of Risk, the Risk level is subsequently determined. Risk Level is Risk inherent in BPR activities after calculating KPMR. The Risk Level can be determined based on the Risk Level determination matrix referring to Appendix II which forms an integral part of this Financial Services Authority Circular.
4. Risk Rating Determination
  a) Based on the determination of the Risk Level for each type of Risk, the Risk Rating is determined by paying attention to the significance and materiality of each type of Risk to the overall Risk Profile. b) Risk Rating determination consists of 5 (five) ratings, namely:
  (1) Rating 1 (very low);
  (2) Rating 2 (low);
  (3) Rating 3 (medium);
  (4) Rating 4 (high); and
  (5) Rating 5 (very high).
  Risk Rating determination refers to guidelines as in Appendix II which forms an integral part of this Financial Services Authority Circular. c) In considering the significance and materiality of Risk to the BPR's overall Risk Profile, generally Credit Risk, Operational Risk, and Compliance Risk determine the result of the BPR's Risk Profile assessment. However, as a reference to test the significance and materiality of a Risk, including Risks other than these 3 (three) Risks, to the BPR's Risk Profile, the following must be considered:
  (1) exposure or volume of Risk and significance to the BPR's overall Risk Profile; and (2) impact of problems caused by said Risk on the financial condition of the BPR. b. Risk Rating determination is conducted by paying attention to the significance and materiality of the Risk Level of each type of Risk to the overall Risk Profile, paying attention to general principles as follows:
5. Risk-Oriented
  Assessment of BPR's Risk Management implementation is based on BPR's Risk and the impact caused on BPR's overall performance. This is done by identifying internal and external factors that can increase Risk or affect BPR's financial performance currently and in the future. Thus, BPR is expected to be able to detect the root causes of BPR's problems earlier and take preventive and corrective measures effectively and efficiently.
6. Proportionality
  The use of parameters or indicators in each pillar of BPR's Risk Management implementation assessment is conducted by paying attention to the characteristics and complexity of the BPR's business. Parameters or indicators for assessing Risk Management implementation in this Financial Services Authority Circular are minimum standards that must be used in assessing Risk Management implementation. In addition, BPRs can use additional parameters or indicators according to the characteristics and complexity of the business in assessing Risk Management implementation so that it can reflect the BPR's condition better.
7. Significance and Materiality
  Assessment of BPR's Risk Management implementation needs to pay attention to the significance and materiality of each pillar and parameters or indicators for assessment in each type of Risk in concluding assessment results and determining Risk Ratings. Determination of significance and materiality is based on analysis supported by adequate data and information regarding Risk and BPR's financial condition.
8. Comprehensive and Structured
  The assessment process is conducted thoroughly and systematically and focused on the main problems of the BPR. Analysis is conducted integratively, i.e., by considering the interconnection between Risks. Analysis must be supported by key facts and relevant ratios to show the problems faced by the BPR.
  c. The Risk Profile report submitted by the BPR contains the same material as the Risk Profile report submitted by the Risk Management Working Unit or the Executive Official designated responsible for implementing Risk Management to the members of the Board of Directors who oversee the Risk Management function and to the Risk Management Committee if there is one.
  d. According to Article 27 of POJK MR BPR, the Financial Services Authority conducts an assessment of Risk Management implementation in BPRs. In the event there is a difference between the result of the Risk Management implementation assessment of the BPR conducted by the Financial Services Authority and the result of the Risk Management implementation assessment by the BPR, the result of the Risk Management implementation assessment of the BPR conducted by the Financial Services Authority shall prevail. e. In the event that based on the assessment results there are matters that need to be reviewed and followed up by the BPR, the BPR submits the review results and immediate action plans immediately after the assessment is conducted. f. The procedure for assessing Risk Management implementation refers to Appendix II which forms an integral part of this Financial Services Authority Circular.
New Products and Activities Report
According to Article 23 paragraph (1) of POJK MR BPR, BPRs are required to submit a new products and activities report to the Financial Services Authority, consisting of reports on the plan for issuing products and carrying out new activities as well as reports on the realization of product issuance and carrying out new activities. Coverage, format, and submission methods refer to the Financial Services Authority Regulation regarding business activities and office network areas of rural banks based on core capital.
Other Risk Profile Reports
a. According to Article 24 of POJK MR BPR, BPRs are required to submit other Risk Profile reports to the Financial Services Authority in the event of conditions that have the potential to cause significant losses to the financial condition of the BPR. b. Other Risk Profile reports are submitted no later than 1 (one) month after the condition potentially causing significant losses to the financial condition of the BPR is known or based on a request from the Financial Services Authority.
c. Other Risk Profile reports are incidental reports submitted to the Financial Services Authority based on the current conditions of the BPR having certain exposures and the Financial Services Authority's assessment results of the BPR. Reports are submitted in the event of conditions including:
1. The BPR has been placed by the Financial Services Authority in intensive supervision status or special supervision status.
  Example: BPR A has core capital of Rp7,000,000,000.00 (seven billion rupiah), placed under intensive supervision due to liquidity factors on March 1, 2020. With said conditions, BPR A is required to submit a Liquidity Risk Profile report no later than 1 (one) month after March 1, 2020, namely April 1, 2020.
2. The BPR has Risk exposure other than the types of Risk required to be implemented based on Article 3 of POJK MR BPR.
  Example: BPR B has core capital of Rp18,000,000,000.00 (eighteen billion rupiah), there is Reputation Risk due to fraud committed by the Board of Directors of BPR and news related to said fraud is published in local media and there are customer complaints estimated to affect the reputation of the BPR. With said conditions, BPR B is required to submit a Reputation Risk Profile report no later than 1 (one) month after the potential Reputation Risk is known. BPR B became aware of the potential Reputation Risk on March 1, 2020. With said conditions, BPR B is required to submit a Reputation Risk Profile report no later than April 1, 2020.
Action Plan Realization Report
a. According to Article 21 of POJK MR BPR, BPRs are required to submit reports on the realization of action plans for Risk Management implementation as referred to in Article 20 of POJK MR BPR every semester to the Financial Services Authority. b. In the event there are no targets and/or action plan realizations in the reporting period, BPRs are still required to submit action plan realization reports as per Article 21 of POJK MR BPR.
BPRs submit reports as referred to in numbers 1 and 3 to the Financial Services Authority online via the Financial Services Authority reporting system. In the event the Financial Services Authority reporting system is not yet available, the reports as referred to in numbers 1 and 3 are submitted offline.
BPRs submit reports as referred to in number 4 to the Financial Services Authority offline.
Submission of reports offline as in numbers 5 and 6 in the form of printed results according to the format referring to Appendix III which forms an integral part of this Financial Services Authority Circular. The report is signed by the member of the Board of Directors who oversees the Risk Management function, and submitted to the Financial Services Authority. Offline submission is conducted by one of the following methods:
a. handed over directly to the Regional Office or Financial Services Authority Office covering the BPR's head office; or b. sent via post office or courier service.
BPRs are deemed to have submitted reports offline as referred to in numbers 5 and 6 evidenced by:
a. Receipt letter from the Financial Services Authority, if the report is handed over directly to the Regional Office or Local Financial Services Authority Office covering the BPR's head office as referred to in number 7 letter a; or b. Shipping receipt from the post office or courier service, if the report is sent via post office or courier service as referred to in number 7 letter b.

This copy is consistent with the original
Director of Law 1
Legal Department signed
Yuliana

V. CLOSING

Provisions in this Financial Services Authority Circular shall come into force on the date of determination.

Determined in Jakarta on January 21, 2019
EXECUTIVE HEAD OF BANKING SUPERVISOR
FINANCIAL SERVICES AUTHORITY, signed
HERU KRISTIYANA

APPENDIX I
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 1 /SEOJK.03/2019 CONCERNING THE IMPLEMENTATION OF RISK MANAGEMENT FOR RURAL BANKS

CHAPTER I
GENERAL GUIDELINES

As regulated in the Financial Services Authority Regulation Number 13/POJK.03/2015 concerning the Implementation of Risk Management for Rural Banks, Rural Banks (BPR) are required to implement Risk Management at least covering:

Supervision by the Board of Directors and Board of Commissioners.
Adequacy of policies, procedures, and limits, namely:
a. Risk Management policy; b. Risk Management procedures; and
c. Determination of Risk limits.
Adequacy of processes and systems, namely:
a. Risk identification, measurement, monitoring, and control processes; and b. Risk Management information system.
Comprehensive internal control system.

Risk Management Principles are described as follows:
A. Supervision by the Board of Directors and Board of Commissioners

The Board of Directors and Board of Commissioners are responsible for the effectiveness of Risk Management implementation in the BPR. Therefore, the Board of Directors and Board of Commissioners must understand the Risks faced by the BPR and provide clear direction, conduct active supervision and mitigation, and develop a Risk Management culture in the BPR. The Board of Directors and Board of Commissioners must also ensure adequate organizational structure, establish clear duties and responsibilities for each unit, and ensure the adequacy of quantity and quality of Human Resources (HR) to support effective Risk Management implementation.
a. Supervision by the Board of Directors
Authority and responsibility of the Board of Directors in the context of supervising BPR's Risk Management implementation at least include:
1. Formulating written policies and guidelines for Risk Management implementation
  Risk Management policy includes among others strategy

and the established Risk Management framework, including overall risk limits and per risk type according to the risk appetite and risk tolerance appropriate to the BPR's conditions, while also considering the impact of risks on capital adequacy. The Board of Directors must formulate written and comprehensive risk management policies and guidelines for each type of risk and provide clear direction regarding the level of risk to be taken and the BPR's risk tolerance. The formulation of policies and guidelines for implementing Risk Management must involve the work units or employees performing the BPR's operational functions and the Risk Management Work Unit (SKMR) or the Executive Officer responsible for implementing the Risk Management function, hereinafter referred to as PEMR.

Evaluating and deciding on transactions requiring Board of Directors approval
The Board of Directors evaluates transaction proposals received before granting approval. Transactions requiring Board of Directors approval include, among others, transactions that have exceeded the authority of the BPR official one level below the Board of Directors, in accordance with internal policies and procedures, including regarding the transaction approval mechanism and approval authority for each job level.
Developing a Risk Management culture at all organizational levels
The Board of Directors develops a Risk Management culture, including providing information to all employees and adequate communication regarding Risk Management principles, including developing a risk-aware culture and the importance of effective internal controls. The development of a Risk Management culture can also be done in the form of training for BPR employees regarding Risk Management according to each unit within the BPR.

A risk-aware culture consists of adequate awareness and understanding from every individual BPR employee, both those handling operational and non-operational functions, regarding the potential risks that may arise from all BPR activities. Furthermore, the implementation of a risk-aware culture aims to ensure that BPR employees understand their respective roles and responsibilities in implementing Risk Management.

Ensuring the improvement of human resources (HR) competence related to Risk Management
The Board of Directors ensures the adequacy of resource support to manage and control risks, including regarding the adequacy of the quantity and quality of HR. The improvement of HR competence can be realized, among others, through continuous education and training programs regarding the implementation of Risk Management. The Board of Directors must ensure that officials and staff placed in each unit within the BPR have an understanding of the risks inherent in each BPR product and/or activity, as well as the Risk Management policies formulated by the Board of Directors and approved by the Supervisory Board.
Ensuring that the Risk Management function operates independently
The Board of Directors ensures that the Risk Management function has been applied independently, reflected, among others, by the separation of functions between the SKMR or PEMR, which performs risk identification, measurement, monitoring, and control, and the work units or employees performing operational functions. The operational function refers to functions related to fund gathering and lending.
Responsible for:
a) Implementation of Risk Management policies
Including responsibility for the implementation of Risk Management policies are:

(1) Evaluating and providing direction based on reports submitted by the SKMR or PEMR.
(2) Submitting accountability reports to the Supervisory Board every 6 (six) months or more frequently depending on operational changes, the issuance of new products, and/or the implementation of new activities. (3) Ensuring that significant risk impacts have been followed up. Significant risks based on reports submitted by the SKMR or PEMR to the Board of Directors as referred to in item (1). Significant risks are risks that have the potential to cause losses that could disrupt BPR operations. (4) Effectively communicating Risk Management policies to all relevant organizational levels to ensure clear understanding. The Board of Directors must ensure that the communicated Risk Management policies can be understood and applied by all levels of the BPR organization. (5) Ensuring that work units or employees handling operational functions inform the SKMR or PEMR of the risk exposures inherent in their respective work units every 6 (six) months or more frequently depending on operational changes, the issuance of new products, and/or the implementation of new activities.

b) Overall risk exposures taken by the BPR
In establishing the overall risk exposures taken by the BPR, the Board of Directors must know the risks inherent in the units performing operational functions. Information regarding risks inherent in units performing operational functions is obtained based on reports submitted by the SKMR or PEMR as referred to in letter a) item (1). The establishment of risk exposures taken must be supported by complete, accurate, current, and comprehensive data and information related to the implementation of Risk Management. In carrying out authority and responsibility regarding the supervision of the implementation of BPR Risk Management, the Board of Directors must have adequate understanding of the risks inherent in all functional activities of the BPR and be able to take necessary actions according to the BPR's risk profile.

b. Supervisory Board Supervision
The authorities and responsibilities of the Supervisory Board that must be included in internal regulations include at least:

Approving and evaluating Risk Management policies
The Supervisory Board approves the Risk Management policies formulated by the Board of Directors, considering the strategy and Risk Management framework established according to the level of risk to be taken and the BPR's risk tolerance. Furthermore, the evaluation of Risk Management policies is conducted by the Supervisory Board at least 1 (one) time in 1 (one) year or whenever there are changes that significantly affect BPR business activities. The results of the evaluation by the Supervisory Board serve as input for the Board of Directors to adjust Risk Management policies if needed.
Ensuring the implementation of Risk Management by the Board of Directors
In order to ensure the implementation of Risk Management by the Board of Directors, the Supervisory Board supervises the implementation of Risk Management policies. If necessary, the Supervisory Board can provide input to the Board of Directors regarding the refinement of Risk Management implementation.
Evaluating the Board of Directors' accountability for the implementation of Risk Management policies
The Supervisory Board evaluates the Board of Directors' accountability for the implementation of Risk Management policies based on the Risk Management policy implementation reports submitted by the Board of Directors to the Supervisory Board every 6 (six) months as referred to in item 1.a.6).a).(2). The results of the evaluation by the Supervisory Board serve as input for the Board of Directors in improving the quality of Risk Management implementation.
Evaluating and deciding on Board of Directors' requests related to transactions requiring Supervisory Board approval
The Supervisory Board evaluates and decides on Board of Directors' requests for transactions requiring evaluation and approval by the Supervisory Board, including:
a) the provision of funds to related parties as referred to in the Financial Services Authority Regulation regarding the maximum limit for BPR credit provision; and/or b) transactions exceeding the authority of the Board of Directors in accordance with applicable laws and regulations.

Human Resources (HR)
In carrying out the responsibility for implementing Risk Management regarding the improvement of HR competence as referred to in item 1.a.4), the Board of Directors must:
a. establish clear HR qualifications for each job level related to the implementation of Risk Management; b. ensure the adequacy of the quantity and quality of existing HR in the BPR and ensure that the said HR understands their tasks and responsibilities, both for business units, Risk Management units, and supporting units responsible for implementing Risk Management;
c. develop a system for employee recruitment, development, and training, including managerial succession plans and adequate remuneration to ensure the availability of competent employees in the field of Risk Management;
d. ensure the improvement of competence and integrity of leaders and personnel of business work units, SKMR or PEMR, and the Internal Audit Work Unit (SKAI) or the Executive Officer handling internal audit functions, hereinafter referred to as PEAI, by considering factors such as knowledge, experience or track record, and adequate ability in the field of Risk Management through continuous education and training programs to guarantee the effectiveness of the Risk Management process; e. place competent employees in each unit according to the nature, quantity, and complexity of the BPR's business activities; f. ensure that employees placed in each of these units have:

an understanding of the risks inherent in each BPR product and/or activity;
an understanding of relevant risk factors and market conditions affecting BPR products and/or activities, and the ability to estimate the impact of changes in these factors on the sustainability of BPR business;
the ability to communicate the implications of BPR risk exposures to the Board of Directors, SKMR, PEMR, and the Risk Management Committee, if any, in a timely manner; and
g. ensure that all HR understands the strategy, the level of risk to be taken and risk tolerance, the Risk Management framework established by the Board of Directors and approved by the Supervisory Board, and ensure that all HR apply it consistently in the activities they handle.

Organization and Risk Management Functions
In the implementation of Risk Management, the BPR Board of Directors formulates the organizational structure and Risk Management functions in accordance with POJK MR BPR. The said organizational structure and functions can be developed according to the business characteristics and complexity of the BPR's business activities. The said Risk Management organizational structure and functions consist of:
a. Risk Management Committee

BPRs with core capital of at least IDR 80,000,000,000.00 (eighty billion rupiah) are required to form a Risk Management Committee and SKMR.
If necessary, BPRs with core capital less than IDR 80,000,000,000.00 (eighty billion rupiah) may form a Risk Management Committee by considering the complexity of business activities, size, and BPR capabilities.
The Risk Management Committee is a non-structural unit with membership that can be permanent or non-permanent according to BPR policy, consisting of at least:
a) Majority of the Board of Directors
(1) Majority of the Board of Directors means more than 50% (fifty percent) of the total number of Board of Directors members. (2) Board of Directors members overseeing the compliance function must be members of the Risk Management Committee. (3) The President Director cannot be a member of the Risk Management Committee. In the event that a BPR has core capital less than IDR 50,000,000,000.00 (fifty billion rupiah) and will form a Risk Management Committee, the said BPR must have at least 3 (three) Board of Directors members. b) Relevant Executive Officers (1) Relevant Executive Officers are BPR officials one level below the Board of Directors, consisting of at least 1 (one) Executive Officer leading the operational work unit and 1 (one) Executive Officer leading the Risk Management work unit. (2) The membership of Executive Officers in the Risk Management Committee is adjusted according to the problems and needs of the BPR. In the event that a BPR has core capital less than IDR 50,000,000,000.00 (fifty billion rupiah) and will form a Risk Management Committee, then the Executive Officers who are members of the Risk Management Committee consist of at least 1 (one) Executive Officer leading the operational work unit and 1 (one) PEMR.
The authority and responsibility of the Risk Management Committee is to provide recommendations to the President Director, which include at least:
a) the formulation of policies and guidelines for implementing Risk Management, including recommendations regarding the level of risk to be taken and risk tolerance in determining BPR business strategy; b) improvement and/or refinement of Risk Management implementation based on the results of Risk Management implementation evaluation; and c) consideration and/or determination of matters related to operational decisions that deviate from normal procedures.

b. SKMR or PEMR

BPRs with core capital of at least IDR 50,000,000,000.00 (fifty billion rupiah) are required to form an SKMR.
BPRs with core capital less than IDR 50,000,000,000.00 (fifty billion rupiah) are at least required to appoint one PEMR.
SKMR is a structural work unit responsible directly to the Board of Directors member overseeing the Risk Management function.
SKMR and Compliance Work Unit (SKP) can be combined structurally, i.e., a work unit handling Risk Management and compliance.
PEMR is responsible directly to the Board of Directors member overseeing the Risk Management function.
PEMR can hold a concurrent position with the Executive Officer handling the compliance function.
SKMR and PEMR must be independent, i.e., not handling fund gathering and lending functions and not performing internal audit functions.
The authority and responsibility of SKMR or PEMR include:
a) Monitoring the implementation of Risk Management policies and guidelines approved by the Board of Directors Monitoring the implementation of Risk Management policies and guidelines can be done, among others, through impact testing or simulation. This is, among others, to determine the impact of the implementation of Risk Management policies and strategies on the BPR's portfolio or overall performance. b) Monitoring overall risk positions, per risk type, and per functional activity type The said monitoring covers compliance with established risk tolerance and limits. c) Study of proposals for the issuance of new products and/or implementation of new activities The study of new product and/or activity proposals aims to assess the BPR's ability to issue new products and/or implement new activities, including the study of system and procedure changes due to the issuance of new products and/or implementation of new activities, and to see the impact on the BPR's overall risk exposure. d) Submission of recommendations to work units or employees handling operational functions and the Risk Management Committee according to their authority Work units or employees handling operational functions are work units or employees handling credit granting, fund gathering, and other operational activities. Recommendations submitted by SKMR or PEMR include information regarding the size or maximum risk exposure that the BPR must maintain. These recommendations are submitted to the Board of Directors member overseeing the Risk Management function and the Risk Management Committee, if any. e) Formulation and submission of periodic risk profile reports to the Board of Directors member overseeing the Risk Management function and the Risk Management Committee The Risk Profile is a comprehensive overview of the magnitude of potential risks inherent in the entire portfolio or BPR exposure. Periodic submission of reports is adjusted to BPR conditions and is conducted at least every semester. The Risk Profile report is submitted to the Board of Directors member overseeing the Risk Management function and the Risk Management Committee, if any. The said report is evaluated and serves as the basis for providing direction to the Board of Directors in formulating Risk Management policies and guidelines.
The authority and responsibility of SKMR or PEMR can be adjusted according to the business characteristics and complexity of the BPR's business activities.

B. Risk Management Policies, Risk Management Procedures, and Risk Limit Establishment Effective Risk Management implementation must be supported by a framework that includes Risk Management policies and procedures as well as established risk limits that are clearly aligned with the BPR's vision, mission, and business strategy. The formulation of these Risk Management policies and procedures is done by considering, among others, the type, complexity of business activities, risk profile, level of risk to be taken, interrelationship between risks, and regulations established by authorities and/or healthy banking practices. Furthermore, the implementation of Risk Management policies and procedures owned by the BPR must be supported by adequate capital and HR quality. In order to effectively control risks, the policies and procedures owned by the BPR must be based on a Risk Management strategy equipped with risk tolerance and risk limits. The establishment of risk tolerance and risk limits is done by considering the level of risk to be taken and the BPR's overall strategy. Matters that need to be considered in establishing the Risk Management framework, including policies, procedures, and limits, include:

Risk Management Strategy
a. BPR formulates Risk Management strategy in accordance with the overall business strategy by considering the level of risk to be taken and risk tolerance. b. Risk Management strategy is formulated to ensure that BPR risk exposures are managed in a controlled manner in accordance with BPR internal policies and procedures and applicable laws and regulations.
c. Risk Management strategy is formulated based on the following general principles:

Risk Management strategy is long-term oriented to ensure BPR business sustainability by considering economic conditions or cycles;
Risk Management strategy is comprehensive and can control and manage BPR risks; and
Achieving capital adequacy accompanied by adequate resource allocation.
d. Risk Management strategy is formulated by considering the following factors:
economic and industry development and its impact on BPR risks;
BPR organization including HR adequacy and supporting infrastructure;
BPR financial conditions including the ability to generate profit, and the BPR's ability to manage risks arising from changes in external and internal factors; and
BPR portfolio mix and diversification.
e. The Board of Directors effectively communicates the said Risk Management strategy to all work units and employees to ensure clear understanding. f. The Board of Directors evaluates the said Risk Management strategy periodically, including its impact on BPR financial performance, to determine the urgency of changing the BPR's Risk Management strategy.

Risk Management Policies
a. BPR Risk Management policies are formed to identify and analyze risks faced by the BPR, to determine appropriate risk boundaries and controls, and to supervise risks and compliance with established boundaries. b. Risk Management policies are written directives in implementing Risk Management and must be aligned with the BPR's vision and mission.
c. The formulation of Risk Management policies must involve work units or employees performing BPR operational functions and SKMR or PEMR, and the Risk Management Committee, if any.
d. The establishment of Risk Management policies considers business characteristics, complexity of business activities, risk profile, level of risk to be taken, risk tolerance, risk limits, financial conditions, and BPR organizational structure. e. Risk Management policies are formulated and established by the Board of Directors and approved and evaluated by the Supervisory Board at least 1 (one) time a year or whenever there are changes that significantly affect BPR business activities. f. Risk Management policies include at least:

Establishment of risks related to business activities, products, and BPR services
The establishment of risks related to business activities, products, and BPR services is based on the results of the BPR's analysis of risks inherent in business activities, products, and BPR services by considering business characteristics and the complexity of BPR business activities.
Establishment of Risk Management information systems
BPR needs to establish methods for identifying, measuring, monitoring, and controlling risks, as well as Risk Management information systems to accurately assess risk exposure on each BPR product and banking transaction and business activities. Included in the Risk Management information system is the information flow to the BPR Board of Directors utilizing information technology and data processing results to support decision-making. The implementation of Risk Management policies must be supported by a Risk Management information system capable of providing complete, accurate, current, and comprehensive information, including data and information for the assessment of Risk Management implementation, including data on savings and credit customers, violation data, deviation (fraud) data, customer complaint data, and negative news data. The establishment of data to be reported, report formats, and types of information must be included in Risk Management reports so as to reflect risk exposures that are considerations in business decision-making while still observing the principle of prudence.
Determination of limits and establishment of risk tolerance
BPR must establish authority and limit sizes hierarchically, including transaction boundaries requiring Board of Directors approval. BPR must determine risk limits according to the level of risk to be taken, risk tolerance, and the BPR's overall business strategy by considering the BPR's capital ability to absorb risk exposures or arising losses, past loss experience, HR capabilities, and compliance with applicable laws and regulations. The determination of limits is done comprehensively over all aspects related to risks by establishing the level and type of risk to be taken in order to achieve BPR targets. BPR must establish risk tolerance, which is the potential loss that can be absorbed by the BPR's capital.
Determination of Risk Rating Assessment
Risk Rating Assessment is the basis for BPRs to establish the BPR's Risk Rating, which is categorized into 5 (five) Risk Ratings, namely Rating 1 (very low), Rating 2 (low), Rating 3 (medium), Rating 4 (high), and Rating 5 (very high). The results of the Risk Rating Assessment can be used by the BPR as a basis for determining improvement steps for business activities, products, and BPR services. The results of the Risk Rating Assessment can also be used by the BPR to evaluate the implementation results of Risk Management policies.
Preparation of contingency plans in worst-case conditions
A contingency plan is a plan for developing scenarios to anticipate internal disruptions, including system failures, and external disruptions that cause emergency conditions that can lead to operational disruptions for the BPR. In preparing contingency plans, BPRs must also prepare business continuity policies in the event of the worst external and internal conditions, so that the continuity of the BPR's business can be maintained, including disaster recovery plans. The preparation of business continuity policies meets, among others:
a) involves various related work units; b) is flexible to respond to various scenarios of unexpected and specific disruptions, i.e., descriptions of specific conditions and actions required immediately; c) periodic testing and evaluation of the business continuity plan; and d) the Board of Directors tests and updates the business continuity plan periodically to ensure the effectiveness of the business continuity plan that has been prepared.
Determination of the internal control system in the implementation of Risk Management
The determination of the internal control system in the implementation of Risk Management is carried out to ensure BPR compliance with internal BPR regulations and legislation, the effectiveness and efficiency of BPR operational activities, the effectiveness of the Risk Management culture at all levels of the BPR organization, and the availability of complete, accurate, current, and comprehensive Risk Management information.

Risk Management Procedures
Risk Management procedures are adjusted to the level of Risk that will be taken regarding BPR Risk. The level of Risk to be taken takes into account the experience owned by the BPR regarding BPR business transaction Risks in the past. Risk Management procedures must include at least:
a. Clear levels of delegation of authority and accountability BPRs must have a clear organizational structure regarding the implementation of Risk Management. A clear organizational structure formulates the roles and responsibilities of the Board of Directors, Board of Commissioners, Risk Management Committee (if any), Risk Management Unit (SKMR) or Risk Management Officer (PEMR), work units or employees handling operational functions, Internal Audit Unit (SKAI) or Internal Audit Officer (PEAI), and other supporting work units. BPRs must have procedures explaining the authority of each position, including in conditions where there is an exceedance of position authority in the implementation of Risk Management.

b. Adequate documentation of procedures and determination of Risk limits Adequate documentation is written, complete, accurate, current, and comprehensive documentation so that it facilitates audit trails for the purpose of internal control of the BPR. Documentation of procedures and determination of Risk limits must facilitate the SKAI or PEAI in carrying out tasks related to internal control.

Determination of Risk Limits
a. In formulating Risk Management policies, the Board of Directors must provide clear direction regarding the level of Risk to be taken and the BPR's Risk tolerance. b. The level of Risk to be taken is the level and type of Risk willing to be taken by the BPR in order to achieve BPR objectives. The level of Risk to be taken is reflected in the BPR's business strategy and objectives.
c. Risk tolerance is the level and type of Risk that is maximally established by the BPR. Risk tolerance is an elaboration of the level of Risk to be taken.
d. In determining Risk tolerance, the BPR needs to consider the BPR's business strategy and objectives as well as the BPR's ability to take Risk (risk bearing capacity). e. The level of Risk to be taken and Risk tolerance must be considered in the formulation of Risk Management policies, including in the determination of limits. f. BPRs must establish Risk limits that are in accordance with the level of Risk to be taken, Risk tolerance, and BPR business strategy, taking into account the BPR's capital ability to absorb Risk exposure or losses arising, past loss experience, human resource capabilities, and compliance with legislative regulations. g. Procedures and determination of Risk limits must include at least:

clear accountability and levels of delegation of authority;
adequate documentation of procedures and determination of Risk limits to facilitate audit trails; and
the determination of Risk limits is carried out comprehensively on all aspects related to Risk, which includes overall Risk limits, limits per Risk type, and limits per BPR business activity that has Risk exposure.
h. Risk limits must be understood by all related parties and communicated well, including if changes occur.
i. The magnitude of Risk limits is proposed by work units or employees handling operational functions, which are then recommended to the SKMR or PEMR to obtain approval from the Board of Directors or Board of Commissioners through the Risk Management Committee, if any.
j. Risk limits are used as thresholds to determine the level of intensity of Risk mitigation to be carried out by the BPR. k. Any exceedance of Risk limits must obtain approval based on mechanisms and procedures regulated in internal BPR regulations.
l. The SKMR or PEMR, in coordination with work units or employees handling operational functions, must provide complete, accurate, current, and comprehensive information that facilitates the Board of Directors in formulating and determining Risk limits.
m. Determination of Risk limits includes:
Overall Limits
Overall limits are the Risk limits that can be tolerated by the BPR for all Risks applied.
Limits per Risk Type
Limits per Risk type are the Risk limits that can be tolerated by the BPR for each type of Risk.
Limits per Specific Functional Activity with Risk Exposure
Limits per specific functional activity are the Risk limits that can be tolerated by the BPR for each functional activity.

C. Risk Identification, Measurement, Monitoring, and Control Process, and Risk Management Information System
Risk identification, measurement, monitoring, and control are the main part of the Risk Management implementation process. Risk identification is proactive, covers all BPR business activities, and is carried out to analyze Risk sources and possible impacts that arise. Subsequently, the BPR needs to measure Risk according to the characteristics and complexity of business activities. In monitoring the results of Risk measurement, the SKMR or PEMR monitors the level and trends and analyzes the direction of Risk. In addition, the effectiveness of Risk Management implementation needs to be supported by Risk control by considering the results of Risk measurement and monitoring. In order to support the process of risk identification, measurement, monitoring, and control, the BPR also needs to develop a management information system that is adjusted to the characteristics, activities, and complexity of the BPR's business activities, as well as an accurate and informative reporting system regarding the BPR's financial conditions, functional activity performance, and BPR Risk exposure.

Risk Identification
Risk identification aims to identify all types of Risk inherent in each functional activity that has the potential to harm the BPR. Risk identification is carried out based on past experience related to transactions that caused losses, reduced profits, or caused problems for the BPR. The Risk identification process must be carried out periodically. The implementation of the Risk identification process is carried out through analysis of all Risk sources, which is carried out at least on Risks from products and BPR activities, and ensures that Risks from new products and activities have gone through an appropriate Risk Management process before the product is issued or the activity is carried out.
Risk Measurement
Risk measurement approaches are used to measure BPR Risk exposure as a reference for carrying out Risk control. The Risk measurement process must be carried out periodically on business activities, products, and BPR services. In order to carry out Risk measurement, the BPR carries out at least:
a. Evaluation of the suitability of assumptions, data sources, and procedures used to measure Risk Evaluation is carried out by independent work units or officials who are not related to the formulation and/or determination in the context of Risk measurement according to business developments, internal and external conditions of the BPR that can directly affect BPR conditions. In the event that the formulation and/or determination in the context of Risk measurement is carried out by operational units, evaluation is carried out by the SKMR or PEMR. In the event that the formulation and/or determination in the context of Risk measurement is carried out by the SKMR or PEMR, evaluation is carried out by the SKAI or PEAI. Evaluation of the suitability of assumptions, resources, and procedures used to measure Risk can also be carried out by the SKMR or PEMR with a self-evaluation mechanism. b. Adjustment to the Risk measurement process if there are material changes in BPR service activities, products, and Risk factors Material changes include changes in products, BPR service activities, organizational structure, information systems, and Risk factors that are quantitative and qualitative and have a significant impact on BPR conditions. The results of Risk measurement are the BPR's assessment of the Risk inherent in BPR functional activities. The aforementioned assessment results are part of the BPR's Risk Management implementation assessment which is formulated in the BPR Risk Profile Report.
Risk Monitoring
In order to carry out Risk monitoring, the BPR carries out at least:
a. Evaluation of Risk exposure is carried out by independent work units or officials who are not related to the formulation and/or determination of Risk exposure by monitoring and reporting significant Risks or those that impact the BPR's capital conditions, which is carried out, among others, using historical data analysis. In the event that the formulation and/or determination of Risk exposure is carried out by operational units, evaluation of Risk exposure is carried out by the SKMR or PEMR. In the event that the formulation and/or determination of Risk exposure is carried out by the SKMR or PEMR, evaluation of Risk exposure is carried out by the SKAI or PEAI, or by the SKMR or PEMR with a self-evaluation mechanism. b. Adjustment of the reporting process if there are material changes in BPR business activities, products, Risk factors, information technology, and Risk Management information systems. The results of monitoring are presented in periodic reports submitted to the Board of Directors for the purpose of Risk mitigation and decision-making on necessary actions. BPRs must prepare a back-up system and effective procedures to prevent disruptions in the Risk monitoring process, and carry out checks and re-evaluations periodically on the back-up system.
Risk Control
The implementation of the Risk control process is used by the BPR to manage Risks that can endanger the continuity of the BPR's business. Included in the Risk control process is the addition of capital to absorb potential losses. The BPR carries out the Risk control process based on analysis results of Risk identification, measurement, and monitoring. Risk control is an action taken by the BPR in the context of Risk mitigation carried out by work units related to each Risk. BPRs must have an adequate Risk control system with reference to established policies and procedures. The Risk control process applied by the BPR must be in accordance with Risk exposure as well as the level of Risk to be taken and Risk tolerance.
Risk Management Information System
a. An adequate Risk Management information system is a management information system capable of providing complete, accurate, current, and comprehensive data and information for decision-making by the Board of Directors. b. The Risk Management information system must be owned and developed according to the BPR's needs in order to implement effective Risk Management. The Risk Management information system is used to support the implementation of the risk identification, measurement, monitoring, and control processes.
c. The Risk Management information system must be able to ensure:

the effectiveness of Risk Management implementation, including Risk Management policies and procedures as well as the determination of Risk limits; and
the availability of information about the results or realization of Risk Management implementation compared to targets established by the BPR in accordance with Risk Management implementation policies and strategies.
d. The Risk Management information system must be able to generate data and information needed according to the development of internal and external BPR conditions, business characteristics, and the complexity of BPR business activities, and must be able to adjust to changes. e. The Risk Management information system must include at least reports or information regarding:
Risk Exposure
Risk exposure reports or information include overall quantitative and/or qualitative Risk exposure, details per Risk type, and per functional activity type.
Compliance with Risk Management policies, considering the objectives of formulating Risk Management policies, among others, to supervise Risk and compliance with established Risk boundaries and controls.
Compliance with Risk Management procedures and the determination of Risk limits, including among others regarding the implementation of delegation of authority and accountability, and the use of Risk limits.
Realization of Risk Management implementation compared to established targets, to ensure information about the results or realization of Risk Management implementation compared to targets established by the BPR in accordance with Risk Management implementation policies and strategies.
f. Reports or information generated from the Risk Management information system are submitted periodically by the SKMR or PEMR to the Board of Directors or more frequently if there are operational changes, new product issuances, and/or new activity implementations. The Risk Management information system supports reporting to the Financial Services Authority (OJK). g. As part of the Risk Management information system, the Risk Profile Report is prepared periodically by the SKMR or PEMR which is independent of the work unit carrying out business activities. h. The frequency of submitting reports to the Board of Directors, and the Risk Management Committee, if any, must be increased as needed, especially in cases where market conditions change rapidly.
i. In developing new information systems and software, the BPR must ensure that the implementation of new information systems and technology will not disrupt the continuity of the BPR's information system.
j. The BPR must account for and update system documentation containing hardware, software, databases, parameters, process stages, assumptions used, data sources, and generated outputs so as to facilitate control and the implementation of audit trails.

D. Internal Control System
The internal control system is a supervision mechanism established by the BPR management on an ongoing basis. BPRs must implement a comprehensive internal control system effectively on the implementation of business activities and operations at all levels of the organization. The implementation of a comprehensive internal control system must at least be able to detect weaknesses and deviations that occur in a timely manner. BPRs must pay attention to several factors in the implementation of the internal control system, among others total assets, types of products and services, operational complexity, office network, Risk profile of each business activity, and legislative regulations.

The objectives of a comprehensive internal control system are to ensure:
a. Compliance with legislation, policies, and internal BPR regulations This is intended to ensure that all BPR business activities have been carried out in accordance with legislation, policies, and internal BPR regulations. b. Availability of complete, accurate, current, and comprehensive financial and management information This is intended to ensure the availability of information to support the preparation of complete, accurate, current, and comprehensive reports required for decision-making by the Board of Directors that is appropriate and accountable.
c. Effectiveness and efficiency in operational activities
This is intended to increase effectiveness and efficiency in using assets and other resources in order to protect the BPR from losses. d. Effectiveness of Risk culture in the BPR organization comprehensively This is intended to identify weaknesses and assess deviations early and continuously re-evaluate the fairness of existing Risk Management policies and procedures at the BPR.
A reliable and effective internal control system is the responsibility of all parties involved in the BPR organization, including:
a. Board of Commissioners
The Board of Commissioners is responsible for supervising the implementation of the internal control system in general, including the policies of the Board of Directors that establish such internal controls. b. Board of Directors The Board of Directors is responsible for the internal control system, including:

creating and maintaining an effective internal control system;
establishing an effective and efficient organizational structure that supports the internal control system;
ensuring that all work units in the BPR are aware of the internal control system as one of the BPR's cultures, so that each work unit can cooperate in supporting the implementation of the internal control system;
ensuring the implementation of the duties and responsibilities of the SKAI or PEAI in the implementation of internal control; and
ensuring the independence and adequate competence of the SKAI or PEAI.
c. SKMR or PEMR
In carrying out authority and responsibility, the SKMR or PEMR is involved in the implementation of the internal control system. d. SKAI or PEAI The SKAI or PEAI must be able to evaluate and play an active role in improving the effectiveness of the internal control system. Evaluation is carried out continuously in relation to BPR operational activities that have the potential to cause losses in achieving objectives established by the Board of Directors and Board of Commissioners of the BPR. e. BPR Officials and Employees Every BPR official and employee must understand and participate in implementing the established internal control system. Effective internal control will increase the accountability of BPR officials and employees, encourage an adequate Risk culture, and accelerate the identification process of unhealthy banking practices and organizational problems through efficient early detection systems. f. External Parties External parties of the BPR include, among others, the Financial Services Authority (OJK), external auditors, and BPR customers who are interested in the implementation of the BPR's internal control system.

A comprehensive internal control system in the context of Risk Management implementation must include at least:
a. Suitability of the internal control system with the type and level of Risk inherent in business activities and BPR service types The determination of the internal control system is adjusted to the BPR's needs which are linked to the type and level of Risk inherent in business activities and BPR service types. The more complex the type and level of BPR Risk, the more adequate the internal control system required. b. Determination of authority and responsibility for monitoring compliance with Risk Management policies The implementation of monitoring compliance with Risk Management policies is the authority and responsibility of the SKMR or PEMR.
c. Determination of authority and responsibility for monitoring compliance with Risk Management procedures and the determination of Risk limits
The implementation of monitoring compliance with Risk Management procedures and the determination of Risk limits is the authority and responsibility of the SKMR or PEMR. d. Determination of clear reporting lines and separation of functions The determination of clear reporting lines and separation of functions is:

Reporting lines from work units or employees handling operational functions to work units or employees carrying out control functions, namely the SKMR or PEMR and SKAI or PEAI.
Separation of functions between work units or employees handling operations and work units or employees carrying out control functions, namely the SKMR or PEMR and SKAI or PEAI.
e. Organizational structure that clearly depicts BPR business activities BPRs must have an organizational structure that supports the implementation of business activities effectively and efficiently. The BPR's organizational structure must also meet requirements for the implementation of Risk Management functions and governance as regulated in POJK MR BPR and Financial Services Authority Regulations regarding the implementation of governance for rural banks. f. Accurate financial and operational activity reporting and

timely.
BPR must ensure that financial reporting and operational activities are supported by complete, accurate, current, and comprehensive data and information. To support this, BPR must have an adequate management information system that facilitates the Board of Directors in decision-making. g. Adequacy of procedures to ensure BPR compliance with legislation In order to ensure compliance of all activities and functional activities with legislation, BPR must have procedures formulated in the form of internal BPR regulations. BPR must ensure that its internal procedures are aligned with legislation. h. Complete and adequate documentation BPR must carry out complete and adequate documentation of all matters related to the implementation of Risk Management, including but not limited to the supervision of the Board of Directors and Board of Commissioners, Risk Management policies and procedures, determination of Risk limits, the process of Risk identification, measurement, monitoring and control, Risk Management information systems, and internal control systems comprehensively.
i. Verification and review or re-examination of the internal control system
Verification and review or re-examination of the internal control system also covers the handling of significant weaknesses of the BPR and actions by BPR management to correct deviations that occur.
4. Monitoring must be conducted by SKAI or PEAI regarding improvements based on findings from internal audits as well as external audits. Audit findings that have not been followed up must be reported by SKAI or PEAI to the Board of Directors to take the necessary steps.

BPR must be responsive to weaknesses and/or deviations that occur regarding internal and external regulations.

CHAPTER II
CREDIT RISK

Credit Risk is the Risk arising from the failure of the debtor and/or other parties to fulfill obligations to the BPR. Credit Risk generally exists in all BPR activities whose performance depends on the performance of counterparties (banks and non-banks). Credit Risk can also be caused by the concentration of fund provision to specific debtors, geographical areas, products, types of financing, or specific economic sectors. This risk is commonly referred to as Credit Concentration Risk and is taken into account in the assessment of Inherent Risk.
Credit Risk can be the main cause of BPR failure. Thus, the BPR's ability to identify, measure, monitor, and control Credit Risk, as well as provide sufficient capital reserves for Credit Risk, is an absolute necessity.
The implementation of Risk Management for Credit Risk aims to ensure that the BPR's fund provision activities are not exposed to Credit Risks that could cause losses to the BPR. The implementation of Risk Management is adjusted to the business characteristics, scale and complexity of business activities, and the level of Risk that can be tolerated by the BPR.
Asset portfolios containing Credit Risk are:
a. Loans granted
Generally, loans granted constitute the largest portion of the BPR's balance sheet and are also the largest source of Credit Risk that can directly impact the BPR's capital. b. Placements in other banks Credit Risk in placements in other banks arises due to the possibility that the other bank in question cannot fulfill its payment obligations at maturity.
The relationship between Credit Risk and other Risks is as follows:
a. Operational Risk
Credit Risk can also be influenced by Operational Risk, which can arise, for example, from weaknesses in human resources, processes, or systems related to fund provision. b. Compliance Risk Credit distribution activities can affect Compliance Risk, given that there are regulations and limits that the BPR must comply with regarding these activities, including the Maximum Credit Limit (BMPK) for both related and unrelated parties, as well as for individual debtors and group debtors.
c. Liquidity Risk
Credit management generally has a significant impact on the BPR's liquidity conditions. Credit Risk due to poor credit quality, resulting in disbursed funds not being recoverable at their initial value, can cause the BPR to face Liquidity Risk when third-party fund customers withdraw funds. d. Reputational Risk Credit problems experienced by the BPR can affect the BPR's performance, which can have a negative impact on the BPR's reputation. Problems in fund provision, for example, if the BPR is not transparent with debtors regarding their rights and obligations, can lead to legal action against the BPR, causing a poor reputation for the BPR. e. Strategic Risk Inappropriate strategies in fund provision standards, loan growth, or new products and/or activities can affect the BPR's performance and increase Credit Risk. In the implementation of Credit Risk Management, adequate analysis is required for Risks arising from business activities and new products and/or activities of the BPR, as well as a realistic analysis of Strategic Risk. BPR must identify and manage Credit Risk inherent in all new products and/or activities, ensure the implementation of appropriate Risk Management control processes before the issuance of products and/or implementation of new activities, and obtain approval from the Board of Directors based on the results of the review by SKMR or PEMR.

B. Supervision by the Board of Directors and Board of Commissioners In the implementation of Risk Management through the supervision of the Board of Directors and Board of Commissioners for Credit Risk, in addition to implementing supervision as regulated in Chapter I letter A, BPR must add the following implementation:

Authority and Responsibilities of the Board of Directors and Board of Commissioners
a. The Board of Directors is responsible for establishing and implementing Credit Risk Management policies and developing procedures for the identification, measurement, monitoring, and control of Credit Risk. The policies and procedures developed and implemented must be able to:

support healthy lending standards;
monitor and control Credit Risk; and
identify and handle non-performing loans.
b. The Board of Directors is responsible for ensuring that all fund provision activities are carried out in accordance with the Credit Risk Management strategy and policies approved by the Board of Commissioners.
c. The Board of Directors must ensure that the implementation of Risk Management is carried out effectively in the execution of fund provision activities, including monitoring developments and problems in BPR business activities related to Credit Risk, including the resolution of non-performing loans.
d. In implementing Credit Risk Management policies, the Board of Directors must ensure that relevant operational units related to credit distribution have functions that perform:
marketing, analysis, and credit approval (front office);
credit monitoring (middle office), including assessment of credit quality and placements in other banks, collateral, and reserve formation;
credit approval/disbursement (back office);
credit restructuring;
credit collection; and
credit administration.
e. The Board of Commissioners monitors fund provision, including the provision of large amounts or funds provided to related parties. f. The Board of Commissioners is responsible for conducting periodic approval and evaluation at least once (1) in one (1) year regarding the BPR's Credit Risk Management policies, including credit Risk tolerance limits.

Human Resources
Adequacy of Human Resources for Credit Risk refers to the scope of general implementation as referred to in Chapter I item A.2.
Credit Risk Management Organization
In order to implement Risk Management for Credit Risk, there are several units handling functions:
a. business units that carry out credit granting or fund provision activities; b. credit recovery units that handle non-performing loans; and
c. Risk Management (SKMR or PEMR), specifically those that assess and monitor Credit Risk.
In addition, BPR may also form a credit committee responsible specifically for deciding on the granting of credit in certain amounts according to each BPR's policy. Membership of the credit committee is not limited to the business unit but also includes other units related to Credit Risk management, such as the credit recovery unit.

Risk Limit Determination
In implementing Risk Management policies and procedures and determining Risk limits for Credit Risk, in addition to implementing Risk Management policies and procedures and determining Risk limits as referred to in Chapter I letter B, BPR adds the following implementation:

Risk Management Strategy
a. Risk Management Strategy for Credit Risk includes strategies for all products and/or activities that have Credit Risk exposure, clearly containing the steps the BPR will take in the provision and distribution of funds. b. Risk Management Strategy for Credit Risk must align with the BPR's objectives to maintain credit quality, profit, and business growth.
Policies and Procedures
a. In Credit Risk policies covering the implementation of Risk Management for Credit Risk for all BPR business activities, BPR must have policies and procedures covering the framework for fund provision and healthy fund provision policies, including policies and procedures for controlling Credit Concentration Risk. BPR must have clearly established procedures for the approval of fund provision, including changes, renewals, and refinancing. b. The policies and procedures referred to in letter a also include policies and procedures to ensure that all fund provision is conducted fairly without special treatment (arm's length basis). In the event that the BPR has policies allowing, under certain conditions, fund provision outside normal policies, such policies must clearly contain criteria, requirements, and procedures, including steps to control or mitigate the Risk from such fund provision.
c. BPR must have policies and procedures to identify the existence of Credit Concentration Risk.
d. BPR must develop and apply policies and procedures appropriately so that they can:

support healthy fund provision;
monitor and control Credit Risk;
correctly evaluate opportunities to utilize new business opportunities; and
identify and handle non-performing loans.
e. BPR has sufficient information to conduct a comprehensive assessment of the debtor's Risk profile. BPR policies contain information needed for healthy credit granting. Factors to be considered and documented in credit approval include:
credit purpose and payment source;
analysis of the debtor's ability to repay, both historically and in the future based on historical financial developments and cash flow projections;
the debtor's business capability and field conditions as well as the debtor's position in a specific industry; and
credit requirements submitted, including agreements designed to anticipate changes in debtor Risk exposure in the future.
Specifically for loans exceeding IDR 5,000,000,000.00 (five billion rupiah), or up to IDR 5,000,000,000.00 (five billion rupiah) but included in the 25 (twenty-five) largest debtors, BPR needs to consider and document other consideration factors in the form of debtor Risk profile, mitigation, and the influence of economic and market condition developments on the debtor, in credit approval. f. BPR policies also contain factors to be noted in the credit approval process, including:
Selection conducted on credit transactions and commitments to take Risk exposure must consider profitability levels. Selection of Credit Risk transactions is at least conducted by ensuring that the analysis of estimated costs and revenues is done comprehensively, including operating costs, funding costs, costs related to the estimated occurrence of debtor default, until full payment is obtained, and capital requirement calculations.
Pricing of credit facilities must be done consistently by taking into account the Risk level of the transaction concerned, specifically the debtor's overall conditions, asset quality, and the ease of liquidating collateral.
The Board of Directors must obtain the results of profitability performance analysis from granted credit transactions at least every semester. Pricing of credit facilities can be adjusted if needed to prevent deterioration of the BPR's financial conditions.
g. BPR must have procedures for credit analysis, approval, and administration, which include:
Decision-making procedures for credit approval, especially those conducted through delegation of authority, must be clearly formalized according to the BPR's characteristics and supported by the systems owned by the BPR.
Separation of functions between units, departments, or employees who conduct analysis, provide approval, and perform credit administration within the framework or mechanism of procedures for delegating fund provision decision-making authority.
BPR conducts periodic monitoring to establish or update the quality of fund provision affected by Credit Risk.
In developing credit administration systems, BPR ensures:
a) efficiency and effectiveness of credit administration operations, including monitoring documentation, credit agreements, and collateral binding; b) accuracy and timeliness of information provided for management information systems; c) adequate separation of functions and/or tasks; d) feasibility of controls over all back-office procedures; and e) compliance with written internal policies and procedures and legislation regulations.
BPR must account for and document all quantitative and qualitative information and material evidence in credit archives used for assessment and monitoring.
BPR needs to have procedures in the event of fund provision outside normal procedures. Criteria, procedures, and control steps regarding conditions for fund provision outside normal policies must be clearly stated, taking into account legislation regulations.

Risk Limit Determination
a. BPR must determine overall fund provision limits for all BPR business activities containing Credit Risk, both for related and unrelated parties, as well as for individual and group debtors. b. BPR needs to determine Risk tolerance for Credit Risk.
c. Limits for Credit Risk are intended to reduce Risks arising from the concentration of credit distribution. Established Risk limits must at least cover exposure to counterparties (banks and non-banks) and related parties.
d. Risk limits for counterparties (banks and non-banks) can be based on the results of quantitative data analysis obtained from financial reports or information, as well as the results of qualitative information analysis that can be sourced from interviews with customers. e. The determination of Credit Risk limits must be documented in writing and completely to facilitate the establishment of an audit trail for the benefit of internal and external auditors. f. BPR must determine Risk limits appropriate to the level of Risk to be taken, Risk tolerance, and BPR business strategy, taking into account the BPR's capital ability to absorb Risk exposure or losses arising, past loss experience, HR capability, and compliance with legislation regulations. g. The determination of the level of Risk to be taken and Risk tolerance for Credit Risk refers to the scope of general implementation as referred to in Chapter I item B.4.

Example:
BPR A determines the level of Risk to be taken and Risk tolerance for Credit Risk after comparing historical data, economic and market conditions, and peer group, for several parameters such as:

Parameter	Risk Appetite	Risk Tolerance
NPL Net	3%	6%
Ratio of low-quality loans to total loans	7%	10%

Note: This table is only an example and cannot immediately serve as a basis for determining the level of Risk to be taken or Risk tolerance for each BPR.

D. Process of Risk Identification, Measurement, Monitoring, and Control, and Risk Management Information System In implementing Risk Management through the process of risk identification, measurement, monitoring, and control, and Risk Management information system for Credit Risk, in addition to implementing the process as referred to in Chapter I letter C, BPR adds the following implementation:

Credit Risk Identification
a. BPR must identify Credit Risk inherent in all products and activities. Identification of Credit Risk is the result of a study on the characteristics of Credit Risk inherent in specific functional activities such as lending and placements in other banks. b. Credit Risk assessment must take into account the debtor's financial conditions, ability to pay on time, and guarantees or collateral provided. For debtor Risk, the assessment must include analysis of:

debtor environment, for example regarding competition at the business location;
business partner characteristics, for example suppliers or buyers;
quality of shareholders and management, including the ability of shareholders and management to add capital if needed, specifically for legal entity debtors;
latest financial reports or information;
results of cash flow projections;
quality of business plans, especially for loans exceeding IDR 5,000,000,000.00 (five billion rupiah); and
other documents that can be used to support a comprehensive analysis of the debtor's conditions and credibility.
c. Systems for conducting Credit Risk identification must be able to provide adequate information, including regarding credit portfolio composition.
d. In conducting Credit Risk identification, factors that can influence the level of Credit Risk in the future must be considered, such as the possibility of changes in economic conditions, including changes due to natural disasters and government policies. e. In identifying Credit Risk, the results of credit quality assessment based on analysis of payment accuracy, debtor payment sustainability, and debtor compliance with credit agreements must be considered. f. Specifically for Credit Concentration Risk, BPR must also identify the causes of Credit Concentration Risk to be monitored and considered in determining BPR credit policies.

Credit Risk Measurement
a. BPR must have written systems and procedures for measuring Risk that at least allow for:

viewing Risk exposure from counterparties (banks and non-banks);
assessment of differences in Credit Risk categories using a combination of qualitative and quantitative data aspects and selection of specific criteria;
distribution of Risk measurement results comprehensively for monitoring purposes by relevant units; and
comprehensive management of Credit Risk due to counterparty (bank and non-bank) failure.
b. Credit Risk measurement systems must at least consider:
characteristics of each type of transaction affected by Credit Risk;
counterparty (bank and non-bank) financial conditions and requirements in credit agreements such as interest rates;
loan term linked to potential changes occurring in the market;
collateral aspects and/or guarantees;
potential for default; and
BPR's ability to absorb potential failure.
c. Measurement tools must be able to measure quantifiable Inherent Risk exposure, including portfolio composition including composition and concentration levels, and fund provision quality including the level of non-performing assets and foreclosed assets.
d. One model that BPR can use is statistical or probabilistic methodology to measure Risk related to specific types of Credit Risk transactions, such as credit scoring tools. e. In using systems to measure Credit Risk, BPR:
conducts periodic evaluation of the accuracy of models and assumptions used to project failure; and
adjusts assumptions with changes occurring in internal and external conditions.
f. In the event of large Risk exposure or relatively complex transactions, the decision-making process for Credit Risk transactions is not only based on the system but must also be supported by other Credit Risk measurement tools. g. BPR documents assumptions, data, and other information used in the system, including changes, and such documentation is subsequently updated periodically. h. Implementation of the measurement system:
supports the decision-making process and ensures compliance with delegation of authority regulations;
is independent from possible manipulation that would influence results through reasonable and effective security procedures; and
is evaluated by units or parties independent of the unit applying the system.

Credit Risk Monitoring
a. BPR develops and applies comprehensive information systems and procedures to monitor the composition and conditions of counterparties (banks and non-banks) against the entire BPR credit portfolio. The system must align with the BPR's portfolio characteristics, size, and complexity. b. Monitoring procedures must be able to identify non-performing assets or other transactions to ensure that problematic assets receive attention, including rescue actions and the formation of sufficient reserves.
c. Credit Risk monitoring systems must at least contain measures to:

ensure that BPR knows the latest financial conditions of counterparties (banks and non-banks);
monitor compliance with requirements in credit agreements;
assess the adequacy of collateral compared to counterparty (bank and non-bank) obligations;
identify payment delays and classify non-performing loans accurately and on time;
handle non-performing loans quickly; and
identify the overall level of Credit Risk.
d. BPR must also monitor Credit Risk exposure compared to established Credit Risk limits. e. Monitoring of Credit Risk exposure must be conducted continuously by comparing Credit Risk

current with the established Credit Risk limits. f. SKMR or PEMR prepares periodic reports on the development of Credit Risk, including causal factors, which are submitted to the Board of Directors members overseeing the Risk Management function and the Risk Management Committee, if any. g. The core principles in monitoring Credit Risk for BPRs are as follows:

The monitoring process must be documented in written procedures.
The monitoring process must be able to identify early changes in the Risk profile caused by potential or actual declines in Credit Risk.
Monitoring procedures must be evaluated periodically by an independent party from the work unit applying the monitoring procedures;
In the event that BPR applies monitoring procedures to determine asset quality and provision amounts, there must be formal procedures ensuring that the determination of asset quality and provisions using the measurement methods established by the BPR is stricter or equal to the applicable regulations;
and
Reports on Credit Risk measurement results, such as credit portfolio condition reports, are submitted periodically to the Board of Directors members overseeing the Risk Management function.

Credit Risk Control
a. BPR ensures that work units or employees handling lending and other work units conducting transactions affected by Credit Risk function adequately, and Credit Risk exposure is kept consistent with established limits and meets prudential principles. b. Credit Risk control can be conducted through Risk mitigation, setting authority levels in the fund provision approval process, and periodic credit concentration analysis.
c. BPR has an effective system to detect problematic loans for immediate follow-up. Furthermore, BPR separates employees handling problematic loan resolution from employees handling the credit decision function.
BPRs with core capital above IDR 80,000,000,000.00 (eighty billion rupiah) must separate the problematic loan resolution function from the credit decision function. The results of handling problematic loans are accounted for and subsequently used as input for the work units responsible for disbursing or restructuring credit.
Risk Management Information System
a. To improve the effectiveness of the Credit Risk measurement process, BPR must have a Risk Management information system that provides complete, accurate, current, and comprehensive reports and data to support decision-making by the Board of Directors and other officials. b. The Risk Management information system must generate reports or information for monitoring actual exposure against established limits and exceeding Risk limits that require the attention of the Board of Directors.
c. The Risk Management information system must provide accurate and timely data regarding the total exposure of counterparty credit (banks and non-banks), credit portfolios, and reports on Credit Risk limit exceptions.
BPR must have a Risk Management information system that enables the Board of Directors to identify Risk concentrations in the credit portfolio. E. Internal Control System
BPR establishes an independent and continuous assessment system for the effectiveness of Credit Risk Management implementation. This assessment must at least include an evaluation of the lending administration process, an assessment of the accuracy of Credit Risk monitoring, and the effectiveness of work units or employees performing individual credit quality monitoring.
BPR ensures that work units or employees handling the lending function and other Credit Risk transactions are managed adequately so that Credit Risk exposure remains consistent with established limits and meets prudential principles.
Internal audit of the Credit Risk process is conducted periodically, including among others:
a. identification that fund provision activities align with established Credit Risk Management policies; b. all authorizations are within the boundaries of the guidelines provided;
c. individual credit quality and portfolio composition are accurately reported to the Board of Directors;
d. weaknesses in the Credit Risk Management process, Credit Risk Management policies, including any exceptions to policies and procedures, and limit exceedances; and e. compliance with Credit Risk limits.

CHAPTER III
OPERATIONAL RISK

Operational Risk is Risk caused by, among others, the inadequacy and/or failure of internal processes, human resource errors, system failures, and/or external issues affecting BPR operations.
Operational Risk can cause direct or indirect financial losses and potential losses from the loss of opportunities to obtain profits.
Operational Risk can be inherent in every functional activity of BPR, such as lending (fund provision) activities, operations and services, information technology, management information systems, and human resource management. Furthermore, Operational Risk is inherent in the complexity of business and institutional structure viewed from the scale of business and organizational structure, the diversity of BPR products and/or services, office networks, and corporate actions.
Operational Risk is important because it is related to all BPR business processes and procedures, is inherent in all BPR business lines, and reflects changes in the BPR Risk profile.
All employees in BPR business units and support activities must be part of the implementation of Operational Risk Management.
Operational Risk at BPR is generally caused by four main sources, namely:
a. Human Resources (HR)
HR can be a source of Operational Risk as a result of HR's inability to perform tasks according to responsibilities. Operational Risk caused by HR includes among others:

occupational health and safety issues;
employee turnover;
internal (fraud) deviations;
inadequate number of HR; and
low HR competence.

b. Internal Processes
Internal BPR process or procedure failures cause Operational Risk, among others caused by:

ineffective organizational structure;
inappropriate division of labor;
incomplete documentation;
inaccurate reports;
overlapping functions;
inadequate internal procedures; and
abuse of authority.
c. Systems and Infrastructure
The failure of information technology and infrastructure used by BPR can cause Operational Risk, among others caused by:
absence of systems;
programming errors;
inadequate data controls;
service disruptions; and
weak system security.
d. External Events
External events can be a source of Operational Risk as a result of events outside the direct control of BPR, which generally have low frequency but high impact. Examples of such external events include among others:
fire;
natural disasters; and
social and political conditions.

Operational Risk can cause the following impacts:
a. Direct losses, i.e., financial losses that directly impact the income statement, such as asset value decline, business activities, asset damage or loss, payment of administrative fines, and payment of compensation to third parties. b. Indirect losses, i.e., losses that are difficult to calculate financially but reduce the effectiveness and efficiency of BPR business, including loss of income such as inefficient work processes, reporting errors, loss of opportunities to obtain profits, loss of potential customers, and resignation of potential employees.
The main objective of Risk Management for Operational Risk is to minimize the possibility of negative impacts from the failure of internal processes, human errors, system failures, and/or external events.
Operational Risk is inherent in all BPR business lines and support activities, so it intersects with other Risks such as Compliance Risk, Credit Risk, Reputational Risk, Liquidity Risk, and Strategic Risk.
Weaknesses in HR, internal processes, systems and infrastructure, and external events can cause weaknesses in compliance aspects, compliance violations, and BPR reputational issues that can impact Compliance Risk, Credit Risk, Reputational Risk, Liquidity Risk, and Strategic Risk. B. Board of Directors and Board of Commissioners Supervision In implementing Risk Management through the supervision of the Board of Directors and Board of Commissioners for Operational Risk, in addition to implementing supervision as referred to in Chapter I letter A, BPR adds the implementation:
Authority and Responsibility of the Board of Directors and Board of Commissioners
a. The Board of Directors and Board of Commissioners of BPR understand Operational Risk and actively approve and evaluate Operational Risk policies and strategies periodically. b. The Board of Directors and Board of Commissioners are responsible for developing an organizational culture aware of Operational Risk and fostering commitment to manage Operational Risk in accordance with BPR's business strategy.
c. The Board of Directors and Board of Commissioners are responsible for ensuring that the implementation of Operational Risk Management is adequate according to the characteristics of the business, complexity of business activities, and BPR's Risk profile.
d. Operational Risk policies and strategies must consider the impact on capitalization by paying attention to external and internal changes. e. The Board of Directors must elaborate and communicate Operational Risk Management policies to all work units, employees, or functions in BPR and evaluate the implementation of said policies. f. The Board of Directors must be able to identify and manage Operational Risk inherent in new products and activities and ensure that the Risk of new products and activities has gone through adequate Risk control processes, before the product is issued or the activity is implemented. g. The Board of Directors must ensure the placement and enhancement of adequate competence and integrity of HR in all functional activities of BPR. h. The Board of Directors must create a culture of objective disclosure of Operational Risk in all organizational elements so that Operational Risk can be identified quickly and mitigated accurately.
i. The Board of Directors establishes effective reward (including remuneration) and punishment policies integrated into the performance evaluation system to support optimal Risk Management implementation.
j. The Board of Commissioners ensures that BPR's remuneration policies are in accordance with BPR's Risk Management strategy.
Human Resources (HR)
a. BPR must have a code of ethics applied to all employees at every level of the organization; and b. BPR must consistently apply sanctions to employees proven to have committed deviations and violations.
Operational Risk Management Organization
Regarding the organization of Operational Risk Management, business unit or support unit management is responsible for the daily Operational Risk Management process and reports specific operational Risk issues in the unit according to the reporting level.

Setting Risk Limits
In implementing Operational Risk Management policies and procedures and setting Risk limits for Operational Risk, in addition to implementing Operational Risk Management policies and procedures as referred to in Chapter I letter B, BPR adds the implementation:

Risk Management Strategy
The formulation of strategies for Operational Risk refers to the general scope of implementation as referred to in Chapter I item B.1.
Policies and Procedures
a. BPR must establish Operational Risk Management policies that must be internalized in the business processes of all BPR business lines and support activities. b. BPR must have procedures that are derivatives of Operational Risk Management policies, which can be general controls such as separation of functions or the requirement to take leave, and specific controls such as the accounting of debtor credit documents.
c. BPR must have procedures to measure the exposure of transaction settlement Risk.
d. BPR assesses the stages in the transaction settlement process, particularly regarding the final deadline for payment orders, the final deadline for receipt, and the time for recording fund payments. e. BPR must formulate a monitoring procedure for new transaction settlements or if there are transactions whose payments have not been completed. f. BPR must provide transaction settlement procedures caused by worsening BPR liquidity conditions. g. BPR confirms transactions promptly according to established procedures and monitors said transactions consistently. h. BPR is expected to have business continuity management (BCM), i.e., an integrated and comprehensive protocol to ensure the continuity of BPR operations in conducting business and serving customers, to anticipate dire situations such as natural disasters, fires, robberies, or technical problems experienced by BPR that affect the continuity of BPR operational activities. In implementing BCM, BPR has policies that at least include:

business impact analysis;
assessment of Operational Risk that may occur due to disruptions in BPR operations;
recovery strategies implemented by BPR for each form of disruption that occurs;
documentation (including disaster recovery plans and emergency plans); and
periodic testing of the BCM approach used to ensure it can operate effectively during disruptions.
Effective BCM needs to be supported by several things, one of which is the formulation of a business continuity plan (BCP). BCP procedure components that BPR must possess are disaster recovery plans as referred to in the Financial Services Authority Regulation regarding information technology service standards.
i. To mitigate Operational Risk arising from the complexity of internal processes, BPR must have Operational Risk Management policies in accordance with vision, mission, business strategy, capital adequacy, and HR adequacy that at least include:
controls to prevent Operational Risk for all internal processes and those directly related to customers;
transaction settlement procedures from internal processes, including ensuring the effectiveness of the transaction settlement process;
accounting execution procedures to ensure accurate accounting records, including the suitability of accounting methods used, the accounting processes implemented, and the accounting of supporting documents;
procedures for the execution of product provision and other activities conducted by BPR; and
procedures for preventing and resolving deviations (fraud).
j. To reduce the possibility of Operational Risk arising from HR, BPR's Risk Management policies must at least include policies on recruitment and placement according to organizational needs, competitive remuneration and incentive structures, training and development, periodic rotation, career and succession planning policies, and handling issues of termination of employment and labor unions. k. To reduce the possibility of Operational Risk arising from systems and infrastructure, BPR's Risk Management policies must be supported by access procedures, including to management information systems, accounting information systems, and Risk management systems.
l. To reduce the possibility of Operational Risk arising from customer and prospective customer profiles, Risk Management policies must contain the obligation for BPR to conduct Customer Due Diligence (CDD) or Enhanced Due Diligence (EDD) periodically and consistently in accordance with Operational Risk exposure. The implementation of CDD or EDD refers to all requirements and guidelines as referred to in legislation and Financial Services Authority Regulations regarding the implementation of anti-money laundering and counter-terrorism financing programs. CDD or EDD must be supported by an effective internal control system, specifically BPR's efforts to prevent internal deviations (internal fraud).
m. BPR ensures that the use of accounting methods is in accordance with applicable accounting standards and pays attention to the following:
periodic review to ensure the suitability of methods used to assess transactions;
periodic review of the suitability of accounting methods used with applicable financial accounting standards;
periodic reconciliation of transaction data;
identification and analysis of every irregularity in transactions that occur;
maintenance of all documents and archives (files) related to account details, general ledgers, asset classification administration, and provision formation documentation, to facilitate the audit trail process.

Setting Risk Limits
a. BPR must set Operational Risk limits by considering Risk exposure and past loss experiences caused by Operational Risk. These limits must be evaluated and adjusted in the event of significant changes in Operational Risk exposure. b. BPR must set Risk limits in accordance with the level of Risk to be taken, Risk tolerance, and BPR's business strategy by paying attention to BPR's capital capacity to absorb Risk exposure or losses arising, past loss experiences, HR capacity, and compliance with applicable legislation.
c. The setting of the level of Risk to be taken and Risk tolerance for Operational Risk refers to the general scope of implementation as referred to in Chapter I item B.2.
Example:
After comparing historical data, economic and market conditions, and peer groups, BPR A sets the level of Risk to be taken and Risk tolerance for Operational Risk by establishing several parameters, namely:
Parameter Risk Appetite Risk Tolerance
Number of human errors
Maximally causing an impact of 2% on BPR finances Maximally causing an impact of 5% on BPR finances

Parameter Risk Appetite Risk Tolerance
Core Banking System
Maximally 1 system error occurs
Maximally 2 system errors occur
Note: This table is only an example and cannot immediately be used as a basis for determining the level of Risk to be taken or Risk tolerance for each BPR. D. Process of Identification, Measurement, Monitoring, and Control of Risk, as well as Risk Management Information System In implementing Risk Management through the process of identification, measurement, monitoring, and control of Risk, as well as the Risk Management information system for Operational Risk, in addition to implementing the process as referred to in Chapter I letter C, BPR adds the implementation:

Identification and Measurement of Operational Risk
a. BPR must identify and measure parameters that affect Operational Risk exposure, including the frequency and impact of:

system failures and errors;
administrative system weaknesses;
failure of customer relationships;
accounting errors;
delays and errors in payment settlement;
deviations (fraud); and
accounting manipulation.
b. BPR develops a database regarding:
types and impacts of losses, caused by Operational Risk based on Risk identification results, in the form of predictable and unpredictable loss data;
violations of control systems; and/or
other operational issues that may cause losses in the future.
c. BPR considers various internal and external factors in identifying and measuring Operational Risk, including among others:
BPR organizational structure, Risk culture, HR management, organizational changes, and employee turnover;
BPR customer characteristics, products and/or activities, and the complexity of BPR business activities and transaction volume;
the design and implementation of systems and processes used; and/or
external environment, industry trends, market structure, including social and political conditions.
d. Methods that BPR can use to identify and measure Operational Risk, including among others:
self-risk assessment in the form of checklists to identify strengths and weaknesses in the BPR Operational Risk environment, such as the role of the Board of Directors and Board of Commissioners, organizational structure, HR, and information and communication flows within BPR;
risk mapping in the form of mapping by type of Risk against functional activities, organizational structure, and transaction process flows;
key risk indicators in the form of statistics or matrices providing data on BPR's Operational Risk position, such as the number of transaction cancellations, employee turnover rates, and frequency of errors; and
scorecards that provide methods to translate qualitative assessments/criteria into quantitative matrices, which can be used to allocate capital requirements for each functional activity.

Monitoring of Operational Risk
a. BPR conducts continuous monitoring of Operational Risk against all Operational Risk exposures and losses that can be caused by main functional activities, including by applying internal control systems and providing periodic reports on losses caused by Operational Risk. b. BPR periodically evaluates the causal factors of Operational Risk and the impact of losses.

c. BPR has a reliable monitoring mechanism for Operational Risk and operational losses that is able to produce an informative and up-to-date Operational Risk profile for the Board of Directors in order to determine the necessary control measures.

d. The Risk Management Committee (SKMR) or Head of Operational Risk Management Unit (PEMR) must compile reports regarding losses from Operational Risk and submit these reports to the Board of Directors and the Risk Management Committee, if any.

Operational Risk Control

a. BPR conducts effective Operational Risk control by at least considering:

Risks that can be accepted;
Risks that must be avoided, including resolution steps; and
steps to mitigate Risks, including transferring Risks to third parties such as insurance.

b. BPR controls Risks consistently in accordance with the level of Operational Risk to be taken and the results of Operational Risk identification and measurement as determined in the Risk Management policy.

c. BPR establishes clear delegation of authority and clarity of control steps for parties responsible for the implementation of Operational Risk Management across all work units, employees, or functions of the BPR.

d. BPR may develop programs to mitigate Operational Risk, including among others the security of information technology processes. In the event that BPR develops information technology process security, BPR ensures the level of security of electronic data processing.

e. Control over information systems must ensure:

periodic assessment of information system security, accompanied by corrective actions where necessary;
backup procedures and contingency plans to ensure that BPR's operational activities continue and to prevent significant disruptions, and are tested periodically;
submission of information to the Board of Directors regarding activities as referred to in item 1) and 2); and
storage of information and documents related to analysis, programming, and implementation of data processing.

f. BPR has support systems, which at least include:

early identification of errors;
efficient, accurate, and timely processing and settlement of all transactions; and
confidentiality, truthfulness, and security of transactions.

g. In the implementation of Operational Risk control, BPR may develop programs to mitigate Operational Risk, including among others the security of information technology processes, insurance, and outsourcing of some of BPR's operational activities.

Risk Management Information System

a. BPR has adequate information systems and technology, in accordance with the nature and volume of transactions.

b. The Risk Management Information System must be able to produce complete and accurate reports used for Risk monitoring in order to detect and correct deviations in a timely manner to reduce the potential for losses.

c. BPR has a reporting mechanism for Operational Risk that must be able to provide information according to user needs, including:

Operational Risk profile and losses caused by Operational Risk;
results from various Operational Risk measurement methods and trends, and/or summaries of internal audit findings;
reports on the status and effectiveness of the implementation of action plans for Operational Risk issues;
reports on procedural deviations;
reports on deviations (fraud); and
recommendations from SKMR or PEMR for Operational Risk, supervisory letters from external auditors, specifically regarding BPR's operational control aspects, and supervisory letters from the Financial Services Authority (OJK).

d. The Risk Management Information System must be able to provide complete, accurate, up-to-date, and comprehensive reports on Operational Risk exposure so that decision-making processes by the Board of Directors can be carried out in a timely manner. The Risk Management Information System must be able to provide storage of information and documents related to analysis, programming, and implementation of data processing.

E. Internal Control System

In implementing Risk Management through the implementation of an internal control system for Operational Risk, in addition to implementing internal controls as referred to in Chapter I letter D, BPR needs to have a routine rotation system to avoid the potential for self-dealing, collusion, or concealment of documentation or transactions that are not normal.
BPR must conduct periodic evaluations of procedures, documentation, data processing systems, contingency plans, and other operational practices to reduce the possibility of human error causing Operational Risk.

CHAPTER IV
COMPLIANCE RISK

Compliance Risk is the Risk resulting from BPR not complying with and/or not implementing legislation and other regulations, including Risks resulting from weaknesses in legal aspects.
Compliance Risk stems from legal aspects, namely BPR's behavior or activities that deviate from or violate legislation regulations and organizational behavior, namely BPR's behavior or activities that deviate from or contradict generally applicable standards.
The main objective of Compliance Risk Management is to ensure that the Risk Management process can minimize the possibility of negative impacts from BPR's behavior that deviates from or violates generally applicable standards and/or legislation regulations.
Sources of Compliance Risk include among others:

a. Legal Behavior
As a legal subject, BPR can engage in legal behavior consisting of errors that can be interpreted broadly to include three elements: intent, negligence, and accountability. Legal behavior performed by BPR can include violations of public law, including among others regulations of the Financial Services Authority (OJK), as well as private law, including among others agreements with third parties.

b. Organizational Behavior
The Board of Directors, as the representative of the organization, must establish ways to achieve organizational objectives implemented in the form of organizational behavior. In this regard, the Board of Directors has the authority to influence the performance of BPR's organization. There are several factors influencing the Board of Directors' decisions in conducting business related to Compliance Risk, including among others business profile factors, economic factors, psychological factors, and sociological factors.

c. Weaknesses in Legal Aspects
Weaknesses in legal aspects can occur in agreements made by BPR regarding the validity conditions and content of agreements with third parties. BPR's weak position in making agreements with third parties can result in among others financial losses. Weaknesses in legal aspects can lead to litigation processes in court.

d. Legislation Supporting BPR Products and Activities In conducting business activities, BPR must refer to applicable legislation. In the event that there are BPR products and activities not yet supported by legislation, this can cause legal Risks for BPR.

The impact of Compliance Risk can be direct losses and indirect losses. Direct losses are financial losses that directly impact profit or loss, including among others decreased profits and business losses, and decreased asset values. Indirect losses are losses that are difficult to calculate financially and do not directly impact profit or loss, including among others work process inefficiencies, and lost opportunities to obtain profits.

B. Supervision by the Board of Directors and Board of Commissioners

In implementing Risk Management through supervision by the Board of Directors and Board of Commissioners for Compliance Risk, in addition to implementing supervision as referred to in Chapter I letter A, BPR adds the implementation, namely:

Authority and Responsibilities of the Board of Directors and Board of Commissioners

a. The Board of Directors and Board of Commissioners must ensure that Risk Management for Compliance Risk is carried out in an integrated manner with other Risk Managements that can impact BPR's Compliance Risk profile.

b. The Board of Directors and Board of Commissioners must ensure that every compliance issue that arises can be resolved effectively by the relevant work unit and that monitoring is conducted over corrective actions taken.

c. The Board of Directors has the authority and responsibility to:

Ensure that Risk Management is carried out in an integrated manner with other Risks present in BPR's Compliance Risk profile, for example, compliance with BPR lending regulations related to Credit Risk.
Ensure that every compliance issue that arises can be resolved effectively by the relevant work unit and that monitoring is conducted over corrective actions taken.
Ensure that the Compliance Risk Management function has been applied independently, reflected among others by the separation of functions between work units that identify, measure, monitor, and control Compliance Risk and work units that conduct and settle transactions with Compliance Risk exposure.

d. Board of Directors members who oversee the compliance function play an important role in Risk Management for Compliance Risk with responsibilities at least as referred to in the Financial Services Authority Regulation regarding the implementation of corporate governance for rural banks and the Financial Services Authority Circular Letter regarding the implementation of the compliance function for rural banks, including among others:

formulating strategies to encourage the creation of a compliance culture;
proposing compliance policies or compliance principles to be established by the Board of Directors;
establishing compliance systems and procedures to be used to formulate BPR's internal regulations and guidelines;
ensuring that all policies, regulations, systems, procedures, and business activities conducted by BPR are in accordance with legislation regulations;
minimizing BPR's Compliance Risk;
taking preventive actions so that policies and/or decisions taken by BPR's Board of Directors do not deviate from legislation regulations; and
performing other tasks related to the compliance function.

e. Board of Directors members who oversee the compliance function must submit reports on the implementation of their duties to the Financial Services Authority (OJK) as referred to in the Financial Services Authority Regulation regarding the implementation of corporate governance for rural banks, the Financial Services Authority Circular Letter regarding the implementation of the compliance function for rural banks, and other related regulations.

Human Resources

Employees in the Compliance Unit (SKP) are not allowed to be placed in positions vulnerable to conflicts of interest in carrying out compliance function responsibilities.

Compliance Risk Management Organization

a. BPR must have an adequate Compliance Risk Management function with clear authority and responsibilities for each unit or work unit carrying out the Compliance Risk Management function.

b. BPR must have an independent Compliance Unit (SKP) with duties, authorities, and responsibilities at least as referred to in the Financial Services Authority Regulation regarding the implementation of corporate governance for rural banks and the Financial Services Authority Circular Letter regarding the implementation of the compliance function for rural banks, including among others:

establishing steps to support the creation of a compliance culture in all BPR business activities at every level of the organization;
having written work programs and conducting identification, measurement, monitoring, and control related to Compliance Risk Management;
assessing and evaluating the effectiveness, adequacy, and suitability of BPR's policies, systems, and procedures with legislation regulations;
recommending updates and improvements to BPR's policies, regulations, systems, and procedures to ensure compliance with legislation regulations;
making efforts to ensure that BPR's policies, regulations, systems, procedures, and business activities are in accordance with legislation regulations; and
performing other tasks related to the compliance function.

Setting Risk Limits

In implementing Risk Management policies and procedures and setting Risk limits for Compliance Risk, in addition to implementing Risk Management policies and procedures and setting Risk limits, BPR adds the implementation:

Risk Management Strategy

The formulation of strategies for Compliance Risk refers to the general scope of implementation as referred to in Chapter I item B.1.

Policies and Procedures

a. BPR has adequate compliance work plans.

b. BPR ensures the effectiveness of Compliance Risk Management implementation, especially in formulating policies and procedures to be in accordance with generally applicable standards and/or legislation regulations, including among others related to:

accuracy of limit setting;
policies to exclude the execution of transactions exceeding limits;
application of compliance check policies through periodic procedures;
timeliness of communicating policies to all employees at every level of the organization;
adequacy of control over the development of new products and/or activities; and
adequacy of reports and data systems, especially in controlling the accuracy, completeness, and integrity of data.

Setting Risk Limits

a. Setting limits for Compliance Risk refers to the general scope of implementation as referred to in Chapter I item B.4.

b. BPR must comply with legislation regulations. This requires BPR to have no tolerance for Compliance Risk and to take quick and appropriate steps in handling Compliance Risk.

D. Process of Identification, Measurement, Monitoring, and Control of Risk, as well as Risk Management Information System

Identification of Compliance Risk

BPR must conduct identification and analysis of several factors that can increase Compliance Risk exposure and quantitatively impact BPR's profit or loss and capital, such as:
a. BPR's business activities, namely the type and complexity of BPR's business activities including new products and/or activities; b. BPR's non-compliance, namely the volume and materiality of BPR's non-compliance with internal policies and procedures, legislation regulations, and healthy business ethics practices and standards; and
c. litigation, namely the volume and materiality of litigation claims.

Measurement of Compliance Risk

In measuring Compliance Risk, one can use among others indicators or parameters such as the type, significance, and frequency of violations of legislation regulations or BPR's compliance track record, behavior underlying violations, and violations of generally applicable standards.

Monitoring of Compliance Risk

a. In carrying out the Compliance Risk Management function, continuous monitoring of Compliance Risk occurring across all Compliance Risk exposures must be conducted.

b. SKMR or PEMR compiles periodic progress reports on Compliance Risk, including factors causing Compliance Risk, which are submitted to Board of Directors members overseeing the Risk Management function and the Risk Management Committee, if any.

Control of Compliance Risk

BPR must ensure the effectiveness of the control system:
a. there is monitoring of deviant decision-making that is able to identify and measure increases in the frequency and volume of Risk exposure; b. BPR's responsiveness to deviations from BPR's internal policies and procedures; and
c. BPR's responsiveness to deviations in BPR's internal control system.

Risk Management Information System

The implementation of information management systems for Compliance Risk refers to the general scope of implementation as referred to in Chapter I item C.5.

E. Internal Control System

In the implementation of Compliance Risk Management, in addition to implementing internal controls as referred to in Chapter I letter D, BPR must have an internal control system for Compliance Risk, including among others to ensure BPR's responsiveness to deviations from generally applicable standards and/or legislation regulations.

CHAPTER V
LIQUIDITY RISK

Liquidity Risk is the Risk resulting from BPR's inability to meet maturing obligations from cash flow funding sources and/or high-quality liquid assets that can be pledged, without disrupting BPR's activities and/or financial conditions.
Liquidity Risk can be inherent in lending functional activities, fund provision, and funding activities.
Liquidity Risk is also called Second Tier Risk because it is often caused by other Risks, including among others Credit Risk and Reputational Risk. This Risk is also closely related to external factors, including among others macroeconomic conditions and policies that affect the availability of funding sources and/or market liquidity.
The main objective of Liquidity Risk Management is to minimize the possibility of BPR's inability to obtain cash flow funding sources. BPR needs to ensure daily fund adequacy both under normal conditions and crisis conditions in meeting obligations in a timely manner from various available funding sources.
The implementation of Risk Management for Liquidity Risk must be integrated with the overall implementation of Risk Management. In implementing Risk Management for Liquidity Risk, BPR needs to evaluate the Liquidity Risk profile faced in relation to capital adequacy.
Sources of Liquidity Risk can stem from BPR's inability to obtain cash flow funding sources, which can be caused among others by:
a. inability to generate cash flows from productive assets or from the sale of assets including liquid assets; and/or b. inability to generate cash flows from fund gathering, interbank transactions, and received loans.
BPR's inability to obtain funding to meet maturing obligations will decrease public confidence, thereby further increasing Liquidity Risk, and subsequently can affect other financial aspects that can threaten the continuity of BPR's business.
The interconnection of Liquidity Risk with other Risks includes among others:

a. Reputational Risk
Negative public opinion regarding BPR's liquidity conditions or financial conditions can trigger fund providers to request BPR to provide higher returns on funds invested in that BPR. In the event that public opinion worsens, there is a possibility for depositors to withdraw funds, thereby affecting BPR's liquidity.

b. Strategic Risk
Strategies and policies established by BPR can significantly impact BPR's liquidity position. For example, BPR's strategy to increase the credit portfolio or to conduct new activities can increase Liquidity Risk if BPR does not obtain adequate funding sources to finance those activities. Therefore, BPR needs to consider the impact of BPR's strategies or policies on BPR's funding capacity.

c. Credit Risk
BPR's Liquidity Risk can increase with increasing Credit Risk, which among others is caused by the growth of untested assets or credits or BPR lacking adequate experience, thereby worsening asset quality and increasing the potential for credit failure. If Credit Risk increases, Liquidity Risk also increases because BPR must increase funding costs to maintain the funding sources needed by BPR to anticipate potential losses from non-performing loans.

d. Operational Risk
In the event of changes in BPR's products and/or activities, BPR must adjust systems so that all transactions can be handled properly. Significant problems can occur if the system for processing transactions fails, thereby delaying transactions. In the event that customers experience difficulties in conducting transactions, customers may close accounts, thereby causing Liquidity Risk for BPR. Operational Risk caused by BPR employees, for example, fraud, can also increase Liquidity Risk if significant operational losses occur.

e. Compliance Risk
Compliance Risk can affect Liquidity Risk in the event of compliance violations of legislation regulations that impact BPR's Liquidity Risk.

B. Supervision by the Board of Directors and Board of Commissioners

In implementing Risk Management through supervision by the Board of Directors and Board of Commissioners for Liquidity Risk, in addition to implementing supervision as referred to in Chapter I letter A, BPR adds the implementation, namely:

Authority and Responsibilities of the Board of Directors and Board of Commissioners

a. The Board of Directors and Board of Commissioners are responsible for ensuring that the implementation of Risk Management for Liquidity Risk is in accordance with strategic objectives, scale, business characteristics, and BPR's Liquidity Risk profile, including ensuring the integration of Risk Management implementation for Liquidity Risk with other Risks that can impact BPR's liquidity position.

b. The Board of Directors ensures that Risk Management implementation is effective, including among others monitoring developments and issues in BPR's business activities related to Liquidity Risk.

c. In Liquidity Risk management, the Board of Directors has authority and responsibility at least including:

monitoring BPR's liquidity position and Liquidity Risk based on current adequacy and evaluation of funding strategy implementation, especially under unfavorable market conditions;
conducting periodic evaluations of BPR's liquidity position and Liquidity Risk;
conduct an immediate evaluation of liquidity conditions and the Rural Bank's Risk profile in the event of significant changes, including the following conditions:
a) an increase in the cost of fund collection; b) an increase in asset or liability concentration; c) an increase in the liquidity gap; d) limitations on alternative funding sources; e) material exceedance of limits; and/or f) changes in market conditions that may cause problems in the future;
adjust Risk Management policies and strategies for Liquidity Risk as necessary based on the evaluation of Liquidity Risk results; and
report to the Board of Commissioners regarding Liquidity Risk and the implementation of Risk Management policies and procedures for Liquidity Risk, including an evaluation of policies, strategies, procedures, and liquidity conditions, both periodically and when significant changes occur.
d. The Board of Commissioners, in the implementation of Risk Management for Liquidity Risk, has the authority and responsibility, including approving and periodically evaluating Risk Management policies for Liquidity Risk, including emergency funding plans. Periodic evaluations may be conducted once (one) per year (one) or more frequently in the event of changes in factors significantly affecting the Rural Bank's business activities.

Human Resources
The adequacy of Human Resources for Liquidity Risk refers to the general implementation scope as referred to in Chapter I, Section A.2.
Liquidity Risk Management Organization
The adequacy of the Risk Management organization for Liquidity Risk refers to the general implementation scope as referred to in Chapter I, Section A.3.

Risk Limit Determination
In implementing Risk Management policies and procedures and determining Risk limits for Liquidity Risk, in addition to implementing Risk Management policies and procedures as referred to in Chapter I, Letter B, Rural Banks must add the following implementation:

Risk Management Strategy
Rural Banks must formulate strategies for Liquidity Risk, referring to the scope as referred to in Chapter I, Section B.1.
Policies and Procedures
a. Liquidity Risk Management policies and procedures must be formulated in accordance with the Rural Bank's vision, mission, business strategy, capital adequacy, Human Resources capacity, and the level of Risk to be taken by the Rural Bank. b. Liquidity Risk Management policies and procedures must include, at a minimum:

Policies regarding Human Resources and organizations related to Liquidity Risk management, including the responsibilities of each involved unit or function, such as the Board of Directors, Board of Commissioners, and internal audit.
Liquidity management policies and procedures, which must include, at a minimum:
a) asset and liability composition; b) the level of liquid assets that the Rural Bank must maintain; c) diversification and stability of funding sources; d) liquidity management across various funding sources; e) daily Liquidity Risk management; f) Liquidity Risk limits; and g) assessment of liquidity factors in accordance with applicable regulations regarding the health level of Rural Banks.
c. Determination of indicators, which are early warning indicators for Liquidity Risk, as a tool for identifying problems and determining Liquidity Risk mitigation. The aforementioned early warning indicators include internal and external indicators.
d. Liquidity Risk measurement methods must be adjusted to the Rural Bank's fund management strategy so as to accurately reflect the Rural Bank's Liquidity Risk profile. e. Risk Management information systems and other systems that are adequately necessary for the identification, measurement, monitoring, and control of Liquidity Risk, including liquidity reporting. f. Emergency funding plans, including those explaining the approach and strategy for facing crisis conditions affecting the Rural Bank's Liquidity Risk. Policies regarding emergency funding plans must include, at a minimum, the Rural Bank's response actions in a liquidity crisis situation and the methods used to obtain funding in such situations. g. Liquidity Risk Management policies and procedures approved by the Board of Commissioners must be communicated and implemented effectively by Rural Bank units handling functional activities with Liquidity Risk exposure. Furthermore, Liquidity Risk Management policies must be evaluated and updated periodically with changes in liquidity conditions, vision, mission, and business strategy, as well as overall capital capacity. Rural Banks must also have clear policies regarding funding responsibilities, reporting, and pricing policies.

Risk Limit Determination
a. Risk limits must be determined and implemented consistently, paying at least attention to the following:

periodic funding needs or liquidity surplus; and
potential liquidity shortages occurring based on past experience.
Risk limits must be evaluated and adjusted in the event of significant overall changes in market conditions. b. Policies, procedures, and processes for determining Liquidity Risk limits must be documented in writing and completely to facilitate audit trails.
c. The level of Risk to be taken by the Rural Bank is reflected, among other things, in the composition of assets and liabilities and the gapping strategy performed by the Rural Bank.
d. Risk tolerance for Liquidity Risk must reflect the level of Liquidity Risk to be taken by the Rural Bank, determined, among other things, by the composition of liquid assets and funding sources owned by the Rural Bank to support the Rural Bank's current and future strategies. Example:
After comparing historical data, economic and market conditions, and peer groups, Rural Bank A determines the level of Risk to be taken and Risk tolerance for Liquidity Risk by establishing several parameters, including:

Parameter	Risk Appetite	Risk Tolerance
Ratio of liquid assets to total assets	20%	15%
Ratio of liquid assets to current liabilities	40%	20%
Ratio of total loans to total third-party funds other than banks	90%	95%

Note: This table is only an example and cannot immediately serve as the basis for determining the level of Risk to be taken or Risk tolerance for each Rural Bank.

D. Process of Identification, Measurement, Monitoring, and Control of Risk, as well as Risk Management Information Systems In implementing Risk Management through the processes of identification, measurement, monitoring, and control of Risk, as well as Risk Management information systems for Liquidity Risk, in addition to implementing the processes referred to in Chapter I, Letter C, Rural Banks must add the following implementation:

Liquidity Risk Identification
a. Rural Banks must conduct careful identification and analysis of all sources of Liquidity Risk, including:

Rural Bank products and activities that can affect the sources and use of funds, both in asset and liability positions and administrative accounts; and
Other Risks that can increase Liquidity Risk, such as Credit Risk, Compliance Risk, and Operational Risk.
b. Analysis is conducted to determine the amount and trend of liquidity needs and available funding sources to meet those needs.
c. Rural Banks must analyze exposures to other Risks that can increase Liquidity Risk. Generally, Liquidity Risk is often caused by weaknesses or problems arising from other Risks, so Risk identification must include the link between Liquidity Risk and other Risks.
d. Rural Banks must analyze the potential impact of applying various different scenarios on liquidity positions depending on cash flow patterns under various conditions. e. Rural Banks may apply various scenarios used to assess:
Rural Bank cash flows and liquidity positions in normal conditions;
Rural Bank scenarios during a crisis, reflected, among other things, by the non-renewal of most of the Rural Bank's liabilities; and
banking system scenarios during a crisis, reflected, among other things, by the condition where most or all of the banking system faces liquidity problems.
f. In applying these scenarios, Rural Banks make assumptions regarding future liquidity needs, both short-term and long-term, and the Rural Bank's ability to obtain liquidity based on existing sources.

Liquidity Risk Measurement
a. Rural Banks have measurement tools that can quantify Liquidity Risk accurately and comprehensively in a timely manner. b. Liquidity Risk measurement includes:

assessment of deposit structures based on type, maturity, interest rate, fund owners, and ownership concentration;
assessment of all cash inflows and outflows, including funding needs to meet commitments on administrative accounts, to identify potential funding shortages in the future;
assessment of the Rural Bank's ability to obtain liquidity in the market, both in normal conditions and in crisis conditions; and
assessment of liquid assets that can be converted into cash, particularly in crisis conditions, i.e., when the Rural Bank cannot meet all obligations using positive cash flows and loans owned.
c. Liquidity calculations can be performed by compiling cash flows based on maturity or estimates using assumptions based on the Rural Bank's past experience.
d. If cash flow estimates are based on statistical data estimates, the accuracy and precision of these estimates must be reviewed periodically. Furthermore, the assumptions and variables used in these estimates must be evaluated according to changes in market conditions, competition factors among Rural Banks, and changes in Rural Bank customer behavior.

Liquidity Risk Monitoring
a. Liquidity Risk monitoring conducted by Rural Banks pays attention to early warning indicators to know potential increases in the Rural Bank's Liquidity Risk. b. Rural Banks assess the stability and trends of community fund deposits and formulate worst-case scenarios based on observations of the largest withdrawal trends that have occurred during the observation period, particularly for Rural Banks that have experienced very large fund withdrawals.
c. Rural Banks collect data and monitor liquidity positions periodically (daily, weekly, monthly, and other periods) as well as potential losses caused by Liquidity Risk, including by managing the maturity of liquidity positions.
d. Rural Banks must periodically evaluate the factors causing Liquidity Risk and its connection to potential losses. e. For the purpose of monitoring Liquidity Risk exposure, the Risk Management Committee (SKMR) or Risk Management Unit (PEMR) must compile reports on losses caused by Liquidity Risk factors and submit them to the Board of Directors and the Risk Management Committee, if any.
Liquidity Risk Control
a. Liquidity Risk control is conducted through funding strategies, liquidity position management, daily Liquidity Risk management, and emergency funding plans. b. Funding strategies include strategies for diversifying funding sources and maturities linked to the Rural Bank's characteristics and business plans.
c. Rural Banks must identify and monitor key factors affecting the ability to obtain funds, including identifying and monitoring alternative funding sources and market access that can strengthen the Rural Bank's capacity to withstand crisis conditions.
d. Liquidity position management and daily Liquidity Risk management aim to meet obligations at all times throughout the day (intra-day) accurately, both in normal conditions and crisis conditions, by prioritizing immediate obligations. e. Rural Banks have emergency funding plans to avoid liquidity difficulties that may cause the Rural Bank to fail to make payments to other parties. Emergency funding plans must include accurate assumptions and estimates, including:

determination of deposit stability and cash outflows based on statistical estimates;
the possibility of counterparty (bank and non-bank) failure to meet obligations on time; and
the possibility of administrative account transaction withdrawals.
f. Rural Banks periodically evaluate emergency funding plans to determine the amount of funds that can be obtained from regular funding sources.

Risk Management Information Systems
a. Liquidity Risk Management information systems must provide complete, accurate, current, and comprehensive information and reports regarding liquidity conditions, maturity profiles against Rural Bank liabilities, and projected cash flows. These systems must be designed and developed in accordance with changes in internal and external conditions. b. Risk Management information systems must fulfill reporting obligations to the Financial Services Authority (OJK) and must provide information, at a minimum, regarding:

cash flows from assets, liabilities, and administrative accounts;
compliance with Risk Management policies, strategies, and procedures for Liquidity Risk, including limits and liquidity ratios;
Risk profile and liquidity trend reports for the Rural Bank's benefit in a timely manner;
information that can be used for Liquidity Risk measurement purposes; and
other information related to Liquidity Risk, such as the concentration of funding sources, assets and liabilities, and unstable administrative account receivables and payables.
c. The Risk Management Committee (SKMR) or Risk Management Unit (PEMR) must analyze the generated reports and subsequently submit the analysis results periodically according to the Rural Bank's needs to the Board of Directors, the Risk Management Committee, if any, and the Internal Audit Committee (SKAI) or Internal Audit Unit (PEAI). The frequency of report submission may be increased if the analysis results indicate that the Rural Bank has significant potential liquidity difficulties.
d. The effectiveness and reliability of reports generated by the information system must be re-tested periodically according to the latest liquidity gap position.

E. Internal Control System

Rural Banks must have adequate internal control systems to ensure the integrity, effectiveness, and fairness of the Risk Management process for Liquidity Risk.
Internal control over the implementation of Risk Management for Liquidity Risk conducted by the Internal Audit Committee (SKAI) or Internal Audit Unit (PEAI) includes, among other things:
a. the adequacy of Board of Directors and Board of Commissioners oversight governance; b. the adequacy of policies, procedures, and Liquidity Risk limit determinations;
c. the adequacy of the identification, measurement, monitoring, and control processes, as well as Liquidity Risk Management systems; and
d. the adequacy of comprehensive internal control systems for Liquidity Risk.
Rural Banks must evaluate the implementation of Risk Management for Liquidity Risk, including:
a. compliance with liquidity management policies and procedures; b. the adequacy of systems and procedures for identifying, measuring, monitoring, and controlling Liquidity Risk, including the adequacy of methods, assumptions, and Liquidity Risk measurement indicators;
c. the effectiveness of the implementation process of identifying, measuring, monitoring, and controlling Liquidity Risk periodically;
d. Liquidity Risk measurement model performance, including by comparing Liquidity Risk measurement results with actual values; and e. the integrity of Risk Management information system reports.
Weaknesses identified in internal controls and the results of Liquidity Risk management implementation evaluations must be reported immediately to the Board of Directors for follow-up action.

CHAPTER VI
REPUTATION RISK

Reputation Risk is the Risk resulting from a decrease in the level of trust of stakeholders stemming from negative perceptions regarding the Rural Bank.
The main objective of implementing Risk Management for Reputation Risk is to anticipate and minimize the loss impact of the Rural Bank's Reputation Risk.
Reputation Risk is not a standalone Risk, but a second-tier Risk (second tier risk), i.e., a Risk that occurs because it is triggered by other Risks such as Credit Risk, Liquidity Risk, or Operational Risk. Thus, when assessing Reputation Risk, the relationship between Reputation Risk and other Risks must be understood.
For example, weaknesses in the Rural Bank's information technology that cause customer transaction failures are Operational Risks that can cause Reputation Risk in the form of negative media coverage of the Rural Bank's services. However, in certain cases, Reputation Risk may also occur without being preceded by other Risks, such as negative reporting due to misunderstandings with customers or information manipulation by business competitors.
Reputation Risk can stem from various Rural Bank business activities, including:
a. events that have harmed the Rural Bank's reputation, such as negative media coverage, violations of business ethics, and customer complaints; or b. other matters that can cause Reputation Risk, such as weaknesses in governance, corporate culture, and Rural Bank business practices.
Rural Bank Reputation Risk can also be caused by the influence of reputation events involving members of the Board of Directors, members of the Board of Commissioners, shareholders, and/or parties associated with the Rural Bank. Rural Banks must also pay attention to the frequency and significance of customer complaints. Furthermore, business partners can play a role in increasing the Rural Bank's Reputation Risk. Cooperation conducted by the Rural Bank with business partners experiencing reputation disturbances can impact the Rural Bank's operational activities, especially if the aforementioned business partners support the Rural Bank's operational activities, such as information technology service providers that continuously operate the Rural Bank's core banking applications.
Rural Banks must implement Reputation Risk Management appropriate to the scale and complexity of the business. Reputation Risk Management not only mitigates the downside aspects of the Rural Bank's reputation but is also part of the Rural Bank's overall efforts to build the Rural Bank's reputation to increase competitiveness.
Reputation is highly influenced by several factors in Rural Bank business, including:
a. managerial and leadership aspects and the application of governance; b. other Risks, so Rural Banks must pay attention to the level and exposure of the Rural Bank to Risks other than Reputation Risk, particularly Credit Risk, Operational Risk, and Liquidity Risk; and
c. the development of stakeholder needs and the business environment.
By considering the interrelationship between Risks, building reputation, and addressing issues related to Rural Bank reputation, Rural Banks may be able to improve other aspects that can enhance Rural Bank reputation.

B. Board of Directors and Board of Commissioners Oversight In implementing Risk Management through Board of Directors and Board of Commissioners oversight for Reputation Risk, in addition to implementing oversight as referred to in Chapter I, Letter A, Rural Banks must add the following implementation:

Authority and Responsibility of the Board of Directors and Board of Commissioners
a. The Board of Directors and Board of Commissioners must pay attention to the implementation of Risk Management for Reputation Risk by relevant units, including public relations (PR) units and other relevant business units. b. The Board of Directors and Board of Commissioners must understand the Reputation Risk inherent in certain Rural Bank activities, particularly those that can significantly affect financial conditions, and implement approval and evaluation of policies for controlling Reputation Risk.
c. The Board of Directors and Board of Commissioners must behave professionally and maintain business ethics so as to serve as examples for all elements of the Rural Bank organization in efforts to build and maintain reputation.
d. The Board of Directors must ensure that the Rural Bank has policies to calculate the impact of Reputation Risk on the Rural Bank's capital. e. The Board of Directors must ensure that the Rural Bank has work units, employees, or functions with the authority and responsibility to provide comprehensive information to customers and other stakeholders regarding Rural Bank business activities in order to control Reputation Risk.
Human Resources
The adequacy of Human Resources for Reputation Risk refers to the general implementation scope as referred to in Chapter I, Section A.2.
Reputation Risk Management Organization
a. Regarding the Reputation Risk Management organization, all employees, including business unit management and supporting activity management of the Rural Bank, must be part of the implementation structure for Risk Management for Reputation Risk, given that reputation is the result of all Rural Bank business activities. The role of business unit management is to identify Reputation Risks occurring in their business or activities and to act as front-liners in building and preventing Reputation Risk, particularly regarding customer relations. b. Units implementing Risk Management for Reputation Risk are responsible, among other things:

performing public relations functions and following up on negative reporting or other events affecting the Rural Bank's reputation and causing losses to the Rural Bank; and
communicating information needed by Rural Bank stakeholders, including investors, customers, creditors, associations, and the community.

Risk Limit Determination
In implementing Risk Management policies and procedures and determining Risk limits for Reputation Risk, in addition to implementing Risk Management policies and procedures as referred to in Chapter I, Letter B, Rural Banks must add the following implementation:

Risk Management Strategy
The formulation of Risk Management strategies for Reputation Risk refers to the general implementation scope as referred to in Chapter I, Section B.1.
Policies and Procedures
a. Rural Banks must have written policies and procedures that meet the principles of transparency and improving the quality of service to customers and other stakeholders in order to control Reputation Risk. These policies must be in line with applicable regulations regarding consumer protection. b. Rural Banks must have and implement appropriate communication policies in order to face news or publications that are negative or prevent information that tends to be counterproductive, including by applying effective media usage strategies to respond to negative news.
c. Rural Banks need to have special protocols for reputation management during crises so that they can quickly anticipate increases in Reputation Risk.
d. Rural Banks must implement procedures to control Reputation Risk related to Reputation Risk experiences that materially affect the Rural Bank's financial conditions.
Risk Limit Determination
a. Reputation Risk limits are generally not limits that can be quantified financially. For example: limits on time to follow up on customer complaints and time limits on...

waiting in line to receive services. The example mentioned relates to Risk mitigation in the context of resolving customer complaints and mitigating Reputational Risk resulting from customer complaints.

b. Determination of the level of Risk to be taken and Risk tolerance for Reputational Risk refers to the general scope of implementation as referred to in Chapter I item B.4.

Example:
After comparing historical data, economic and market conditions, and peer groups, BPR A determines the level of Risk to be taken and Risk tolerance for Reputational Risk by establishing several parameters as follows:

Parameter	Risk Appetite	Risk Tolerance
Number of customer complaints	10	15
Number of negative reports from parties associated with the BPR	1 news report in mass media	3 news reports in mass media

Note: This table is only an example and cannot immediately be used as a basis for determining the level of Risk to be taken or Risk tolerance for each BPR.

D. Process of Risk Identification, Measurement, Monitoring, and Control, as well as Risk Management Information Systems

In implementing Risk Management through the processes of risk identification, measurement, monitoring, and control, as well as Risk Management information systems for Reputational Risk, in addition to carrying out the processes referred to in Chapter I letter C, BPRs must add the following implementation:

Identification and Measurement of Reputational Risk

a. BPRs must identify Reputational Risk inherent in specific functional activities such as lending (fund provision), operations, services, information technology, and human resources. b. BPRs must record and account for every event related to Reputational Risk, including the amount of potential losses caused by the said event, in a data administration system. The recording and accounting of this data are compiled into statistical data that can be used to project potential losses for a certain period and specific functional activities.
c. BPRs can use various information sources to identify and measure the impact of Reputational Risk, including mass media reports, BPR websites and social network analysis results, customer complaints through customer service, and customer satisfaction questionnaires.

Monitoring of Reputational Risk

BPRs monitor Reputational Risk continuously based on past loss experiences caused by Reputational Risk. The implementation of monitoring for Reputational Risk refers to the general scope of implementation as referred to in Chapter I item C.3.

Control of Reputational Risk

a. BPRs must immediately follow up on and resolve customer complaints and lawsuits that can increase Reputational Risk exposure. b. BPRs must develop reliable mechanisms to carry out effective Reputational Risk control measures. Generally, Reputational Risk control can be carried out through 2 (two) things:

prevention of events that cause Reputational Risk, which is generally carried out through a series of activities as follows:
a) social and environmental responsibility (corporate social responsibility), which is a series of activities carried out by BPRs for community empowerment in the form of economic or social activities expected to build a positive reputation among stakeholders towards the BPR; and b) routine communication or education to stakeholders in order to form a positive reputation among stakeholders.
recovery of BPR reputation after an event causing Reputational Risk occurs, which is all follow-up actions by the BPR to restore reputation and prevent a decline in BPR reputation.
c. Mitigation of Reputational Risk or events causing Reputational Risk is carried out by considering the materiality of the problem and costs. Nevertheless, Reputational Risk can be accepted as long as it is still in accordance with the level of Risk to be taken.
d. In order to control Reputational Risk on a larger scale in the future, the preventive and recovery actions for Reputational Risk that have been carried out must be followed by improvements in control weaknesses and procedures that trigger Reputational Risk.

Risk Management Information System

a. BPRs must have regular procedures and mechanisms for reporting Reputational Risk or events causing Reputational Risk, both in written form and in electronic system form, including discussions in the Board of Directors and/or Board of Commissioners meetings of the BPR. b. BPRs must have an early warning system mechanism to provide signals to the Board of Directors and/or Board of Commissioners so that they can carry out follow-up and necessary mitigation.

E. Internal Control System

BPRs must resolve customer complaints and lawsuits that can increase Reputational Risk exposure, for example, by communicating continuously with opposing parties (banks and non-banks) and conducting bilateral negotiations with customers to avoid litigation and legal claims.
BPRs can cooperate with third parties, such as the use of outsourcing, in order to control Reputational Risk by considering the costs and benefits of using outsourcing.
The implementation of the internal control system for Reputational Risk refers to the general scope of implementation as referred to in Chapter I letter D.

CHAPTER VII
STRATEGIC RISK

Strategic Risk is Risk resulting from the inaccuracy of the BPR in making and/or implementing a strategic decision, as well as the BPR's failure to anticipate changes in the business environment.
Strategic Risk is important because weaknesses in BPR's management of Strategic Risk can lower the BPR's competitive position in the industry and potentially trigger the overall failure of the BPR's business.
Strategic Risk can originate from weaknesses in the strategy formulation process and inaccuracy in strategy formulation, inadequate management information systems, inadequate results of internal and external environment analysis, overly aggressive setting of strategic objectives, inaccuracy in strategy implementation, and failure to anticipate changes in the business environment.
The implementation of Strategic Risk Management aims to ensure that the Risk Management process can minimize the possibility of negative impacts from inaccurate strategic decision-making and failure to anticipate changes in the business environment.
In formulating strategies to minimize Strategic Risk, the following must be considered:
a. External factors, including local economic conditions, technological development, competitive conditions or competitors, and customer preferences. b. Internal factors, including vision, mission, corporate culture, financial conditions, human resources, and infrastructure at the BPR.
The BPR's consideration of external and internal factors and their alignment with the BPR's vision and mission must be formulated into strategies established by the BPR in conducting business as outlined in the BPR's business plan. In addition, the BPR must consider changes in business strategy in the implementation of Strategic Risk Management, including additions or changes in main business focus and organizational changes related to the expansion of office networks and products.

B. Supervision by the Board of Directors and Board of Commissioners

In implementing Risk Management through supervision by the Board of Directors and Board of Commissioners for Strategic Risk, in addition to carrying out supervision as referred to in Chapter I letter A, BPRs must add the following implementation:

Authority and Responsibilities of the Board of Directors and Board of Commissioners

a. The Board of Directors and Board of Commissioners must understand the Strategic Risk inherent in specific BPR activities, especially those that can significantly affect the BPR's financial condition, and carry out approval and evaluation of policies for the purpose of controlling Strategic Risk. b. The Board of Directors must formulate a business plan and have it approved by the Board of Commissioners, which covers matters as referred to in the Financial Services Authority Regulation regarding business plans for rural banks and sharia retail financing banks, and communicate it to employees at every organizational level.
c. The Board of Directors is responsible for ensuring that established strategic objectives are aligned with the vision and mission, corporate culture, business direction, and BPR Risk tolerance, providing approval for strategic plans and any changes, and conducting periodic evaluations.
d. The Board of Directors must ensure that the structure, corporate culture, infrastructure, financial conditions, personnel and managerial competence including Executive Officials, as well as systems and controls are suitable and adequate to support the implementation of established strategies. e. The Board of Directors must monitor internal conditions (BPR weaknesses and strengths) and the development of external conditions that directly or indirectly affect the established business strategy of the BPR. f. The Board of Directors must establish work units or employees or functions that have the authority and responsibility to support the formulation and monitoring of strategy implementation, including strategic plans and business plans. g. The Board of Directors is responsible for ensuring that Risk Management for Strategic Risk has been implemented effectively and consistently at all relevant operational levels. In the event that the Board of Directors delegates part of its responsibilities to officials, such delegation does not eliminate the obligation of the Board of Directors as the primary party responsible.

Human Resources

The adequacy of Human Resources for Strategic Risk refers to the general scope of implementation as referred to in Chapter I item A.2.

Strategic Risk Management Organization

a. All business units and support units are responsible for assisting the Board of Directors in formulating plans and implementing strategies effectively. b. Business units and support units are responsible for ensuring at least:

Strategic Risk Management and control practices in business units are consistent with the overall Strategic Risk Management framework; and
Business units and support units have policies, procedures, and resources to support the effectiveness of the Strategic Risk Management framework.
c. The Board of Directors leads change programs required for the implementation of established strategies.
d. Work units, employees, or functions at the BPR that perform strategic planning functions are responsible for assisting the Board of Directors in managing Strategic Risk and facilitating change management in the context of sustainable company development. e. SKMR or PEMR is responsible for the Strategic Risk Management process at least:
coordinating with all business units in the process of formulating strategic plans;
monitoring and evaluating the development of strategic plan implementation, providing input regarding opportunities and choices available for continuous strategy development and improvement; and
ensuring that all strategic issues and influences on the achievement of strategic objectives are followed up in a timely manner.

C. Risk Management Policies, Risk Management Procedures, and Risk Limit Determination

In implementing Risk Management policies and procedures as well as Risk limit determination for Strategic Risk, in addition to carrying out Risk Management policies and procedures as well as Risk limit determination as regulated in Chapter I letter B, BPRs add the following implementation:

Risk Management Strategy

a. BPRs must evaluate their competitive position in the industry in the context of formulating Risk Management strategies, at least covering:

analysis of external factors including business, economic, and banking industry environmental conditions in the location where the BPR operates, including the impact of environmental changes on BPR business, products, technology, and office networks;
measuring BPR's strengths and weaknesses related to competitive position, BPR's business position in the banking industry, financial performance, organizational structure and Risk Management functions, infrastructure for current and future business needs, managerial capability, as well as the availability and limitations of BPR resources; and
analysis of all available strategy alternatives after considering BPR's strategic objectives and Risk tolerance. The depth and scope of analysis must be in line with the scale and complexity of the BPR's business activities.
b. BPRs must establish strategic plans and business plans in writing, implement these policies, and conduct evaluations and adjustments in the event of deviations from targets due to significant external and internal changes. In the event of a long-term strategy implementation plan, the BPR must have adequate managerial succession plans to support the effectiveness of the implementation of the said strategy.
c. Business plans must state reasons in the form of assumptions related to established targets.
d. BPRs must have sufficient resources to support the implementation of strategic plans.

Policies and Procedures

a. BPRs must have policies and procedures for formulating and approving strategic plans. The said strategic plans must be evaluated periodically and adjusted if there are deviations from targets to be achieved as a result of changes in external and internal environments. b. BPRs must have adequate procedures to identify and respond to changes in the business environment.
c. BPRs must have procedures to measure progress achieved from the realization of business plans and performance according to the established schedule.

Risk Limit Determination

a. Strategic Risk limits generally relate to limits on deviations from established strategic plans, such as budget deviation limits and target completion time deviation limits. b. Determination of the level of Risk to be taken and Risk tolerance for Strategic Risk refers to the general scope of implementation as referred to in Chapter I item B.4.

Example:
After comparing historical data, economic and market conditions, and peer groups, BPR A determines the level of Risk to be taken and Risk tolerance for Strategic Risk by establishing parameters as follows:

Parameter	Risk Appetite	Risk Tolerance
Ratio of comparison between realization and main financial indicator targets according to the business plan	100%	90%

Note: This table is only an example and cannot immediately be used as a basis for determining the level of Risk to be taken or Risk tolerance for each BPR.

D. Process of Risk Identification, Measurement, Monitoring, and Control, as well as Risk Management Information Systems

In implementing Risk Management through the processes of risk identification, measurement, monitoring, and control, as well as Risk Management information systems for Strategic Risk, in addition to carrying out the processes as regulated in Chapter I letter C, BPRs add the following implementation:

Identification of Strategic Risk

a. BPRs must identify and account for performance changes resulting from the non-realization or ineffectiveness of the implementation of established business strategies or business plans, especially those that are significant to the BPR's capital. b. BPRs must conduct Risk analysis, especially regarding strategies that require many resources and/or are high risk, such as strategies to enter new market segments, acquisition strategies, or diversification strategies in the form of products and/or activities.

Measurement of Strategic Risk

a. In the process of measuring Strategic Risk, BPRs can use indicators or parameters such as the complexity level of the BPR's business strategy, the BPR's business position in the banking industry, and the achievement of business plans. b. BPRs can conduct trials on strategy implementation in order to identify any events or changes in the business environment that can have a negative impact on the fulfillment of initial assumptions from strategic plans and measure the potential negative impact of the said events on BPR business performance, both financially and non-financially.
c. Trial results must provide feedback to the strategy planning process.
d. In the event that trial results show a Risk level higher than the BPR's Risk tolerance or the BPR's ability to absorb Risk, the BPR develops a contingency plan or strategy to mitigate Risk.

Monitoring of Strategic Risk

a. BPRs monitor Strategic Risk continuously by analyzing past loss experiences caused by Strategic Risk or deviations in strategy plan implementation. b. Strategic issues arising from operational and business environment changes that have a negative impact on the business condition or financial condition of the BPR must be reported to the Board of Directors in a timely manner, accompanied by an analysis of the impact on Strategic Risk and necessary corrective actions.

Control of Strategic Risk

a. BPRs must have systems and controls to monitor BPR performance, including financial performance, by monitoring realization compared to targets to be achieved and ensuring that the level of Risk to be taken is still within Risk tolerance limits. b. The said system is evaluated periodically by the Board of Directors to ensure the continuous suitability of the system.

Strategic Risk Management Information System

a. BPRs must ensure that the management information systems owned are adequate to support the process of strategic planning and decision-making and are evaluated periodically. b. Work units, employees, or functions at the BPR that perform Strategic Risk Management functions are responsible for analyzing realization reports against targets in business plans and submitting them to the Board of Directors in a timely manner.

This copy is consistent with the original
Legal Director 1
Legal Department signed
Yuliana

E. Internal Control System

The adequacy of the internal control system in the implementation of Risk Management for Strategic Risk refers to the general scope of implementation as referred to in Chapter I letter D.

Determined in Jakarta on January 21, 2019
CHIEF EXECUTIVE OF BANKING SUPERVISOR
FINANCIAL SERVICES AUTHORITY, signed
HERU KRISTIYANA

APPENDIX II
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 1 /SEOJK.03/2019 REGARDING IMPLEMENTATION OF RISK MANAGEMENT FOR RURAL BANKS

CHAPTER I
PROCEDURES FOR ASSESSING THE IMPLEMENTATION OF BPR RISK MANAGEMENT

A. GENERAL PRINCIPLES OF ASSESSING BPR RISK MANAGEMENT IMPLEMENTATION

Generally, the assessment of BPR Risk Management implementation is based on the following general principles:

Risk-Oriented
The assessment of BPR Risk Management implementation is based on BPR Risk and its impact on the overall performance of the BPR. This is done by identifying internal and external factors that can increase Risk or affect the financial performance of the BPR currently and in the future. Thus, BPRs are expected to be able to detect the root causes of BPR problems earlier and take preventive and corrective steps effectively and efficiently.
Proportionality
The use of parameters or indicators in each pillar of the assessment of BPR Risk Management implementation is done by considering the characteristics and complexity of the BPR's business. Parameters or indicators for assessing Risk Management implementation in this Financial Services Authority Circular are minimum standards that must be used in assessing Risk Management implementation. In addition, BPRs can use additional parameters or indicators according to the characteristics and complexity of the business in assessing Risk Management implementation so that it can reflect the condition of the BPR better.
Significance and Materiality
The assessment of BPR Risk Management implementation needs to consider the significance and materiality of each pillar and parameter or indicator of assessment for each type of Risk in concluding assessment results and setting Risk ratings. The determination of significance and materiality is based on analysis supported by adequate data and information regarding Risk and the financial performance of the BPR.
Comprehensive and Structured
The assessment process is carried out thoroughly and systematically and is focused on the main problems of the BPR. Analysis is carried out in an integrated manner, i.e., by considering the interrelationships between Risks. Analysis must be supported by key facts and relevant ratios to show the level, trends, and level of problems faced by the BPR.

B. STEPS FOR ASSESSING BPR RISK MANAGEMENT IMPLEMENTATION

The assessment of Risk Management implementation that results in a Risk rating is carried out according to the type of Risk that must be assessed according to the phased implementation of Risk Management as referred to in the Financial Services Authority Regulation regarding the implementation of Risk Management for rural banks. The said assessment is carried out through 4 (four) stages as follows:

Step 1 Assessment and determination of inherent Risk level Step 2 Assessment and determination of Risk Management Implementation Quality (KPMR) level Step 3 Determination of Risk level for each type of Risk Step 4 Determination of Risk rating

Step 1: Assessment and Determination of Inherent Risk Level

Inherent Risk assessment is an assessment of Risk inherent in BPR business activities, both quantifiable and non-quantifiable, that has the potential to affect the BPR's financial position.
The characteristics of BPR inherent Risk are determined by internal and external factors, including business strategy, business characteristics, complexity of BPR products and activities, banking industry conditions, and macroeconomic conditions.
Assessment of inherent risk is conducted by considering parameters or indicators that are both quantitative and qualitative.
The description of rating parameters presented in the appendix of this Financial Services Authority Circular is indicative and serves as a general reference. In the event of a discrepancy between actual conditions and the existing rating descriptions, it is possible to determine ratings based on general principles of risk assessment implementation as referred to in letter A.
In order to determine the level of inherent risk for each type of risk, a comprehensive analysis of all pillars and parameters must be conducted, including considering the interrelationships between pillars and parameters. This is to obtain an inherent risk level that objectively reflects the risk at the Rural Bank (BPR), through the determination of the significance and materiality of the pillars and parameters that most influence the BPR's inherent risk.
The determination of the inherent risk level is individual, meaning it is not influenced by the quality of risk management implementation or risk mitigation conducted by the BPR. The inherent risk level is categorized into rating 1 (very low), rating 2 (low), rating 3 (medium), rating 4 (high), and rating 5 (very high).
The BPR assigns ratings to each inherent risk parameter as follows:

a. Credit Risk
Credit risk is the risk arising from the failure of debtors and/or other parties to fulfill their obligations to the BPR. Credit risk can also be caused by concentrated fund provision, among others, on debtors, geographical areas, products, types of financing, or specific business fields. This risk is commonly referred to as credit concentration risk and is considered in the assessment of inherent risk.

Pillar: Asset Portfolio Composition and Credit Concentration Level

In this pillar, the BPR assesses the composition of the asset portfolio owned as well as the level of concentration of certain asset components linked to the attached credit risk, conducted by analyzing and assigning ratings to at least the following parameters:

a) Parameter: Ratio of productive assets to total assets

In this parameter, the BPR assesses the composition of productive assets owned, compared to total assets.

(1) Definition of productive assets is the provision of funds by the BPR in Rupiah currency to obtain income, in the form of loans, Indonesia Treasury Bills (SBI), and placements in other banks.

(2) Definition of total assets is the amount of assets in the BPR's financial position report.

The higher the percentage composition, the higher the risk the BPR has because the greater the likelihood of the BPR experiencing credit risk due to the failure of counterparties (banks and non-banks) to fulfill their obligations.

The determination of the parameter rating is based on the following indicative descriptions:

Rating	Description
1	< 95%, productive asset components have low credit risk exposure
2	>95%, productive asset components have moderate credit risk exposure
3	>95%, productive asset components have high credit risk exposure
4	>95%, productive asset components have very high credit risk exposure
5	>95%, productive asset components have very high credit risk exposure

Note:
BPRs with a ratio ≤ 95% may receive a worse rating than 1, for example, if the BPR has productive assets with higher credit risk exposure, such as fund placements in other BPRs that have a KPMM ratio below regulations and/or BPR loans are channeled to high-risk economic sectors with high non-performing loan levels.

b) Parameter: Ratio of loans given to total productive assets

In this parameter, the BPR assesses the composition of loans given, compared to total productive assets.

(1) Definition of loans given is all loans given to Banks and third-party non-banks.

(2) Definition of total productive assets is the provision of funds by the BPR in Rupiah currency to obtain income, in the form of loans, Indonesia Treasury Bills (SBI), and placements in other banks.

The higher the percentage composition, the higher the risk the BPR has because the greater the likelihood of the BPR experiencing credit risk due to the failure of debtors and/or other parties to fulfill their obligations to the BPR.

The determination of the parameter rating is based on the following indicative descriptions:

Rating	Description
1	< 75%
2	>75%, most or all credit schemes are simple, and credit types are not diverse
3	>75%, most or all credit schemes are simple, and credit types are diverse
4	>75%, most or all credit schemes are complex, and credit types are not diverse
5	>75%, most or all credit schemes are complex, and credit types are diverse

Note:

BPRs with a ratio ≤75% may receive a worse rating than 1, in cases where the BPR's credit portfolio has riskier schemes and types of credit, for example, working capital loans for plantations with more complex terms and conditions, or working capital loans for construction businesses requiring comprehensive credit analysis.
Simple credit schemes include employee salary-deducted loans with simple credit analysis, terms, and conditions.
Diversity of credit types refers to the variety of credit products marketed by the BPR, considering the size and scale of the BPR's business.
Other considerations for rating determination include the BPR's reach or ability to monitor and collect loans.

c) Parameter: Ratio of the 25 largest debtors to total loans given

In this parameter, the BPR assesses the concentration of the credit portfolio given to the 25 largest non-bank debtors, compared to total loans given.

(1) Definition of the 25 largest debtors is 25 non-bank debtors based on Customer Information File (CIF) with the largest credit balance.

(2) Definition of total loans given is all loans given to third-party non-banks.

The higher the concentration percentage, the higher the risk the BPR has because the greater the likelihood of the BPR experiencing credit risk due to large credit concentration on the 25 debtors, so that when the 25 debtors experience default, the BPR can suffer large losses simultaneously.

The determination of the parameter rating is based on the following indicative descriptions:

Rating	Description
1	< 20%
2	>20%, target market has not changed for a very long time
3	>20%, target market has not changed for a long time
4	>20%, target market has not changed for a fairly long time
5	>20%, target market has not changed for a short time

Note:

BPRs with a ratio < 20% may receive a worse rating than 1, in cases where the 25 largest debtors of the BPR in question come from a market share that changes quickly. Market share refers to the economic sector and type of business of the 25 largest debtors mentioned.
The time period related to market share (very long/long/fairly long/short) is determined by considering, among other things, how long the BPR has operated, the loan term given, for example, a mortgage loan with a 10-year credit term is considered short for a BPR that has only operated for 5 years because it has not been proven successful in managing the loan from initial issuance to repayment.
Other considerations for rating determination include: the lower the BPR's understanding of the economic sector of the 25 largest debtors and the higher the level of non-performing loans in the economic sector concerned compared to the total credit balance on the 25 largest debtors, the worse the risk rating.

d) Parameter: Ratio of loans per economic sector to total loans given

In this parameter, the BPR assesses the concentration of loans from 3 (three) economic sectors dominating the BPR's credit portfolio, compared to total loans given.

(1) Definition of loans per economic sector is loans to third-party non-banks based on economic sector categories as referred to in regulations governing monthly BPR reports.

(2) Definition of total loans given is all loans given to third-party non-banks.

The higher the concentration percentage, the higher the risk the BPR has because the greater the likelihood of the BPR experiencing credit risk due to large credit concentration on 3 (three) economic sectors, so that when loans from the three economic sectors concerned experience default, the BPR can suffer large losses simultaneously.

The determination of the parameter rating is based on the following indicative descriptions:

Rating	Description
1	< 85%
2	>85% loans from the 3 (three) largest economic sectors have not changed for a very long time
3	>85% loans from the 3 (three) largest economic sectors have not changed for a long time
4	>85% loans from the 3 (three) largest economic sectors have not changed for a fairly long time
5	>85% loans from the 3 (three) largest economic sectors have not changed for a short time

Note:

For BPRs with smaller size and business volume with credit portfolios of less than 3 (three) economic sectors, or larger BPRs with credit portfolios dominated by more than 3 (three) economic sectors, the number of economic sectors assessed can be adjusted to the conditions of each BPR.
BPRs with a ratio < 85% may receive a worse rating than 1, in cases where loans to the 3 (three) largest economic sectors of the BPR in question are given with credit schemes and types with higher credit risk.
The time period related to the target market (very long/long/fairly long/short) is determined by considering, among other things, how long the BPR has operated, the loan term given, for example, a mortgage loan with a 10-year credit term is considered short for a BPR that has only operated for 5 years because it has not been proven successful in managing the loan from initial issuance to repayment.
Other considerations for rating determination include: the lower the BPR's understanding of the economic sector financed and the higher the level of non-performing loans in the 3 (three) largest economic sectors compared to the total credit balance on the 3 (three) largest economic sectors, the worse the risk rating.

Pillar: Asset Quality

In this pillar, the BPR assesses the quality of assets owned, linked to the attached credit risk, conducted by analyzing and assigning ratings to at least the following parameters:

a) Parameter: Non-performing productive assets to total productive assets

In this parameter, the BPR assesses the amount of non-performing productive assets, compared to total productive assets.

(1) Definition of non-performing productive assets is the provision of funds by the BPR in Rupiah currency to obtain income, in the form of loans, Indonesia Treasury Bills (SBI), and placements in other banks, with fair, doubtful, and loss quality.

The higher the percentage of non-performing productive assets, the higher the risk faced by the BPR because the greater the likelihood of the BPR suffering losses.

b) Parameter: Net non-performing loan ratio to total loans given (NPL net)

In this parameter, the BPR assesses the amount of non-performing loans in net nominal terms, compared to total loans given.

(1) Definition of net non-performing loans is all loans given to third-party non-banks with fair, doubtful, and loss quality after being reduced by the formation of productive asset write-off provisions (PPAP).

(2) Definition of total loans given is all loans given to third-party non-banks.

The higher the percentage of net non-performing loans, the higher the risk faced by the BPR because the greater the likelihood of the BPR suffering losses.

c) Parameter: Low-quality loan ratio to total loans given

In this parameter, the BPR assesses the amount of loans assessed to have low quality, compared to total loans given.

(1) Definition of low-quality loans is all loans given to third-party non-banks with quality other than performing and loans restructured with performing quality.

(2) Definition of total loans given is all loans given to third-party non-banks.

The higher the percentage of low-quality loans, the higher the risk faced by the BPR because the greater the likelihood of the BPR suffering losses.

The determination of parameter ratings in the asset quality pillar is based on the following indicative descriptions:

Rating	Description
Non-performing productive assets/total productive assets	≤ 7%
Net non-performing loans/total loans given	≤ 5%
Low-quality loans/total loans given	≤ 7%
1	Ratio above the threshold of rating 1, with credit granting conditions having good quality, among others indicated by: 1. Restructured loans are not significant 2. Decline in credit quality from Performing Loan to Non-Performing Loan is not significant 3. High-risk economic sectors are not significant 4. Number of performing loans overdue >7 days is not significant 5. Non-performing productive asset components are mostly placements in other banks
2	Ratio above the threshold of rating 1, with credit granting conditions having fairly good quality, but there is potential for decline, among others indicated by: 1. Restructured loans are fairly significant 2. Decline in credit quality from Performing Loan to Non-Performing Loan is fairly significant 3. High-risk economic sectors are fairly significant 4. Number of performing loans overdue >7 days is fairly significant 5. Non-performing productive asset components are mostly placements in other banks
3	Ratio above the threshold of rating 1, with credit granting conditions having poor quality, among others indicated by: 1. Restructured loans are significant 2. Decline in credit quality from Performing Loan to Non-Performing Loan is significant 3. High-risk economic sectors are significant 4. Number of performing loans overdue >7 days is significant 5. Non-performing productive asset components are mostly loans
4	Ratio above the threshold of rating 1, with credit granting conditions having bad quality, among others indicated by: 1. Restructured loans are very significant 2. Decline in credit quality from Performing Loan to Non-Performing Loan is very significant 3. High-risk economic sectors are very significant 4. Number of performing loans overdue >7 days is very significant 5. Non-performing productive asset components are mostly loans

Note:

BPRs with asset quality ratios below the threshold of rating 1 may receive a worse rating than 1, in cases where productive asset conditions are riskier, for example, low NPLs are largely generated from restructuring results and collateral takeovers.
Determination of the significance of restructuring, decline in credit quality, high-risk economic sectors, and performing loans overdue >7 days considers, among other things, the number of restructured loans/decline in credit quality/high-risk economic sectors/loans overdue >7 days against the nominal credit portfolio as a whole, and the impact on the BPR's financial conditions (e.g., profit decline due to increased provisioning due to decline in credit quality).
Definition of high-risk economic sectors is linked to the possibility of loans from the economic sector concerned experiencing a decline in credit quality caused by various conditions, such as the impact of current economic conditions on the economic sector concerned, for example, the coal mining economic sector for exporting debtors as a result of the decline in coal commodity prices.

Pillar: Fund Provision Strategy

In this pillar, the BPR assesses the strategy established by the BPR in providing funds, from the side of credit portfolio growth linked to the attached credit risk, conducted by analyzing and assigning ratings to at least the credit growth parameter.

In this parameter, the BPR assesses the achievement of credit growth given to third-party non-banks and the economic sectors of debtors contributing to the credit growth concerned, compared to the achievement of industry credit growth.

The larger the positive difference between the BPR's credit growth and industry credit growth and the larger the credit channeled to economic sectors controlled by the BPR, the lower the BPR's risk because it shows the success of the strategy established by the BPR and the BPR's ability to understand the debtors financed.

The determination of the parameter rating is based on the following indicative descriptions:

Rating	Description
1	• Credit growth above industry average, and - Entirely channeled to economic sectors controlled.
2	• Credit growth above industry average, and - Most channeled to economic sectors controlled.
3	• Credit growth above or equal to industry average, and - A small portion or not at all channeled to economic sectors controlled.
4	• Credit growth below industry average, and - Most channeled to economic sectors controlled.
5	• Credit growth below industry average, and - A small portion or not at all channeled to economic sectors controlled.

Pillar: External Factors

In this pillar and parameter, the BPR assesses external factors linked to the attached credit risk, including changes in regional economic conditions, changes and developments in technology, regulations, and debtor business cycles, which can affect the debtor's ability to repay loans, thereby affecting risk including causing losses to the BPR.

The higher the impact of external factors on the debtor's ability to repay loans, the higher the risk for the BPR.

The determination of the parameter rating is based on the following indicative descriptions:

Rating	Description
1	There are changes in external factors, but no impact on the debtor's ability to repay loans.
2	There are changes in external factors, which impact the debtor's ability to repay loans resulting in loan defaults but do not cause a decline in the debtor's credit quality.
3	There are changes in external factors, which impact the debtor's business performance resulting in loan defaults but do not reduce the debtor's credit quality to NPL.
4	There are changes in external factors, which cause a decline in the debtor's credit quality to NPL.
5	There are changes in external factors, which cause the debtor's bankruptcy.

Note:

Industry average data can use data/information as published by BI, OJK, Perbarindo, BPS, or other accountable sources. In the event that industry average data sources are delayed, year-to-year (YoY) and year-to-date (YtD) industry data or the last available data in the last month can be used.
Definition of economic sectors controlled is economic sectors that have been financed by the BPR for at least 1 (one) year with performing credit quality.

b. Operational Risk
Operational risk is risk caused, among others, by the inadequacy and/or malfunction of internal processes, human resource errors, system failures, and/or external issues affecting BPR operations.

Pillar: Business Complexity and Institutional Structure

In this pillar, the BPR assesses the level of business complexity run as well as the schemes and institutional activities conducted by the BPR, linked to the attached operational risk, conducted by analyzing and assigning ratings to at least the following parameters:

a) Parameter: Business scale and organizational structure

In this parameter, the BPR assesses the size of the BPR's business scale and the completeness of the BPR's organizational structure.

The larger the BPR's business scale not supported by the completeness of the organizational structure, the higher the risk for the BPR because the greater the likelihood of the BPR experiencing operational risk due to the inadequacy and/or malfunction of internal processes.

The determination of the parameter rating is based on the following indicative descriptions:

Rating	Description
1	• BPR business scale is small or medium; and - BPR organizational structure is fully complete according to BPR governance regulations.
2	• BPR business scale is large; and - BPR organizational structure is fully complete according to BPR governance regulations.
3	• BPR business scale is small or medium; and - There is incompleteness of BPR organizational structure in functions that are not significant.
4	• BPR business scale is large; and - There is incompleteness of BPR organizational structure in functions that are not significant.
5	• BPR business scale is small, medium, or large; and - There is incompleteness of BPR organizational structure in functions that are significant.

Note:

Definition of not significant includes vacancies in parts supporting governance functions.
Definition of significant is vacancies in the Board of Directors and/or Board of Commissioners positions.
Definition of small is BPR Business Activity (KU) 1, medium is BPR KU 2, and large is BPR KU 3.

b) Parameter: Office network and span of control

In this parameter, the BPR assesses the number of networks and branch office locations as well as the span of control of the head office over branch offices.

The more numerous the office networks with too large a span of control and located in areas with difficult access, the higher the risk for the BPR because the greater the likelihood of the BPR experiencing operational risk due to the inadequacy and/or malfunction of internal processes.

The determination of the parameter rating is based on the following indicative descriptions:

Rating	Description
1	BPR office network has no branch office network and/or cash offices.
2	• BPR has the number of branch office networks at most 25% of the maximum allowed for the KU scale • Has cash offices
3	• BPR has the number of branch office networks more than 25% and at most 50% of the maximum allowed for the KU scale • Has cash offices
4	• BPR has the number of branch office networks more than 50% and at most 75% of the maximum allowed for the KU scale • Has cash offices
5	• BPR has the number of branch office networks more than 75% of the maximum allowed for the KU scale • Has cash offices

Span of control and branch office location
Small span of control and easily accessible branch office location Small span of control but with branch office locations that are difficult to access Large span of control and easily accessible branch office location Large span of control with branch office locations that are difficult to access Note:
Other considerations for setting the rating include the fact that the more difficult it is to access branch offices, the worse the Risk rating.

c) Parameter for product and/or service diversity In this parameter, the BPR assesses the diversity and complexity of the types of products and/or services managed. The higher the diversity and complexity of the types of products and/or services managed by the BPR, the higher the Risk for the BPR, as there is a greater possibility of the BPR experiencing operational Risk due to insufficient and/or non-functional internal processes. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description The BPR has products/services that are part of its main business activities.
The BPR has products/services that are part of its main business activities; and

foreign currency exchange; and/or
The BPR has products/services that are part of its main business activities and conducts business services.
The BPR conducts business as a technology-based service provider, for example, as a BPR conducting business activities not in accordance with regulations regarding business activities.
third-party cooperation services that do not require high competence and do not involve technology (e.g., card-based electronic money agents or e-money)
third-party cooperation involving third-party technology (e.g., server-based electronic money agents or e-cash) issuer/ATM card issuer, or internet banking provider, and the BPR's office network area based on core capital (including business activities not in accordance with BPRK group, business activities not reported or lacking approval from OJK or BI)

Note:
The main business activities referred to are fund collection, fund disbursement, and/or placement in other banks (including payment points).

d) Parameter for corporate actions
In this parameter, the BPR assesses corporate actions taken, including mergers, consolidations, and takeovers, head office relocation, and the issuance of products and/or new activities. The more diverse the corporate actions taken, particularly corporate actions with high operational Risk such as mergers, consolidations, and takeovers, conducted in the short term before the reporting period, the higher the Risk for the BPR, as there is a greater possibility of the BPR experiencing operational Risk due to insufficient and/or non-functional internal processes. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description • The BPR is not in the process of merger, consolidation, or takeover;

The BPR is not in the process of relocating its head office;
and
The BPR is not in the process of issuing products and/or conducting new activities.
The BPR is not in the process of merger, consolidation, or takeover;
There is a process of relocating the BPR head office; and/or
The BPR is in the process of developing products and/or new activities (which only require reporting to OJK).
There is a process of relocating the BPR head office;
The BPR issues products and/or conducts new activities (requiring OJK approval) in cooperation with third parties (no investment costs – BPR capital expenditure); and/or
The BPR conducts mergers, consolidations, and
There is a process of relocating the BPR head office;
The BPR issues products and/or conducts new activities (requiring OJK approval) that require investment costs – BPR capital expenditure; and/or
The BPR conducts mergers, consolidations, and
There is a process of relocating the BPR head office;
The BPR issues products and/or conducts new activities (requiring OJK approval) that require investment costs – BPR capital expenditure; and/or
The BPR conducts mergers, consolidations, and
There is a process of relocating the BPR head office;
The BPR issues products and/or conducts new activities (requiring OJK approval) that require investment costs – BPR capital expenditure; and/or
The BPR conducts mergers, consolidations, and
Takeover in a very long time before the assessment period.
Takeover process does not affect business strategy and corporate culture.
Takeover in a long time before the assessment period.
Takeover process affects business strategy and corporate culture.
Takeover in a short time before the assessment period.
Takeover process affects business strategy and corporate culture.

Note:

A very long time is defined as mergers, consolidations, and takeovers having been executed more than 1 (one) year before the assessment period.
A long time is defined as mergers, consolidations, and takeovers having been executed less than 1 (one) year before the assessment period.
A short time is defined as mergers, consolidations, and takeovers having been executed in the assessment period.

Human Resources (HR) Pillar
In this pillar, the BPR assesses the existing HR in relation to the inherent operational Risk, by analyzing and ranking at least the following parameters:
a) Parameter for the adequacy of HR quantity and quality In this parameter, the BPR assesses the adequacy of HR quality and quantity compared to organizational needs. The more adequate the quality and quantity of existing HR in the BPR in meeting organizational needs, the lower the Risk for the BPR, as there is a lower possibility of the BPR experiencing operational Risk due to human error. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description The BPR's HR quantity and quality are very adequate.
The BPR's HR quantity and quality are adequate.
The BPR's HR quantity and quality are fairly adequate.
The BPR's HR quantity and quality are less than adequate.
The BPR's HR quantity and quality are inadequate.

Note:

Quantity is viewed from the number of HR compared to organizational needs, while quality is viewed from the competence and integrity of HR required by the organization.
Definitions:
Very adequate: HR quantity compared to organizational needs is fully met, and HR quality, i.e., competence and integrity, matches organizational requirements.
Adequate: All positions are filled, but the number of HR is lower than organizational needs, although there are no dual roles, and HR quality, i.e., competence and integrity, matches organizational requirements.
Fairly adequate: HR quantity compared to organizational needs is met, but there are dual roles, and HR quality, i.e., competence and integrity, matches organizational requirements.
Less than adequate: HR quantity compared to organizational needs is met, but there are dual roles, and HR quality, i.e., competence matches organizational requirements, but there are deviations (fraud).
Inadequate: HR quantity compared to organizational needs is not met, indicated by dual roles and/or vacant positions, and HR quality, i.e., competence does not match organizational requirements, and there are deviations (fraud).
Other considerations for meeting organizational needs include the existence of several functions requiring specific educational backgrounds (e.g., accounting), while other functions can be more flexible (e.g., credit analysts, customer service).
b) Parameter for operational issues due to human factors (human error) In this parameter, the BPR assesses the frequency and impact of operational issues caused by human factors. The higher the frequency and impact of operational issues caused by human factors, the higher the Risk for the BPR, as there is a higher possibility of the BPR experiencing operational Risk due to human error. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description No human error occurred in the BPR.

Human error occurred in the BPR; however
no financial impact on the BPR.
Human error occurred in the BPR;
and
reduces profit but does not cause the BPR to record a negative profit.
Human error occurred in the BPR;
and
The BPR records a negative profit causing the capital adequacy ratio to decline but still in accordance with KPMM regulations.
Human error occurred in the BPR;
and
The BPR records a negative profit causing the capital adequacy ratio to decline below KPMM regulations.

Information Technology (IT) Governance Pillar
In this pillar, the BPR assesses the conformity of IT governance with IT Governance Standards (SPTI) and the implementation of fundamental changes in BPR IT governance. The more the BPR's IT governance conforms to SPTI and the absence of fundamental changes in BPR IT governance, the lower the Risk for the BPR, as there is a lower possibility of operational Risk occurring due to system failure. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description • The BPR's IT conforms to regulations regarding SPTI; and

The BPR is not currently in the process of making fundamental changes to IT governance.
The BPR's IT is largely in accordance with regulations regarding SPTI;
and
The BPR is not currently in the process of making fundamental changes to IT governance.
The BPR's IT is largely in accordance with regulations regarding SPTI;
and
The BPR is currently in the process of making fundamental changes to IT governance.
The BPR's IT is largely not in accordance with regulations regarding SPTI;
and
The BPR is not currently in the process of making fundamental changes to IT governance.
The BPR's IT is largely not in accordance with regulations regarding SPTI;
and
The BPR is currently in the process of making fundamental changes to IT governance.

Fraud Pillar
In this pillar and parameter, the BPR assesses the frequency and impact of fraud occurrences in the BPR, whether fraud originating from external or internal parties. The higher the frequency and impact of fraud in the BPR, the higher the Risk for the BPR, as there is a greater possibility of operational Risk occurring due to human error. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description No indication of fraud in the BPR.

There is an indication of fraud in the BPR with low frequency;
and
has not/had no financial impact.
There is an indication of fraud in the BPR with high frequency;
and
reduces profit but does not cause the BPR to record a negative profit and does not cause the capital adequacy ratio to decline.
There is an indication of significant fraud in the BPR;
and
reduces profit or the BPR records a negative profit causing the capital adequacy ratio to decline but still in accordance with KPMM regulations.
There is an indication of very significant fraud in the BPR;
and
The BPR records a negative profit causing the capital adequacy ratio to decline below KPMM regulations.

External Factor Pillar
In this pillar and parameter, the BPR assesses the frequency and materiality of external events impacting BPR operational activities. External events may include natural disasters, riots, government policies, and crime. The higher the frequency and materiality of external events impacting BPR operational activities, the higher the Risk for the BPR, as there is a greater possibility of operational Risk occurring due to external events. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description No external events occurred.

There were external events;
however
no financial impact on the BPR.
There were external events;
and
reduced profit but did not cause the BPR to record a negative profit.
There were external events;
and
The BPR recorded a negative profit causing the capital adequacy ratio to decline but still in accordance with KPMM regulations.
There were external events;
and
The BPR recorded a negative profit causing the capital adequacy ratio to decline below KPMM regulations.

c. Compliance Risk
Compliance Risk is the Risk arising from the BPR's failure to comply with and/or implement statutory regulations and other regulations, including Risk arising from weaknesses in legal aspects. Compliance Risk can be caused by legal behavior involving three elements: intent, negligence, and accountability, as well as organizational behavior influenced by business profile factors, economic factors, psychological factors, and sociological factors.

Pillar for violations of statutory regulations and other regulations
In this pillar, the BPR assesses the type, significance, frequency, and follow-up actions regarding violations committed, linked to the inherent Compliance Risk. Violations include those related to authority regulations, such as those from the Financial Services Authority (OJK), Bank Indonesia, Deposit Insurance Agency, Transaction Reports and Analysis Center, and the Ministry of Finance, by analyzing and ranking at least the following parameters:
a) Parameter for the type, significance, and frequency of violations committed In this parameter, the BPR assesses the type, significance, and frequency of regulatory violations committed by the BPR. The higher the frequency of significant violations committed by the BPR, the higher the Compliance Risk for the BPR. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description No violations of statutory regulations and/or other regulations occurred during the assessment period.

There were violations of statutory regulations with light sanction types;
and
Low violation frequency.
There were violations of statutory regulations with light sanction types;
and
Medium violation frequency.
There were violations of statutory regulations with light sanction types with high violation frequency; and/or
There are allegations of violations of Banking Law, including Article 49, committed by BPR officials or employees.
There were significant violations; and/or
There are allegations of violations of Banking Law, including Article 49, committed by BPR Board of Directors and/or Board of Commissioners.

Note:

The determination of low, medium, and high violation frequency is linked to and compared with the BPR's business volume.
Violations with light sanctions include reporting violations with sanctions in the form of written warnings and/or fines.
Violations with heavy sanctions and significant violation types include BMPK violations, fulfillment of minimum management personnel numbers, and capital adequacy.

b) Parameter for the significance of follow-up actions on violation findings In this parameter, the BPR assesses the follow-up actions taken by the BPR regarding findings of regulatory violations committed by the BPR. The more frequent the occurrence of repeated violations, the higher the Compliance Risk for the BPR. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description No repeated violations occurred, and violations in previous periods have been fully followed up.
There were repeated violations in two previous periods with the same type, but there was a high decrease in frequency compared to the previous period. There were repeated violations in two previous periods with the same type, but there was a medium decrease in frequency compared to the previous period. There were repeated violations in two previous periods with the same type, but there was a low decrease in frequency compared to the previous period.

There were repeated violations in two previous periods with the same type with more frequency than the previous period; and/or
There were repeated violations that were significant, including violations regarding BMPK, minimum management personnel numbers, and capital adequacy.

Note:

High frequency decrease means a decrease in the frequency of similar violations of at least 75% from the previous violation frequency.
Medium frequency decrease means a decrease in the frequency of similar violations of at least 50% from the previous violation frequency.
Low frequency decrease means a decrease in the frequency of similar violations of at least 25% from the previous violation frequency.
More frequency means an increase in the frequency of similar violations compared to the previous period's violation frequency.

Pillar for legal weakness factors
In this pillar, the BPR assesses legal weaknesses occurring in the BPR linked to inherent Compliance Risk, specifically legal aspect weaknesses, by analyzing and ranking at least the following parameters:
a) Parameter for weaknesses in agreements
In this parameter, the BPR assesses agreements made by the BPR, linked to the fulfillment of valid agreement conditions and weaknesses in agreement clauses detrimental to the BPR. The lower the fulfillment of valid agreement conditions and the more weaknesses in agreement clauses made by the BPR, the higher the Compliance Risk for the BPR, particularly from a legal aspect. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description • There are credit agreements or other collaborations that meet the conditions for valid agreements; and

No weaknesses in agreement clauses.
There are credit agreements or other collaborations that meet the conditions for valid agreements;
and/or
There are weaknesses in agreement clauses causing clauses in the agreement to be unexecutable but not potentially causing legal lawsuits and material losses.
There are credit agreements or other collaborations that meet the conditions for valid agreements;
and/or
There are weaknesses in agreement clauses potentially causing legal lawsuits and/or material losses.
There are credit agreements or other collaborations that do not meet the conditions for valid agreements;
and/or
There are weaknesses in agreement clauses potentially causing legal lawsuits and/or very material losses.

There are credit grants or other collaborations not supported by written agreements.
Note:
The conditions for valid agreements as referred to in the Civil Code are mutual agreement of those binding themselves, capacity to make an agreement, a specific object, and a lawful cause.
Weaknesses in agreements include, for example, credit agreements accompanied by mortgage agreements that do not meet regulations governing debt guarantees, or agreements between the BPR and IT service providers that do not heed guidelines as referred to in regulations regarding BPR IT governance standards, thereby creating legal weakness Risk that can harm the BPR.
b) Parameter for litigation related to claim nominal or estimated losses suffered by the BPR due to lawsuits In this parameter, the BPR assesses the possibility of lawsuits or estimated losses due to lawsuits and the financial impact on the BPR. Litigation can occur due to lawsuits or claims from third parties against the bank, or lawsuits or claims filed against third parties, both through courts and outside courts. Lawsuits or claims essentially incur costs that can harm the bank's condition. The higher the financial impact of losses due to lawsuits or estimated losses suffered by the BPR, the higher the Compliance Risk for the BPR, particularly from a legal aspect. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description No lawsuits occurred or no estimated losses suffered by the BPR due to lawsuits.
There are claim nominals or estimated losses due to lawsuits with values not significant compared to BPR capital.
There are claim nominals or estimated losses due to lawsuits with values less than significant compared to BPR capital. There are claim nominals or estimated losses due to lawsuits with values fairly significant compared to BPR capital. There are claim nominals or estimated losses due to lawsuits causing capital adequacy to decline below KPMM regulations.

Note:
Claim nominal is the amount of the claim submitted.
Estimated loss is the estimated loss that the BPR might suffer due to lawsuits.

c) Parameter for litigation related to losses suffered due to final court decisions In this parameter, the BPR assesses losses suffered by the BPR due to final court decisions. The higher the losses suffered by the BPR, the higher the Compliance Risk for the BPR, particularly from a legal aspect. The rating for this parameter is based on the following indicative descriptions:

Rating 1 2 3 4 5
Description No losses suffered by the BPR due to final court decisions during the assessment period.
There were losses due to final court decisions, with values not significant compared to BPR capital during the assessment period. There were losses due to final court decisions, with values less than significant compared to BPR capital during the assessment period. There were losses due to final court decisions, with values fairly significant compared to BPR capital during the assessment period. There were losses due to final court decisions during the assessment period causing capital adequacy to decline below KPMM regulations.

d. Liquidity Risk
Liquidity risk is the risk arising from the inability of a Rural Bank (BPR) to meet obligations as they fall due from cash flow funding sources and/or from high-quality liquid assets that can be pledged, without disrupting the BPR's activities and financial condition. Liquidity risk can stem from external factors, including the level of competition in obtaining funding sources, volatility in funding markets, and changes in regulatory provisions that impact the BPR's liquidity position. Liquidity risk can also stem from internal factors, generally originating from business strategies that impact liquidity risk, unstable funding sources, and BPR administrative account transactions that impact liquidity risk.

Pillar of Asset and Liability Composition and Concentration
In this pillar, the BPR assesses the composition of its asset and liability portfolios and the level of concentration of specific asset and liability components in relation to inherent liquidity risk, by analyzing and ranking at least the following parameters:

a) Parameter of the ratio of liquid assets to total assets In this parameter, the BPR assesses the composition of liquid assets held, compared to total assets. (1) Definition of liquid assets is all liquid assets used to meet liquidity needs for third-party fund withdrawals and obligations falling due, consisting of cash (Rupiah and foreign currency), and placements in other banks (checking accounts and savings offset). (2) Definition of total assets is the amount of assets according to the BPR's financial position report. The lower the composition percentage, the higher the risk for the BPR, as the BPR is potentially exposed to liquidity risk due to insufficient liquid assets.

b) Parameter of the ratio of liquid assets to current liabilities In this parameter, the BPR assesses the amount of liquid assets held, compared to current liabilities, to determine the ability of the held liquid assets to meet the BPR's current liabilities. (1) Definition of liquid assets is all liquid assets used to meet liquidity needs for third-party fund withdrawals and obligations falling due, consisting of cash (Rupiah and foreign currency), and placements in other banks (checking accounts and savings offset). (2) Definition of current liabilities is all obligations that do not have a due date and/or have a due date of not more than 1 year, consisting of immediate obligations and deposits (savings and time deposits). The lower the ratio percentage, the higher the risk for the BPR, as the BPR is potentially exposed to liquidity risk due to insufficient liquid assets to meet current liabilities. The ranking of the parameter for the ratio of liquid assets to total assets and the parameter for the ratio of liquid assets to current liabilities is based on the following indicative descriptions:

Rank 1: Liquid Assets / Total Assets ≥15%
Rank 2: Liquid asset composition lower than 15% of total assets and liquid asset composition lower than 20% of current liabilities, but still adequate to cover falling due obligations Rank 3: Liquid asset composition lower than 15% of total assets and liquid asset composition lower than 20% of current liabilities, but adequately enough to cover falling due obligations Rank 4: Liquid asset composition lower than 15% of total assets and liquid asset composition lower than 20% of current liabilities, and insufficient to cover falling due obligations Rank 5: Liquid asset composition lower than 15% of total assets and liquid asset composition lower than 20% of current liabilities, and insufficient to cover falling due obligations; and/or the liquid assets/current liabilities ratio meets the BDPI criteria.

Note:
Other considerations for ranking: The higher the portfolio of credit with interest-only payment methods (principal payment at the end of the period), the worse the risk ranking, as the likelihood of debtor default increases, thereby affecting the BPR's liquidity position due to cash flow mismatch.

c) Parameter of the ratio of credit granted to total non-bank third-party funds (Loan to Deposit Ratio/LDR) In this parameter, the BPR assesses the amount of credit granted, compared to total non-bank third-party funds. (1) Definition of credit granted is all credit granted to third parties other than banks. (2) Definition of total non-bank third-party funds is all funding obtained by the BPR from third parties other than banks, consisting of savings and deposits. The higher the ratio percentage, the higher the risk for the BPR, as the BPR is exposed to liquidity risk because the funding source for the credit granted comes from non-bank third parties, which can be withdrawn at any time by the fund owners. The ranking of the parameter is based on the following indicative descriptions:

Rank 1: <90%
Rank 2: LDR higher than 90% and non-performing credit is not significant Rank 3: LDR higher than 90% but non-performing credit is less significant Rank 4: LDR higher than 90% but non-performing credit is quite significant Rank 5: LDR higher than 90% and non-performing credit is very significant

Note:

Non-performing credit not significant means the BPR has Net NPL ≤ 5%
Non-performing credit less significant means the BPR has 5% < Net NPL ≤ 6%
Non-performing credit quite significant means the BPR has 6% < Net NPL ≤ 7%
Non-performing credit very significant means the BPR has Net NPL > 7%

d) Parameter of the ratio of the 25 largest depositors and savers to total third-party funds In this parameter, the BPR assesses the concentration of the 25 largest depositors and savers, compared to total third-party funds collected. (1) Definition of the 25 largest depositors and savers is the 25 non-bank depositors and savers based on the same CIF with the largest deposit and savings amounts at the relevant BPR. (2) Definition of total third-party funds is all funding obtained by the BPR from third parties other than banks, consisting of savings and deposits. The higher the ratio percentage, the higher the risk for the BPR, as the BPR is exposed to liquidity risk because the collected third-party funds are concentrated among the 25 largest depositors and savers, in the event of simultaneous withdrawals by the 25 largest depositors and savers. The ranking of the parameter is based on the following indicative descriptions:

Rank 1: <25%
Rank 2: Composition of the 25 largest depositors and savers is more than 25% and all are old customers Rank 3: Composition of the 25 largest depositors and savers is more than 25% and the majority are old customers Rank 4: Composition of the 25 largest depositors and savers is more than 25% and the majority are new customers Rank 5: Composition of the 25 largest depositors and savers is more than 25% but all are new customers

Note:

All are old customers means all customers among the 25 largest depositors and savers are old customers
The majority are old customers means ≥ 50% of the customers among the 25 largest depositors and savers are old customers
The majority are new customers means ≥ 50% of the customers among the 25 largest depositors and savers are new customers
All are new customers means all customers among the 25 largest depositors and savers are new customers (depositors and savers who opened accounts at the time of the assessment period)

e) Parameter of the ratio of non-core funding to total funding In this parameter, the BPR assesses the concentration of non-core funding, compared to total funding. (1) Definition of non-core funding is funding that, according to the BPR, is relatively unstable or tends not to remain in the BPR in normal and crisis conditions, including:
(a) Third-party funds with nominal amounts and/or interest rates above the provisions of the Deposit Insurance Agency (LPS); (b) All inter-BPR transactions; and/or (c) Loans that, according to the BPR's assessment, have a likelihood of being withdrawn unilaterally at any time by the lender. (2) Definition of total funding is all funding obtained by the BPR from both third-party funds and received loans. The higher the ratio percentage, the higher the risk for the BPR, as the BPR is exposed to liquidity risk due to high funding that does not remain in the BPR in terms of its characteristics, in the event of withdrawal of said funds at any time. The ranking of the parameter is based on the following indicative descriptions:

Rank 1: <10%
Rank 2: Non-core funding ratio is greater than 10% but not significant to total funding, and can still be managed by the BPR Rank 3: Non-core funding ratio is greater than 10% and quite significant to total funding Rank 4: Non-core funding ratio is greater than 10%, and significant so that it almost dominates BPR funding Rank 5: Non-core funding ratio is very large and dominates BPR funding

Pillar of Vulnerability to Funding Needs and Access to Funding Sources
In this pillar, the BPR assesses the BPR's funding needs in normal and crisis situations, the BPR's ability to meet such funding needs which is enabled by access to available funding sources, by analyzing and ranking at least the following parameters:

a) Parameter for assessing BPR funding needs in normal and crisis situations, and the BPR's ability to meet funding needs, for example by looking at the fairness of the interest rates of obtained funding sources. The higher the funding needs not accompanied by the BPR's ability to meet such needs, the greater the likelihood of the BPR experiencing liquidity risk. The ranking of the parameter is based on the following indicative descriptions:

Rank 1: BPR is very capable of meeting obligations and cash flow needs under normal and crisis conditions; and/or cash flows from assets and liabilities match very well (well matched). Rank 2: BPR is capable of meeting obligations and cash flow needs under normal and crisis conditions; and/or cash flows from assets and liabilities match well on the majority of time scales. Rank 3: BPR is fairly capable of meeting obligations and cash flow needs under normal and crisis conditions (100%); and/or cash flows from assets and liabilities match fairly well (100%), especially in the short term. Rank 4: BPR is less capable of meeting obligations and cash flow needs under normal and crisis conditions; and/or there is a significant cash flow mismatch for the BPR on various time scales. Rank 5: BPR is unable to meet obligations and cash flow needs under normal and crisis conditions; and/or BPR cash flows cannot match.

Note:

Ranking 1, 2, 4, and 5 consider deviations from the percentage of obligation fulfillment and cash flow needs under normal and crisis conditions with a reference of 100% (Rank 3).
Crisis conditions can be interpreted as conditions where BPR funding needs exceed the average funding needs under normal conditions.

b) Parameter for assessing how broad or how large the BPR's funding commitments are that can be used if needed.
The greater the funding access held by the BPR, the lower the liquidity risk for the BPR.
The ranking of the parameter is based on the following indicative descriptions:

Rank 1: BPR's access to funding sources is very adequate, proven by the BPR's very good reputation, bank loans that can be withdrawn at any time being very adequate, and the existence of liquidity commitments/support from controlling shareholders/parent companies/intra-group BPR. Rank 2: BPR's access to funding sources is adequate, proven by the BPR's good reputation, bank loans that can be withdrawn at any time being adequate, and the existence of liquidity commitments/support from controlling shareholders/parent companies/intra-group BPR. Rank 3: BPR's access to funding sources is fairly adequate, proven by the BPR's fairly good reputation, bank loans that can be withdrawn at any time being fairly adequate, and the existence of liquidity commitments/support from controlling shareholders/parent companies/intra-group BPR that is fairly adequate. Rank 4: BPR's access to funding sources is less adequate, proven by the BPR's declining reputation, bank loans that can be withdrawn at any time being less adequate, and liquidity commitments/support from controlling shareholders/parent companies/intra-group BPR being very limited. Rank 5: BPR's access to funding sources is inadequate, proven by the BPR's poor reputation so that the BPR has difficulty obtaining funding, no bank loans that can be withdrawn at any time, and no liquidity commitments/support from controlling shareholders/parent companies/intra-group BPR.

Note:

Commitments and support can be proven with documents/statement letters.
Definitions:
BPR's access to funding sources is very adequate, meaning the BPR has a very good reputation, there are loan facilities from other banks and other parties from at least 3 (three) funding sources that can be withdrawn at any time.
BPR's access to funding sources is adequate, meaning the BPR has a good reputation, there are loan facilities from other banks and other parties from 2 (two) funding sources that can be withdrawn at any time.
BPR's access to funding sources is fairly adequate, meaning the BPR has a fairly good reputation, there are loan facilities from other banks and other parties from 1 (one) funding source that can be withdrawn at any time.
BPR's access to funding sources is less adequate, meaning the obtained funding sources are insufficient against the amount of funds needed with a ratio < 100%.
BPR's access to funding sources is inadequate, meaning the BPR has no funding source facilities from other banks or other parties.
Existence of liquidity commitments/support from Controlling Shareholders/parent companies/intra-group BPR, meaning liquidity commitments/support from Controlling Shareholders/parent companies/intra-group BPR is greater than expected with support capability > 100%.
Existence of fairly adequate liquidity commitments/support from Controlling Shareholders/parent companies/intra-group BPR, meaning liquidity commitments/support from Controlling Shareholders/parent companies/intra-group BPR is as expected with support capability of 100%.
Liquidity commitments/support from Controlling Shareholders/parent companies/intra-group BPR that is very limited, meaning liquidity commitments/support from Controlling Shareholders/parent companies/intra-group BPR is not as expected with support capability < 100%.

e. Reputation Risk
Reputation risk is the risk arising from a decline in the level of trust of stakeholders stemming from negative perceptions of the BPR. Reputation risk can stem from various BPR business activities, including events that have harmed the BPR's reputation, such as negative media coverage, violations of business ethics, and customer complaints.

Pillar of the Influence of Reputation of Parties Associated with the BPR
In this pillar, the BPR assesses the credibility of the BPR and parties associated with the BPR, including the frequency and impact of negative coverage and reputation events, by analyzing and ranking at least the following parameters:

a) Parameter of the credibility of the BPR and parties associated with the BPR In this parameter, the BPR assesses the credibility of the BPR and parties associated with the BPR, including Board of Directors and Board of Commissioners members, shareholders, and related companies of the BPR, and their impact on the BPR, which is assessed from negative coverage in mass media and other media. The higher the breadth and impact of negative coverage on the BPR and parties associated with the BPR, the higher the risk for the BPR, as the BPR is exposed to reputation risk due to such negative coverage. The ranking of the parameter is based on the following indicative descriptions:

Rank 1: No negative coverage regarding the BPR including Board of Directors and Board of Commissioners members, shareholders, and related companies of the BPR, in mass media (print and electronic) and other media accessible to the public. Rank 2: There is negative coverage regarding the BPR including Board of Directors and Board of Commissioners members, shareholders, and related companies of the BPR, in mass media (print and electronic) and other media accessible to the public, but the scale of influence is not material and can be mitigated well. Rank 3: There is negative coverage regarding the BPR including Board of Directors and Board of Commissioners members, shareholders, and related companies of the BPR, in mass media (print and electronic) and other media accessible to the public, with a fairly material scale of influence on the BPR's performance but still controllable. Rank 4: There is negative coverage regarding the BPR including Board of Directors and Board of Commissioners members, shareholders, and related companies of the BPR, in mass media (print and electronic) and other media accessible to the public, with a material scale of influence on the BPR's performance and requiring special attention. Rank 5: There is negative coverage regarding the BPR including Board of Directors and Board of Commissioners members, shareholders, and related companies of the BPR, in mass media (print and electronic) and other media accessible to the public, with a very material scale of influence on the BPR's performance, thus requiring immediate follow-up.

b) Parameter of the significance and materiality of the impact caused by reputation events In this parameter, the BPR assesses the significance and materiality of reputation events occurring at the BPR. The higher the significance and materiality of reputation events occurring at the BPR, the higher the risk for the BPR, as the BPR is exposed to reputation risk due to negative perceptions. The ranking of the parameter is based on the following indicative descriptions:

Rank 1: No reputation events.
Rank 2: There are reputation events with low frequency; however, they do not affect the BPR's reputation relative to the size and scale of the BPR's business; or there are reputation events with fairly high frequency; however, they do not affect the BPR's reputation relative to the size and scale of the BPR's business. Rank 3: There are reputation events with low frequency; and they have a fairly material impact on the BPR's reputation relative to the size and scale of the BPR's business; or there are reputation events with fairly high frequency; however, not all materially affect the BPR's reputation relative to the size and scale of the BPR's business. Rank 4: There are reputation events with fairly high frequency; and they have a material impact on the BPR's reputation relative to the size and scale of the BPR's business. Rank 5: There are reputation events with very high frequency; and they have a very material impact on the BPR's reputation relative to the size and scale of the BPR's business.

Note:
Reputation events can include, for example, bankruptcy, business failure, financial scandals, material legal violations/lawsuits, occurring at the owner/related companies and impacting the bank's reputation risk.

Pillar of the Frequency and Significance of Customer Complaints
In this pillar, the BPR assesses the frequency and significance of customer complaints against the BPR, including the administration and follow-up of received customer complaints, by analyzing and ranking at least the following parameters:

a) Parameter of customer complaint administration and follow-up In this parameter, the BPR assesses the administration of received customer complaints and the resolution of customer complaints through follow-up actions. Administration refers to recording and assigning responsible officers. The more adequate the administration of customer complaints accompanied by the resolution of customer complaints through adequate follow-up, the lower the risk for the BPR, as the likelihood of the BPR being exposed to reputation risk due to such customer complaints decreases. The ranking of the parameter is based on the following indicative descriptions:

Rank 1: Customer complaints are administered in an orderly and informative manner (present, complete, routine); and/or all complaints have been resolved; and/or the majority of complaints have been resolved. Rank 2: Customer complaints are administered in a fairly orderly and informative manner (majority present, majority complete, majority routine); and/or the majority of complaints have been resolved. Rank 3: Customer complaints are administered in a fairly orderly and informative manner (majority present, majority complete, majority routine); and/or a small portion of complaints have been resolved. Rank 4: Customer complaints are administered in a less orderly and informative manner (small portion present, small portion complete, small portion routine); and/or a small portion of complaints have been resolved. Rank 5: No administration regarding customer complaints and/or none have been resolved.

Note:

The term "majority" means at least 50%.
The term "small portion" means less than 50%.

b) Parameter of the significance and materiality of customer complaints In this parameter, the BPR assesses the significance and materiality of customer complaints received by the BPR. The higher the significance and materiality of customer complaints, the higher the risk for the BPR, as the BPR is exposed to reputation risk due to such customer complaints. The ranking of the parameter is based on the following indicative descriptions:

Rank 1: Frequency of customer complaints is very minimal and very not material.
Rank 2: Frequency of customer complaints is minimal and not material.
Rank 3: Frequency of customer complaints is fairly high and fairly material.
Rank 4: Frequency of customer complaints is high and material.
Rank 5: Frequency of customer complaints is very high and very material and/or caused by deviations

banking regulations.

Note:

The assessment of the frequency level of customer complaints is linked to the number of customers and/or the business volume of each BPR.
The assessment of the materiality level of customer complaints is linked to the number of BPR customers or accounts, which may include impacts such as the loss of core customers or depositors.

Business ethics violation pillar
In this pillar, the BPR conducts an assessment of the transparency performed by the BPR, both financial information transparency and BPR product and service transparency, which is done by analyzing and ranking at least the following parameters:

a) Financial information transparency parameter In this parameter, the BPR assesses the provision of the BPR's financial information that is complete, accurate, current, and whole to all interested parties in accordance with applicable regulations. The more complete, accurate, current, and whole the financial information provided, the smaller the likelihood of the BPR being exposed to Reputational Risk due to business ethics violations. The ranking of the parameter is based on the following indicative descriptions:

Rank	Description
1	Reports and financial information provided by the BPR to all parties with an interest in the BPR are complete, accurate, current, and whole in accordance with applicable regulations.
2	Reports and financial information provided by the BPR to all parties with an interest in the BPR are complete, accurate, and current, but not whole.
3	Reports and financial information provided by the BPR to all parties with an interest in the BPR are less complete and there is still information provided that does not comply with applicable regulations, but does not result in an assessment that does not match the actual financial condition.
4	Reports and financial information provided by the BPR to all parties with an interest in the BPR are less complete and there is still information provided that does not comply with applicable regulations, and results in an assessment that does not match the actual financial condition.
5	The BPR does not provide financial information and reports in accordance with applicable regulations, and results in the actual financial condition of the BPR not being known.

b) BPR product and service transparency parameter In this parameter, the BPR assesses the complexity of products and services managed that require special understanding from the BPR's customers or business partners, as well as the implementation of providing the information needed to obtain such understanding. The higher the need for special understanding from the BPR's customers or business partners not accompanied by the implementation of providing the necessary information, the more the BPR is exposed to Reputational Risk due to business ethics violations. The ranking of the parameter is based on the following indicative descriptions:

Rank	Description
1	BPR products and services have a simple scheme, do not require special understanding from BPR customers or business partners, and the BPR provides information regarding BPR product and service specifications to customers or business partners clearly and completely.
2	BPR products and services have a complex scheme and require special understanding from BPR customers or business partners, and the BPR provides information regarding BPR product and service specifications to customers or business partners clearly and completely.
3	There are BPR products and services with a complex scheme that require special understanding from BPR customers or business partners, but the BPR has not fully provided information regarding BPR product and service specifications to customers or business partners clearly and completely.
4	There are BPR products and services with a complex scheme that require special understanding from BPR customers or business partners, but the BPR does not provide information regarding BPR product and service specifications to customers or business partners clearly and completely.
5	There are BPR products and services with a complex scheme that require special understanding from BPR customers or business partners, but the BPR provides incorrect information to customers or business partners regarding BPR product and service specifications.

f. Strategic Risk
Strategic Risk is Risk due to inaccuracies in making and/or implementing a strategic decision and failure to anticipate changes in the business environment. Strategic Risk can stem from strategies that are not aligned with the BPR's vision and mission, non-comprehensive strategic environment analysis, inconsistency of strategic plans across strategic levels, and failure to anticipate changes in the business environment including changes in technology, changes in macroeconomic conditions, market competition dynamics, and changes in relevant authority policies.

Business strategy determination pillar
In this pillar and parameter, the BPR assesses the selection of strategies based on the level of Risk and success of the type/choice of business strategy and market share set, including the use of the BPR's existing business strategy and market share that has been chosen so far. The higher the level of Risk of the business strategy and market share chosen by the BPR, the higher the BPR's Strategic Risk. The ranking of the parameter is based on the following indicative descriptions:

Rank	Description
1	• No new products/activities owned by the BPR, strategy choice aligned with resources owned with a high level of strategy success; and/or<br>• BPR conducts business activities in market segments/economic sectors and customers that have been known/existed previously, including no office network development strategy.<br>• BPR is new to operation.
2	• BPR has several new strategies but still within the main business and BPR's competence (there are several new products) and aligned with resources owned with a fairly high level of strategy success; and/or<br>• BPR conducts business activities in market segments/economic sectors and customers that have been known/existed previously, with a wider market share.
3	• BPR has several new strategies including the existence of new products classified as high risk, among others requiring specialized human resources and/or more complex IT infrastructure with a moderate level of BPR strategy success; and/or<br>• Most of the BPR's business activities are in market segments/economic sectors and customers that have been known/existed previously, there is an expansion of market share and new customers but without office network development strategy.
4	• The majority of BPR strategies shift to new strategies with new products classified as high risk, among others requiring specialized human resources and/or more complex IT infrastructure with an uncertain level of success; and/or<br>• Most of the BPR's business activities are in market segments/economic sectors and new customers, including through office network development strategy.
5	• BPR changes business strategy to enter new products classified as high risk, among others requiring specialized human resources and/or more complex IT infrastructure that is not the main business and competence of the BPR with an uncertain level of success;<br>• All of the BPR's business activities are in market segments/economic sectors and new customers, including through office network development strategy.

Business plan formulation pillar
In this pillar and parameter, the BPR assesses the BPR's considerations in formulating business plans and models that consider external factors (regional economic conditions, regulatory changes, technological developments, changes in the level of competition, consumer preferences for products or services offered by the BPR, political conditions, and saturation levels) and internal factors (BPR's vision and mission, BPR's financial condition related to capital, funding sources, and key financial performance ratios, and BPR infrastructure including BPR human resources, organization including internal control systems, and IT), which is done by analyzing and ranking at least the following parameters:

a) Parameter for considering external and internal factors in formulating business plans and models In this parameter, the BPR assesses the basis for consideration in formulating the business plan and model to be implemented. The more external and internal factors considered in formulating the BPR's business plan and model, and the higher the BPR's responsiveness level to changes in external factors, the lower the BPR's Strategic Risk. The ranking of the parameter is based on the following indicative descriptions:

Rank	Description
1	• BPR's strategy (plan and business model) has considered all factors affecting the BPR's business environment, both internal and external factors, comprehensively; and/or<br>• The BPR's responsiveness level to changes in external factors is high, business plan changes are made if needed in a timely manner.
2	• BPR's strategy (plan and business model) has considered all factors affecting the BPR's business environment, both internal and external factors, but there are some weaknesses; and/or<br>• The BPR's responsiveness level to changes in external factors is moderate, business plan changes are made if needed but require a not-so-long time.
3	• BPR's strategy (plan and business model) has considered most factors affecting the BPR's business environment, both internal and external factors, but there are some weaknesses; and/or<br>• The BPR's responsiveness level to changes in external factors is low, business plan changes are made if needed but require a fairly long time.
4	• BPR's strategy (plan and business model) only considers some factors affecting the BPR's business environment, both internal and external factors, and there are weaknesses that are very significant; and/or<br>• The BPR's responsiveness level to changes in external factors is very low, business plan changes are made if needed but require a very long time.
5	• BPR's strategy (plan and business model) has not considered the BPR's business environment, both internal and external factors; and/or<br>• The BPR does not respond to changes in external factors, i.e., does not make the necessary business plan changes.

Note:
The responsiveness level is indicated, among others, by the implementation of discussions and formulation of action plans regarding the aforementioned external changes.

b) BPR competitive advantage and threat from competitors parameter In this parameter, the BPR assesses the competitive advantages owned and the level of threat from competitors. The higher the competitive advantage owned by the BPR accompanied by a low level of threat from competitors, the lower the BPR's Strategic Risk. The ranking of the parameter is based on the following indicative descriptions:

Rank	Description
1	BPR has stable competitive advantages and there is no threat from competitors.
2	BPR has moderate competitive advantages but there is a threat from competitors that does not affect the BPR (example: third-party funds (DPK) credit and fund growth are still above target).
3	BPR has moderate competitive advantages and there is a threat from competitors that affects the BPR (example: there is a deviation in credit and DPK growth achievement that is classified as low).
4	BPR has less competitive advantage, and/or there is a significant threat from competitors that impacts the BPR's financial performance (example: there is a deviation in credit and DPK growth achievement that is classified as moderate).
5	BPR does not have competitive advantages, and/or there is a very significant threat from competitors that has a significant impact on financial performance (example: there is a deviation in credit and DPK growth achievement that is classified as high).

Business target achievement pillar
In this pillar, the BPR assesses the realization of the business plan compared to the set targets, as well as the level of success in implementing the strategic decisions set by the BPR, which is done by analyzing and ranking at least the following parameters:

a) Parameter for comparing the realization and target of key financial indicators in accordance with the BPR's business plan regulations, specifically for capital factors, asset quality, credit, liquidity, credit disbursement to MSMEs, and profitability. The targets set in the BPR's business plan include quantitative targets (financial report performance, i.e., balance sheet and income statement, fund mobilization and disbursement, and capital including ratios, core capital fulfillment, capital addition plan fulfillment) and qualitative targets (organization development, IT, human resources, implementation of new business activities or new products/services, and office networks). The higher the BPR's deviation below target, the higher the BPR's Risk because the BPR is exposed to Strategic Risk due to the BPR's inability to achieve the set targets. The ranking of the parameter is based on the following indicative descriptions:

Rank	Description
1	• Realization above quantitative target or deviation of at most 5% from target; and<br>• Most or all qualitative targets are achieved.
2	• Low deviation compared to quantitative target; and<br>• Most qualitative targets are achieved.
3	• Moderate deviation compared to quantitative target; and<br>• Most qualitative targets are achieved.
4	• High deviation compared to quantitative target; and<br>• A small portion of qualitative targets are achieved.
5	• Very high deviation compared to quantitative target; and<br>• A small portion of qualitative targets are achieved or no targets are achieved.

Note:

Deviation greater than 5% may receive a lower Risk ranking if there are external conditions causing the same condition in target achievement across the industry.
The determination of low/moderate/high/very high deviation can be based on deviation in the BPR peer group (e.g., BPRs with similar conditions, BPRs in the same operational region, BPRs with the same business scale and complexity) or compared with the historical trend of the respective BPR.

b) BPR's track record of success in implementing strategic decisions related to new product/service development, changes in business targets, strategic investments, merger, consolidation, and acquisition plans, and business target achievement. The track record period assessed is at least the last 5 (five) years. The higher the BPR's level of success in implementing strategic decisions, the lower the BPR's Strategic Risk. The ranking of the parameter is based on the following indicative descriptions:

Rank	Description
1	Historically, the BPR has a very good track record in implementing strategic decisions related to the four track record assessment factors.
2	Historically, the BPR has a good track record in implementing strategic decisions related to the four track record assessment factors.
3	Historically, the BPR has a fairly good track record in implementing strategic decisions related to the four track record assessment factors.
4	Historically, the BPR has a less good track record in implementing strategic decisions related to the four track record assessment factors.
5	Historically, the BPR has a poor track record in implementing strategic decisions related to the four track record assessment factors.

Note:
Track record assessment factors include, among others:

achievement of newly developed products;
level of success of strategic decisions related to changes in business plans previously implemented;
level of success of strategic investments, mergers, consolidations, and acquisitions previously implemented; and
trend of business plan achievement levels.
After ranking each parameter for each type of Risk, the BPR determines the inherent Risk level for each type of Risk based on the parameter rankings assessed as most significant and significantly affecting the BPR's financial position.
The determination of the inherent Risk level for each type of Risk refers to the inherent Risk level determination matrix as referred to in the Inherent Risk Level Determination Matrix.

Step 2: Assessment and Determination of Risk Management Implementation Quality Level (KPMR)

The assessment of the KPMR level aims to assess the adequacy of the Risk control system.
BPR Risk Management implementation varies greatly according to the scale, complexity, and level of Risk that the BPR can tolerate. Thus, the KPMR level assessment needs to be adjusted to the BPR's characteristics, complexity, and business scale.
The KPMR level assessment is conducted by considering qualitative parameters or indicators.
The parameter ranking descriptions presented in this Financial Services Authority Circular are indicative and serve as a general reference. In the event of a difference between actual conditions and the existing ranking descriptions, adjustments to the said rankings may be made based on Risk considerations.
The determination of KPMR parameter rankings is conducted through comprehensive analysis considering the interconnection between one assessment parameter and other parameters, and is not influenced by the inherent Risk owned by the BPR.
The determination of the KPMR level for each type of Risk is categorized into rank 1 (very adequate), rank 2 (adequate), rank 3 (fairly adequate), rank 4 (less adequate), and rank 5 (inadequate).
The BPR provides rankings for each inherent KPMR parameter as follows:
a. Credit Risk

No	Assessment Parameter	Assessment Criteria
		1 - Very Adequate	2 - Adequate	3 - Fairly Adequate	4 - Less Adequate	5 - Inadequate
1	Has the Board of Commissioners given approval for the Credit Risk Management policy drafted by the Board of Directors and conducted periodic evaluations?	• The Board of Commissioners has given approval for the Credit Risk Management policy;<br>• The Board of Commissioners has conducted an evaluation of the Credit Risk Management policy;<br>• Evaluations are conducted by the Board of Commissioners periodically at least once a year or ad hoc in the event of changes significantly affecting the BPR's business activities;<br>• Evaluations conducted are relevant to the need for Credit Risk Management policy adjustments.	• The Board of Commissioners has given approval for the Credit Risk Management policy;<br>• The Board of Commissioners has conducted an evaluation of the Credit Risk Management policy; and<br>• Evaluations are conducted by the Board of Commissioners periodically at least once a year or ad hoc in the event of changes significantly affecting the BPR's business activities.	• The Board of Commissioners has given approval for the Credit Risk Management policy;<br>• The Board of Commissioners has conducted an evaluation of the Credit Risk Management policy; and<br>• Evaluations are NOT conducted by the Board of Commissioners periodically at least once a year or ad hoc in the event of changes significantly affecting the BPR's business activities.	• The Board of Commissioners has given approval for the Credit Risk Management policy; and<br>• The Board of Commissioners does NOT conduct evaluations of the Credit Risk Management policy.	• The Board of Commissioners does NOT give approval for the Credit Risk Management policy; and<br>• The Board of Commissioners does NOT conduct evaluations of the Credit Risk Management policy.
2	Has the Board of Commissioners conducted evaluations of the Board of Directors' accountability for the implementation of the Credit Risk Management policy periodically and ensured follow-up on evaluation results?	• The Board of Commissioners has conducted an evaluation of the implementation of the Credit Risk Management policy by the Board of Directors;<br>• Evaluations by the Board of Commissioners are conducted periodically every semester or more frequently based on reports submitted by the Board of Directors in the event of changes significantly affecting the BPR's business activities;<br>• The Board of Commissioners has ensured follow-up on evaluation results in every reporting period; and<br>• Evaluations provided are relevant to the implementation of the Credit Risk Management policy to support BPR performance improvement.	• The Board of Commissioners has conducted an evaluation of the implementation of the Credit Risk Management policy by the Board of Directors;<br>• Evaluations by the Board of Commissioners are conducted periodically every semester or more frequently based on reports submitted by the Board of Directors in the event of changes significantly affecting the BPR's business activities; and<br>• The Board of Commissioners has ensured follow-up on evaluation results in every reporting period.	• The Board of Commissioners has conducted an evaluation of the implementation of the Credit Risk Management policy by the Board of Directors;<br>• Evaluations by the Board of Commissioners are conducted periodically every semester or more frequently based on reports submitted by the Board of Directors in the event of changes significantly affecting the BPR's business activities; and<br>• The Board of Commissioners has NOT ensured follow-up on evaluation results in every reporting period.	• The Board of Commissioners has conducted an evaluation of the implementation of the Credit Risk Management policy by the Board of Directors;<br>• Evaluations by the Board of Commissioners are NOT conducted periodically; and<br>• The Board of Commissioners does NOT ensure follow-up on evaluation results in every reporting period.	• The Board of Commissioners does NOT conduct evaluations of the implementation of the Credit Risk Management policy by the Board of Directors.

No	Parameter	Assessment Criteria
		1 - Very Adequate	2 - Adequate	3 - Fairly Adequate	4 - Inadequate	5 - Not Adequate
3	Has the Board of Directors formulated Credit Risk Management policies, implemented them consistently, and updated them periodically?	• The Board of Directors has formulated Credit Risk Management policies;<br>• conducts business activities based on the established Credit Risk Management policies;<br>• The Board of Directors updates the Credit Risk Management policies in the event of changes in regulatory provisions, changes in business, and the results of the Board of Commissioners' evaluation of the Risk Management policies; and<br>• the implemented Credit Risk Management policies prove to mitigate the occurrence of Credit Risk.	• The Board of Directors has formulated Credit Risk Management policies;<br>• conducts business activities based on the established Credit Risk Management policies; and<br>• The Board of Directors updates the Credit Risk Management policies in the event of changes in regulatory provisions, changes in business, and the results of the Board of Commissioners' evaluation of the Risk Management policies.	• The Board of Directors has formulated Credit Risk Management policies;<br>• conducts business activities based on the established Credit Risk Management policies; and<br>• The Board of Directors updates the Credit Risk Management policies in the event of changes in regulatory provisions, changes in business, and the results of the Board of Commissioners' evaluation of the Risk Management policies.	• The Board of Directors has formulated Credit Risk Management policies;<br>• conducts business activities based on the established Credit Risk Management policies; and<br>• The Board of Directors does not update the Credit Risk Management policies in the event of changes in regulatory provisions, changes in business, and the results of the Board of Commissioners' evaluation of the Risk Management policies.<br>• The Board of Directors has formulated Credit Risk Management policies;<br>• does not conduct business activities based on the established Credit Risk Management policies; and<br>• The Board of Directors does not update the Credit Risk Management policies in the event of changes in regulatory provisions, changes in business, and the results of the Board of Commissioners' evaluation of the Risk Management policies.<br>• The Board of Directors does not formulate Credit Risk Management policies.
4	Does the Board of Directors have the ability to take necessary actions in the context of Credit Risk mitigation, and communicate Credit Risk Management policies to all levels of the BPR organization?	• The Board of Directors takes necessary actions to mitigate Risk when implementing Credit Risk Management policies;<br>• The Board of Directors communicates Credit Risk Management policies; and<br>• all levels of the BPR organization are able to understand the implemented Credit Risk Management policies.	• The Board of Directors takes necessary actions to mitigate Risk when implementing Credit Risk Management policies;<br>• The Board of Directors communicates Credit Risk Management policies; and<br>• not all levels of the BPR organization are able to understand the implemented Credit Risk Management policies, but it does not cause significant impact on Credit Risk.	• The Board of Directors takes necessary actions to mitigate Risk when implementing Credit Risk Management policies;<br>• The Board of Directors communicates Credit Risk Management policies; and<br>• not all levels of the BPR organization are able to understand the implemented Credit Risk Management policies and causes significant impact on Credit Risk.	• The Board of Directors takes necessary actions to mitigate Risk when implementing Credit Risk Management policies;<br>• The Board of Directors does not communicate Credit Risk Management policies; and<br>• all levels of the BPR organization are unable to understand the implemented Credit Risk Management policies.<br>• The Board of Directors does not take necessary actions to mitigate Risk when implementing Credit Risk Management policies;<br>• The Board of Directors does not communicate Credit Risk Management policies; and<br>• all levels of the BPR organization are unable to understand the implemented Credit Risk Management policies.
5	Does the BPR have sufficient organization to handle the credit function and the Credit Risk Management function?	• has a work unit that handles the credit function completely and there are no overlapping positions that could cause poor governance;<br>• the work unit handling the credit function has carried out its duties and authorities in accordance with the established guidelines; and<br>• has SKMR or PEMR and is able to carry out its function to mitigate Credit Risk.	• has a work unit that handles the credit function but not completely and there are no overlapping positions that could cause poor governance;<br>• the work unit handling the credit function has carried out its duties and authorities in accordance with the established guidelines; and<br>• has SKMR or PEMR and is able to carry out its function to mitigate Credit Risk.	• has a work unit that handles the credit function but not completely and there are overlapping positions but it does not cause poor governance;<br>• the work unit handling the credit function has carried out its duties and authorities in accordance with the established guidelines; and<br>• has SKMR or PEMR but is unable to carry out its function to mitigate Credit Risk.	• has a work unit that handles the credit function but not completely and there are overlapping positions that could cause poor governance;<br>• the work unit handling the credit function has carried out its duties and authorities in accordance with the established guidelines; and<br>• has SKMR or PEMR but is unable to carry out its function to mitigate Credit Risk.<br>• has a work unit that handles the credit function but not completely and there are overlapping positions that could cause poor governance;<br>• the work unit handling the credit function does not carry out its duties and authorities in accordance with the established guidelines; and<br>• has SKMR or PEMR but is unable to carry out its function to mitigate Credit Risk.
6	Has the Board of Directors applied Human Resource Management policies in the context of implementing Credit Risk Management?	• there is alignment of HR qualifications with positions and fields of work;<br>• there are efforts to consistently improve HR competence; and<br>• the level of HR performance standard fulfillment in work units carrying out the credit function is in accordance with duties and responsibilities.	• there is misalignment of HR qualifications with positions and fields of work but it does not cause significant impact;<br>• there are efforts to consistently improve HR competence; and<br>• the level of HR performance standard fulfillment in work units carrying out the credit function is in accordance with duties and responsibilities.	• there is misalignment of HR qualifications with positions and fields of work but it does not cause significant impact;<br>• there are efforts to improve HR competence but not consistently; and<br>• the level of HR performance standard fulfillment in work units carrying out the credit function is in accordance with duties and responsibilities.	• there is misalignment of HR qualifications with positions and fields of work and causes significant impact;<br>• there are efforts to improve HR competence but not consistently; and<br>• the level of HR performance standard fulfillment in work units carrying out the credit function is not in accordance with duties and responsibilities but does not cause significant impact.	• there is misalignment of HR qualifications with positions and fields of work and causes significant impact;<br>• there are no efforts to improve HR competence; and<br>• the level of HR performance standard fulfillment in work units carrying out the credit function is not in accordance with duties and responsibilities and causes significant impact.
7	Does the BPR have adequate Credit Risk Management policies formulated by considering the vision, mission, business scale and complexity, and HR sufficiency?	• has Credit Risk Management policies;<br>• there is alignment between the substance of Credit Risk Management policies with BPR Risk Management regulations, including having Risk Management strategies, healthy credit granting criteria, and the establishment of Risk Management information systems for Credit Risk; and<br>• there is harmony between Credit Risk Management policies with the vision, mission, business scale, and complexity, as well as HR sufficiency in establishing Credit Risk Management policies.	• has Credit Risk Management policies;<br>• there is non-significant misalignment between the substance of Credit Risk Management policies with BPR Risk Management regulations, including having Risk Management strategies, healthy credit granting criteria, and the establishment of Risk Management information systems for Credit Risk; and<br>• there is harmony between Credit Risk Management policies with the vision, mission, business scale, and complexity, as well as HR sufficiency in establishing Credit Risk Management policies.	• has Credit Risk Management policies;<br>• there is non-significant misalignment between the substance of Credit Risk Management policies with BPR Risk Management regulations, including having Risk Management strategies, healthy credit granting criteria, and the establishment of Risk Management information systems for Credit Risk; and<br>• there is disharmony between Credit Risk Management policies with the vision, mission, business scale, and complexity, as well as HR sufficiency in establishing Credit Risk Management policies, but it does not cause significant impact.	• has Credit Risk Management policies;<br>• there is significant misalignment between the substance of Credit Risk Management policies with BPR Risk Management regulations, including having Risk Management strategies, healthy credit granting criteria, and the establishment of Risk Management information systems for Credit Risk; and<br>• there is disharmony between Credit Risk Management policies with the vision, mission, business scale, and complexity, as well as HR sufficiency in establishing Credit Risk Management policies and causes significant impact.	• does not have Credit Risk Management policies.
8	Does the BPR:	• has Credit Risk Management procedures and the establishment of Credit Risk limits set by the Board of Directors;<br>• implements Credit Risk Management procedures and the establishment of Credit Risk limits consistently for all activities; and<br>• conducts evaluation and updating of Credit Risk Management procedures and the establishment of Credit Risk limits periodically?	• has Credit Risk Management procedures and the establishment of Credit Risk limits set by the Board of Directors, at least including clear and documented levels of delegation of authority and accountability;<br>• implements Credit Risk Management procedures and the establishment of Credit Risk limits well so as to facilitate audit trail requirements for internal control purposes;<br>• implements Credit Risk Management procedures and the establishment of Credit Risk limits in every functional activity consistently; and<br>• conducts evaluation and updating of Credit Risk Management procedures and the establishment of Credit Risk limits in the event of significant business changes and/or regulatory provisions.	• has Credit Risk Management procedures and the establishment of Credit Risk limits set by the Board of Directors, at least including clear and documented levels of delegation of authority and accountability;<br>• implements Credit Risk Management procedures and the establishment of Credit Risk limits well so as to facilitate audit trail requirements for internal control purposes;<br>• implements Credit Risk Management procedures and the establishment of Credit Risk limits in every functional activity consistently; and<br>• does not conduct evaluation and updating of Credit Risk Management procedures and the establishment of Credit Risk limits in the event of significant business changes and/or regulatory provisions, but it does not cause significant impact.	• has Credit Risk Management procedures and the establishment of Credit Risk limits set by the Board of Directors, at least including clear and documented levels of delegation of authority and accountability;<br>• implements Credit Risk Management procedures and the establishment of Credit Risk limits well so as to facilitate audit trail requirements for internal control purposes;<br>• does not implement Credit Risk Management procedures and the establishment of Credit Risk limits in every functional activity consistently; and<br>• does not conduct evaluation and updating of Credit Risk Management procedures and the establishment of Credit Risk limits in the event of significant business changes and/or regulatory provisions, and causes significant impact.	• has Credit Risk Management procedures and the establishment of Credit Risk limits set by the Board of Directors, at least including clear and documented levels of delegation of authority and accountability;<br>• does not implement Credit Risk Management procedures and the establishment of Credit Risk limits in every functional
activity consistently; and<br>• does not conduct evaluation and updating of Credit Risk Management procedures and the establishment of Credit Risk limits in the event of significant business changes and/or regulatory provisions.<br>• does not have Credit Risk Management procedures and the establishment of Credit Risk limits set by the Board of Directors.
9	Does the BPR have policies and procedures for the issuance of products and/or implementation of new activities that include identification and mitigation of Credit Risk in accordance with regulations?	• has policies and procedures regarding the issuance of products and/or new activities that have Credit Risk exposure;<br>• implements policies and procedures in the event of product issuance or implementation of new activities; and<br>• there is alignment between policies and procedures for products and/or new activities with regulations.	• has policies and procedures regarding the issuance of products and/or new activities that have Credit Risk exposure;<br>• implements policies and procedures in the event of product issuance or implementation of new activities; and<br>• there is non-significant misalignment between policies and procedures for products and/or new activities with regulations.	• has policies and procedures regarding the issuance of products and/or new activities that have Credit Risk exposure;<br>• implements policies and procedures in the event of product issuance or implementation of new activities; and<br>• there is significant misalignment between policies and procedures for products and/or new activities with regulations.	• has policies and procedures regarding the issuance of products and/or new activities that have Credit Risk exposure;<br>• does not implement policies and procedures in the event of product issuance or implementation of new activities; and<br>• there is significant misalignment between policies and procedures for products and/or new activities with regulations.	• does not have policies and procedures regarding the issuance of products and/or new activities that have Credit Risk exposure.
10	Has the BPR implemented the Credit Risk Management process embedded in the BPR's business activities related to Credit Risk?	• has implemented the Credit Risk Management process including identification, measurement, monitoring, and control of Credit Risk towards BPR business activities related to Credit Risk, at least covering the latest financial conditions or financial reports, cash flow projection results, and other documents that can be used to analyze the condition and credibility of debtors;<br>• the implementation of Credit Risk Management is done very adequately; and<br>• the implementation of Credit Risk Management is done consistently.	• has implemented the Credit Risk Management process including identification, measurement, monitoring, and control of Credit Risk towards BPR business activities related to Credit Risk, at least covering the latest financial conditions or financial reports, cash flow projection results, and other documents that can be used to analyze the condition and credibility of debtors;<br>• the implementation of Credit Risk Management is done adequately; and<br>• the implementation of Credit Risk Management is done fairly consistently.	• has implemented the Credit Risk Management process including identification, measurement, monitoring, and control of Credit Risk towards BPR business activities related to Credit Risk, at least covering the latest financial conditions or financial reports, cash flow projection results, and other documents that can be used to analyze the condition and credibility of debtors;<br>• the implementation of Credit Risk Management is done adequately; and<br>• the implementation of Credit Risk Management is not done consistently but does not cause significant impact.	• has implemented the Credit Risk Management process but not comprehensively including identification, measurement, monitoring, and control of Credit Risk towards BPR business activities related to Credit Risk, at least covering the latest financial conditions or financial reports, cash flow projection results, and other documents that can be used to analyze the condition and credibility of debtors;<br>• the implementation of Credit Risk Management is not adequate; and<br>• the implementation of Credit Risk Management is not done consistently so as to cause significant impact.	• does not implement the Credit Risk Management process including identification, measurement, monitoring, and control of Credit Risk towards BPR business activities related to Credit Risk.
11	Does the BPR have a Risk Management information system that supports the Board of Directors in decision-making regarding Credit Risk and has been reported to the Board of Directors periodically?	• has a Risk Management information system that reflects Credit Risk;<br>• data in the Risk Management information system is complete, accurate, current, and whole;<br>• the Risk Management information system supports the Board of Directors in decision-making; and<br>• the Risk Management information system strongly supports SKMR or PEMR in preparing reports to the Board of Directors every semester.	• has a Risk Management information system that reflects Credit Risk;<br>• data in the Risk Management information system is fairly complete, accurate, current, and whole;<br>• the Risk Management information system supports the Board of Directors in decision-making; and<br>• the Risk Management information system fairly supports SKMR or PEMR in preparing reports to the Board of Directors every semester.	• has a Risk Management information system that reflects Credit Risk;<br>• data in the Risk Management information system is less complete, accurate, current, and whole;<br>• the Risk Management information system does not fully support the Board of Directors in decision-making; and<br>• the Risk Management information system less supports SKMR or PEMR in preparing reports to the Board of Directors every semester.	• has a Risk Management information system that reflects Credit Risk;<br>• data in the Risk Management information system is not complete, accurate, current, and whole;<br>• the Risk Management information system does not fully support the Board of Directors in decision-making; and<br>• the Risk Management information system does not support SKMR or PEMR in preparing reports to the Board of Directors every semester.	• does not have a Risk Management information system that reflects Credit Risk.
12	Has the Internal Audit Committee (SKAI) or Internal Audit Unit (PEAI) conducted periodic audits on the implementation of Credit Risk Management, submitted internal audit result reports, and ensured follow-up on examination findings?	• SKAI or PEAI has conducted internal audits on the implementation of Credit Risk Management, provided recommendations, and reported internal audit results to the Chief Director;<br>• internal audits conducted by SKAI or PEAI cover the implementation of Credit Risk Management policies and procedures.	• SKAI or PEAI has conducted internal audits on the implementation of Credit Risk Management, provided recommendations, and reported internal audit results to the Chief Director;<br>• internal audits conducted by SKAI or PEAI cover the implementation of Credit Risk Management policies and procedures.	• SKAI or PEAI has conducted internal audits on the implementation of Credit Risk Management, provided recommendations, and reported internal audit results to the Chief Director;<br>• internal audits conducted by SKAI or PEAI cover the implementation of Credit Risk Management policies and procedures.	• SKAI or PEAI has conducted internal audits on the implementation of Credit Risk Management, provided recommendations, and reported internal audit results to the Chief Director;<br>• internal audits conducted by SKAI or PEAI are not in accordance with the scope of implementation of Credit Risk Management policies and procedures.	• SKAI or PEAI does not conduct internal audits on the implementation of Credit Risk Management.

No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate by considering the regulations and conditions of the BPR; and

the results of
internal audit findings made as recommendations have been followed up. by considering the regulations and conditions of the BPR; and
the results of
internal audit findings made as recommendations have not been fully followed up but do not result in significant impact. by considering the regulations and conditions of the BPR; and
the results of
internal audit findings made as recommendations have not been fully followed up and result in significant impact.
Credit Risk
Management; and
the results of
internal audit findings made as recommendations have not been followed up.
13 Has the internal control system against
Credit Risk been implemented by all levels of the BPR organization?
all levels of
the BPR organization related to activities with Credit Risk exposure have implemented internal control functions by considering
all levels of
the BPR organization related to activities with Credit Risk exposure have implemented internal control functions but have not
all levels of
the BPR organization related to activities with Credit Risk exposure have implemented internal control functions but have not
not all levels
of the BPR organization related to activities with Credit Risk exposure have implemented internal control functions with
all levels of
the BPR organization related to activities with Credit Risk exposure have not implemented internal control functions;
there is no
No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate policies on
Risk
Management, Risk
Management procedures, and the establishment of Credit Risk limits;
there is
clear authority and responsibility for each level of the BPR organization related to activities with Credit Risk exposure;
SKMR or
PEMR is separate from units related to activities with Credit Risk exposure; and
SKAI or PEAI
fully considers
Risk
Management policies, Risk
Management procedures, and the establishment of Credit Risk limits and has no significant impact;
there is
clear authority and responsibility for each level of the BPR organization related to activities with Credit Risk exposure;
SKMR or
PEMR is separate from units related to activities with Risk Management policies, Risk Management procedures, and the establishment of Credit Risk limits and has significant impact;
there is
clear authority and responsibility for each level of the BPR organization related to activities with Credit Risk exposure;
SKMR or
PEMR is separate from units related to activities with Risk Management policies, Risk Management procedures, and the establishment of Credit Risk limits and has very significant impact;
there is no
clear authority and responsibility for each level of the BPR organization related to activities with Credit Risk exposure;
SKMR or
PEMR is separate from units related to activities with clear authority and responsibility for each level of the BPR organization related to activities with Credit Risk exposure;
SKMR or
PEMR is not separate from units related to activities with Credit Risk exposure; and
SKAI or PEAI
is not separate from units related to activities with Credit Risk exposure.
No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate separate from units related to activities with Credit Risk exposure. with Credit Risk exposure; and
SKAI or PEAI
is separate from units related to activities with Credit Risk exposure. with Credit Risk exposure; and
SKAI or PEAI
is separate from units related to activities with Credit Risk exposure.
Credit Risk exposure; and
SKAI or PEAI
is separate from units related to activities with Credit Risk exposure. b. Operational Risk No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate 1 Has the Board of Commissioners given approval for operational Risk Management policies
The Board of
Commissioners has given approval for operational Risk Management policies;
The Board of
Commissioners has conducted an evaluation of
The Board of
Commissioners has given approval for operational Risk Management policies;
The Board of
Commissioners has conducted an evaluation of
The Board of
Commissioners has given approval for operational Risk Management policies;
The Board of
Commissioners has conducted an evaluation of
The Board of
Commissioners has given approval for operational Risk Management policies;
The Board of
Commissioners has not conducted an evaluation of
The Board of
Commissioners has not given approval for operational Risk Management policies;
The Board of
Commissioners has not conducted an evaluation of No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate drafted by the Board of Directors and conducts periodic evaluations? operational Risk Management policies;
evaluations
are conducted by the Board of
Commissioners periodically at least once within one year or whenever there are changes that affect the business activities of the BPR significantly; and
evaluations
conducted are relevant to the needs for adjusting operational Risk Management policies. operational Risk Management policies; and
evaluations
are conducted by the Board of
Commissioners periodically at least once within one year or whenever there are changes that affect the business activities of the BPR significantly. operational Risk Management policies; and
evaluations
are not conducted by the Board of
Commissioners periodically at least once within one year or whenever there are changes that affect the business activities of the BPR significantly. operational Risk Management policies; and operational Risk Management policies. 2 Has the Board of Commissioners conducted an evaluation of the accountability of the Board of Directors regarding the implementation of operational Risk Management policies periodically and ensured follow-up on the results of the said evaluation? an evaluation of the implementation of operational Risk Management policies by the Board of Directors;
evaluations
by the Board of
Commissioners are conducted periodically every semester based on reports submitted by the Board of Directors or more frequently in the event of changes that affect the business activities of the BPR significantly;
The Board of
Commissioners has ensured follow-up on the results of evaluations in each reporting period; and an evaluation of the implementation of operational Risk Management policies by the Board of Directors;
evaluations
by the Board of
Commissioners are conducted periodically every semester based on reports submitted by the Board of Directors or more frequently in the event of changes that affect the business activities of the BPR significantly; and
The Board of
Commissioners has ensured follow-up on the results of evaluations in each reporting period. an evaluation of the implementation of operational Risk Management policies by the Board of Directors;
evaluations
by the Board of
Commissioners are conducted periodically every semester based on reports submitted by the Board of Directors or more frequently in the event of changes that affect the business activities of the BPR significantly; and
The Board of
Commissioners has not ensured follow-up on the results of evaluations in each reporting period. an evaluation of the implementation of operational Risk Management policies by the Board of Directors;
evaluations
by the Board of
Commissioners are not conducted periodically; and
The Board of
Commissioners has not ensured follow-up on the results of evaluations in each reporting period. an evaluation of the implementation of operational Risk Management policies by the Board of Directors. No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate
evaluations
provided are relevant to the implementation of operational Risk Management policies to support the improvement of BPR performance. 3 Has the Board of Directors prepared operational Risk Management policies, implemented them consistently, and conducted periodic updates?
The Board of
Directors has prepared operational Risk
Management policies;
conducting
business activities based on operational Risk
Management policies that have been established;
The Board of
Directors conducts updates to
The Board of
Directors has prepared operational Risk
Management policies;
conducting
business activities based on operational Risk
Management policies that have been established; and
The Board of
Directors conducts updates
The Board of
Directors has prepared operational Risk
Management policies;
conducting
business activities based on operational Risk
Management policies that have been established; and
The Board of
Directors does not conduct updates
The Board of
Directors has prepared operational Risk
Management policies;
does not
conduct business activities based on operational Risk Management policies that have been established; and
The Board of
Directors does not conduct
The Board of
Directors does not prepare operational Risk
Management policies.
No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate operational Risk
Management policies in the event of changes in regulations, business changes, and the results of evaluations of operational Risk Management policies by the Board of Commissioners; and
operational
Risk
Management policies implemented have proven to mitigate the occurrence of operational Risk. updates to operational Risk Management policies in the event of changes in regulations, business changes, and the results of evaluations of operational Risk Management policies by the Board of Commissioners. updates to operational Risk Management policies in the event of changes in regulations, business changes, and the results of evaluations of operational Risk Management policies by the Board of Commissioners. updates to operational Risk Management policies in the event of changes in regulations, business changes, and the results of evaluations of operational Risk Management policies by the Board of Commissioners. 4 Has the Board of Directors had the ability to take necessary actions in the context of mitigating Operational Risk, and conducting communication of operational Risk Management policies to all levels of the BPR organization?
The Board of
Directors takes necessary actions to mitigate
Risk when implementing operational
Risk
Management policies;
The Board of
Directors communicates operational Risk
Management policies; and
all levels of
the BPR organization are able to understand operational Risk Management policies that are applied.
The Board of
Directors takes necessary actions to mitigate
Risk when implementing operational Risk
Management policies;
The Board of
Directors communicates operational Risk
Management policies; and
not all levels
of the BPR organization are able to understand operational Risk Management policies that are applied but do not result in significant impact.
The Board of
Directors takes necessary actions to mitigate
Risk when implementing operational Risk
Management policies;
The Board of
Directors communicates operational Risk
Management policies; and
not all levels
of the BPR organization are able to understand operational Risk Management policies that are applied and result in significant impact.
The Board of
Directors takes necessary actions to mitigate
Risk when implementing operational Risk
Management policies;
The Board of
Directors does not communicate operational Risk Management policies; and
all levels of
the BPR organization are not able to understand operational Risk Management policies that are applied.
The Board of
Directors takes necessary actions to mitigate
Risk when implementing operational Risk
Management policies;
The Board of
Directors does not communicate operational Risk Management policies; and
all levels of
the BPR organization are not able to understand operational Risk Management policies that are applied.
5 Has the BPR had adequate organization to handle operational functions and Operational Risk Management functions?
having working
units that handle operational functions, namely fund collection and distribution completely and there are no dual roles that could cause good governance not to be implemented;
working units
handling operational functions have executed their duties and authorities according to the established guidelines; and
having SKMR
or PEMR and being able to execute their functions to mitigate Operational Risk.
having working
units that handle operational functions, namely fund collection and distribution but not completely and there are no dual roles that could cause good governance not to be implemented;
working units
handling operational functions have executed their duties and authorities according to the established guidelines; and
having SKMR
or PEMR and being able to execute their functions to mitigate Operational Risk.
having working
units that handle operational functions, namely fund collection and distribution but not completely and there are dual roles but do not cause good governance not to be implemented;
working units
handling operational functions have executed their duties and authorities according to the established guidelines; and
having SKMR
or PEMR but not being able to execute their functions to mitigate Operational Risk.
having working
units that handle operational functions, namely fund collection and distribution but not completely and there are dual roles that could cause good governance not to be implemented;
working units
handling operational functions have executed their duties and authorities according to the established guidelines; and
having SKMR
or PEMR but not being able to execute their functions to mitigate Operational Risk.
having working
units that handle operational functions, namely fund collection and distribution but not completely and there are dual roles that could cause good governance not to be implemented;
working units
handling operational functions have not executed their duties and authorities according to the established guidelines; and
having SKMR
or PEMR but not being able to execute their functions to mitigate Operational Risk.
6 Has the Board of
Directors implemented human resource management policies in the context of implementing Operational Risk Management?
there is
alignment of HR qualifications with positions and fields of work;
there are efforts
to improve
HR competence consistently; and
the level of
HR performance standards compliance in working units executing operational functions according to duties and responsibilities.
there is
misalignment of HR qualifications with positions and fields of work but does not provide significant impact;
there are efforts
to improve
HR competence consistently; and
the level of
HR performance standards compliance in working units executing operational functions according to duties and responsibilities.
there is
misalignment of HR qualifications with positions and fields of work but does not provide significant impact;
there are efforts
to improve
HR competence but not consistently; and
the level of
HR performance standards compliance in working units executing operational functions according to duties and responsibilities misalignment of HR qualifications with positions and fields of work and provides significant impact;
there are efforts
to improve
HR competence but not consistently; and
the level of
HR performance standards compliance in working units executing operational functions not according to duties and responsibilities but does not provide significant impact. misalignment of HR qualifications with positions and fields of work and provides significant impact;
there are no
efforts to improve
HR competence; and
the level of
HR performance standards compliance in working units executing operational functions not according to duties and responsibilities and provides significant impact. No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate 7 Has the BPR had adequate operational Risk Management policies prepared by considering vision, mission, business scale and business complexity, as well as HR adequacy?
has operational
Risk
Management policies;
there is
alignment between the substance of operational Risk Management policies with BPR Risk Management regulations regarding transaction settlement, accounting, principles of knowing the customer and employees; and
there is
harmony between operational Risk
Management policies with vision, mission, business scale, and complexity, as well as HR adequacy in establishing operational Risk Management policies
has operational
Risk
Management policies;
there is
misalignment that is not significant between the substance of operational Risk Management policies with BPR Risk Management regulations regarding transaction settlement, accounting, principles of knowing the customer and employees; and
there is
harmony between operational Risk
Management policies with vision, mission, business scale, and complexity, as well as HR adequacy in establishing operational Risk Management policies
has operational
Risk
Management policies;
there is
misalignment that is not significant between the substance of operational Risk Management policies with BPR Risk Management regulations regarding transaction settlement, accounting, principles of knowing the customer and employees; and
there is
misalignment between operational
Risk
Management policies with vision, mission, business scale, and complexity, as well as HR adequacy in establishing operational Risk Management policies, but does not result in significant impact.
has operational
Risk
Management policies;
there is
significant misalignment between the substance of operational Risk Management policies with BPR Risk Management regulations regarding transaction settlement, accounting, principles of knowing the customer and employees; and
there is
misalignment between operational
Risk
Management policies with vision, mission, business scale, and complexity, has no operational Risk Management policies. No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate business, as well as HR adequacy in establishing operational Risk Management policies business, as well as HR adequacy in establishing operational Risk Management policies business, as well as HR adequacy in establishing operational Risk Management policies, and results in significant impact. 8 Has the BPR:
has operational
Risk
Management procedures and establishment of Operational Risk limits established by the Board of Directors;
implements
operational
Risk
Management procedures and establishment of Operational Risk limits consistently for all activities; and
conducts
evaluations and updates to operational Risk
Management procedures and establishment of Operational Risk limits periodically?
has operational
Risk
Management procedures and establishment of Operational Risk limits established by the Board of Directors at least including levels of delegation of authority and clear accountability as well as well documented so as to facilitate audit trail needs for internal control purposes;
implements
operational Risk
Management procedures and establishment of Operational Risk limits in every functional activities consistently; and
conducts
evaluations and updates to operational Risk
Management procedures and establishment of Operational Risk limits in the event of business changes so as to facilitate audit trail needs for internal control purposes;
has operational
Risk
Management procedures and establishment of Operational Risk limits established by the Board of Directors at least including levels of delegation of authority and clear accountability as well as well documented so as to facilitate audit trail needs for internal control purposes;
implements
operational Risk
Management procedures and establishment of Operational Risk limits in every functional activities consistently; and
does not conduct
evaluations and updates to operational Risk
Management procedures and establishment of Operational Risk limits in the event of business changes so as to facilitate audit trail needs for internal control purposes;
has operational
Risk
Management procedures and establishment of Operational Risk limits established by the Board of Directors at least including levels of delegation of authority and clear accountability as well as well documented so as to facilitate audit trail needs for internal control purposes;
implements
operational Risk
Management procedures and establishment of Operational Risk limits in every functional activities consistently; and
does not conduct
evaluations and updates to operational Risk
Management procedures and establishment of Operational Risk limits in the event of business changes so as to facilitate audit trail needs for internal control purposes;
does not
implement operational Risk
Management procedures and establishment of Operational Risk limits in every functional activities consistently; and
does not conduct
evaluations and updates to operational Risk
Management procedures and establishment of Operational Risk limits in the event of No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate operational Risk Management procedures and establishment of Operational Risk limits established by the Board of Directors.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate significant and/or regulatory provisions. significant and/or regulatory provisions, but do not result in significant impact. significant and/or regulatory provisions, and result in significant impact. significant business changes and/or regulatory provisions. 9 Has the BPR established policies and procedures for the issuance of products and/or implementation of new activities that include identification and mitigation of Operational Risk in accordance with the provisions?

has
policies and procedures regarding product issuance and/or new activities that have Operational Risk exposure;
implements
policies and procedures in the event of product issuance or implementation of new activities;
has
policies and procedures regarding product issuance and/or new activities that have Operational Risk exposure;
implements
policies and procedures in the event of product issuance or implementation of new activities;
has
policies and procedures regarding product issuance and/or new activities that have Operational Risk exposure;
implements
policies and procedures in the event of product issuance or implementation of new activities;
has
policies and procedures regarding product issuance and/or new activities that have Operational Risk exposure;
does not implement
policies and procedures in the event of product issuance or implementation of new activities; no policies and procedures regarding product issuance and/or activities Operational Risk exposure.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate and

there is
correspondence between policies and procedures for products and/or new activities with provisions. and
there is
non-correspondence that is not significant between policies and procedures for products and/or new activities with provisions. and
there is
non-correspondence that is significant between policies and procedures for products and/or new activities with provisions. and
there is
non-correspondence that is significant between policies and procedures for products and/or new activities with provisions. 10 Has the BPR implemented the Operational Risk Management process embedded in the BPR's business activities?
has
implemented the Operational Risk
Management process including identification, measurement, monitoring, and control of Operational Risk against all BPR business activities at least by considering the number and
has
implemented the Operational Risk
Management process including identification, measurement, monitoring, and control of Operational Risk against all BPR business activities at least by considering the number and
has
implemented the Operational Risk
Management process including identification, measurement, monitoring, and control of Operational Risk against all BPR business activities at least by considering the number and
has
implemented the Operational Risk
Management process but not comprehensively including identification, measurement, monitoring, and control of Operational Risk against all BPR business activities at least does not implement Operational Risk Management process including identification, measurement, monitoring, and control of Operational Risk against all BPR business activities.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate frequency of system failures, failures in customer relations, accounting errors, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;

application
of Operational Risk
Management is done very adequately; and
application
of Operational Risk
Management is done consistently. frequency of system failures, failures in customer relations, accounting errors, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;
application
of Operational Risk
Management is done adequately; and
application
of Operational Risk
Management is done not quite consistently. frequency of system failures, failures in customer relations, accounting errors, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;
application
of Operational Risk
Management is done adequately; and
application
of Operational Risk
Management is done not consistently but do not result in by considering the number and frequency of system failures, failures in customer relations, accounting errors, delays and payment settlement errors, deviations, accounting fraud, and strategy failures;
application
of Operational Risk
Management is not inadequate; and
application
of Operational Risk
Management is done not consistently and result in significant impact.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate significant impact. consistently and result in significant impact. 11 Has the BPR established an Information Management Risk system that supports the Board of Directors in decision-making regarding Operational Risk and has been reported to the Board of Directors periodically?

has an
Information Management Risk system that reflects Operational Risk;
data in the
Information Management Risk system is complete, accurate, current, and intact;
Information Management Risk
system supports the Board of Directors in decision-making; and
Information Management Risk
system very supports SKMR or PEMR
has an
Information Management Risk system that reflects Operational Risk;
data in the
Information Management Risk system is fairly complete, accurate, current, and intact;
Information Management Risk
system supports the Board of Directors in decision-making; and
Information Management Risk
system fairly supports SKMR or PEMR
has an
Information Management Risk system that reflects Operational Risk;
data in the
Information Management Risk system is less complete, accurate, current, and intact;
Information Management Risk
system does not fully support the Board of Directors in decision-making; and
Information Management Risk
system less supports
has an
Information Management Risk system that reflects Operational Risk;
data in the
Information Management Risk system is incomplete, accurate, current, and intact;
Information Management Risk
system does not fully support the Board of Directors in decision-making; and
Information Management Risk
system does not support
SKMR or PE no Information Management Risk system that reflects Operational Risk.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate in making reports to the Board of Directors every semester. in making reports to the Board of Directors every semester. SKMR or PEMR in making reports to the Board of Directors every semester. Risk Management in making reports to the Board of Directors every semester. 12 Has the BPR established policies and procedures for IT management?

has established
policies and procedures for IT management that have been established by the Board of Directors;
has
implemented operational activities in accordance with policies and procedures for IT management; and
has IT security aspects
in accordance with provisions of the
Financial Services Authority.
has established
policies and procedures for IT management that have been established by the Board of Directors;
has
implemented operational activities but not fully in accordance with policies and procedures for IT management and does not result in significant impact; and
has IT security aspects
has established
policies and procedures for IT management that have been established by the Board of Directors;
has
implemented operational activities but not fully in accordance with policies and procedures for IT management and result in significant impact; and
has IT security aspects
has established
policies and procedures for IT management that have been established by the Board of Directors;
has
implemented operational activities but not fully in accordance with policies and procedures for IT management and result in significant impact; and
has IT security aspects
no policies and procedures for IT management that have been established by the Board of Directors.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate IT security aspects in accordance with provisions of the Financial Services Authority. IT security aspects in accordance with provisions of the Financial Services Authority. IT security aspects but not in accordance with provisions of the Financial Services Authority. 13 Has the BPR implemented Operational Risk mitigation steps regarding external events?

has established
among others backups, backup power sources, alternative communication networks, and business recovery centers in accordance with provisions of the Financial Services Authority;
has established
business recovery plans in accordance with provisions of the Financial Services Authority; and
has conducted
tests on the plans
has established
among others backups, backup power sources, alternative communication networks, and business recovery centers in accordance with provisions of the Financial Services Authority;
has established
business recovery plans in accordance with provisions of the Financial Services Authority; and
has conducted
tests on the plans
has established
among others backups, backup power sources, alternative communication networks, and business recovery centers in accordance with provisions of the Financial Services Authority;
has established
business recovery plans but not fully in accordance with provisions of the Financial Services Authority and does not
has established
among others backups, backup power sources, alternative communication networks, and business recovery centers in accordance with provisions of the Financial Services Authority;
has established
business recovery plans but not fully in accordance with provisions of the Financial Services Authority and result in
has no established
among others backups, backup power sources, alternative communication networks, and business recovery centers in accordance with provisions of the Financial Services Authority;
has established
business recovery plans but not fully in accordance with provisions of the Financial Services Authority and result in

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate business recovery plans in accordance with provisions of the Financial Services Authority. business recovery plans but not fully in accordance with provisions of the Financial Services Authority. result in significant impact; and

has conducted
tests on the plans business recovery plans but not fully in accordance with provisions of the Financial Services Authority. significant impact; and
has conducted
tests on the plans business recovery plans but not fully in accordance with provisions of the Financial Services Authority. significant impact; and
has conducted
tests on the plans business recovery plans but not fully in accordance with provisions of the Financial Services Authority. 14 Has the SKAI or Internal Audit PE implemented periodic audits regarding the implementation of Operational Risk Management, submitting audit results reports, and ensuring follow-up on inspection findings?
SKAI or PEAI has
implemented internal audits regarding the implementation of Operational Risk Management, providing recommendations, and reporting internal audit results to the Chief Director;
SKAI or PEAI has
implemented internal audits regarding the implementation of Operational Risk Management, providing recommendations, and reporting internal audit results to the Chief Director;
SKAI or PEAI has
implemented internal audits regarding the implementation of Operational Risk Management, providing recommendations, and reporting internal audit results to the Chief Director;
SKAI or PEAI has
implemented internal audits regarding the implementation of Operational Risk Management, providing recommendations, and reporting internal audit results to the Chief Director; SKAI or PEAI does not implement internal audits regarding the implementation of Operational Risk Management.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate internal audits, and ensuring follow-up on inspection findings?

internal audits have been
implemented by
SKAI or PEAI including implementation of policies and procedures for Operational Risk Management by considering provisions as well as BPR conditions; and
internal audit findings
that are made into recommendations have been followed up.
internal audits have been
implemented by
SKAI or PEAI including implementation of policies and procedures for Operational Risk Management by considering provisions as well as BPR conditions; and
internal audit findings
that are made into recommendations are not fully followed up but do not result in significant impact.
internal audits have been
implemented by
SKAI or PEAI including implementation of policies and procedures for Operational Risk Management by considering provisions as well as BPR conditions; and
internal audit findings
that are made into recommendations are not fully followed up and result in significant impact.
internal audits have been
implemented by
SKAI or PEAI but not in accordance with the scope of implementation of policies and procedures for Operational Risk Management by considering provisions as well as BPR conditions; and
internal audit findings
that are made into recommendations are not followed up.
15 Has the internal control system regarding
Operational Risk been implemented by all levels of the BPR organization?
all levels
of the BPR organization related to activities that have Operational Risk exposure have implemented internal control functions by considering Operational Risk Management policies, Operational Risk Management procedures, and setting Operational Risk limits;
there is clarity
of authority and responsibility from each level of the BPR organization related to activities that have Operational Risk exposure;
SKMR or PEMR
that have
Operational Risk exposure have implemented internal control functions but not fully considering Operational Risk Management policies, Operational Risk Management procedures, and setting Operational Risk limits and do not have significant impact;
there is clarity
of authority and responsibility from each level of the BPR organization related to activities that have that have Operational Risk exposure have implemented internal control functions but not fully considering Operational Risk Management policies, Operational Risk Management procedures, and setting Operational Risk limits and have significant impact;
there is clarity
of authority and responsibility from each level of the BPR organization related to activities that have Operational Risk activities that have Operational Risk exposure have implemented internal control functions by considering Operational Risk Management policies, Operational Risk Management procedures, and setting Operational Risk limits and have very significant impact;
not all levels
of the BPR organization related to activities that have that have Operational Risk exposure have not implemented internal control functions;
there is no clarity
of authority and responsibility from each level of the BPR organization related to activities that have that have Operational Risk exposure have not implemented internal control functions;
SKMR or PEMR
is not separate from units related to activities that have Operational Risk exposure; and
SKAI or PEAI

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate not separate from units related to activities that have Operational Risk exposure; and

SKAI or PEAI
is separate from units related to activities that have Operational Risk exposure.
Operational Risk exposure;
SKMR or PEMR
is separate from units related to activities that have Operational Risk exposure; and
SKAI or PEAI
is separate from units related to activities that have Operational Risk exposure.
Operational Risk exposure;
SKMR or PEMR
is separate from units related to activities that have Operational Risk exposure; and
SKAI or PEAI
is separate from units related to activities that have Operational Risk exposure.
Operational Risk exposure;
SKMR or PEMR
is separate from units related to activities that have Operational Risk exposure; and
SKAI or PEAI
is separate from units related to activities that have Operational Risk exposure. not separate from units related to activities that have Operational Risk exposure.
c. Compliance Risk
No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate 1 Has the Board of Commissioners provided
The Board of Commissioners
has provided approval for
The Board of Commissioners
has provided approval for
The Board of Commissioners
has provided approval for
The Board of Commissioners
has provided approval for
The Board of Commissioners
has not provided approval for

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate approval for regarding Compliance Risk Management policies drafted by the Board of Directors and conducting periodic evaluations? Compliance Risk Management policies;

The Board of Commissioners
has conducted evaluations of
Compliance Risk Management policies;
evaluations
are conducted by the Board of Commissioners periodically at least once in one year or whenever there are changes that affect BPR business activities significantly; and
evaluations
provided are relevant to
Compliance Risk Management policies needs;
The Board of Commissioners
has conducted evaluations of
Compliance Risk Management policies; and
evaluations
are conducted by the Board of Commissioners periodically at least once in one year or whenever there are changes that affect BPR business activities significantly. Compliance Risk Management policies;
The Board of Commissioners
has conducted evaluations of
Compliance Risk Management policies; and
evaluations
are not conducted by the Board of Commissioners periodically at least once in one year or whenever there are changes that affect BPR business activities significantly. Compliance Risk Management policies; and
The Board of Commissioners
has not conducted evaluations of
Compliance Risk Management policies.
Compliance Risk Management policies; and
The Board of Commissioners
has not conducted evaluations of
Compliance Risk Management policies.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate adjustments to Compliance Risk Management policies. 2 Has the Board of Commissioners conducted evaluations of the Board of Directors' accountability for the implementation of Compliance Risk Management policies periodically and ensuring follow-up on the results of the said evaluations?

The Board of Commissioners
has conducted evaluations of the implementation of Compliance Risk Management policies by the Board of Directors;
evaluations by
the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event there are changes that affect BPR business activities significantly;
The Board of Commissioners
The Board of Commissioners
has conducted evaluations of the implementation of Compliance Risk Management policies by the Board of Directors;
evaluations by
the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event there are changes that affect BPR business activities significantly; and
The Board of Commissioners
The Board of Commissioners
has conducted evaluations of the implementation of Compliance Risk Management policies by the Board of Directors;
evaluations by
the Board of Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in the event there are changes that affect BPR business activities significantly; and
The Board of Commissioners
The Board of Commissioners
has conducted evaluations of the implementation of Compliance Risk Management policies by the Board of Directors;
evaluations by
the Board of Commissioners are not conducted periodically; and
The Board of Commissioners
has not ensured follow-up on evaluation results every reporting period.
The Board of Commissioners has not conducted evaluations of the implementation of Compliance Risk Management policies by the Board of Directors.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate has ensured follow-up on evaluation results every reporting period; and

evaluations
provided are relevant to the implementation of Compliance Risk Management policies in order to support BPR performance improvement. has ensured follow-up on evaluation results every reporting period. has not ensured follow-up on evaluation results every reporting period. 3 Has the Board of Directors compiled Compliance Risk Management policies, implemented consistently, and conducted updates
The Board of Directors
has compiled
Compliance Risk Management policies;
implementing
business activities based on
Compliance Risk Management policies
The Board of Directors
has compiled
Compliance Risk Management policies;
implementing
business activities based on
Compliance Risk Management policies
The Board of Directors
has compiled
Compliance Risk Management policies;
implementing
business activities based on
Compliance Risk Management policies
The Board of Directors
has compiled
Compliance Risk Management policies;
not
implementing business activities based on
Compliance Risk Management policies
The Board of Directors has not compiled
Compliance Risk Management policies.

Implementation of Compliance Risk Management for Rural Banks

Assessment Criteria

No	Parameter	Assessment Criteria
		1 - Very Adequate	2 - Adequate	3 - Fairly Adequate	4 - Inadequate	5 - Not Adequate
1	Has the Board of Directors established policies for Compliance Risk Management periodically?	• The Board of Directors has established policies for Compliance Risk Management; <br>• The Board of Directors updates the Compliance Risk Management policy when necessary, including changes in laws and regulations, business changes, and the results of the Board of Commissioners' evaluation of the Compliance Risk Management policy; and <br>• The established Compliance Risk Management policy is executed.	• The Board of Directors has established policies for Compliance Risk Management; <br>• The Board of Directors updates the Compliance Risk Management policy when necessary, including changes in laws and regulations, business changes, and the results of the Board of Commissioners' evaluation of the Compliance Risk Management policy; and <br>• The established Compliance Risk Management policy is executed.	• The Board of Directors has established policies for Compliance Risk Management; <br>• The Board of Directors updates the Compliance Risk Management policy when necessary, including changes in laws and regulations, business changes, and the results of the Board of Commissioners' evaluation of the Compliance Risk Management policy; and <br>• The established Compliance Risk Management policy is executed.	• The Board of Directors has established policies for Compliance Risk Management; <br>• The Board of Directors does NOT update the Compliance Risk Management policy when necessary, including changes in laws and regulations, business changes, and the results of the Board of Commissioners' evaluation of the Compliance Risk Management policy; and <br>• The established Compliance Risk Management policy is executed.	• The Board of Directors has established policies for Compliance Risk Management; <br>• The Board of Directors does NOT update the Compliance Risk Management policy when necessary, including changes in laws and regulations, business changes, and the results of the Board of Commissioners' evaluation of the Compliance Risk Management policy; and <br>• The established Compliance Risk Management policy is executed.
2	Has the Compliance Risk Management policy effectively mitigated the occurrence of Compliance Risk?	• The established Compliance Risk Management policy has proven to mitigate the occurrence of Compliance Risk.	• The established Compliance Risk Management policy has proven to mitigate the occurrence of Compliance Risk.	• The established Compliance Risk Management policy has proven to mitigate the occurrence of Compliance Risk.	• The established Compliance Risk Management policy has proven to mitigate the occurrence of Compliance Risk.	• The established Compliance Risk Management policy has proven to mitigate the occurrence of Compliance Risk.
3	Has the Board of Directors the ability to take necessary actions in the context of mitigating Compliance Risk, and communicated the Compliance Risk Management policy to all levels of the BPR organization?	• The Board of Directors takes necessary actions to mitigate Risk when executing the Compliance Risk Management policy; <br>• The Board of Directors communicates the Compliance Risk Management policy; and <br>• All levels of the BPR organization are able to understand the implemented Compliance Risk Management policy.	• The Board of Directors takes necessary actions to mitigate Risk when executing the Compliance Risk Management policy; <br>• The Board of Directors communicates the Compliance Risk Management policy; and <br>• Not all levels of the BPR organization are able to understand the implemented Compliance Risk Management policy, but it does not cause significant impact.	• The Board of Directors takes necessary actions to mitigate Risk when executing the Compliance Risk Management policy; <br>• The Board of Directors communicates the Compliance Risk Management policy; and <br>• Not all levels of the BPR organization are able to understand the implemented Compliance Risk Management policy, causing significant impact.	• The Board of Directors takes necessary actions to mitigate Risk when executing the Compliance Risk Management policy; <br>• The Board of Directors does NOT communicate the Compliance Risk Management policy; and <br>• All levels of the BPR organization are NOT able to understand the implemented Compliance Risk Management policy.	• The Board of Directors does NOT take necessary actions to mitigate Risk when executing the Compliance Risk Management policy; <br>• The Board of Directors does NOT communicate the Compliance Risk Management policy; and <br>• All levels of the BPR organization are NOT able to understand the implemented Compliance Risk Management policy.
4	Has the BPR adequate organization handling the compliance function and Compliance Risk Management function?	• Has a working unit or Executive Officer handling the compliance function; <br>• The working unit or Executive Officer handling the compliance function has executed its duties and authorities as per the established guidelines; and <br>• Has SKMR (Compliance Risk Management Unit) or PEMR (Compliance Risk Management Officer) capable of executing its function to mitigate Compliance Risk.	• Has a working unit or Executive Officer handling the compliance function; <br>• The working unit or Executive Officer handling the compliance function has executed its duties and authorities as per the established guidelines, but there are weaknesses causing insignificant impact; and <br>• Has SKMR or PEMR capable of executing its function to mitigate Compliance Risk.	• Has a working unit or Executive Officer handling the compliance function; <br>• The working unit or Executive Officer handling the compliance function has executed its duties and authorities as per the established guidelines, but there are weaknesses causing insignificant impact; and <br>• Has SKMR or PEMR but NOT capable of executing its function to mitigate Compliance Risk.	• Has a working unit or Executive Officer handling the compliance function; <br>• The working unit or Executive Officer handling the compliance function has executed its duties and authorities as per the established guidelines, but there are weaknesses causing significant impact; and <br>• Has SKMR or PEMR but NOT capable of executing its function to mitigate Compliance Risk.	• Has a working unit or Executive Officer handling the compliance function; <br>• The working unit or Executive Officer handling the compliance function has NOT executed its duties and authorities as per the established guidelines; and <br>• Has SKMR or PEMR but NOT capable of executing its function to mitigate Compliance Risk.
5	Has the Board of Directors implemented Human Resources Management policies in the context of implementing Compliance Risk Management?	• There is a match between HR qualifications and positions/job fields; <br>• There are consistent efforts to improve HR competence; and <br>• The level of HR performance standards fulfillment in working units executing the compliance function is in accordance with duties and responsibilities.	• There is a mismatch between HR qualifications and positions/job fields, but it does not cause significant impact; <br>• There are consistent efforts to improve HR competence; and <br>• The level of HR performance standards fulfillment in working units executing the compliance function is in accordance with duties and responsibilities.	• There is a mismatch between HR qualifications and positions/job fields, but it does not cause significant impact; <br>• There are efforts to improve HR competence but NOT consistent; and <br>• The level of HR performance standards fulfillment in working units executing the compliance function is in accordance with duties and responsibilities, but does not cause significant impact.	• There is a mismatch between HR qualifications and positions/job fields, causing significant impact; <br>• There are efforts to improve HR competence but NOT consistent; and <br>• The level of HR performance standards fulfillment in working units executing the compliance function is NOT in accordance with duties and responsibilities, causing significant impact.	• There is a mismatch between HR qualifications and positions/job fields, causing significant impact; <br>• There are NO efforts to improve HR competence; and <br>• The level of HR performance standards fulfillment in working units executing the compliance function is NOT in accordance with duties and responsibilities, causing significant impact.
6	Has the Board of Directors formulated internal policies supporting the implementation of the compliance function, paying attention to laws and regulations, and are there reward and punishment policies for internal BPR?	• The Board of Directors has formulated internal regulations to support the implementation of the compliance function; <br>• The Board of Directors pays attention to laws and regulations in implementing the compliance function, including understanding new regulations issued and relevant to the BPR; and <br>• The Board of Directors has formulated internal regulations to support the implementation of the compliance function; <br>• The Board of Directors pays attention to laws and regulations in implementing the compliance function, including understanding new regulations issued and relevant to the BPR; and <br>• Has reward and punishment policies for internal BPR.	• The Board of Directors has formulated internal regulations to support the implementation of the compliance function; <br>• The Board of Directors pays attention to laws and regulations in implementing the compliance function, including understanding new regulations issued and relevant to the BPR; and <br>• Has reward and punishment policies for internal BPR, but NOT running optimally.	• The Board of Directors has formulated internal regulations to support the implementation of the compliance function; <br>• The Board of Directors pays attention to laws and regulations in implementing the compliance function, including understanding new regulations issued and relevant to the BPR; and <br>• Does NOT have reward and punishment policies for internal BPR.	• The Board of Directors has NOT formulated internal regulations to support the implementation of the compliance function; <br>• The Board of Directors pays attention to laws and regulations in implementing the compliance function, including understanding new regulations issued and relevant to the BPR; and <br>• Does NOT have reward and punishment policies for internal BPR.	• The Board of Directors has NOT formulated internal regulations to support the implementation of the compliance function; <br>• The Board of Directors does NOT pay attention to laws and regulations in implementing the compliance function and does NOT understand new regulations issued and relevant to the BPR; and <br>• Does NOT have reward and punishment policies for internal BPR.
7	Does the BPR have adequate Compliance Risk Management policies formulated considering vision, mission, business scale and complexity, and HR adequacy?	• Has Compliance Risk Management policies; <br>• There is consistency between the substance of Compliance Risk Management policies and BPR Risk Management regulations, including regarding the absence of tolerance for violations; and <br>• There is harmony between Compliance Risk Management policies with vision, mission, business scale and complexity, and HR adequacy in establishing Compliance Risk Management policies.	• Has Compliance Risk Management policies; <br>• There are insignificant inconsistencies between the substance of Compliance Risk Management policies and BPR Risk Management regulations, including regarding the absence of tolerance for violations; and <br>• There is harmony between Compliance Risk Management policies with vision, mission, business scale and complexity, and HR adequacy in establishing Compliance Risk Management policies.	• Has Compliance Risk Management policies; <br>• There are insignificant inconsistencies between the substance of Compliance Risk Management policies and BPR Risk Management regulations, including regarding the absence of tolerance for violations; and <br>• There is disharmony between Compliance Risk Management policies with vision, mission, business scale and complexity, and HR adequacy in establishing Compliance Risk Management policies, but does not cause significant impact.	• Has Compliance Risk Management policies; <br>• There are significant inconsistencies between the substance of Compliance Risk Management policies and BPR Risk Management regulations, including regarding the absence of tolerance for violations; and <br>• There is disharmony between Compliance Risk Management policies with vision, mission, business scale and complexity, and HR adequacy in establishing Compliance Risk Management policies, causing significant impact.	• Does NOT have Compliance Risk Management policies.
8	Does the BPR: <br>• Have Compliance Risk Management procedures and compliance risk limit determination established by the Board of Directors; <br>• Execute Compliance Risk Management procedures and compliance risk limit determination consistently for all activities; and <br>• Periodically evaluate and update Compliance Risk Management procedures and compliance risk limit determination?	• Has Compliance Risk Management procedures and compliance risk limit determination established by the Board of Directors; <br>• Executes Compliance Risk Management procedures and compliance risk limit determination consistently for all activities; and <br>• Periodically evaluates and updates Compliance Risk Management procedures and compliance risk limit determination.	• Has Compliance Risk Management procedures and compliance risk limit determination established by the Board of Directors, at least including levels of authority delegation and clear accountability well documented to facilitate audit trail for internal control purposes; <br>• Executes Compliance Risk Management procedures and compliance risk limit determination in every functional activity consistently; and <br>• Evaluates and updates Compliance Risk Management procedures and compliance risk limit determination in the event of significant business changes and/or changes in laws and regulations.	• Has Compliance Risk Management procedures and compliance risk limit determination established by the Board of Directors, at least including levels of authority delegation and clear accountability well documented to facilitate audit trail for internal control purposes; <br>• Executes Compliance Risk Management procedures and compliance risk limit determination in every functional activity consistently; and <br>• Does NOT evaluate and update Compliance Risk Management procedures and compliance risk limit determination in the event of significant business changes and/or changes in laws and regulations, but does not cause significant impact.	• Has Compliance Risk Management procedures and compliance risk limit determination established by the Board of Directors, at least including levels of authority delegation and clear accountability well documented to facilitate audit trail for internal control purposes; <br>• Executes Compliance Risk Management procedures and compliance risk limit determination in every functional activity consistently; and <br>• Does NOT evaluate and update Compliance Risk Management procedures and compliance risk limit determination in the event of significant business changes and/or changes in laws and regulations, causing significant impact.	• Does NOT have Compliance Risk Management procedures and compliance risk limit determination established by the Board of Directors; <br>• Does NOT execute Compliance Risk Management procedures and compliance risk limit determination in every functional activity consistently; and <br>• Does NOT evaluate and update Compliance Risk
Management procedures and compliance risk limit determination in the event of significant business changes and/or changes in laws and regulations.
9	Does the BPR have policies and procedures for issuing products and/or executing new activities that include identification and mitigation of Compliance Risk in accordance with regulations?	• Has policies and procedures regarding the issuance of products and/or new activities that have Compliance Risk exposure; <br>• Applies policies and procedures in the event of product issuance or new activity execution; and <br>• There is consistency between policies and procedures for products and/or new activities with regulations.	• Has policies and procedures regarding the issuance of products and/or new activities that have Compliance Risk exposure; <br>• Applies policies and procedures in the event of product issuance or new activity execution; and <br>• There are insignificant inconsistencies between policies and procedures for products and/or new activities with regulations.	• Has policies and procedures regarding the issuance of products and/or new activities that have Compliance Risk exposure; <br>• Applies policies and procedures in the event of product issuance or new activity execution; and <br>• There are significant inconsistencies between policies and procedures for products and/or new activities with regulations.	• Has policies and procedures regarding the issuance of products and/or new activities that have Compliance Risk exposure; <br>• Does NOT apply policies and procedures in the event of product issuance or new activity execution; and <br>• There are significant inconsistencies between policies and procedures for products and/or new activities with regulations.	• Does NOT have policies and procedures regarding the issuance of products and/or new activities that have Compliance Risk exposure.
10	Has the BPR executed Compliance Risk Management processes embedded in BPR business activities?	• Has executed Compliance Risk Management processes including identification, measurement, monitoring, and control of Compliance Risk against all BPR business activities, at least considering BPR business activities, BPR non-compliance, and litigation processes; <br>• Implementation of Compliance Risk Management is very adequate; and <br>• Implementation of Compliance Risk Management is executed consistently.	• Has executed Compliance Risk Management processes including identification, measurement, monitoring, and control of Compliance Risk against all BPR business activities, at least considering BPR business activities, BPR non-compliance, and litigation processes; <br>• Implementation of Compliance Risk Management is adequate; and <br>• Implementation of Compliance Risk Management is executed fairly consistently.	• Has executed Compliance Risk Management processes including identification, measurement, monitoring, and control of Compliance Risk against all BPR business activities, at least considering BPR business activities, BPR non-compliance, and litigation processes; <br>• Implementation of Compliance Risk Management is adequate; and <br>• Implementation of Compliance Risk Management is NOT executed consistently, but does not cause significant impact.	• Has executed Compliance Risk Management processes but NOT entirely including identification, measurement, monitoring, and control of Compliance Risk against all BPR business activities, at least considering BPR business activities, BPR non-compliance, and litigation processes; <br>• Implementation of Compliance Risk Management is NOT adequate; and <br>• Implementation of Compliance Risk Management is NOT executed consistently, causing significant impact.	• Does NOT execute Compliance Risk Management processes including identification, measurement, monitoring, and control of Compliance Risk against all BPR business activities, at least considering BPR business activities, BPR non-compliance, and litigation processes.
11	Does the BPR have an information system for Compliance Risk Management that supports the Board of Directors in decision-making regarding Compliance Risk and has been reported to the Board of Directors periodically?	• Has an information system for Compliance Risk Management that reflects Compliance Risk; <br>• Data in the Compliance Risk Management information system is complete, accurate, current, and whole; <br>• Compliance Risk Management information system supports the Board of Directors in decision-making, including being able to reflect developments of newly issued laws and regulations; and <br>• Compliance Risk Management information system strongly supports Compliance Risk Management.	• Has an information system for Compliance Risk Management that reflects Compliance Risk; <br>• Data in the Compliance Risk Management information system is fairly complete, accurate, current, and whole; <br>• Compliance Risk Management information system supports the Board of Directors in decision-making, including being able to reflect developments of newly issued laws and regulations; and <br>• Compliance Risk Management information system fairly supports Compliance Risk Management.	• Has an information system for Compliance Risk Management that reflects Compliance Risk; <br>• Data in the Compliance Risk Management information system is less complete, accurate, current, and whole; <br>• Compliance Risk Management information system does NOT fully support the Board of Directors in decision-making; and <br>• Compliance Risk Management information system less supports SKMR or PEMR in making reports to the Board of Directors every semester.	• Has an information system for Compliance Risk Management that reflects Compliance Risk; <br>• Data in the Compliance Risk Management information system is NOT complete, accurate, current, and whole; <br>• Compliance Risk Management information system does NOT fully support the Board of Directors in decision-making; and <br>• Compliance Risk Management information system does NOT support SKMR or PEMR in making reports to the Board of Directors every semester.	• Does NOT have an information system for Compliance Risk Management that reflects Compliance Risk.
12	Has SKAI (Internal Audit Unit) or PEAI (Internal Audit Officer) executed periodic audits on the implementation of Compliance Risk Management, submitted internal audit result reports, and ensured follow-up on inspection findings?	• SKAI or PEAI has executed periodic internal audits on the implementation of Compliance Risk Management, provided recommendations, and reported internal audit results to the President Director; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management.	• SKAI or PEAI has executed periodic internal audits on the implementation of Compliance Risk Management, provided recommendations, and reported internal audit results to the President Director; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management.	• SKAI or PEAI has executed periodic internal audits on the implementation of Compliance Risk Management, provided recommendations, and reported internal audit results to the President Director; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management.	• SKAI or PEAI has executed periodic internal audits on the implementation of Compliance Risk Management, provided recommendations, and reported internal audit results to the President Director; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management; <br>• Internal audits executed by SKAI or PEAI include the implementation of policies and procedures for Compliance Risk Management.	• SKAI or PEAI has executed periodic internal audits on the implementation of Compliance Risk Management, provided recommendations, and reported internal audit results to the President Director; <br>• Internal audits executed by SKAI or PEAI are NOT in accordance with the scope of implementation of policies and procedures for Compliance Risk Management.	• SKAI or PEAI does
NOT execute periodic internal audits on the implementation of Compliance Risk Management.

No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate
Compliance Risk considering regulations and conditions of BPR; and

internal audit
findings made as recommendations have been followed up.
Compliance Risk considering regulations and conditions of BPR; and
internal audit
findings made as recommendations have not been fully followed up but do not result in significant impact.
Compliance Risk considering regulations and conditions of BPR; and
internal audit
findings made as recommendations have not been fully followed up and result in significant impact.
Compliance Risk management procedures considering regulations and conditions of BPR; and
internal audit
findings made as recommendations have not been followed up.
14 Has the internal control system for Compliance Risk been implemented by all levels of the BPR organization?
all levels of
the BPR organization related to activities with Compliance Risk exposure have implemented internal control functions by considering
all levels of
the BPR organization related to activities with Compliance Risk exposure have implemented internal control functions but have not fully
all levels of
the BPR organization related to activities with Compliance Risk exposure have implemented internal control functions but have not fully
not all levels
of the BPR organization related to activities with Compliance Risk exposure have implemented internal control functions with
all levels of
the BPR organization related to activities with Compliance Risk exposure have not implemented internal control functions;
there is no
No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate policies
Risk Management, procedures
Risk Management, and the setting of Compliance Risk limits;
there is
clear authority and responsibility for each level of the BPR organization related to activities with Compliance Risk exposure;
SKMR or PEMR
is separate from units in BPR related to activities with Compliance Risk exposure; and
SKAI or PEAI
considers policies
Risk Management, procedures
Risk Management, and the setting of Compliance Risk limits and does not result in significant impact;
there is
clear authority and responsibility for each level of the BPR organization related to activities with Compliance Risk exposure;
SKMR or PEMR
is separate from units in BPR related to activities with considering policies Risk Management, procedures Risk Management, and the setting of Compliance Risk limits and results in significant impact;
there is
clear authority and responsibility for each level of the BPR organization related to activities with Compliance Risk exposure;
SKMR or PEMR
is separate from units in BPR related to activities with considering policies Risk Management, procedures Risk Management, and the setting of Compliance Risk limits and results in very significant impact;
there is no
clear authority and responsibility for each level of the BPR organization related to activities with Compliance Risk exposure;
SKMR or PEMR
is separate from units in BPR related to activities with clear authority and responsibility for each level of the BPR organization related to activities with Compliance Risk exposure;
SKMR or PEMR
is not separate from units in
BPR related to activities with
Compliance Risk exposure; and
SKAI or PEAI
is not separate from units in
BPR related to activities with
Compliance Risk exposure.
No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate separate from units in BPR related to activities with Compliance Risk exposure. activities with Compliance Risk exposure; and
SKAI or PEAI
is separate from units in BPR related to activities with Compliance Risk exposure. activities with Compliance Risk exposure; and
SKAI or PEAI
is separate from units in BPR related to activities with Compliance Risk exposure. activities with Compliance Risk exposure; and
SKAI or PEAI
is separate from units in BPR related to activities with Compliance Risk exposure. exposure. d. Liquidity Risk No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate 1 Has the Board of Commissioners given approval for the Liquidity Risk Management policy drafted by the Board of Directors and conducting evaluations periodically?
The Board of
Commissioners has given approval for the Liquidity Risk Management policy;
The Board of
Commissioners has conducted an evaluation of the Liquidity Risk Management policy;
The Board of
Commissioners has given approval for the Liquidity Risk Management policy;
The Board of
Commissioners has conducted an evaluation of the Liquidity Risk Management policy;
The Board of
Commissioners has given approval for the Liquidity Risk Management policy;
The Board of
Commissioners has conducted an evaluation of the Liquidity Risk Management policy;
The Board of
Commissioners has given approval for the Liquidity Risk Management policy;
The Board of
Commissioners has not conducted an evaluation of the Liquidity Risk Management policy.
The Board of
Commissioners has not given approval for the Liquidity Risk Management policy; and
The Board of
Commissioners has not conducted
No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate by the Board of
Directors and conducting evaluations periodically? of the Liquidity Risk Management policy;
evaluations
are conducted by the Board of
Commissioners periodically at least once in one year or whenever there are changes that affect BPR business activities significantly; and
evaluations
provided are relevant to the needs for adjusting Liquidity Risk Management policies. of the Liquidity Risk Management policy; and
evaluations
are conducted by the Board of
Commissioners periodically at least once in one year or whenever there are changes that affect BPR business activities significantly. of the Liquidity Risk Management policy; and
evaluations
are not conducted by the Board of
Commissioners periodically at least once in one year or whenever there are changes that affect BPR business activities significantly. of the Liquidity Risk Management policy. of the Liquidity Risk Management policy. No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate 2 Has the Board of Commissioners conducted an evaluation of the Board of Directors' accountability for the implementation of Liquidity Risk Management policies periodically and ensuring follow- up on the results of the evaluation?
The Board of
Commissioners has conducted an evaluation of the implementation of Liquidity Risk Management policies by the Board of Directors;
evaluations
by the Board of
Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in cases where there are changes that affect BPR business activities significantly;
The Board of
Commissioners has ensured follow-up on evaluation results in every
The Board of
Commissioners has conducted an evaluation of the implementation of Liquidity Risk Management policies by the Board of Directors;
evaluations
by the Board of
Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in cases where there are changes that affect BPR business activities significantly; and
The Board of
Commissioners has ensured follow-up on evaluation results in every
The Board of
Commissioners has conducted an evaluation of the implementation of Liquidity Risk Management policies by the Board of Directors;
evaluations
by the Board of
Commissioners are conducted periodically every semester or more based on reports submitted by the Board of Directors in cases where there are changes that affect BPR business activities significantly; and
The Board of
Commissioners has not ensured follow-up on evaluation results in every
The Board of
Commissioners has conducted an evaluation of the implementation of Liquidity Risk Management policies by the Board of Directors;
evaluations
by the Board of
Commissioners are not conducted periodically every semester or more based on reports submitted by the Board of Directors in cases where there are changes that affect BPR business activities significantly; and
The Board of
Commissioners has not ensured follow-up on evaluation results No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate reporting periods; and
evaluations
provided are relevant to the implementation of Liquidity Risk Management policies in support of improving BPR performance. reporting periods. reporting periods. in every reporting period. The Board of Commissioners has not conducted an evaluation of the implementation of Liquidity Risk Management policies by the Board of Directors. No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate 3 Has the Board of Directors drafted Liquidity Risk Management policies, implemented them consistently, and updated them periodically?
The Board of
Directors has drafted
Liquidity Risk
Management policies;
conducting
business activities based on
Liquidity Risk
Management policies that have been established;
The Board of
Directors conducts
The Board of
Directors has drafted
Liquidity Risk
Management policies;
conducting
business activities based on
Liquidity Risk
Management policies that have been established; and
The Board of
Directors conducts
The Board of
Directors has drafted
Liquidity Risk
Management policies;
conducting
business activities based on
Liquidity Risk
Management policies that have been established; and
The Board of
Directors does not conduct
The Board of
Directors has drafted
Liquidity Risk
Management policies;
does not
conduct business activities based on Liquidity Risk Management policies that have been established; and
The Board of
Directors does not conduct
The Board of
Directors does not draft
Liquidity Risk
Management policies.
No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate updating of
Liquidity Risk
Management policies in cases where there are changes in regulations, business changes, and evaluation results of Risk Management policies by the Board of Commissioners; and
Liquidity Risk
Management policies implemented prove to mitigate the occurrence of Liquidity Risk. updating of Liquidity Risk Management policies in cases where there are changes in regulations, business changes, and evaluation results of Risk Management policies by the Board of Commissioners. updating of Liquidity Risk Management policies in cases where there are changes in regulations, business changes, and evaluation results of Risk Management policies by the Board of Commissioners. updating of Liquidity Risk Management policies in cases where there are changes in regulations, business changes, and evaluation results of Risk Management policies by the Board of Commissioners. No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate 4 Has the Board of Directors the ability to take necessary actions to mitigate Liquidity Risk, and communicate Liquidity Risk Management policies to all levels of the BPR organization?
The Board of
Directors takes necessary actions to mitigate Risk when implementing Liquidity Risk Management policies;
The Board of
Directors communicates
Liquidity Risk
Management policies; and
all levels of
the BPR organization are able to understand
Liquidity Risk
Management policies implemented.
The Board of
Directors takes necessary actions to mitigate Risk when implementing Liquidity Risk Management policies;
The Board of
Directors communicates
Liquidity Risk
Management policies; and
not all levels
of the BPR organization are able to understand Liquidity Risk Management policies implemented but do not result in significant impact.
The Board of
Directors takes necessary actions to mitigate Risk when implementing Liquidity Risk Management policies;
The Board of
Directors communicates
Liquidity Risk
Management policies; and
not all levels
of the BPR organization are able to understand Liquidity Risk Management policies implemented and result in significant impact.
The Board of
Directors takes necessary actions to mitigate Risk when implementing Liquidity Risk Management policies;
The Board of
Directors does not communicate
Liquidity Risk
Management policies; and
all levels of
the BPR organization are unable to understand
Liquidity Risk
Management policies implemented.
The Board of
Directors does not take necessary actions to mitigate Risk when implementing Liquidity Risk Management policies;
The Board of
Directors does not communicate
Liquidity Risk
Management policies; and
all levels of
the BPR organization are unable to understand
Liquidity Risk
Management policies implemented.
No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate
5 Has BPR sufficient organization to handle liquidity functions and Liquidity Risk Management functions?
has work units
that handle liquidity functions;
work units
that handle liquidity functions have implemented tasks and authority in accordance with established guidelines; and
has SKMR or
PEMR capable of implementing its functions to mitigate Liquidity Risk
has work units
that handle liquidity functions but incomplete;
work units
that handle liquidity functions have implemented tasks and authority in accordance with established guidelines; and
has SKMR or
PEMR capable of implementing its functions to mitigate Liquidity Risk.
has work units
that handle liquidity functions;
work units
that handle liquidity functions have implemented tasks and authority in accordance with established guidelines; and
has SKMR or
PEMR that is not capable of implementing its functions to mitigate Liquidity Risk.
has work units
that handle liquidity functions but incomplete;
work units
that handle liquidity functions have implemented tasks and authority in accordance with established guidelines; and
has SKMR or
PEMR that is not capable of implementing its functions to mitigate Liquidity Risk.
has work units
that handle liquidity functions but incomplete;
work units
that handle liquidity functions do not implement tasks and authority in accordance with established guidelines; and
has SKMR or
PEMR that is not capable of implementing its functions to mitigate Liquidity Risk.
6 Has the Board of Directors implemented human resource management policies in order to implement Liquidity Risk Management?
there is
alignment of human resource qualifications with positions and fields of work;
there are
efforts to
there is
misalignment of human resource qualifications with positions and fields of work but does not provide
there is
misalignment of human resource qualifications with positions and fields of work but does not provide
there is
misalignment of human resource qualifications with positions and fields of work and provides
there is
misalignment of human resource qualifications with positions and fields of work and provides No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate implementation of Liquidity Risk Management? improve human resource competence consistently; and
the level of
human resource performance standard compliance in work units performing liquidity functions according to tasks and responsibilities. immediate impact;
there are
efforts to improve human resource competence consistently; and
the level of
human resource performance standard compliance in work units performing liquidity functions according to tasks and responsibilities. immediate impact;
there are
efforts to improve human resource competence but not consistently; and
the level of
human resource performance standard compliance in work units performing liquidity functions according to tasks and responsibilities. immediate impact;
there are
efforts to improve human resource competence but not consistently; and
the level of
human resource performance standard compliance in work units performing liquidity functions is not in accordance with tasks and responsibilities but does not provide immediate impact. immediate impact;
there are no
efforts to improve human resource competence; and
the level of
human resource performance standard compliance in work units performing liquidity functions is not in accordance with tasks and responsibilities and provides immediate impact. 7 Has BPR sufficient Liquidity Risk Management policies including among others market condition assessments, handling Liquidity Risk concentration issues, preventing dependence on certain funding sources, and drafted by considering vision, mission, business scale and business complexity, as well as human resource sufficiency?
has Liquidity
Risk Management policies;
there is
alignment between the substance of
Liquidity Risk
Management policies and
BPR Risk
Management regulations including early warning indicators for Liquidity Risk, periodic funding needs or liquidity surplus, and potential liquidity shortfalls that occur based on past experience; and
there is
consistency between
Liquidity Risk
Management policies and vision, mission, business scale, and business complexity, as well as human resource sufficiency in establishing Liquidity Risk Management policies.
has Liquidity
Risk Management policies;
there is
misalignment that is not significant between the substance of Liquidity Risk Management policies and BPR Risk Management regulations including early warning indicators for Liquidity Risk, periodic funding needs or liquidity surplus, and potential liquidity shortfalls that occur based on past experience; and
there is
consistency between
Liquidity Risk
Management policies and vision, mission, business scale, and business complexity, as well as human resource sufficiency in establishing Liquidity Risk Management policies.
has Liquidity
Risk Management policies;
there is
misalignment that is not significant between the substance of Liquidity Risk Management policies and BPR Risk Management regulations including early warning indicators for Liquidity Risk, periodic funding needs or liquidity surplus, and potential liquidity shortfalls that occur based on past experience; and
there is
inconsistency between
Liquidity Risk
Management policies and vision, mission, business scale, and business complexity, as well as human resource sufficiency in establishing Liquidity Risk Management policies, but does not result in significant impact.
has Liquidity
Risk Management policies;
there is
significant misalignment between the substance of Liquidity Risk Management policies and BPR Risk Management regulations including early warning indicators for Liquidity Risk, periodic funding needs or liquidity surplus, and potential liquidity shortfalls that occur based on past experience; and
there is
inconsistency between
Liquidity Risk
Management policies and vision, mission, business scale, and business complexity, as well as human resource sufficiency in establishing Liquidity Risk Management policies, and results in significant impact. No Liquidity Risk Management policies. No Parameter Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate Adequate 5 - Not Adequate 8 Has BPR:
has Liquidity
Risk Management procedures and
Liquidity Risk limit setting established by the Board of Directors;
implements
Liquidity Risk
Management procedures and
Liquidity Risk limit setting consistently for all activities; and
conducts
evaluations and updates of
Liquidity Risk
Management procedures and
Liquidity Risk limit setting periodically?
has Liquidity
Risk Management procedures and
Liquidity Risk limit setting established by the Board of Directors at least covering levels of delegation of authority and accountability that are clear and well documented so as to facilitate audit trail requirements for internal control purposes;
implements
Liquidity Risk
Management procedures and
Liquidity Risk limit setting in every functional activity consistently; and
conducts
evaluations and updates of
Liquidity Risk
Management procedures and
Liquidity Risk limit setting
has Liquidity
Risk Management procedures and
Liquidity Risk limit setting established by the Board of Directors at least covering levels of delegation of authority and accountability that are clear and well documented so as to facilitate audit trail requirements for internal control purposes;
implements
Liquidity Risk
Management procedures and
Liquidity Risk limit setting in every functional activity consistently; and
does not conduct
evaluations and updates of
Liquidity Risk
Management procedures and
Liquidity Risk limit setting
has Liquidity
Risk Management procedures and
Liquidity Risk limit setting established by the Board of Directors at least covering levels of delegation of authority and accountability that are clear and well documented so as to facilitate audit trail requirements for internal control purposes;
implements
Liquidity Risk
Management procedures and
Liquidity Risk limit setting in every functional activity consistently; and
does not conduct
evaluations and updates of
Liquidity Risk
Management procedures and
Liquidity Risk limit setting
has Liquidity
Risk Management procedures and
Liquidity Risk limit setting established by the Board of Directors at least covering levels of delegation of authority and accountability that are clear and well documented so as to facilitate audit trail requirements for internal control purposes;
does not
implement
Liquidity Risk
Management procedures and
Liquidity Risk limit setting in every functional activity consistently; and
does not conduct
evaluations and updates of
Liquidity Risk
Management procedures and
Liquidity Risk limit setting
No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate periodically? periodically? periodically?
No Parameter
Assessment Criteria
1 - Very
Adequate 2 - Adequate 3 - Fairly
Adequate
4 - Inadequate
Adequate
5 - Not
Adequate does not have
Liquidity Risk
Management procedures and
Liquidity Risk limit setting established by the Board of Directors

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate liquidity in the event of significant business changes and/or regulatory provisions. liquidity in the event of significant business changes and/or regulatory provisions, but does not cause significant impact. liquidity in the event of significant business changes and/or regulatory provisions and causes significant impact. Liquidity Risk limits in the event of significant business changes and/or regulatory provisions and causes significant impact. 9 Has the BPR established policies and procedures for the issuance of products and/or implementation of new activities that include identification and mitigation of Liquidity Risk in accordance with

has
policies and procedures regarding the issuance of products and/or new activities that have Liquidity Risk exposure;
implements
policies and procedures in the event of issuance of products or implementation of new activities; and
there is
consistency between policies and procedures for products and/or new activities with regulations.
has
policies and procedures regarding the issuance of products and/or new activities that have Liquidity Risk exposure;
implements
policies and procedures in the event of issuance of products or implementation of new activities; and
there is
insignificant inconsistency between policies and procedures for products and/or new activities with regulations.
has
policies and procedures regarding the issuance of products and/or new activities that have Liquidity Risk exposure;
implements
policies and procedures in the event of issuance of products or implementation of new activities; and
there is
significant inconsistency between policies and procedures for products and/or new activities with regulations.
has
policies and procedures regarding the issuance of products and/or new activities that have Liquidity Risk exposure;
does not implement
policies and procedures in the event of issuance of products or implementation of new activities; and
there is
significant inconsistency between policies and procedures for products and/or new activities with regulations. has no policies and procedures regarding issuance of products and/or new activities Liquidity Risk exposure.

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate regulations?

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate Liquidity Risk at least includes assessment of deposit structure, all cash inflows and outflows including funding needs, BPR's ability to obtain liquidity, and liquid assets that can be converted especially in crisis conditions;

implementation
of Liquidity Risk Management is done very adequately; and
implementation
of Liquidity Risk Management is done consistently.
Liquidity Risk at least includes assessment of deposit structure, all cash inflows and outflows including funding needs, BPR's ability to obtain liquidity, and liquid assets that can be converted especially in crisis conditions;
implementation
of Liquidity Risk Management is done adequately; and
implementation
of Liquidity Risk Management is done fairly consistently.
Liquidity Risk at least includes assessment of deposit structure, all cash inflows and outflows including funding needs, BPR's ability to obtain liquidity, and liquid assets that can be converted especially in crisis conditions;
implementation
of Liquidity Risk Management is done adequately; and
implementation
of Liquidity Risk Management is not done consistently, but does not affect the business activities of the BPR related to Liquidity Risk at least includes assessment of deposit structure, all cash inflows and outflows including funding needs, BPR's ability to obtain liquidity, and liquid assets that can be converted especially in crisis conditions;
implementation
of Liquidity Risk Management is inadequate; and
implementation
of Liquidity Risk Management
Liquidity Risk.

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate causes significant impact. is not done consistently so that causes significant impact. 11 Has the BPR established an information system for Risk Management that supports the Board of Directors in decision-making related to Liquidity Risk and has been reported to the Board of Directors periodically?

has
established a Risk Management information system that reflects Liquidity Risk;
data in the Risk Management
information system is complete, accurate, timely, and intact;
Risk Management
information system supports the Board of Directors in decision-making; and
Risk Management
information system is very
has
established a Risk Management information system that reflects Liquidity Risk;
data in the Risk Management
information system is sufficiently complete, accurate, timely, and intact;
Risk Management
information system supports the Board of Directors in decision-making; and
Risk Management
information system is sufficiently
has
established a Risk Management information system that reflects Liquidity Risk;
data in the Risk Management
information system is less complete, accurate, timely, and intact;
Risk Management
information system does not fully support the Board of Directors in decision-making; and
Risk Management
information system
has
established a Risk Management information system that reflects Liquidity Risk;
data in the Risk Management
information system is not complete, accurate, timely, and intact;
Risk Management
information system does not fully support the Board of Directors in decision-making; and
Risk Management
information system has no
Risk Management information system that reflects Liquidity Risk.

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate supports Internal Audit Committee (SKMR) or Internal Audit Unit (PEMR) in preparing reports to the Board of Directors every semester. supports Internal Audit Committee (SKMR) or Internal Audit Unit (PEMR) in preparing reports to the Board of Directors every semester. Risk Management less supports Internal Audit Committee (SKMR) or Internal Audit Unit (PEMR) in preparing reports to the Board of Directors every semester. Risk Management does not support Internal Audit Committee (SKMR) or Internal Audit Unit (PEMR) in preparing reports to the Board of Directors every semester. 12 Has the Internal Audit Committee (SKAI) or Internal Audit Unit (PEAI) conducted periodic audits on the implementation of Liquidity Risk Management, submitting internal audit reports, and ensuring follow-up on audit findings?

SKAI or PEAI has
conducted internal audit on the implementation of Liquidity Risk Management, providing recommendations, and reporting internal audit results to the Chief Director;
internal audit has
been conducted by
SKAI or PEAI including implementation of policies and procedures
SKAI or PEAI has
conducted internal audit on the implementation of Liquidity Risk Management, providing recommendations, and reporting internal audit results to the Chief Director;
internal audit has
been conducted by
SKAI or PEAI including implementation of policies and procedures
SKAI or PEAI has
conducted internal audit on the implementation of Liquidity Risk Management, providing recommendations, and reporting internal audit results to the Chief Director;
internal audit has
been conducted by
SKAI or PEAI including implementation of policies and procedures
SKAI or PEAI has
conducted internal audit on the implementation of Liquidity Risk Management, providing recommendations, and reporting internal audit results to the Chief Director;
internal audit has
been conducted by
SKAI or PEAI but not in accordance with the scope of implementation SKAI or PEAI has not conducted internal audit on the implementation of Liquidity Risk Management, providing recommendations, and reporting internal audit results to the Chief Director.

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate Liquidity Risk Management by considering regulations and BPR conditions; and

internal audit findings
used as recommendations have been followed up.
Liquidity Risk Management by considering regulations and BPR conditions; and
internal audit findings
used as recommendations are not fully followed up but do not cause significant impact.
Liquidity Risk Management by considering regulations and BPR conditions; and
internal audit findings
used as recommendations are not fully followed up and cause significant impact.
Liquidity Risk Management policies and procedures; and
internal audit findings
used as recommendations are not followed up.
13 Has the internal control system for
Liquidity Risk been implemented by all levels of the BPR organization?
all levels of
BPR organization related to activities with
Liquidity Risk exposure have implemented internal control functions with
all levels of
BPR organization related to activities with
Liquidity Risk exposure have implemented internal control functions but
all levels of
BPR organization related to activities with
Liquidity Risk exposure have implemented internal control functions but
not all levels of
BPR organization related to activities with
Liquidity Risk exposure have implemented internal control
all levels of
BPR organization related to activities with
Liquidity Risk exposure have not implemented internal control functions;

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate considering Risk Management policies, Risk Management procedures, and setting of Liquidity Risk limits;

there is
clear authority and responsibility from each level of BPR organization related to activities with Liquidity Risk exposure;
Internal Audit Committee (SKMR) or Internal Audit Unit (PEMR)
is separate from units related to activities with Liquidity Risk exposure; and
Internal Audit Committee (SKAI) or Internal Audit Unit (PEAI)
is not fully considering
Risk Management policies, Risk Management procedures, and setting of Liquidity Risk limits and has no significant impact;
there is
clear authority and responsibility from each level of BPR organization related to activities with Liquidity Risk exposure;
Internal Audit Committee (SKMR) or Internal Audit Unit (PEMR)
is separate from units related to activities with Liquidity Risk exposure not fully considering Risk Management policies, Risk Management procedures, and setting of Liquidity Risk limits and has significant impact;
there is
clear authority and responsibility from each level of BPR organization related to activities with Liquidity Risk exposure;
Internal Audit Committee (SKMR) or Internal Audit Unit (PEMR)
is separate from units related to activities with Liquidity Risk exposure not fully considering Risk Management policies, Risk Management procedures, and setting of Liquidity Risk limits and has significant impact;
there is
clear authority and responsibility from each level of BPR organization related to activities with Liquidity Risk exposure;
Internal Audit Committee (SKMR) or Internal Audit Unit (PEMR)
is separate from units related to activities with Liquidity Risk exposure; and
Internal Audit Committee (SKAI) or Internal Audit Unit (PEAI)
is separate from units related to activities with Liquidity Risk exposure.
not all levels of
BPR organization related to activities with
Liquidity Risk exposure have implemented internal control functions by considering Risk Management policies, Risk Management procedures, and setting of Liquidity Risk limits and has very significant impact;
there is no
clear authority and responsibility from each level of BPR organization related to activities with Liquidity Risk exposure;
Internal Audit Committee (SKMR) or Internal Audit Unit (PEMR)
is separate from units related to activities with Liquidity Risk exposure; and
Internal Audit Committee (SKAI) or Internal Audit Unit (PEAI)
is separate from units related to activities with Liquidity Risk exposure.
there is no
clear authority and responsibility from each level of BPR organization related to activities with Liquidity Risk exposure;
Internal Audit Committee (SKMR) or Internal Audit Unit (PEMR)
is not separate from units related to activities with Liquidity Risk exposure; and
Internal Audit Committee (SKAI) or Internal Audit Unit (PEAI)
is not separate from units related to activities with Liquidity Risk exposure.

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate separate from units related to activities with Liquidity Risk exposure. with Liquidity Risk exposure; and

Internal Audit Committee (SKAI) or Internal Audit Unit (PEAI)
is separate from units related to activities with Liquidity Risk exposure.
Liquidity Risk exposure; and
Internal Audit Committee (SKAI) or Internal Audit Unit (PEAI)
is separate from units related to activities with Liquidity Risk exposure.
Liquidity Risk exposure; and
Internal Audit Committee (SKAI) or Internal Audit Unit (PEAI)
is separate from units related to activities with Liquidity Risk exposure. e. Reputation Risk No Parameter Assessment Assessment Criteria 1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate 1 Has the Board of Commissioners given approval for Reputation Risk Management policies drafted by the Board of Directors and
Board of Commissioners
has given approval for
Reputation Risk Management policies;
Board of Commissioners
has conducted evaluation of
Reputation Risk Management policies;
evaluation
is conducted by
Board of Commissioners periodically at least once a year or whenever there are changes that affect BPR business activities significantly; and
evaluation conducted is relevant to
needs for adjusting
Reputation Risk Management policies.
Board of Commissioners
has given approval for
Reputation Risk Management policies;
Board of Commissioners
has conducted evaluation of
Reputation Risk Management policies; and
evaluation
is conducted by
Board of Commissioners periodically at least once a year or whenever there are changes that affect BPR business activities significantly.
Board of Commissioners
has given approval for
Reputation Risk Management policies;
Board of Commissioners
has conducted evaluation of
Reputation Risk Management policies; and
evaluation is not
conducted by
Board of Commissioners periodically at least once a year or whenever there are changes that affect BPR business activities significantly.
Board of Commissioners
has given approval for
Reputation Risk Management policies; and
Board of Commissioners
has not conducted evaluation of
Reputation Risk Management policies.
Board of Commissioners has not given approval for Reputation Risk Management policies; and
Board of Commissioners
has not conducted evaluation of
Reputation Risk Management policies.

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate conducting evaluation periodically? Reputation Risk Management policies;

evaluation
is conducted by
Board of Commissioners periodically at least once a year or whenever there are changes that affect BPR business activities significantly; and
evaluation conducted is relevant to
needs for adjusting
Reputation Risk Management policies.

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate 2 Has the Board of Commissioners conducted evaluation of

Board of Commissioners
has conducted evaluation of implementation of
Reputation Risk Management policies by the Board of Directors;
evaluation by
Board of Commissioners is conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that affect BPR business activities significantly;
Board of Commissioners
has ensured follow-up on evaluation results each reporting period; and
evaluation
provided is relevant to implementation of
Reputation Risk Management policies to support BPR performance improvement.
Board of Commissioners
has conducted evaluation of implementation of
Reputation Risk Management policies by the Board of Directors;
evaluation by
Board of Commissioners is conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that affect BPR business activities significantly; and
Board of Commissioners
has ensured follow-up on evaluation results each reporting period.
Board of Commissioners
has conducted evaluation of implementation of
Reputation Risk Management policies by the Board of Directors;
evaluation by
Board of Commissioners is conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that affect BPR business activities significantly; and
Board of Commissioners
has not ensured follow-up on evaluation results each reporting period.
Board of Commissioners
has conducted evaluation of implementation of
Reputation Risk Management policies by the Board of Directors;
evaluation by
Board of Commissioners is not conducted periodically; and
Board of Commissioners
has not ensured follow-up on evaluation results each reporting period.
Board of Commissioners
has not conducted evaluation of implementation of Reputation Risk Management policies by the Board of Directors.

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate accountability of the Board of Directors for implementation of Reputation Risk Management policies periodically and ensuring follow-up on evaluation results as mentioned? implementation of Reputation Risk Management policies by the Board of Directors;

evaluation by
Board of Commissioners is conducted periodically every semester or more based on reports submitted by the Board of Directors in the event of changes that affect BPR business activities significantly;
Board of Commissioners
has ensured follow-up on evaluation results each reporting period; and
evaluation
provided is relevant to implementation of
Reputation Risk Management policies to support BPR performance improvement.

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate 3 Has the Board of Directors drafted Reputation Risk Management policies, implemented consistently, and conducted periodic updates?

Board of Directors has
drafted
Reputation Risk Management policies;
conducts
business activities based on
Reputation Risk Management policies that have been established;
Board of Directors
conducts updating of
Reputation Risk Management policies in the event of changes in regulatory provisions, business changes, and results of evaluation of Reputation Risk Management policies by Board of Commissioners; and
Reputation Risk Management
policies implemented prove to mitigate occurrence of Reputation Risk.
Board of Directors has
drafted
Reputation Risk Management policies;
conducts
business activities based on
Reputation Risk Management policies that have been established; and
Board of Directors
conducts updating of
Reputation Risk Management policies in the event of changes in regulatory provisions, business changes, and results of evaluation of Reputation Risk Management policies by Board of Commissioners.
Board of Directors has
drafted
Reputation Risk Management policies;
conducts
business activities based on
Reputation Risk Management policies that have been established; and
Board of Directors does not
conduct updating of
Reputation Risk Management policies in the event of changes in regulatory provisions, business changes, and results of evaluation of Reputation Risk Management policies by Board of Commissioners.
Board of Directors has
drafted
Reputation Risk Management policies;
does not
conduct business activities based on
Reputation Risk Management policies that have been established; and
Board of Directors does not
conduct updating of
Reputation Risk Management policies in the event of changes in regulatory provisions, business changes, and results of evaluation of Reputation Risk Management policies by Board of Commissioners. Board of Directors does not draft Reputation Risk Management policies.

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate Reputation Risk Management policies.

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate 4 Has the Board of Directors the ability to take necessary actions in mitigation of Reputation Risk, and conducting communication of Reputation Risk Management policies to all levels of BPR organization?

Board of Directors
takes necessary actions to mitigate Risk when implementing Reputation Risk Management policies;
Board of Directors
communicates
Reputation Risk Management policies; and
all levels of
BPR organization are able to understand
Reputation Risk Management policies implemented.
Board of Directors
takes necessary actions to mitigate Risk when implementing Reputation Risk Management policies;
Board of Directors
communicates
Reputation Risk Management policies; and
not all levels of
BPR organization are able to understand
Reputation Risk Management policies implemented but do not cause significant impact.
Board of Directors
takes necessary actions to mitigate Risk when implementing Reputation Risk Management policies;
Board of Directors
communicates
Reputation Risk Management policies; and
not all levels of
BPR organization are able to understand
Reputation Risk Management policies implemented and cause significant impact.
Board of Directors
takes necessary actions to mitigate Risk when implementing Reputation Risk Management policies;
Board of Directors does not
communicate
Reputation Risk Management policies; and
all levels of
BPR organization are unable to understand
Reputation Risk Management policies implemented.
Board of Directors does not
take necessary actions to mitigate Risk when implementing Reputation Risk Management policies;
Board of Directors does not
communicate
Reputation Risk Management policies; and
all levels of
BPR organization are unable to understand
Reputation Risk Management policies implemented.
5 Has the BPR established sufficient organization to handle functions
has a working unit
that handles reputation functions;
working unit that
has a working unit
that handles reputation functions but is not complete;
has a working unit
that handles reputation functions;
working unit that
has a working unit
that handles reputation functions but is not complete;
has a working unit
that handles reputation functions but is not complete;

No Parameter
Assessment
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate of reputation risk management?

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate reputation and function Reputation Risk Management? handling reputation function has executed tasks and authority according to established guidelines; and

has SKMR or PEMR capable of executing its function to mitigate Reputation Risk.
unit handling reputation function has
executed tasks and authority according to established guidelines; and
has SKMR or PEMR capable of executing its function to mitigate Reputation Risk.
handling reputation function has executed tasks and authority according to established guidelines; and
has SKMR or PEMR
but not capable of executing its function to mitigate Reputation Risk.
unit handling
reputation function has executed tasks and authority according to established guidelines; and
has SKMR or PEMR
but not capable of executing its function to mitigate Reputation Risk.
unit handling
reputation function has not executed tasks and authority according to established guidelines; and
has SKMR or PEMR
but not capable of executing its function to mitigate Reputation Risk.
6 Has the Board of Directors implemented
HR management policy in the context of implementing Reputation Risk Management?
there is
alignment of HR qualifications with positions and job fields;
there are efforts to
consistently improve HR competence; and
there is
misalignment of HR qualifications with positions and job fields but does not give significant impact;
there are efforts to
improve
there is
misalignment of HR qualifications with positions and job fields but does not give significant impact;
there are efforts to
improve
there is
misalignment of HR qualifications with positions and job fields and gives significant impact;
there are efforts to
improve
there is
misalignment of HR qualifications with positions and job fields and gives significant impact;
there are no
efforts to

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

level of
HR performance standard fulfillment in units executing reputation functions according to tasks and responsibilities. HR competence consistently; and
level of
HR performance standard fulfillment in units executing reputation functions according to tasks and responsibilities. HR competence but not consistently; and
level of
HR performance standard fulfillment in units executing reputation functions according to tasks and responsibilities HR competence but not consistently; and
level of
HR performance standard fulfillment in units executing reputation functions not aligned with tasks and responsibilities but does not give significant impact. improvement HR competence; and
level of
HR performance standard fulfillment in units executing reputation functions not aligned with tasks and responsibilities and gives significant impact. 7 Has the BPR has adequate Reputation Risk Management policy including applying principles
has
Reputation Risk Management policy;
there is
alignment between the substance of the Reputation Risk Management policy
has
Reputation Risk Management policy;
there is
insignificant misalignment between the substance of the policy
has
Reputation Risk Management policy;
there is
insignificant misalignment between the substance of the policy
has
Reputation Risk Management policy;
there is
significant misalignment between the substance of the policy does not have Reputation Risk Management policy.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate transparency and improvement of customer service quality, and formulated by considering vision, mission, business scale and business complexity, as well as HR sufficiency? with BPR Risk Management regulations including policies to prevent occurrence of Reputation Risk, and improvement of customer service quality; and

there is
harmony between Reputation Risk Management policy with vision, mission, business scale, and business complexity, as well as HR sufficiency in setting Reputation Risk Management policy. Reputation Risk Management policy with BPR Risk Management regulations including policies to prevent occurrence of Reputation Risk, and improvement of customer service quality; and
there is
harmony between Reputation Risk Management policy with vision, mission, business scale, and business complexity, as well as HR sufficiency business in setting Reputation Risk Management policy. Reputation Risk Management policy with BPR Risk Management regulations including policies to prevent occurrence of Reputation Risk, and improvement of customer service quality; and
there is
disharmony between Reputation Risk Management policy with vision, mission, business scale, and business complexity, as well as HR sufficiency business in setting Reputation Risk Management policy, Risk Management policy with BPR Risk Management regulations including policies to prevent occurrence of Reputation Risk, and improvement of customer service quality; and
there is
disharmony between Reputation Risk Management policy with vision, mission, business scale, and business complexity, as well as HR sufficiency business in setting Reputation Risk Management policy, and

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate but does not cause significant impact. case significant impact. 8 Has the BPR:

has
Reputation Risk Management procedures and establishment of Reputation Risk limits set by the Board of Directors;
executes
Reputation Risk Management procedures and establishment of Reputation Risk limits consistently for all activities; and
conducts
evaluation and updating
has procedures for
Reputation Risk Management and establishment of Reputation Risk limits set by the Board of Directors at least covering levels of delegation of authority and clear accountability well documented to facilitate audit trail needs for internal control purposes;
executes
has procedures for
Reputation Risk Management and establishment of Reputation Risk limits set by the Board of Directors at least covering levels of delegation of authority and clear accountability well documented to facilitate audit trail needs for internal control purposes;
executes
has procedures for
Reputation Risk Management and establishment of Reputation Risk limits set by the Board of Directors at least covering levels of delegation of authority and clear accountability well documented to facilitate audit trail needs for internal control purposes;
executes
has procedures for
Reputation Risk Management and establishment of Reputation Risk limits set by the Board of Directors at least covering levels of delegation of authority and clear accountability well documented to facilitate audit trail needs for internal control purposes;
does not
not have
Reputation Risk Management procedures and establishment of Reputation Risk limits set by

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate against Reputation Risk Management procedures and establishment of Reputation Risk limits periodically? Reputation Risk Management procedures and establishment of Reputation Risk limits in each functional activity consistently; and

conducts
evaluation and updating
Reputation Risk Management procedures and establishment of Reputation Risk limits in case of significant business changes and/or regulatory provisions. Reputation Risk Management procedures and establishment of Reputation Risk limits in each functional activity consistently; and
does not conduct
evaluation and updating
Reputation Risk Management procedures and establishment of Reputation Risk limits in case of significant business changes and/or regulatory provisions, but does not cause Reputation Risk Management procedures and establishment of Reputation Risk limits in each functional activity consistently; and
does not conduct
evaluation and updating
Reputation Risk Management procedures and establishment of Reputation Risk limits in case of significant business changes and/or regulatory provisions, and case significant impact. case significant impact. case significant impact. 9 Has the BPR has policies and procedures for issuance of products and/or implementation of new activities including identification and mitigation of Reputation Risk according to regulations?
has
policies and procedures regarding issuance of products and/or new activities that have Reputation Risk exposure;
applies
policies and procedures in case of issuance of products or implementation of new activities; and
there is
alignment between policies and procedures for products and/or new activities with
has
policies and procedures regarding issuance of products and/or new activities that have Reputation Risk exposure;
applies
policies and procedures in case of issuance of products or implementation of new activities; and
there is
insignificant misalignment between policies and procedures for products and/or
has
policies and procedures regarding issuance of products and/or new activities that have Reputation Risk exposure;
applies
policies and procedures in case of issuance of products or implementation of new activities; and
there is
significant misalignment between policies and procedures for products and/or new activities
has
policies and procedures regarding issuance of products and/or new activities that have Reputation Risk exposure;
does not apply
policies and procedures in case of issuance of products or implementation of new activities; and
there is
significant misalignment between policies and procedures for products and/or new activities do not have policies and procedures regarding issuance of products and/or new activities exposure Reputation Risk.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate regulations. new activities with regulations. with regulations. with regulations. 10 Has the BPR has executed Reputation Risk Management process embedded in BPR business activities?

has
executed Reputation Risk Management process including identification, measurement, monitoring, and control of Reputation Risk against all BPR business activities including against the number of complaints from customers submitted as well as against negative reporting of BPR;
application of
Reputation Risk Management is done with
has
executed Reputation Risk Management process including identification, measurement, monitoring, and control of Reputation Risk against all BPR business activities including against the number of complaints from customers submitted as well as against negative reporting of BPR;
application of
Reputation Risk Management is done with
has
executed Reputation Risk Management process including identification, measurement, monitoring, and control of Reputation Risk against all BPR business activities including against the number of complaints from customers submitted as well as against negative reporting of BPR;
application of
Reputation Risk Management is done with
has
executed Reputation Risk Management process but not entirely including identification, measurement, monitoring, and control of Reputation Risk against all BPR business activities including against the number of complaints from customers submitted as well as against negative reporting of BPR;
application of
not executed Reputation Risk Management process including identification, measurement, monitoring, and control of Reputation Risk against all BPR business activities.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate very adequate; and

application of
Reputation Risk Management is done consistently. adequate; and
application of
Reputation Risk Management is done fairly consistently. adequate; and
application of
Reputation Risk Management is not done consistently, but does not cause significant impact.
Reputation Risk Management is not adequate; and
application of
Reputation Risk Management is not done consistently so that case significant impact.
11 Has the BPR has Risk Management information system that supports the Board of Directors in decision-making related to Reputation Risk as well as has been reported to the Board of Directors periodically?
has
Risk Management information system that reflects Reputation Risk;
data on Risk Management information system is complete, accurate, current, and whole;
Risk Management information system
has
Risk Management information system that reflects Reputation Risk;
data on Risk Management information system is fairly
complete, accurate, current, and whole;
Risk Management information system
has
Risk Management information system that reflects Reputation Risk;
data on Risk Management information system is less
complete, accurate, current, and whole;
Risk Management information system does not
has
Risk Management information system that reflects Reputation Risk;
data on Risk Management information system is not
complete, accurate, current, and whole;
Risk Management information system is not
do not have
Risk Management information system that reflects Reputation Risk.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate periodically? supports the Board of Directors in decision-making; and

Risk Management information system very strongly supports
SKMR or PEMR in making reports to the Board of Directors every semester. supports the Board of Directors in decision-making; and
Risk Management information system fairly supports
SKMR or PEMR in making reports to the Board of Directors every semester. fully supports the Board of Directors in decision-making; and
Risk Management information system less supports
SKMR or PE Risk Management in making reports to the Board of Directors every semester. fully supports the Board of Directors in decision-making; and
Risk Management information system does not support
SKMR or PEMR in making reports to the Board of Directors every semester.
12 Has SKAI or PEAI has executed periodic audits on the implementation of Reputation Risk Management, submitted internal audit result reports, and
SKAI or PEAI has
executed internal audit on the implementation of Reputation Risk Management, provided recommendations, and reported internal audit results
SKAI or PEAI has
executed internal audit on the implementation of Reputation Risk Management, provided recommendations, and reported internal audit results
SKAI or PEAI has
executed internal audit on the implementation of Reputation Risk Management, provided recommendations, and reported internal audit results
SKAI or PEAI has
executed internal audit on the implementation of Reputation Risk Management, provided recommendations, and reported internal audit results SKAI or PEAI does not execute internal audit on the implementation of Reputation Risk Management.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate ensured follow-up on inspection findings? to the Chief Director;

internal audit has been executed by SKAI or PEAI including implementation of policies and procedures for Reputation Risk Management considering regulations as well as BPR conditions; and
internal audit findings that become recommendations have been followed up.
to the Chief Director;
internal audit has been executed by SKAI or PEAI including implementation of policies and procedures for Reputation Risk Management considering regulations as well as BPR conditions; and
internal audit findings that become recommendations are not fully followed up
but does not cause significant impact. to the Chief Director;
internal audit has been executed by SKAI or PEAI including implementation of policies and procedures for Reputation Risk Management considering regulations as well as BPR conditions; and
internal audit findings that become recommendations are not fully followed up
and case significant impact. to the Chief Director;
internal audit has been executed by SKAI or PEAI
but not in accordance with the scope of implementation of policies and procedures for Reputation Risk Management; and
internal audit findings that become recommendations are not
followed up.
13 Has the internal control system against Reputation Risk has been executed by all levels of BPR organization?
all levels of BPR organization
related to activities that have Reputation Risk exposure have executed internal control functions by considering Reputation Risk Management policies, Reputation Risk Management procedures, as well as establishment of Reputation Risk limits;
there is
clear authority and responsibility from each level of BPR organization related to activities that have Reputation Risk exposure
all levels of BPR organization
related to activities that have Reputation Risk exposure have executed internal control functions but not fully considering Reputation Risk Management policies, Reputation Risk Management procedures, as well as establishment of Reputation Risk limits and does not have significant impact;
there is
clear authority and responsibility from each level of BPR organization related to activities that have Reputation Risk exposure have executed internal control functions but not fully considering Reputation Risk Management policies, Reputation Risk Management procedures, as well as establishment of Reputation Risk limits and has significant impact;
there is
clear authority and responsibility from each level of BPR organization related do not all levels of BPR organization
all levels of BPR organization

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate internal against Reputation Risk has been executed by all levels of BPR organization? with Reputation Risk exposure have executed internal control functions by considering Reputation Risk Management policies, Reputation Risk Management procedures, as well as establishment of Reputation Risk limits;

there is
clear authority and responsibility from each level of BPR organization related to activities that have Reputation Risk exposure with Reputation Risk exposure have executed internal control functions by considering Reputation Risk Management policies, Reputation Risk Management procedures, as well as establishment of Reputation Risk limits;
there is
clear authority and responsibility from each level of BPR organization related to activities that have Reputation Risk exposure with Reputation Risk exposure have executed internal control functions by considering Reputation Risk Management policies, Reputation Risk Management procedures, as well as establishment of Reputation Risk limits;
there is
clear authority and responsibility from each level of BPR organization related to BPR organization related to activities that have Reputation Risk exposure have executed internal control functions by considering Reputation Risk Management policies, Reputation Risk Management procedures, as well as establishment of Reputation Risk limits;
there is no
clear authority and responsibility from each level of BPR organization related to activities that have Reputation Risk exposure;
SKMR or PEMR
is not separated from units related to activities that have Reputation Risk exposure with Reputation Risk exposure;
SKMR or PEMR
is not separated from units related to activities that have Reputation Risk exposure;
SKAI or PEAI
is not separated from units related to activities that have Reputation Risk exposure. with Reputation Risk exposure;
SKMR or PEMR
is not separated from units related to activities that have Reputation Risk exposure;
SKAI or PEAI
is not separated from units related to activities that have Reputation Risk exposure. with activities that have Reputation Risk exposure;
SKMR or PEMR
is not separated from units related to activities that have Reputation Risk exposure;
SKAI or PEAI
is not separated from units related to activities that have Reputation Risk exposure. with activities that have Reputation Risk exposure;
SKMR or PEMR
is not separated from units related to activities that have Reputation Risk exposure;
SKAI or PEAI
is not separated from units related to activities that have Reputation Risk exposure. with Reputation Risk exposure;
SKAI or PEAI
is not separated from units related to activities that have Reputation Risk exposure.

f. Strategic Risk
No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate 1 Has the Board of Commissioners given approval for Strategic Risk Management policy formulated by the Board of Directors and conducted periodic evaluations?

Board of Commissioners
has given approval for Strategic Risk Management policy;
Board of Commissioners
has conducted evaluation of Strategic Risk Management policy;
evaluation is conducted by the Board of Commissioners periodically at least once a year or ad hoc in case of changes affecting business activities
Board of Commissioners
has given approval for Strategic Risk Management policy;
Board of Commissioners
has conducted evaluation of Strategic Risk Management policy; and
evaluation is conducted by the Board of Commissioners periodically at least once a year or ad hoc in case of changes affecting
Board of Commissioners
has given approval for Strategic Risk Management policy;
Board of Commissioners
has conducted evaluation of Strategic Risk Management policy; and
evaluation is not conducted by the Board of Commissioners periodically at least once a year or ad hoc in case of changes affecting
Board of Commissioners
has given approval for Strategic Risk Management policy; and
Board of Commissioners
does not conduct evaluation of Strategic Risk Management policy.
Board of Commissioners
does not give approval for Strategic Risk Management policy; and
Board of Commissioners
does not conduct evaluation of Strategic Risk Management policy.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate

BPR significantly;

evaluations provided are relevant to the needs of adjusting Strategic Risk Management policies.

2 Has the Board of Commissioners conducted periodic evaluations of the Board of Directors' accountability for the implementation of Strategic Risk Management policies and ensured follow-up on the results of said evaluations?

The Board of Commissioners has conducted evaluations of the implementation of Strategic Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are conducted periodically every semester or more frequently based on reports submitted by the Board of Directors in the event of changes that significantly affect BPR business activities;
The Board of Commissioners has ensured follow-up on evaluation results in every reporting period;
evaluations provided are relevant to the implementation of Strategic Risk Management policies in order to support BPR performance improvement.
The Board of Commissioners has conducted evaluations of the implementation of Strategic Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are conducted periodically every semester or more frequently based on reports submitted by the Board of Directors in the event of changes that significantly affect BPR business activities;
The Board of Commissioners has ensured follow-up on evaluation results in every reporting period.
The Board of Commissioners has conducted evaluations of the implementation of Strategic Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are conducted periodically every semester or more frequently based on reports submitted by the Board of Directors in the event of changes that significantly affect BPR business activities;
The Board of Commissioners has not ensured follow-up on evaluation results in every reporting period.
The Board of Commissioners has conducted evaluations of the implementation of Strategic Risk Management policies by the Board of Directors;
evaluations by the Board of Commissioners are not conducted periodically every semester or more frequently based on reports submitted by the Board of Directors in the event of changes that significantly affect BPR business activities;
The Board of Commissioners has not conducted evaluations of the implementation of Strategic Risk Management policies by the Board of Directors.

3 Has the Board of Directors formulated Strategic Risk Management policies, implemented them consistently, and updated them periodically?

The Board of Directors has formulated Strategic Risk Management policies;
business activities are conducted based on the established Strategic Risk Management policies;
The Board of Directors updates Strategic Risk Management policies in the event of changes in regulatory provisions, business changes, and results of Strategic Risk Management policy evaluations by the Board of Commissioners;
the implemented Strategic Risk Management policies have proven to mitigate Strategic Risk.
The Board of Directors has formulated Strategic Risk Management policies;
business activities are conducted based on the established Strategic Risk Management policies;
The Board of Directors updates Strategic Risk Management policies in the event of changes in regulatory provisions, business changes, and results of Strategic Risk Management policy evaluations by the Board of Commissioners.
The Board of Directors has formulated Strategic Risk Management policies;
business activities are conducted based on the established Strategic Risk Management policies;
The Board of Directors does not update Strategic Risk Management policies in the event of changes in regulatory provisions, business changes, and results of Strategic Risk Management policy evaluations by the Board of Commissioners.
The Board of Directors has formulated Strategic Risk Management policies;
business activities are not conducted based on the established Strategic Risk Management policies;
The Board of Directors does not update Strategic Risk Management policies in the event of changes in regulatory provisions, business changes, and results of Strategic Risk Management policy evaluations by the Board of Commissioners.
The Board of Directors has not formulated Strategic Risk Management policies.

4 Has the Board of Directors had the capability to take necessary actions for the mitigation of Strategic Risk, and communicated Strategic Risk Management policies to all levels of the BPR organization?

The Board of Directors takes necessary actions to mitigate Risk when implementing Strategic Risk Management policies;
The Board of Directors communicates Strategic Risk Management policies;
all levels of the BPR organization are able to understand the implemented Strategic Risk Management policies.
The Board of Directors takes necessary actions to mitigate Risk when implementing Strategic Risk Management policies;
The Board of Directors communicates Strategic Risk Management policies;
BPR levels are able to understand the implemented Strategic Risk Management policies but it does not have a significant impact.
The Board of Directors takes necessary actions to mitigate Risk when implementing Strategic Risk Management policies;
The Board of Directors communicates Strategic Risk Management policies;
BPR levels are able to understand the implemented Strategic Risk Management policies and it has a significant impact.
The Board of Directors takes necessary actions to mitigate Risk when implementing Strategic Risk Management policies;
The Board of Directors does not communicate Strategic Risk Management policies;
all levels of the BPR organization are not able to understand the implemented Strategic Risk Management policies.
The Board of Directors does not take necessary actions to mitigate Risk when implementing Strategic Risk Management policies;
The Board of Directors does not communicate Strategic Risk Management policies;
all levels of the BPR organization are not able to understand the implemented Strategic Risk Management policies.

5 Has the BPR had an adequate organization handling strategic functions and Strategic Risk Management functions?

has a work unit handling strategic functions;
the work unit handling strategic functions has carried out its duties and authorities in accordance with established guidelines; and
has SKMR or PEMR capable of carrying out its functions to mitigate Strategic Risk.
has a work unit handling strategic functions but is incomplete;
the work unit handling strategic functions has carried out its duties and authorities in accordance with established guidelines; and
has SKMR or PEMR capable of carrying out its functions to mitigate Strategic Risk.
has a work unit handling strategic functions;
the work unit handling strategic functions has carried out its duties and authorities in accordance with established guidelines; and
has SKMR or PEMR not capable of carrying out its functions to mitigate Strategic Risk.
has a work unit handling strategic functions but is incomplete;
the work unit handling strategic functions has carried out its duties and authorities in accordance with established guidelines; and
has SKMR or PEMR not capable of carrying out its functions to mitigate Strategic Risk.
has a work unit handling strategic functions but is incomplete;
the work unit handling strategic functions has not carried out its duties and authorities in accordance with established guidelines; and
has SKMR or PEMR not capable of carrying out its functions to mitigate Strategic Risk.

6 Has the Board of Directors applied Human Resource Management policies in the implementation of Strategic Risk Management?

there is alignment of HR qualifications with positions and job fields;
there are efforts to consistently improve HR competence; and
the level of HR performance standard fulfillment in work units carrying out strategic functions is in accordance with duties and responsibilities.
there is misalignment of HR qualifications with positions and job fields but it does not provide a significant impact;
there are efforts to consistently improve HR competence; and
the level of HR performance standard fulfillment in work units carrying out strategic functions is in accordance with duties and responsibilities.
there is misalignment of HR qualifications with positions and job fields but it does not provide a significant impact;
there are efforts to improve HR competence but not consistently; and
the level of HR performance standard fulfillment in work units carrying out strategic functions is in accordance with duties and responsibilities.
there is misalignment of HR qualifications with positions and job fields and provides a significant impact;
there are efforts to improve HR competence but not consistently; and
the level of HR performance standard fulfillment in work units carrying out strategic functions is not in accordance with duties and responsibilities and provides a significant impact.
there is misalignment of HR qualifications with positions and job fields and provides a significant impact;
there are no efforts to improve HR competence; and
the level of HR performance standard fulfillment in work units carrying out strategic functions is not in accordance with duties and responsibilities.

7 Has the BPR had adequate Strategic Risk Management policies formulated by considering vision, mission, business scale and business complexity, as well as HR adequacy?

has Strategic Risk Management policies;
there is alignment between the substance of Strategic Risk Management policies and BPR Risk Management regulations, including BPR annual achievement targets contained in the BPR business plan; and
there is harmony between Strategic Risk Management policies with vision, mission, business scale, and business complexity, as well as HR adequacy in establishing Strategic Risk Management policies.
has Strategic Risk Management policies;
there is insignificant misalignment between the substance of Strategic Risk Management policies and BPR Risk Management regulations, including BPR annual achievement targets contained in the BPR business plan; and
there is harmony between Strategic Risk Management policies with vision, mission, business scale, and business complexity, as well as HR adequacy in establishing Strategic Risk Management policies.
has Strategic Risk Management policies;
there is insignificant misalignment between the substance of Strategic Risk Management policies and BPR Risk Management regulations, including BPR annual achievement targets contained in the BPR business plan; and
there is disharmony between Strategic Risk Management policies with vision, mission, business scale, and business complexity, as well as HR adequacy in establishing Strategic Risk Management policies but it does not have a significant impact.
has Strategic Risk Management policies;
there is significant misalignment between the substance of Strategic Risk Management policies and BPR Risk Management regulations, including BPR annual achievement targets contained in the BPR business plan; and
there is disharmony between Strategic Risk Management policies with vision, mission, business scale, and business complexity, as well as HR adequacy in establishing Strategic Risk Management policies and has a significant impact.
does not have Strategic Risk Management policies.

8 Has the BPR:

Strategic Risk Management procedures and Strategic Risk limit setting established by the Board of Directors;
Strategic Risk Management procedures and Strategic Risk limit setting established by the Board of Directors at least covering levels of delegation of authority and clear accountability, well-documented to facilitate audit trail requirements for internal control purposes;
implementation of Strategic Risk Management procedures and Strategic Risk limit setting consistently for all activities; and
evaluation and updating of Strategic Risk Management procedures and Strategic Risk limit setting periodically?
has Strategic Risk Management procedures and Strategic Risk limit setting established by the Board of Directors at least covering levels of delegation of authority and clear accountability, well-documented to facilitate audit trail requirements for internal control purposes;
implementation of Strategic Risk Management procedures and Strategic Risk limit setting in every functional activity consistently; and
evaluation and updating of Strategic Risk Management procedures and Strategic Risk limit setting in the event of significant business changes and/or regulatory provisions.
has Strategic Risk Management procedures and Strategic Risk limit setting established by the Board of Directors at least covering levels of delegation of authority and clear accountability, well-documented to facilitate audit trail requirements for internal control purposes;
implementation of Strategic Risk Management procedures and Strategic Risk limit setting in every functional activity consistently; and
does not evaluate and update Strategic Risk Management procedures and Strategic Risk limit setting in the event of significant business changes and/or regulatory provisions, but it does not have a significant impact.
has Strategic Risk Management procedures and Strategic Risk limit setting established by the Board of Directors at least covering levels of delegation of authority and clear accountability, well-documented to facilitate audit trail requirements for internal control purposes;
implementation of Strategic Risk Management procedures and Strategic Risk limit setting in every functional activity consistently; and
does not evaluate and update Strategic Risk Management procedures and Strategic Risk limit setting in the event of significant business changes and/or regulatory provisions and has a significant impact.
has Strategic Risk Management procedures and Strategic Risk limit setting established by the Board of Directors at least covering levels of delegation of authority and clear accountability, well-documented to facilitate audit trail requirements for internal control purposes;
does not implement Strategic Risk Management procedures and Strategic Risk limit setting in every functional activity consistently; and
does not evaluate and update Strategic Risk Management procedures and Strategic Risk limit setting in the event of significant business changes and/or regulatory provisions.
does not have Strategic Risk Management procedures and Strategic Risk limit setting established by the Board of Directors.

9 Has the BPR had policies and procedures for the issuance of products and/or implementation of new activities that cover the identification and mitigation of Strategic Risk in accordance with regulations?

has policies and procedures regarding the issuance of products and/or new activities that have Strategic Risk exposure;
implements policies and procedures in the event of product issuance or new activity implementation; and
there is alignment between product and/or new activity policies and procedures with regulations.
has policies and procedures regarding the issuance of products and/or new activities that have Strategic Risk exposure;
implements policies and procedures in the event of product issuance or new activity implementation; and
there is insignificant misalignment between product and/or new activity policies and procedures with regulations.
has policies and procedures regarding the issuance of products and/or new activities that have Strategic Risk exposure;
implements policies and procedures in the event of product issuance or new activity implementation; and
there is significant misalignment between product and/or new activity policies and procedures with regulations.
has policies and procedures regarding the issuance of products and/or new activities that have Strategic Risk exposure;
does not implement policies and procedures in the event of product issuance or new activity implementation; and
there is significant misalignment between product and/or new activity policies and procedures with regulations.
does not have policies and procedures regarding the issuance of products and/or new activities that have Strategic Risk exposure.

10 Has the BPR implemented a Strategic Risk Management process embedded in BPR business activities?

has implemented a Strategic Risk Management process including the identification, measurement, monitoring, and control of Strategic Risk against all BPR business activities, including the realization of BPR achievement targets;
the implementation of Strategic Risk Management is done very adequately; and
the implementation of Strategic Risk Management is done consistently.
has implemented a Strategic Risk Management process including the identification, measurement, monitoring, and control of Strategic Risk against all BPR business activities, including the realization of BPR achievement targets;
the implementation of Strategic Risk Management is done adequately; and
the implementation of Strategic Risk Management is done fairly consistently.
has implemented a Strategic Risk Management process including the identification, measurement, monitoring, and control of Strategic Risk against all BPR business activities, including the realization of BPR achievement targets;
the implementation of Strategic Risk Management is done adequately; and
the implementation of Strategic Risk Management is not done consistently but it does not have a significant impact.
has implemented a Strategic Risk Management process but not comprehensively including the identification, measurement, monitoring, and control of Strategic Risk against all BPR business activities, including the realization of BPR achievement targets;
the implementation of Strategic Risk Management is not adequate; and
the implementation of Strategic Risk Management is not done consistently so as to have a significant impact.
does not implement a Strategic Risk Management process including the identification, measurement, monitoring, and control of Strategic Risk.

11 Has the BPR had a Risk Management information system that supports the Board of Directors in decision-making related to Strategic Risk and has been reported to the Board of Directors periodically?

has a Risk Management information system that reflects Strategic Risk;
data in the Risk Management information system is complete, accurate, current, and whole;
the Risk Management information system supports the Board of Directors in decision-making; and
the Risk Management information system strongly supports SKMR or PEMR in preparing reports to the Board of Directors every semester.
has a Risk Management information system that reflects Strategic Risk;
data in the Risk Management information system is fairly complete, accurate, current, and whole;
the Risk Management information system supports the Board of Directors in decision-making; and
the Risk Management information system fairly supports SKMR or PEMR in preparing reports to the Board of Directors every semester.
has a Risk Management information system that reflects Strategic Risk;
data in the Risk Management information system is less complete, accurate, current, and whole;
the Risk Management information system does not fully support the Board of Directors in decision-making; and
the Risk Management information system less supports SKMR or PEMR in preparing reports to the Board of Directors every semester.
has a Risk Management information system that reflects Strategic Risk;
data in the Risk Management information system is not complete, accurate, current, and whole;
the Risk Management information system does not fully support the Board of Directors in decision-making; and
the Risk Management information system does not support SKMR or PEMR in preparing reports to the Board of Directors every semester.
does not have a Risk Management information system but does not reflect Strategic Risk.

12 Has SKAI or PEAI conducted periodic audits against

SKAI or PEAI has conducted internal audits against
SKAI or PEAI has conducted internal audits against
SKAI or PEAI has conducted internal audits against
SKAI or PEAI has conducted internal audits against
SKAI or PEAI has not conducted internal audits against

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate implementation of Strategic Risk Management, submitting internal audit results reports, and ensuring follow-up on inspection findings? implementation of Strategic Risk Management, providing recommendations, and reporting internal audit results to the Chief Director;

internal audit has
been conducted by
SKAI or PEAI covering the implementation of policies and procedures for Strategic Risk Management by considering regulations and conditions of the BPR; and
internal audit
findings that are made into recommendations have been implementation of Strategic Risk Management, providing recommendations, and reporting internal audit results to the Chief Director;
internal audit has
been conducted by
SKAI or PEAI covering the implementation of policies and procedures for Strategic Risk Management by considering regulations and conditions of the BPR; and
internal audit
findings that are made into recommendations have not been implementation of Strategic Risk Management, providing recommendations, and reporting internal audit results to the Chief Director;
internal audit has
been conducted by
SKAI or PEAI covering the implementation of policies and procedures for Strategic Risk Management by considering regulations and conditions of the BPR; and
internal audit
findings that are made into recommendations have not been implementation of Strategic Risk Management, providing recommendations, and reporting internal audit results to the Chief Director;
internal audit has
been conducted by
SKAI or PEAI but does not match the scope of implementation of policies and procedures for Strategic Risk Management by considering regulations and conditions of the BPR; and
internal audit
findings that are made into implementation of Strategic Risk Management.

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate followed up. followed up but does not result in significant impact. followed up and results in significant impact. recommendations not followed up. 13 Has the internal control system for Strategic Risk been implemented by all levels of the BPR organization?

all levels of
the BPR organization related to activities with Strategic Risk exposure have implemented internal control functions by considering Risk Management policies, Risk Management procedures, and the establishment of Strategic Risk limits;
there is
clear authority and responsibility
all levels of
the BPR organization related to activities with Strategic Risk exposure have implemented internal control functions but do not fully consider Risk Management policies, Risk Management procedures, and the establishment of Strategic Risk limits and do not have significant impact;
all levels of
the BPR organization related to activities with Strategic Risk exposure have implemented internal control functions but do not fully consider Risk Management policies, Risk Management procedures, and the establishment of Strategic Risk limits and have significant impact;
there is
not all
levels of the BPR organization related to activities with Strategic Risk exposure have implemented internal control functions by considering Risk Management policies, Risk Management procedures, and the establishment of Strategic Risk limits;
there is no
clear authority and
all levels of
the BPR organization related to activities with Strategic Risk exposure do not implement internal control functions;
there is no
clear authority and responsibility from each level of the BPR organization related to activities with Strategic Risk exposure;

No Parameter
Assessment Criteria
1 - Very Adequate 2 - Adequate 3 - Fairly Adequate 4 - Inadequate 5 - Not Adequate from each level of the BPR organization related to activities with Strategic Risk exposure;

SKMR or PEMR
is separate from units related to activities with Strategic Risk exposure; and
SKAI or PEAI
is separate from units related to activities with Strategic Risk exposure.
there is
clear authority and responsibility from each level of the BPR organization related to activities with Strategic Risk exposure;
SKMR or PEMR
is separate from units related to activities with Strategic Risk exposure; and
SKAI or PEAI
is separate from units related to activities with Strategic Risk exposure. clear authority and responsibility from each level of the BPR organization related to activities with Strategic Risk exposure;
SKMR or PEMR
is separate from units related to activities with Strategic Risk exposure; and
SKAI or PEAI
is separate from units related to activities with Strategic Risk exposure. responsibility from each level of the BPR organization related to activities with Strategic Risk exposure;
SKMR or PEMR
is separate from units related to activities with Strategic Risk exposure; and
SKAI or PEAI
is separate from units related to activities with Strategic Risk exposure.
SKMR or PEMR
is not separate from units related to activities with Strategic Risk exposure; and
SKAI or PEAI
is not separate from units related to activities with Strategic Risk exposure.

After assigning ratings to each KPMR parameter for each type of Risk, the BPR determines the KPMR level for each type of Risk based on the parameter rating assessed as most material and significant in affecting Risk mitigation at the BPR.
The determination of the KPMR level for each type of Risk refers to the KPMR level determination matrix as referred to in the Strategic Risk Management Implementation Quality Determination Matrix.
Step 3: Determination of Risk Level for Each Type of Risk
Based on the assessment of Inherent Risk and KPMR for each Risk, the Risk level is subsequently determined. The Risk Level is the Risk inherent in BPR activities after considering KPMR. The Risk Level can be determined based on the Risk Level Determination Matrix as follows:

Risk Level Determination Matrix
Risk Level
Inherent
Quality of Risk Management Implementation Level Very Adequate Adequate Fairly Adequate Inadequate Not Adequate Very Low 1 (limited review, action plan reported semi-annually) Low 1 2 (limited review, action plan reported semi-annually) (limited review, action plan reported quarterly) Medium 2 2 (limited review, action plan reported semi-annually) (limited review, action plan reported quarterly) (comprehensive review, action plan reported quarterly) High 2 (limited review, action plan reported quarterly) (limited review, action plan reported quarterly) (comprehensive review, action plan reported quarterly) (comprehensive review, action plan reported monthly) Very High (limited review, action plan reported quarterly) (limited review, action plan reported monthly) (limited review, action plan reported monthly) (comprehensive review, action plan reported monthly) (embedded supervision, requires more in-depth monitoring)

Note:
In the event that the assessment results indicate matters that need to be reviewed and followed up by the BPR, the BPR submits the review results and action plan immediately after the assessment is conducted.
2. The Risk Level Determination Matrix is essentially used as an indicative reference to map the Risk Level resulting from the combination of Inherent Risk Level and KPMR Level. In the event that the matrix is insufficient to describe the BPR's Risk Level, a comprehensive and structured analysis can be used to adjust the Risk Level as long as it is believed to more accurately describe the Risk Level at the BPR.
Step 4: Determination of Risk Rating

Based on the determination of the Risk Level as referred to in Step 3, the Risk Rating is determined by considering the significance of each Risk.
The determination of Risk Rating consists of 5 (five) ratings, namely Rating 1, Rating 2, Rating 3, Rating 4, and Rating 5. The order of smaller Risk Ratings reflects lower Risk. In determining the Risk Rating, reference is made to the Risk Rating Determination Matrix.
In considering the significance and materiality of Risk to the overall Risk profile of the BPR, Credit Risk, Operational Risk, and Compliance Risk are generally the main Risks at the BPR, so the BPR's Risk Rating is largely determined by the assessment results of these Risks. However, as a reference to test the significance or materiality of a Risk to the BPR's Risk profile, including those not mentioned above, the following need to be considered:
a. Risk exposure or volume and its significance to the overall Risk profile of the BPR; and b. the impact of problems arising from such Risk on the BPR's financial performance.

CHAPTER II
RISK RATING DETERMINATION MATRIX
Risk Rating Explanation
1 (Very Low)
BPR Risk Profiles included in this rating generally have characteristics including but not limited to:
a. Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Inherent Risk is classified as very low during a certain period in the future. b. KPMR is very adequate. In the event there are minor weaknesses, such weaknesses can be ignored. 2 (Low) BPR Risk Profiles included in this rating generally have characteristics including but not limited to:
a. Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Inherent Risk is classified as low during a certain period in the future. b. KPMR is adequate. In the event there are minor weaknesses, such weaknesses need management attention. 3 (Medium) BPR Risk Profiles included in this rating generally have characteristics including but not limited to:
a. Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Inherent Risk is classified as medium during a certain period in the future. b. KPMR is fairly adequate. Although minimum requirements are met, there are some weaknesses that require management attention and improvement. 4 (High) BPR Risk Profiles included in this rating generally have characteristics including but not limited to:
a. Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Inherent Risk is classified as high during a certain period in the future. b. KPMR is inadequate. There are significant weaknesses in various aspects of Risk Management that require immediate corrective action. 5 (Very High) BPR Risk Profiles included in this rating generally have characteristics including but not limited to:
a. Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Inherent Risk is classified as very high during a certain period in the future. b. KPMR is not adequate. There are significant weaknesses in various aspects of Risk Management whose resolution is beyond management's capability.

INHERENT RISK LEVEL DETERMINATION MATRIX FOR CREDIT RISK from Credit Risk is classified as very low during a certain period in the future. Examples of BPR characteristics included in the very low Risk Level include:
a. the credit portfolio is dominated by very low Credit Risk exposure; b. credit exposure is very well diversified;
c. credit provision has very good quality;
d. credit provision strategy is classified as stable; and e. the credit portfolio is relatively unaffected by changes in external factors. 2 (Low) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Credit Risk is classified as low during a certain period in the future. Examples of BPR characteristics included in the Low Risk Level include:
a. the credit portfolio is dominated by low Credit Risk exposure; b. credit exposure is well diversified;
c. credit provision has good quality;
d. credit provision strategy is classified as relatively stable; and e. the credit portfolio is less affected by changes in external factors. 3 (Medium) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Credit Risk is classified as medium during a certain period in the future. Examples of BPR characteristics included in the Medium Risk Level include:
a. the credit portfolio is dominated by medium Credit Risk exposure; b. there is a fairly significant concentration of credit provision;
c. credit provision has fairly good quality, but there is potential for decline;
d. credit provision strategy is generally fairly stable; and

e. the credit portfolio is fairly affected by changes in external factors.
4 (High) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Credit Risk is classified as high during a certain period in the future. Examples of BPR characteristics included in the High Risk Level include:
a. the credit portfolio is dominated by high Credit Risk exposure; b. there is a significant concentration of credit provision;
c. credit provision has poor quality;
d. there are significant changes in credit provision strategy; and e. the credit portfolio is affected by changes in external factors. 5 (Very High) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Credit Risk is classified as very high during a certain period in the future. Examples of BPR characteristics included in the Very High Risk Level include:
a. the credit portfolio is dominated by very high Credit Risk exposure; b. there is a very significant concentration of credit provision;
c. credit provision has poor quality;
d. there are very significant changes in credit provision strategy; and e. the credit portfolio is very affected by changes in external factors.

INHERENT RISK LEVEL DETERMINATION MATRIX FOR OPERATIONAL RISK from Operational Risk is classified as very low during a certain period in the future. Examples of BPR characteristics included in the very low Risk Level include:
a. the BPR's business has very simple characteristics, products and services are not varied, business mechanisms are very simple, transaction volume is low, organizational structure is not complex, and there are no significant corporate actions; b. Human Resources (HR) are very adequate in terms of both quantity and quality sufficiency, and historical data on losses due to human error is not significant;
c. Information Technology (IT) is very adequate and there are no significant changes in the IT system;
d. the frequency and materiality of deviations (fraud) are very low and losses are not significant compared to transaction volume or BPR revenue; and e. the threat of business disruption due to external events is very low. 2 (Low) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Operational Risk is classified as low during a certain period in the future. Examples of BPR characteristics included in the Low Risk Level include:
a. the BPR's business has simple characteristics, products and services are relatively less varied, business mechanisms are simple, transaction volume is relatively low, organizational structure is less complex, and corporate actions are less significant; b. Human Resources (HR) are adequate in terms of both quantity and quality sufficiency, and historical data on losses due to human error is less significant;
c. Information Technology (IT) is adequate and there are no significant changes in the IT system;
d. the frequency and materiality of deviations (fraud) are low and losses are less significant compared to transaction volume or BPR revenue; and

e. the threat of business disruption due to external events is low.
3 (Medium) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Operational Risk is classified as medium during a certain period in the future. Examples of BPR characteristics included in the Medium Risk Level include:
a. the BPR's business has fairly complex characteristics, products and services are fairly varied, business mechanisms are fairly complex, transaction volume is fairly high, organizational structure is fairly complex, and corporate actions are fairly significant; b. Human Resources (HR) are fairly adequate in terms of both quantity and quality sufficiency, and historical data on losses due to human error is fairly significant;
c. Information Technology (IT) is fairly adequate and is in the process of significant changes in the IT system;
d. the frequency and materiality of deviations (fraud) are fairly high and losses are fairly significant compared to transaction volume or BPR revenue; and e. the threat of business disruption due to external events is fairly high. 4 (High) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Operational Risk is classified as high during a certain period in the future. Examples of BPR characteristics included in the High Risk Level include:
a. the BPR's business has complex characteristics, products and services are varied, business mechanisms are complex, transaction volume is high, organizational structure is complex, and corporate actions are significant b. Human Resources (HR) are inadequate in terms of both quantity and quality sufficiency, and historical data on losses due to human error is significant;
c. Information Technology (IT) is inadequate and there are no significant changes in the IT system;
d. the frequency and materiality of deviations (fraud) are high and losses are significant compared to transaction volume or BPR revenue; and e. the threat of business disruption due to external events is high.

5 (Very High) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Operational Risk is classified as very high during a certain period in the future. Examples of BPR characteristics included in the Very High Risk Level include:
a. the BPR's business has very complex characteristics, products and services are very varied, business mechanisms are very complex, transaction volume is very high, organizational structure is very complex, and corporate actions are very significant; b. Human Resources (HR) are inadequate in terms of both quantity and quality sufficiency, and historical data on losses due to human error is very significant;
c. Information Technology (IT) is inadequate and there are very significant changes in the IT system;
d. the frequency and materiality of deviations (fraud) are very high and losses are very significant compared to transaction volume or BPR revenue; and e. the threat of business disruption due to external events is very high.

INHERENT RISK LEVEL DETERMINATION MATRIX FOR COMPLIANCE RISK from Compliance Risk is classified as very low during a certain period in the future. Examples of BPR characteristics included in the very low Risk Level include:
a. there are no violations of regulations; b. the BPR's compliance track record is very good;
c. the BPR has implemented all applicable financial standards and codes of ethics;
d. there are no litigation processes at the BPR or there are litigation processes but the frequency and/or financial impact of insignificant lawsuits do not disturb the BPR's financial conditions and do not have a major impact on the BPR's reputation; e. agreements made by the BPR are very adequate; f. all products and activities of the BPR are in accordance with statutory regulations. 2 (Low) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Compliance Risk is classified as low during a certain period in the future. Examples of BPR characteristics included in the Low Risk Level include:
a. there are relatively minor violations of regulations that can be immediately corrected by the BPR; b. the BPR's compliance track record is good;
c. the BPR has implemented almost all applicable financial standards and codes of ethics;
d. there are litigation processes at the BPR but the frequency and/or financial impact of the lawsuits are less significant disturbing the BPR's financial conditions and do not have a major impact on the BPR's reputation; e. agreements made by the BPR are adequate; f. there are BPR products and activities not yet regulated in statutory regulations with an insignificant number. 3 (Medium) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR

from Compliance Risk is classified as medium during a certain period in the future.
Examples of BPR characteristics included in the Medium Risk Level include:
a. there are fairly significant violations of regulations requiring management attention; b. the BPR's compliance track record is fairly good;
c. there are minor violations of applicable financial standards and codes of ethics;
d. there are litigation processes at the BPR with a frequency and/or financial impact of lawsuits that are fairly significant disturbing the BPR's financial conditions and impacting the BPR's reputation; e. agreements made by the BPR are fairly adequate; f. there are BPR products and activities not yet regulated in statutory regulations with a fairly significant number. 4 (High) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Compliance Risk is classified as high during a certain period in the future. Examples of BPR characteristics included in the High Risk Level include:
a. there are significant violations of regulations requiring immediate corrective action; b. the BPR's compliance track record is poor;
c. there are significant violations of applicable financial standards and codes of ethics;
d. there are litigation processes at the BPR with a frequency and/or financial impact of lawsuits that are significant so that in the event the BPR loses, compensation for the lawsuit can disturb the BPR's financial conditions and have a major impact on the BPR's reputation; e. agreements made by the BPR are inadequate; f. there are BPR products and activities not yet regulated in statutory regulations with a significant number. 5 (Very High) Considering the business activities conducted by the BPR, the likelihood of losses faced by the BPR from Compliance Risk is classified as very high during a certain period in the future.

Examples of BPR characteristics included in the Very High Risk level include:
a. significant violations of regulations requiring immediate improvement; b. poor BPR compliance track record;
c. significant violations of applicable financial standards and codes of ethics;
d. litigation processes involving BPR customers or debtors with very significant frequency and/or financial impact, such that if the BPR loses the court ruling, it could disrupt the BPR's financial condition and have a very large impact on the BPR's reputation; e. agreements made by the BPR are inadequate; f. BPR products and activities not regulated by applicable laws and regulations in very significant quantities.

MATRIKS PENETAPAN TINGKAT RISIKO INHEREN UNTUK RISIKO LIKUIDITAS (LIQUIDITY RISK INHERENT RISK LEVEL DETERMINATION MATRIX)

1 (Sangat Rendah / Very Low) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Liquidity Risk are categorized as very low during a certain period in the future. Examples of BPR characteristics included in the Very Low Risk level include:
a. having high-quality liquid assets that are very adequate to cover maturing obligations; b. unstable funding sources and concentration are not significant;
c. very capable of meeting obligations and cash flow needs under normal and crisis conditions;
d. cash flows from assets and liabilities can offset each other very well; and e. access to funding sources is very adequate, evidenced by very good reputation, very adequate standby loans, and liquidity support from the BPR group.

2 (Rendah / Low) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Liquidity Risk are categorized as low during a certain period in the future. Examples of BPR characteristics included in the Low Risk level include:
a. having high-quality liquid assets that are adequate to cover maturing obligations; b. unstable funding sources and concentration are less significant;
c. capable of meeting obligations and cash flow needs under normal and crisis conditions;
d. cash flows from assets and liabilities can offset each other well; and e. access to funding sources is adequate, evidenced by good reputation, adequate standby loans, and liquidity support from the BPR group.

3 (Sedang / Medium) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Liquidity Risk are categorized as medium during a certain period in the future. Examples of BPR characteristics included in the Medium Risk level include:
a. having high-quality liquid assets that are moderately adequate to cover maturing obligations; b. unstable funding sources and concentration are moderately significant;
c. moderately capable of meeting obligations and cash flow needs under normal and crisis conditions;
d. cash flows from assets and liabilities can offset each other moderately well; and e. access to funding sources is moderately adequate, evidenced by moderately good reputation, and moderately adequate standby loans and liquidity support from the BPR group.

4 (Tinggi / High) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Liquidity Risk are categorized as high during a certain period in the future. Examples of BPR characteristics included in the High Risk level include:
a. having high-quality liquid assets that are less adequate to cover maturing obligations; b. unstable funding sources and concentration are significant;
c. less capable of meeting obligations and cash flow needs under normal and crisis conditions;
d. cash flow gaps at various time scales are quite significant; and e. access to funding sources is less adequate, evidenced by declining reputation, and very limited standby loans and liquidity support from the BPR group.

5 (Sangat Tinggi / Very High) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Liquidity Risk are categorized as very high during a certain period in the future. Examples of BPR characteristics included in the Very High Risk level include:
a. poor quality of liquid assets and very inadequate volume of liquid assets to meet maturing obligations; b. unstable funding sources and concentration are very significant;
c. unable to meet obligations and cash flow needs under normal and crisis conditions;
d. cash flows cannot offset each other at almost all times; and e. access to funding sources is inadequate, evidenced by deteriorating reputation, making it difficult for the BPR to obtain funding, no standby loans, and no liquidity support from the BPR group.

MATRIKS PENETAPAN TINGKAT RISIKO INHEREN UNTUK RISIKO REPUTASI (REPUTATION RISK INHERENT RISK LEVEL DETERMINATION MATRIX)

1 (Sangat Rendah / Very Low) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Reputation Risk are categorized as very low during a certain period in the future. Examples of BPR characteristics included in the Very Low Risk level include:
a. no reputation incidents; b. violations or potential violations of business ethics are very minimal. The BPR has a reputation as a company that highly upholds business ethics;
c. BPR products and services have simple schemes that are easy for customers to understand;
d. no negative news regarding the BPR; e. frequency of customer complaints is very minimal and very immaterial.

2 (Rendah / Low) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Reputation Risk are categorized as low during a certain period in the future. Examples of BPR characteristics included in the Low Risk level include:
a. reputation incidents with low frequency and no impact on BPR's reputation; b. minimal violations or potential violations of business ethics and the BPR has a reputation as a company that upholds business ethics;
c. BPR's product and service activities are complex, requiring special customer understanding, and the BPR provides clear and complete information regarding such products and services;
d. frequency of negative news regarding the BPR is minimal, the negative news is immaterial, and the scope of news is small relative to the BPR's scale; and e. frequency of customer complaints is minimal and immaterial.

3 (Sedang / Medium) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Reputation Risk are categorized as medium during a certain period in the future. Examples of BPR characteristics included in the Medium Risk level include:
a. reputation incidents exist, with a moderately large impact scale but still controllable; b. violations or potential violations of business ethics occur with a moderately significant impact scale requiring attention;
c. BPR's product and service activities are moderately complex, requiring special customer understanding to some extent, but the BPR has not fully provided clear and complete information regarding such products and services;
d. frequency of negative news regarding the BPR is quite high, the negative news is quite material, and the scope of news is quite wide relative to the BPR's scale; and e. frequency of customer complaints is quite high and quite material.

4 (Tinggi / High) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Reputation Risk are categorized as high during a certain period in the future. Examples of BPR characteristics included in the High Risk level include:
a. reputation incidents exist, with a material impact scale requiring special attention; b. violations or potential violations of business ethics occur with a material impact scale requiring special attention;
c. BPR's product and service activities are complex, requiring special customer understanding, but the BPR does not fully provide clear and complete information regarding such products and services;
d. frequency of negative news regarding the BPR is high, the negative news is material, and the scope of news is large relative to the BPR's scale; and e. frequency of customer complaints is high and material.

5 (Sangat Tinggi / Very High) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Reputation Risk are categorized as very high during a certain period in the future. Examples of BPR characteristics included in the Very High Risk level include:
a. reputation incidents exist with a very material impact scale requiring immediate follow-up; b. violations or potential violations of business ethics occur with a very material impact scale requiring immediate follow-up;
c. BPR's product and service activities are very complex and require special customer understanding, and the BPR provides incorrect information regarding such products and services;
d. frequency of negative news regarding the BPR is very high, the negative news is very material, and the scope of news is very large relative to the BPR's scale; and e. frequency of customer complaints is very high and very material.

MATRIKS PENETAPAN TINGKAT RISIKO INHEREN UNTUK RISIKO STRATEJIK (STRATEGIC RISK INHERENT RISK LEVEL DETERMINATION MATRIX)

1 (Sangat Rendah / Very Low) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Strategic Risk are categorized as very low during a certain period in the future. Examples of BPR characteristics included in the Very Low Risk level include:
a. external and internal factors have been considered in formulating business plans, and the BPR's business plan is aligned with the BPR's vision and mission; b. BPR's strategy is conservative or low-risk;
c. the BPR continues existing strategies with a high level of strategic success; and
d. the BPR's business plan achievement is very good.

2 (Rendah / Low) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Strategic Risk are categorized as low during a certain period in the future. Examples of BPR characteristics included in the Low Risk level include:
a. external and internal factors have been considered in formulating business plans, but the BPR's business plan is not fully aligned with the BPR's vision and mission; b. BPR's strategy is low-risk but has an increasing trend;
c. the BPR continues the same strategy or has some new strategies but remains within the main business and BPR's competencies; and
d. the BPR's business plan achievement is good.

3 (Sedang / Medium) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Strategic Risk are categorized as medium during a certain period in the future. Examples of BPR characteristics included in the Medium Risk level include:
a. not fully considering external and internal factors in formulating business plans, and the BPR's business plan is not fully aligned with the BPR's vision and mission but does not cause significant impact; b. BPR's strategy is medium-risk;
c. the BPR's strategic success level is medium due to threats from competitors; and
d. the BPR's business plan achievement is moderately good.

4 (Tinggi / High) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Strategic Risk are categorized as high during a certain period in the future. Examples of BPR characteristics included in the High Risk level include:
a. not fully considering external and internal factors in formulating business plans, and the BPR's business plan is not fully aligned with the BPR's vision and mission, causing quite significant impact; b. BPR's strategy is medium-risk but has an increasing trend;
c. implementing strategies to enter new businesses or markets with uncertain success levels; and
d. the BPR's business plan achievement is less good.

5 (Sangat Tinggi / Very High) Considering the business activities conducted by the BPR, the potential losses faced by the BPR from Strategic Risk are categorized as very high during a certain period in the future. Examples of BPR characteristics included in the Very High Risk level include:
a. not fully considering external and internal factors in formulating business plans, and the BPR's business plan is not fully aligned with the BPR's vision and mission, causing very significant impact; b. BPR's strategy is high-risk;
c. the majority of the BPR's strategies shift to new areas that are not the main business and BPR's competencies; and
d. the BPR's business plan achievement is not good.

MATRIKS PENETAPAN KUALITAS PENERAPAN MANAJEMEN RISIKO UNTUK RISIKO KREDIT (QUALITY OF RISK MANAGEMENT IMPLEMENTATION ASSESSMENT MATRIX FOR CREDIT RISK)

Risk Management Implementation Quality Level (KPMR)	Definition of KPMR Level
Very Adequate	KPMR for Credit Risk is very adequate. Although there are minor weaknesses, these weaknesses are not significant and can be ignored.
Adequate	KPMR for Credit Risk is adequate. Although there are several minor weaknesses, these weaknesses can be resolved in normal business activities.
Moderately Adequate	KPMR for Credit Risk is moderately adequate. Although minimum requirements are met, there are several weaknesses requiring attention.
Less Adequate	KPMR for Credit Risk is less adequate. There are significant weaknesses in various aspects of Credit Risk Management Management requiring immediate corrective action.
Inadequate	KPMR for Credit Risk is inadequate. There are significant weaknesses in various aspects of Credit Risk Management Management, the resolution of which is beyond the BPR's capabilities.

Examples of BPR characteristics included in the Very Adequate KPMR level include:

The Board of Directors and Board of Commissioners have very good awareness and understanding of Credit Risk Management.
Credit Risk Management culture is very strong and has been internalized very well at all organizational levels.
The overall execution of the Board of Directors and Board of Commissioners' duties is very adequate.
The Credit Risk Management function is independent, has clear tasks and responsibilities, and operates very well.
Human resources are generally adequate in both quantity and competence in the Credit Risk Management function.
Delegation of authority is controlled and monitored regularly and operates very well.
Credit Risk strategy is very good and very aligned with the level of Risk to be taken and Credit Risk tolerance.
Credit Risk Management policies and procedures, as well as Credit Risk limit setting, are adequate and available for all Credit Risk Management areas, aligned with implementation, and understood very well by employees.
Formulation of the level of Risk to be taken and Risk tolerance is adequate and aligned with the BPR's overall strategic objectives and business strategy.
The Credit Risk Management process is very adequate in identifying, measuring, monitoring, and controlling Credit Risk.
The fund provision process in general is very adequate, from credit requests to non-performing loan handling. There is an independent dual control function in the credit process that operates well.
The Credit Risk Management information system is very good, producing comprehensive and integrated Credit Risk reports to the Board of Directors and Board of Commissioners.
The internal control system is very effective in supporting the implementation of Credit Risk Management.
Credit Risk Management implementation is reviewed by an independent review function, and the results of such review have been submitted to the Board of Directors and Board of Commissioners.

Examples of BPR characteristics included in the Adequate KPMR level include:

The Board of Directors and Board of Commissioners have good awareness and understanding of Credit Risk Management.
Credit Risk Management culture is strong and has been internalized well at all organizational levels.
The overall execution of the Board of Directors and Board of Commissioners' duties is adequate. There are some insignificant weaknesses that can be improved immediately.
The Credit Risk Management function is independent, has clear tasks and responsibilities, and operates well. There are minor weaknesses, but they can be resolved in normal business activities.
Human resources are adequate, both in quantity and competence in the Credit Risk Management function.
Delegation of authority is controlled and monitored regularly and operates well.
Credit Risk strategy is good and aligned with the level of Risk to be taken and Credit Risk tolerance.
Credit Risk Management policies and procedures, as well as Credit Risk limit setting, are adequate and available for all Credit Risk Management areas, aligned with implementation, and understood well by employees.
Formulation of the level of Risk to be taken and Risk tolerance is adequate and aligned with the BPR's overall strategic objectives and business strategy.
The Credit Risk Management process is adequate in identifying, measuring, monitoring, and controlling Credit Risk.
The fund provision process in general is adequate, from credit requests to non-performing loan handling. The dual control function in the credit process operates independently. There are minor weaknesses in one or more aspects of fund provision that can be easily improved and do not disrupt the overall process.
The Credit Risk Management information system is good, including Credit Risk reporting to the Board of Directors and Board of Commissioners. There are minor weaknesses that can be easily improved.
The internal control system is effective in supporting the implementation of Credit Risk Management.

Examples of BPR characteristics included in the Moderately Adequate KPMR level include:

The Board of Directors and Board of Commissioners have moderately good awareness and understanding of Credit Risk Management.
Credit Risk Management culture is moderately strong and has been internalized moderately well, but not always implemented consistently.
The overall execution of the Board of Directors and Board of Commissioners' duties is moderately adequate. There are some weaknesses in some assessment aspects that need attention.
The Credit Risk Management function operates moderately well, but there are some quite significant weaknesses that need to be resolved immediately.
Human resources are moderately adequate, both in quantity and competence in the Credit Risk Management function.
Delegation of authority is moderately good, but control and monitoring are not always implemented well.
Credit Risk strategy is moderately aligned with the level of Risk to be taken and Credit Risk tolerance.
Credit Risk Management policies and procedures, as well as Credit Risk limit setting, are moderately adequate but not always consistent with implementation and/or not understood well by employees.
Formulation of the level of Risk to be taken and Risk tolerance is moderately adequate but not always aligned with the BPR's overall strategic objectives and business strategy.
The Credit Risk Management process is moderately adequate in identifying, measuring, monitoring, and controlling Credit Risk.
The fund provision process and dual control function are moderately good. There are weaknesses in one or more aspects of fund provision that need attention.
The Credit Risk Management information system meets minimum expectations, but there are several weaknesses, including Credit Risk reporting to the Board of Directors and Board of Commissioners, that require attention.
The internal control system is moderately effective in supporting the implementation of Credit Risk Management.

Examples of BPR characteristics included in the Less Adequate KPMR level include:

Significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Credit Risk Management.
Credit Risk Management culture is weak and not internalized at every organizational unit level.
The overall execution of the Board of Directors and Board of Commissioners' duties is less adequate, and there are weaknesses in some assessment aspects that need to be improved immediately.
Significant weaknesses in the Credit Risk Management function that need to be improved immediately.
Human resources are less adequate in both quantity and competence in the Credit Risk Management function.
Delegation of authority is weak, not controlled, and not monitored well.
Credit Risk strategy is less aligned with the level of Risk to be taken and Credit Risk tolerance.
Significant weaknesses in Credit Risk Management policies and procedures, as well as Credit Risk limit setting.
Formulation of the level of Risk to be taken and Risk tolerance is less adequate and not aligned with the BPR's overall strategic objectives and business strategy.
The Credit Risk Management process is less adequate in identifying, measuring, monitoring, and controlling Credit Risk.
The fund provision process and dual control function are less good. There are several weaknesses that need to be improved immediately.
Significant weaknesses in the Credit Risk Management information system, including Credit Risk reporting to the Board of Directors and Board of Commissioners, that need to be improved immediately.
The internal control system is less effective in supporting the implementation of Credit Risk Management.

Examples of BPR characteristics included in the Inadequate KPMR level include:

The Board of Directors and Board of Commissioners' awareness and understanding of Credit Risk Management are very weak.
Credit Risk Management culture is weak and not internalized at every organizational level.
The overall execution of the Board of Directors and Board of Commissioners' duties is inadequate. There are significant weaknesses in almost all assessment aspects, and the resolution of these weaknesses is beyond

Risk Management Application Rating (KPMR) Matrix for Credit Risk

KPMR Level	Definition of KPMR Level
Very Adequate	KPMR for credit risk is very adequate. Although there are minor weaknesses, they are not significant and can be ignored. Characteristics of BPRs included in the very adequate risk level include, among others:
	1. The Board of Directors and Board of Commissioners have very good awareness and understanding of Risk Management for Credit Risk.

The Risk Management culture for Credit Risk is very strong and has been internalized very well at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is very adequate.
The Risk Management function for Credit Risk is independent, has clear duties and responsibilities, and operates very well.
Generally, Human Resources are very adequate in terms of both quantity and competence in the Risk Management function for Credit Risk.
Delegation of authority is controlled and monitored regularly and operates very well.
Credit Risk Strategy is very good and very aligned with the level of Risk to be taken and Credit Risk tolerance.
Risk Management policies and procedures and the setting of Credit Risk limits are very adequate and available for all areas of Risk Management for Credit Risk, aligned with implementation, and understood very well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is very adequate and aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Credit Risk is very adequate in identifying, measuring, monitoring, and controlling Credit Risk.
The funding provision process and dual control function are good. There are some weaknesses that need to be improved immediately.
Significant weaknesses in the Credit Risk Management information system, including credit risk reporting to the Board of Directors and Board of Commissioners, which need to be improved immediately.
The internal control system is ineffective in supporting the implementation of Risk Management for Credit Risk. |
| Adequate | KPMR for credit risk is adequate. There are some minor weaknesses that can be resolved in normal business activities. Characteristics of BPRs included in the adequate KPMR level include, among others: |
| --- | --- |
| | 1. The Board of Directors and Board of Commissioners have good awareness and understanding of Risk Management for Credit Risk. |
The Risk Management culture for Credit Risk is strong and has been internalized well at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is adequate. There are some weaknesses but they are not significant and can be improved immediately.
The Risk Management function for Credit Risk is independent, has clear duties and responsibilities, and operates well. There are minor weaknesses, but they can be resolved in normal business activities.
Human Resources are adequate, both in terms of quantity and competence in the Risk Management function for Credit Risk.
Delegation of authority is controlled and monitored regularly and operates well.
Credit Risk Strategy is good and aligned with the level of Risk to be taken and Credit Risk tolerance.
Risk Management policies and procedures and the setting of Credit Risk limits are adequate and available for all areas of Risk Management for Credit Risk, aligned with implementation, and understood well by employees although there are minor weaknesses.
The formulation of the level of Risk to be taken and Risk tolerance is adequate and aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Credit Risk is adequate in identifying, measuring, monitoring, and controlling Credit Risk.
The funding provision process and dual control function are good. There are some weaknesses that need to be improved immediately.
Significant weaknesses in the Credit Risk Management information system, including credit risk reporting to the Board of Directors and Board of Commissioners, which need to be improved immediately.
The internal control system is ineffective in supporting the implementation of Risk Management for Credit Risk. |
| Fairly Adequate | KPMR for credit risk is fairly adequate. Although minimum requirements are met, there are some weaknesses that require attention. Characteristics of BPRs included in the fairly adequate KPMR level include, among others: |
| --- | --- |
| | 1. The Board of Directors and Board of Commissioners have fairly good awareness and understanding of Risk Management for Credit Risk. |
The Risk Management culture for Credit Risk is fairly strong and has been internalized fairly well but not always implemented consistently.
The overall execution of duties by the Board of Directors and Board of Commissioners is fairly adequate.
The Risk Management function for Credit Risk has operated fairly well, but there are some weaknesses that need management attention.
Human Resources are fairly adequate in terms of both quantity and competence in the Risk Management function for Credit Risk.
Delegation of authority is fairly good, but control and monitoring are not always implemented well.
Credit Risk Strategy is fairly aligned with the level of Risk to be taken and Credit Risk tolerance.
Risk Management policies and procedures and the setting of Credit Risk limits are fairly adequate but not always consistent with implementation and/or not understood well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is fairly adequate but not always aligned with strategic objectives and overall business strategy.
The Risk Management process for Credit Risk is fairly adequate in identifying, measuring, monitoring, and controlling Credit Risk.
The funding provision process and dual control function are good. There are some weaknesses that need to be improved immediately.
Significant weaknesses in the Credit Risk Management information system, including credit risk reporting to the Board of Directors and Board of Commissioners, which need to be improved immediately.
The internal control system is ineffective in supporting the implementation of Risk Management for Credit Risk. |
| Less Adequate | KPMR for credit risk is less adequate. There are significant weaknesses in various aspects of Risk Management for Credit Risk that require immediate corrective action. Characteristics of BPRs included in the less adequate KPMR level include, among others: |
| --- | --- |
| | 1. Significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Credit Risk. |
The Risk Management culture for Credit Risk is less strong and has not been internalized at every level of work unit.
The overall execution of duties by the Board of Directors and Board of Commissioners is less adequate and there are weaknesses in some assessment aspects that need to be improved immediately.
Significant weaknesses in the Risk Management function for Credit Risk that need to be improved immediately.
Human Resources are less adequate in terms of both quantity and competence in the Risk Management function for Credit Risk.
Delegation of authority is weak, not controlled, and not monitored well.
Credit Risk Strategy is less aligned with the level of Risk to be taken and Credit Risk tolerance.
Significant weaknesses in Risk Management policies and procedures and the setting of Credit Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is less adequate and not aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Credit Risk is less adequate in identifying, measuring, monitoring, and controlling Credit Risk.
The funding provision process and dual control function are good. There are some weaknesses that need to be improved immediately.
Significant weaknesses in the Credit Risk Management information system, including credit risk reporting to the Board of Directors and Board of Commissioners, which need to be improved immediately.
The internal control system is ineffective in supporting the implementation of Risk Management for Credit Risk. |
| Inadequate | KPMR for credit risk is inadequate. There are significant weaknesses in various aspects of Risk Management for Credit Risk whose resolution is beyond the BPR's capability. Characteristics of BPRs included in the inadequate KPMR level include, among others: |
| --- | --- |
| | 1. The awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Credit Risk is very weak. |
The Risk Management culture for Credit Risk is not strong and not internalized at every organizational level.
The overall execution of duties by the Board of Directors and Board of Commissioners is inadequate. There are significant weaknesses in almost all assessment aspects and their resolution is beyond the BPR's capability.
Very significant weaknesses in the Risk Management function for Credit Risk that need to be improved immediately.
Human Resources are inadequate in terms of both quantity and competence in the Risk Management function for Credit Risk.
Delegation of authority is very weak, not controlled, and not monitored well.
Credit Risk Strategy is not aligned with the level of Risk to be taken and Credit Risk tolerance.
Very significant weaknesses in Risk Management policies and procedures and the setting of Credit Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is inadequate and not aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Credit Risk is inadequate in identifying, measuring, monitoring, and controlling Credit Risk.
The funding provision process and dual control function are good. There are some weaknesses that need to be improved immediately.
Very significant weaknesses in the Credit Risk Management information system, including credit risk reporting to the Board of Directors and Board of Commissioners, which need to be improved immediately.
The internal control system is ineffective in supporting the implementation of Risk Management for Credit Risk. |

MATRIKS PENETAPAN KUALITAS PENERAPAN MANAJEMEN RISIKO UNTUK RISIKO OPERASIONAL

KPMR Level	Definition of KPMR Level
Very Adequate	KPMR for Operational Risk is very adequate. Although there are minor weaknesses, they are not significant and can be ignored. Characteristics of BPRs included in the very adequate risk level include, among others:
	1. The Board of Directors and Board of Commissioners have very good awareness and understanding of Risk Management for Operational Risk.

The Risk Management culture for Operational Risk is very strong and has been internalized very well at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is very adequate.
The Risk Management function for Operational Risk is independent, has clear duties and responsibilities, and operates very well.
Generally, Human Resources are very adequate in terms of both quantity and competence in the Risk Management function for Operational Risk.
Delegation of authority is controlled and monitored regularly and operates very well.
Operational Risk Strategy is very good and very aligned with the level of Risk to be taken and Operational Risk tolerance.
Risk Management policies and procedures and the setting of Operational Risk limits are very adequate and available for all areas of Risk Management for Operational Risk, aligned with implementation, and understood very well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is very adequate and aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Operational Risk is very adequate in identifying, measuring, monitoring, and controlling Operational Risk.
Business Continuity Management (BCM) is very reliable and very tested.
The Operational Risk Management information system is very good, producing comprehensive and integrated Operational Risk reporting to the Board of Directors and Board of Commissioners.
The internal control system is very effective in supporting the implementation of Risk Management for Operational Risk.
The implementation of Risk Management is reviewed by a function performing independent review and the results of said review have been submitted to the Board of Directors and Board of Commissioners. |
| Adequate | KPMR for Operational Risk is adequate. There are some minor weaknesses that can be resolved in normal business activities. Characteristics of BPRs included in the adequate KPMR level include, among others: |
| --- | --- |
| | 1. The Board of Directors and Board of Commissioners have good awareness and understanding of Risk Management for Operational Risk. |
The Risk Management culture for Operational Risk is strong and has been internalized well at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is adequate. There are some weaknesses but they are not significant and can be improved immediately.
The Risk Management function for Operational Risk is independent, has clear duties and responsibilities, and operates well. There are minor weaknesses, but they can be resolved in normal business activities.
Human Resources are adequate, both in terms of quantity and competence in the Risk Management function for Operational Risk.
Delegation of authority is controlled and monitored regularly and operates well.
Operational Risk Strategy is good and aligned with the level of Risk to be taken and Operational Risk tolerance.
Risk Management policies and procedures and the setting of Operational Risk limits are adequate and available for all areas of Risk Management for Operational Risk, aligned with implementation, and understood well by employees although there are minor weaknesses.
The formulation of the level of Risk to be taken and Risk tolerance is adequate and aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Operational Risk is adequate in identifying, measuring, monitoring, and controlling Operational Risk.
Business Continuity Management (BCM) is reliable and tested.
The Operational Risk Management information system is good, including Operational Risk reporting to the Board of Directors and Board of Commissioners. There are minor weaknesses that can be easily improved.
The internal control system is effective in supporting the implementation of Risk Management for Operational Risk. |
| Fairly Adequate | KPMR for Operational Risk is fairly adequate. Although minimum requirements are met, there are some weaknesses that require management attention. Characteristics of BPRs included in the fairly adequate KPMR level include, among others: |
| --- | --- |
| | 1. The Board of Directors and Board of Commissioners have fairly good awareness and understanding of Risk Management for Operational Risk. |
The Risk Management culture for Operational Risk is fairly strong and has been internalized fairly well but not always implemented consistently.
The overall execution of duties by the Board of Directors and Board of Commissioners is fairly adequate.
The Risk Management function for Operational Risk has operated fairly well, but there are some weaknesses that need management attention.
Human Resources are fairly adequate in terms of both quantity and competence in the Risk Management function for Operational Risk.
Delegation of authority is fairly good, but control and monitoring are not always implemented well.
Operational Risk Strategy is fairly aligned with the level of Risk to be taken and Operational Risk tolerance.
Risk Management policies and procedures and the setting of Operational Risk limits are fairly adequate but not always consistent with implementation and/or not understood well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is fairly adequate but not always aligned with strategic objectives and overall business strategy.
The Risk Management process for Operational Risk is fairly adequate in identifying, measuring, monitoring, and controlling Operational Risk.
Business Continuity Management (BCM) is fairly reliable and fairly tested.
The Operational Risk Management Information System meets minimum expectations but there are some weaknesses including Operational Risk reporting to the Board of Directors and Board of Commissioners that require attention.
The internal control system is fairly effective in supporting the implementation of Risk Management for Operational Risk. |
| Less Adequate | KPMR for Operational Risk is less adequate. There are significant weaknesses in various aspects of Risk Management for Operational Risk that require immediate corrective action. Characteristics of BPRs included in the less adequate KPMR level include, among others: |
| --- | --- |
| | 1. Significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Operational Risk. |
The Risk Management culture for Operational Risk is less strong and has not been internalized at every level of work unit.
The overall execution of duties by the Board of Directors and Board of Commissioners is less adequate and there are weaknesses in some assessment aspects that need to be improved immediately.
Significant weaknesses in the Risk Management function for Operational Risk that need to be improved immediately.
Human Resources are less adequate in terms of both quantity and competence in the Risk Management function for Operational Risk.
Delegation of authority is weak, not controlled, and not monitored well.
Operational Risk Strategy is less aligned with the level of Risk to be taken and Operational Risk tolerance.
Significant weaknesses in Risk Management policies and procedures and the setting of Operational Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is less adequate and not aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Operational Risk is less adequate in identifying, measuring, monitoring, and controlling Operational Risk.
Business Continuity Management (BCM) is less reliable and less tested.
Significant weaknesses in the Operational Risk Management information system, including reporting to the Board of Directors and Board of Commissioners, which require immediate improvement.
The internal control system is less effective in supporting the implementation of Risk Management for Operational Risk. |
| Inadequate | KPMR for Operational Risk is inadequate. There are significant weaknesses in various aspects of Risk Management for Operational Risk whose resolution is beyond the BPR's capability. Characteristics of BPRs included in the inadequate KPMR level include, among others: |
| --- | --- |
| | 1. The awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Operational Risk is very weak. |
The Risk Management culture for Operational Risk is not strong and not internalized at every organizational level.
The overall execution of duties by the Board of Directors and Board of Commissioners is inadequate. There are significant weaknesses in almost all assessment aspects and their resolution is beyond the BPR's capability.
Very significant weaknesses in the Risk Management function for Operational Risk that need to be improved immediately.
Human Resources are inadequate in terms of both quantity and competence in the Risk Management function for Operational Risk.
Delegation of authority is very weak, not controlled, and not monitored well.
Operational Risk Strategy is not aligned with the level of Risk to be taken and Operational Risk tolerance.
Very significant weaknesses in Risk Management policies and procedures and the setting of Operational Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is inadequate and not aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Operational Risk is inadequate in identifying, measuring, monitoring, and controlling Operational Risk.
Business Continuity Management (BCM) is not reliable and not tested.
Very significant weaknesses in the Operational Risk Management information system, including Operational Risk reporting to the Board of Directors and Board of Commissioners, which need to be improved immediately.
The internal control system is ineffective in supporting the implementation of Risk Management for Operational Risk. |

MATRIKS PENETAPAN KUALITAS PENERAPAN MANAJEMEN RISIKO UNTUK RISIKO KEPATUHAN

KPMR Level	Definition of KPMR Level
Very Adequate	KPMR for Compliance Risk is very adequate. Although there are minor weaknesses, they are not significant and can be ignored. Characteristics of BPRs included in the very adequate risk level include, among others:
	1. The Board of Directors and Board of Commissioners have very good awareness and understanding of Risk Management for Compliance Risk.

The Risk Management culture for Compliance Risk is very strong and has been internalized very well at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is very adequate.
The Risk Management function for Compliance Risk is independent, has clear duties and responsibilities, and operates very well.
Generally, Human Resources are very adequate in terms of both quantity and competence in the Risk Management function for Compliance Risk.
Delegation of authority is controlled and monitored regularly and operates very well.
Compliance Risk Strategy is very good and very aligned with the level of Risk to be taken and Compliance Risk tolerance.
Risk Management policies and procedures and the setting of Compliance Risk limits are very adequate and available for all areas of Risk Management for Compliance Risk, aligned with implementation, and understood well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is very adequate and aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Compliance Risk is very adequate in identifying, measuring, monitoring, and controlling Compliance Risk.
The Compliance Risk Management information system is very good, producing comprehensive and integrated Compliance Risk reporting to the Board of Directors and Board of Commissioners.
The internal control system is very effective in supporting the implementation of Risk Management for Compliance Risk.
The implementation of Risk Management is reviewed by a function performing independent review and the results of said review have been submitted to the Board of Directors and Board of Commissioners. |
| Adequate | KPMR for Compliance Risk is adequate. There are some minor weaknesses that can be resolved in normal business activities. Characteristics of BPRs included in the adequate Risk level include, among others: |
| --- | --- |
| | 1. The Board of Directors and Board of Commissioners have good awareness and understanding of Risk Management for Compliance Risk. |
The Risk Management culture for Compliance Risk is strong and has been internalized well at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is adequate. There are some weaknesses but they are not significant and can be improved immediately.
The Risk Management function for Compliance Risk is independent, has clear duties and responsibilities, and operates well. There are minor weaknesses, but they can be resolved in normal business activities.
Human Resources are adequate in terms of both quantity and competence in the Risk Management function for Compliance Risk.
Delegation of authority is controlled and monitored regularly and operates well.
Compliance Risk Strategy is good and aligned with the level of Risk to be taken and Risk tolerance.
Risk Management policies and procedures and the setting of Compliance Risk limits are adequate and available for all areas of Risk Management for Compliance Risk, aligned with implementation, and understood well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is adequate and aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Compliance Risk is adequate in identifying, measuring, monitoring, and controlling Compliance Risk.
The Compliance Risk Management information system is good, including Compliance Risk reporting to the Board of Directors and Board of Commissioners. There are minor weaknesses that can be easily improved.
The internal control system is effective in supporting the implementation of Risk Management for Compliance Risk. |
| Fairly Adequate | KPMR for Compliance Risk is fairly adequate. Although minimum requirements are met, there are some weaknesses that require management attention. Characteristics of BPRs included in the fairly adequate KPMR level include, among others: |
| --- | --- |
| | 1. The Board of Directors and Board of Commissioners have fairly good awareness and understanding of Risk Management for Compliance Risk. |
The Risk Management culture for Compliance Risk is fairly strong and has been internalized fairly well but not always implemented consistently.
The overall execution of duties by the Board of Directors and Board of Commissioners is fairly adequate. There are weaknesses in some assessment aspects that need attention.
The Risk Management function for Compliance Risk has operated fairly well, but there are some fairly significant weaknesses that need to be resolved immediately.
Human Resources are fairly adequate in terms of both quantity and competence in the Risk Management function for Compliance Risk.
Delegation of authority is fairly good, but control and monitoring are not always implemented well.
Compliance Risk Strategy is fairly aligned with the level of Risk to be taken and Compliance Risk tolerance.
Risk Management policies and procedures and the setting of Compliance Risk limits are fairly adequate but not always consistent with implementation and/or not understood well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is fairly adequate but not always aligned with strategic objectives and overall BPR business strategy.
The Risk Management process for Compliance Risk is fairly adequate in identifying, measuring, monitoring, and controlling Compliance Risk.
The Compliance Risk Management information system meets minimum expectations but there are some weaknesses including reporting to the Board of Directors and Board of Commissioners that require attention.
The internal control system is fairly effective in supporting the implementation of Risk Management for Compliance Risk. |
| Less Adequate | KPMR for Compliance Risk is less adequate. There are significant weaknesses in various aspects of Risk Management for Compliance Risk that require immediate corrective action. Characteristics of BPRs included in the less adequate KPMR level include, among others: |
| --- | --- |
| | 1. Significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Compliance Risk. |
The Risk Management culture for Compliance Risk is less strong and has not been internalized at every level of work unit.
The overall execution of duties by the Board of Directors and Board of Commissioners is less adequate and there are weaknesses in some assessment aspects that need to be improved immediately.
Significant weaknesses in the Risk Management function for Compliance Risk that need to be improved immediately.
Human Resources are less adequate in terms of both quantity and competence in the Risk Management function for Compliance Risk.
Delegation of authority is weak, not controlled, and not monitored well.
Compliance Risk Strategy is less aligned with the level of Risk to be taken and Compliance Risk tolerance.
Significant weaknesses in Risk Management policies and procedures and the setting of Compliance Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is less adequate and not aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Compliance Risk is less adequate in identifying, measuring, monitoring, and controlling Compliance Risk.
Significant weaknesses in the Compliance Risk Management information system, including Compliance Risk reporting to the Board of Directors and Board of Commissioners, which need to be improved immediately.
The internal control system is less effective in supporting the implementation of Risk Management for Compliance Risk. |
| Inadequate | KPMR for Compliance Risk is inadequate. There are significant weaknesses in various aspects of Risk Management for Compliance Risk whose resolution is beyond management's capability. Characteristics of BPRs included in the inadequate KPMR level include, among others: |
| --- | --- |
| | 1. The awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Compliance Risk is very weak. |
The Risk Management culture for Compliance Risk is not strong and not internalized at every organizational level.
The overall execution of duties by the Board of Directors and Board of Commissioners is inadequate. There are significant weaknesses in almost all assessment aspects and their resolution is beyond the BPR's capability.
Very significant weaknesses in the Risk Management function for Compliance Risk that need to be improved immediately.
Human Resources are inadequate in terms of both quantity and competence in the Risk Management function for Compliance Risk.
Delegation of authority is very weak, not controlled, and not monitored well.
Compliance Risk Strategy is not aligned with the level of Risk to be taken and Compliance Risk tolerance.
Very significant weaknesses in Risk Management policies and procedures and the setting of Compliance Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is inadequate and not aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Compliance Risk is inadequate in identifying, measuring, monitoring, and controlling Compliance Risk.
Very significant weaknesses in the Compliance Risk Management information system, including Compliance Risk reporting to the Board of Directors and Board of Commissioners, which need to be improved immediately.
The internal control system is ineffective in supporting the implementation of Risk Management for Compliance Risk. |

RISK MANAGEMENT IMPLEMENTATION QUALITY ASSESSMENT MATRIX FOR LIQUIDITY RISK

KPMR Level Definition

Very Adequate
The KPMR for Liquidity Risk is very adequate. Although there are minor weaknesses, they are not significant and can be ignored.

Examples of BPR characteristics included in the Very Adequate KPMR level include:

The Board of Directors and Board of Commissioners have very good awareness and understanding of Risk Management for Liquidity Risk.
The Risk Management culture for Liquidity Risk is very strong and has been internalized very well at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is very adequate.
The Risk Management function for Liquidity Risk is independent, has clear duties and responsibilities, and operates very well.
Human resources are generally very adequate in terms of both quantity and competence in the Risk Management function for Liquidity Risk.
Delegation of authority is controlled and monitored regularly and operates very well.
Liquidity Risk strategy is very good and very aligned with the level of Risk to be taken and Liquidity Risk tolerance.
Risk Management policies and procedures and the establishment of Liquidity Risk limits are very adequate and available for all areas of Risk Management for Liquidity Risk, aligned with implementation, and understood very well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is very adequate and aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Liquidity Risk is very adequate in identifying, measuring, monitoring, and controlling Liquidity Risk.
The Liquidity Risk Management information system is very good, producing comprehensive and integrated Liquidity Risk reporting to the Board of Directors and Board of Commissioners.
The internal control system is very effective in supporting the implementation of Risk Management for Liquidity Risk.
Risk Management implementation is reviewed by a function performing independent review, and the results of said review have been submitted to the Board of Directors and Board of Commissioners.

Adequate
The KPMR for Liquidity Risk is adequate. There are some minor weaknesses that can be resolved in normal business activities.

Examples of BPR characteristics included in the Adequate KPMR level include:

The Board of Directors and Board of Commissioners have good awareness and understanding of Risk Management for Liquidity Risk.
The Risk Management culture for Liquidity Risk is strong and has been internalized well at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is adequate. There are some weaknesses but they are not significant and can be repaired immediately.
The Risk Management function for Liquidity Risk is independent, has clear duties and responsibilities, and operates well. There are minor weaknesses, but they can be resolved in normal business activities.
Human resources are adequate in terms of both quantity and competence in the Risk Management function for Liquidity Risk.
Delegation of authority is controlled and monitored regularly and operates well.
Liquidity Risk strategy is good and aligned with the level of Risk to be taken and Liquidity Risk tolerance.
Risk Management policies and procedures and the establishment of Liquidity Risk limits are adequate and available for all areas of Risk Management for Liquidity Risk, aligned with implementation, and understood well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is adequate and aligned with
The Risk Management process for Liquidity Risk is adequate in identifying, measuring, monitoring, and controlling Liquidity Risk.
The Liquidity Risk Management information system is good, including Liquidity Risk reporting to the Board of Directors and Board of Commissioners. There are minor weaknesses that can be easily repaired.
The internal control system is effective in supporting the implementation of Risk Management for Liquidity Risk.

Fairly Adequate
The KPMR for Liquidity Risk is fairly adequate. Although minimum requirements are met, there are some weaknesses that require attention.

Examples of BPR characteristics included in the Fairly Adequate KPMR level include:

The Board of Directors and Board of Commissioners have fairly good awareness and understanding of Risk Management for Liquidity Risk.
The Risk Management culture for Liquidity Risk is fairly strong and has been internalized fairly well but is not always implemented consistently.
The overall execution of duties by the Board of Directors and Board of Commissioners is fairly adequate. There are some weaknesses in some assessment aspects that need attention.
The Risk Management function for Liquidity Risk has clear duties and responsibilities and operates fairly well, but there are some weaknesses that need attention.
Human resources are fairly adequate in terms of both quantity and competence in the Risk Management function for Liquidity Risk.
Delegation of authority is fairly good, but control and monitoring are not always implemented well.
Liquidity Risk strategy is fairly aligned with the level of Risk to be taken and Liquidity Risk tolerance.
Risk Management policies and procedures for Liquidity Risk are fairly adequate but are not always consistent with implementation and/or not understood well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is fairly adequate and aligned
The Risk Management process for Liquidity Risk is fairly adequate in identifying, measuring, monitoring, and controlling Liquidity Risk.
The Liquidity Risk Management information system meets minimum expectations but has some weaknesses, including reporting to the Board of Directors and Board of Commissioners that requires attention.
The internal control system is fairly effective in supporting the implementation of Risk Management for Liquidity Risk.

Inadequate
The KPMR for Liquidity Risk is inadequate. There are significant weaknesses in various aspects of Risk Management for Liquidity Risk that require immediate corrective action.

Examples of BPR characteristics included in the Inadequate KPMR level include:

Significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Liquidity Risk.
The Risk Management culture for Liquidity Risk is not strong and has not been internalized at every work unit level.
The overall execution of duties by the Board of Directors and Board of Commissioners is inadequate. There are weaknesses in some assessment aspects that need to be repaired immediately.
Significant weaknesses in the Risk Management function for Liquidity Risk that need to be repaired immediately.
Human resources are inadequate in terms of both quantity and competence in the Risk Management function for Liquidity Risk.
Delegation of authority is weak, not controlled, and not monitored well.
Liquidity management strategy is not aligned with the level of Risk to be taken and Liquidity Risk tolerance.
Significant weaknesses in Risk Management policies and procedures and the establishment of Liquidity Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is inadequate and not aligned
The Risk Management process for Liquidity Risk is inadequate in identifying, measuring, monitoring, and controlling Liquidity Risk.
Significant weaknesses in the Liquidity Risk Management information system, including reporting to the Board of Directors and Board of Commissioners, that need to be repaired immediately.
The internal control system is ineffective in supporting the implementation of Risk Management for Liquidity Risk.

Not Adequate
The KPMR for Liquidity Risk is not adequate. There are significant weaknesses in various aspects of Risk Management for Liquidity Risk, the resolution of which is beyond the BPR's capability.

Examples of BPR characteristics included in the Not Adequate KPMR level include:

The awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Liquidity Risk is very weak.
The Risk Management culture for Liquidity Risk is not strong and is not internalized at every organizational level.
The overall execution of duties by the Board of Directors and Board of Commissioners is not adequate. There are significant weaknesses in almost all assessment aspects, the resolution of which is beyond the BPR's capability.
Very significant weaknesses in the Risk Management function for Liquidity Risk that need to be repaired immediately.
Human resources are not adequate in terms of both quantity and competence in the Risk Management function for Liquidity Risk.
Delegation of authority is very weak, not controlled, and not monitored well.
Liquidity Risk strategy is not aligned with the level of Risk to be taken and Liquidity Risk tolerance.
Very significant weaknesses in Risk Management policies and procedures and the establishment of Liquidity Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is not adequate and not aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Liquidity Risk is not adequate in identifying, measuring, monitoring, and controlling Liquidity Risk.
Very significant weaknesses in the Liquidity Risk Management information system, including Liquidity Risk reporting to the Board of Directors and Board of Commissioners, that need to be repaired immediately.
The internal control system is ineffective in supporting the implementation of Risk Management for Liquidity Risk.

RISK MANAGEMENT IMPLEMENTATION QUALITY ASSESSMENT MATRIX FOR REPUTATION RISK

KPMR Level Definition

Very Adequate
The KPMR for Reputation Risk is very adequate. Although there are minor weaknesses, they are not significant and can be ignored.

Examples of BPR characteristics included in the Very Adequate KPMR level include:

The Board of Directors and Board of Commissioners have very good awareness and understanding of Risk Management for Reputation Risk.
The Risk Management culture for Reputation Risk is very strong and has been internalized very well at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is very adequate.
The Risk Management function for Reputation Risk is independent, has clear duties and responsibilities, and operates very well.
Human resources are generally very adequate in terms of both quantity and competence in the Risk Management function for Reputation Risk.
Delegation of authority is controlled and monitored regularly and operates very well.
Reputation Risk strategy is very good and very aligned with the level of Risk to be taken and Reputation Risk tolerance.
Risk Management policies and procedures and the establishment of Reputation Risk limits are very adequate and available for all areas of Risk Management for Reputation Risk, aligned with implementation, and understood very well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is very adequate and aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Reputation Risk is very adequate in identifying, measuring, monitoring, and controlling Reputation Risk.
The Reputation Risk Management information system is very good, producing comprehensive and integrated Reputation Risk reporting to the Board of Directors and Board of Commissioners.
The internal control system is very effective in supporting the implementation of Risk Management for Reputation Risk.
Risk Management implementation is reviewed by a function performing independent review, and the results of said review have been submitted to the Board of Directors and Board of Commissioners.

Adequate
The KPMR for Reputation Risk is adequate. Although there are some minor weaknesses, they can be resolved in normal business activities.

Examples of BPR characteristics included in the Adequate KPMR level include:

The Board of Directors and Board of Commissioners have good awareness and understanding of Risk Management for Reputation Risk.
The Risk Management culture for Reputation Risk is strong and has been internalized well at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is adequate. There are some weaknesses that are not significant and can be repaired immediately.
The Risk Management function for Reputation Risk is independent, has clear duties and responsibilities, and operates well. There are minor weaknesses, but they can be resolved in normal business activities.
Human resources are adequate, both in terms of quantity and competence in the Risk Management function for Reputation Risk.
Delegation of authority is controlled and monitored regularly and operates well.
Reputation Risk strategy is good and aligned with the level of Risk to be taken and Reputation Risk tolerance.
Risk Management policies and procedures and the establishment of Reputation Risk limits are adequate and available for all areas of Risk Management for Reputation Risk, aligned with implementation, and understood well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is adequate and aligned with
The Risk Management process for Reputation Risk is adequate in identifying, measuring, monitoring, and controlling Reputation Risk.
The Reputation Risk Management information system is good, including Reputation Risk reporting to the Board of Directors and Board of Commissioners. There are minor weaknesses that can be easily repaired.
The internal control system is effective in supporting the implementation of Risk Management for Reputation Risk.

Fairly Adequate
The KPMR for Reputation Risk is fairly adequate. Although minimum requirements are met, there are some weaknesses that require attention.

Examples of BPR characteristics included in the Fairly Adequate KPMR level include:

The Board of Directors and Board of Commissioners have fairly good awareness and understanding of Risk Management for Reputation Risk.
The Risk Management culture for Reputation Risk is fairly strong and has been internalized fairly well but is not always implemented consistently.
The overall execution of duties by the Board of Directors and Board of Commissioners is fairly adequate. There are some weaknesses in some assessment aspects that need attention.
The Risk Management function for Reputation Risk has operated fairly well, but there are some fairly significant weaknesses that need to be resolved immediately.
Human resources are fairly adequate in terms of both quantity and competence in the Risk Management function for Reputation Risk.
Delegation of authority is fairly good, but control and monitoring are not always implemented well.
Reputation Risk strategy is fairly aligned with the level of Risk to be taken and Reputation Risk tolerance.
Risk Management policies and procedures and the establishment of Reputation Risk limits are fairly adequate but are not always consistent with implementation and/or not understood well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is fairly adequate but is not always
The Risk Management process for Reputation Risk is fairly adequate in identifying, measuring, monitoring, and controlling Reputation Risk.
The Reputation Risk Management information system meets minimum expectations but has some weaknesses, including Reputation Risk reporting to the Board of Directors and Board of Commissioners that requires attention.
The internal control system is fairly effective in supporting the implementation of Risk Management for Reputation Risk.

Inadequate
The KPMR for Reputation Risk is inadequate. There are significant weaknesses in various aspects of Risk Management for Reputation Risk that require immediate corrective action.

Examples of BPR characteristics included in the Inadequate KPMR level include:

Significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Reputation Risk.
The Risk Management culture for Reputation Risk is not strong and has not been internalized at every work unit level.
The overall execution of duties by the Board of Directors and Board of Commissioners is inadequate and there are weaknesses in some assessment aspects that need to be repaired immediately.
Significant weaknesses in the Risk Management function for Reputation Risk that need to be repaired immediately.
Human resources are inadequate in terms of both quantity and competence in the Risk Management function for Reputation Risk.
Delegation of authority is weak, not controlled, and not monitored well.
Reputation Risk strategy is not aligned with the level of Risk to be taken and Reputation Risk tolerance.
Significant weaknesses in Risk Management policies and procedures and the establishment of Reputation Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is inadequate and not aligned
The Risk Management process for Reputation Risk is inadequate in identifying, measuring, monitoring, and controlling Reputation Risk.
Significant weaknesses in the Reputation Risk Management information system, including Reputation Risk reporting to the Board of Directors and Board of Commissioners, that need to be repaired immediately.
The internal control system is ineffective in supporting the implementation of Risk Management for Reputation Risk.

Not Adequate
The KPMR for Reputation Risk is not adequate. There are significant weaknesses in various aspects of Risk Management for Reputation Risk, the resolution of which is beyond the BPR's capability.

Examples of BPR characteristics included in the Not Adequate KPMR level include:

The awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Reputation Risk is very weak.
The Risk Management culture for Reputation Risk is not strong and is not internalized at every organizational level.
The overall execution of duties by the Board of Directors and Board of Commissioners is not adequate. There are significant weaknesses in almost all assessment aspects and the resolution of which is beyond the BPR's capability.
Very significant weaknesses in the Risk Management function for Reputation Risk that need to be repaired immediately.
Human resources are not adequate in terms of both quantity and competence in the Risk Management function for Reputation Risk.
Delegation of authority is very weak, not controlled, and not monitored well.
Reputation Risk strategy is not aligned with the level of Risk to be taken and Reputation Risk tolerance.
Very significant weaknesses in Risk Management policies and procedures and the establishment of Reputation Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is not adequate and not aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Reputation Risk is not adequate in identifying, measuring, monitoring, and controlling Reputation Risk.
Very significant weaknesses in the Reputation Risk Management information system, including Reputation Risk reporting to the Board of Directors and Board of Commissioners, that need to be repaired immediately.
The internal control system is ineffective in supporting the implementation of Risk Management for Reputation Risk.

RISK MANAGEMENT IMPLEMENTATION QUALITY ASSESSMENT MATRIX FOR STRATEGIC RISK

KPMR Level Definition

Very Adequate
The KPMR for Strategic Risk is very adequate. Although there are minor weaknesses, they are not significant and can be ignored.

Examples of BPR characteristics included in the Very Adequate KPMR level include:

The Board of Directors and Board of Commissioners have very good awareness and understanding of Risk Management for Strategic Risk.
The Risk Management culture for Strategic Risk is very strong and has been internalized very well at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is very adequate.
The Risk Management function for Strategic Risk is independent, has clear duties and responsibilities, and operates very well.
Human resources are generally very adequate in terms of both quantity and competence in the Risk Management function for Strategic Risk.
Delegation of authority is controlled and monitored regularly and operates very well.
Strategic Risk strategy is very good and very aligned with the level of Risk to be taken and Strategic Risk tolerance.
Risk Management policies and procedures and the establishment of Strategic Risk limits are very adequate and available for all areas of Risk Management for Strategic Risk, aligned with implementation, and understood very well by employees.
The formulation of the level of Risk to be taken and Risk tolerance is very adequate and aligned with the strategic objectives and overall BPR business strategy.
The Risk Management process for Strategic Risk is very adequate in identifying, measuring, monitoring, and controlling Strategic Risk.
The Strategic Risk Management information system is very good, producing comprehensive and integrated Strategic Risk reporting to the Board of Directors and Board of Commissioners.

KPMR Level Definition of KPMR Level
12. Internal control systems are very effective in supporting the implementation of Risk Management for Strategic Risk.
13. The implementation of Risk Management is reviewed by the function conducting the independent review, and the results of said review have been submitted to the Board of Directors and Board of Commissioners.
Adequate KPMR for Strategic Risk is adequate. Although there are some minor weaknesses, these weaknesses can be resolved in normal business activities. Examples of BPR characteristics included in the Adequate KPMR level include:

The Board of Directors and Board of Commissioners have good awareness and understanding of Risk Management for Strategic Risk.
The Risk Management culture for Strategic Risk is strong and has been well internalized at all organizational levels.
The overall execution of duties by the Board of Directors and Board of Commissioners is adequate. There are some weaknesses but they are not significant and can be corrected immediately.
The Risk Management function for Strategic Risk is independent, has clear duties and responsibilities, and has been running well. There are minor weaknesses, but they can be resolved in normal business activities.
Human resources are adequate, both in quantity and competence, in the Risk Management function for Strategic Risk.
Delegation of authority is controlled and monitored regularly and has been running well.
Strategic Risk strategy is good and aligned with the level of Risk to be taken and Strategic Risk tolerance.
Risk Management policies and procedures and the establishment of Strategic Risk limits are adequate and available for all areas of Risk Management for Strategic Risk, aligned with implementation, and well understood by employees.
The formulation of the level of Risk to be taken and Risk tolerance is adequate and has been aligned with

KPMR Level Definition of KPMR Level
10. The Risk Management process for Reputational Risk is adequate in identifying, measuring, monitoring, and controlling Reputational Risk.
11. Strategic Risk Management information systems are good, including Strategic Risk reporting to the Board of Directors and Board of Commissioners. There are minor weaknesses that can be easily corrected.
12. Internal control systems are effective in supporting the implementation of Risk Management for Strategic Risk.
Fairly Adequate KPMR for Strategic Risk is fairly adequate. Although minimum requirements are met, there are some weaknesses that require attention. Examples of BPR characteristics included in the Fairly Adequate KPMR level include:

The Board of Directors and Board of Commissioners have fairly good awareness and understanding of Risk Management for Strategic Risk.
The Risk Management culture for Strategic Risk is fairly strong and has been internalized fairly well but is not always implemented consistently.
The overall execution of duties by the Board of Directors and Board of Commissioners is fairly adequate. There are weaknesses in some assessment aspects that need attention.
The Risk Management function for Strategic Risk has been running fairly well, but there are some fairly significant weaknesses that need to be resolved immediately.
Human resources are fairly adequate, both in quantity and competence, in the Risk Management function for Strategic Risk.
Delegation of authority is fairly good, but control and monitoring are not always implemented well.
Strategic Risk strategy is fairly aligned with the level of Risk to be taken and Strategic Risk tolerance.
Risk Management policies and procedures and the establishment of Strategic Risk limits are fairly adequate but not always consistent with implementation and/or not well understood by employees.
The formulation of the level of Risk to be taken and Risk tolerance is fairly adequate but not always

KPMR Level Definition of KPMR Level aligned with the strategic objectives and overall BPR business strategy.
10. The Risk Management process for Strategic Risk is fairly adequate in identifying, measuring, monitoring, and controlling Strategic Risk.
11. Strategic Risk Management information systems meet minimum expectations but have some weaknesses including Strategic Risk reporting to the Board of Directors and Board of Commissioners that requires attention.
12. Internal control systems are fairly effective in supporting the implementation of Risk Management for Strategic Risk.
Inadequate KPMR for Strategic Risk is inadequate. There are significant weaknesses in various aspects of Risk Management for Strategic Risk that require immediate corrective action. Examples of BPR characteristics included in the Inadequate KPMR level include:

Significant weaknesses in the awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Strategic Risk.
The Risk Management culture for Strategic Risk is not strong and has not been internalized at every level of work unit.
The overall execution of duties by the Board of Directors and Board of Commissioners is inadequate and there are weaknesses in some assessment aspects that need to be corrected immediately.
Significant weaknesses in the Risk Management function for Strategic Risk that need to be corrected immediately.
Human resources are inadequate in terms of quantity and competence in the Risk Management function for Strategic Risk.
Delegation of authority is weak, not controlled, and not monitored well.
Strategic Risk strategy is not aligned with the level of Risk to be taken and Strategic Risk tolerance.
Significant weaknesses in Risk Management policies and procedures and the establishment of Strategic Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is inadequate and not aligned

KPMR Level Definition of KPMR Level with the strategic objectives and overall BPR business strategy.
10. The Risk Management process for Strategic Risk is inadequate in identifying, measuring, monitoring, and controlling Strategic Risk.
11. Significant weaknesses in Strategic Risk Management information systems including Strategic Risk reporting to the Board of Directors and Board of Commissioners that need to be corrected immediately.
12. Internal control systems are ineffective in supporting the implementation of Strategic Risk Management.
Very Inadequate KPMR for Strategic Risk is very inadequate. There are significant weaknesses in various aspects of Risk Management for Strategic Risk whose resolution is beyond the BPR's capability. Examples of BPR characteristics included in the Very Inadequate KPMR level include:

Very weak awareness and understanding of the Board of Directors and Board of Commissioners regarding Risk Management for Strategic Risk.
The Risk Management culture for Strategic Risk is not strong and is not internalized at every organizational level.
The overall execution of duties by the Board of Directors and Board of Commissioners is inadequate. There are significant weaknesses in almost all assessment aspects and the resolution actions are beyond the BPR's capability.
Very significant weaknesses in the Risk Management function for Strategic Risk that need to be corrected immediately.
Human resources are inadequate in terms of quantity and competence in the Risk Management function for Strategic Risk.
Delegation of authority is very weak, not controlled, and not monitored well.
Strategic Risk strategy is not aligned with the level of Risk to be taken and Strategic Risk tolerance.
Very significant weaknesses in Risk Management policies and procedures and the establishment of Strategic Risk limits.
The formulation of the level of Risk to be taken and Risk tolerance is inadequate and not aligned

This copy is consistent with the original
Legal Director 1
Legal Department signed
Yuliana
KPMR Level Definition of KPMR Level with strategic objectives and overall BPR business strategy.
10. The Risk Management process for Strategic Risk is inadequate in identifying, measuring, monitoring, and controlling Strategic Risk.
11. Very significant weaknesses in Strategic Risk Management information systems including Strategic Risk reporting to the Board of Directors and Board of Commissioners that need to be corrected immediately.
12. Internal control systems are ineffective in supporting the implementation of Risk Management for Strategic Risk.
Determined in Jakarta on January 21, 2019
EXECUTIVE HEAD OF BANKING SUPERVISOR
FINANCIAL SERVICES AUTHORITY, signed
HERU KRISTIYANA

APPENDIX III
CIRCULAR LETTER OF THE FINANCIAL SERVICES AUTHORITY NUMBER 1 /SEOJK.03/2019 ABOUT IMPLEMENTATION OF RISK MANAGEMENT FOR RURAL BANKS

RISK PROFILE REPORT
A. RISK PROFILE
Period :
BPR Name :
Address :
Telephone Number :
Core Capital :
Total Assets :
Number of Branch Offices :
Activity as an issuer of ATM cards or debit cards : Yes/No (cross out one) Type of Risk*) Assessment per Position Previous Position Assessment Risk Level Inherent Risk Quality Risk Management Implementation Risk Level) Risk Level Inherent Risk Quality Risk Management Implementation Risk Level Credit Risk Operational Risk Compliance Risk Liquidity Risk Reputational Risk Strategic Risk Risk Ranking Analysis*) Note:
*) Filled in according to the type of Risk that must be assessed according to the staging as referred to in Roman numeral III of this Circular Letter of the Financial Services Authority. ) Filled in with the Risk level per type of Risk based on the determination of the Risk level for each type of Risk as referred to in Chapter I Appendix II of this Circular Letter of the Financial Services Authority. *) Filled in with a description of the overall BPR Risk profile including assessment of inherent Risk and quality of Risk Management implementation, with a focus on significant Risk exposure for the BPR.

B. ANALYSIS BY TYPE OF RISK
RISK ANALYSIS ……. *)
BPR Name :
Period :
Analysis

Risk Level:
………………………………………………………………………………………………………………
……………………………..)
Inherent Risk:
………………………………………………………………………………………………………………
……………………………..*)
Quality of Risk Management Implementation:
……………………………………………………………..………………………………………………
………………………………)
Note:
*) Filled in with the type of Risk analyzed, used to support the analysis of Risk in BPR activities (including Credit Risk, Operational Risk, Compliance Risk, Liquidity Risk, Reputational Risk, and Strategic Risk). ) Contains the final conclusion regarding the level of inherent Risk and the level of quality of Risk Management implementation so that it can describe the level of Risk for each type of Risk. *) Contains analysis regarding the assessment of inherent Risk based on assessment factors and quantitative and qualitative indicators so that it can describe the level of inherent Risk for each type of Risk. ) Contains analysis regarding the assessment of the quality of Risk Management implementation which is a conclusion on the implementation of Risk Management for each type of Risk consisting of supervision by the Board of Directors and Board of Commissioners; adequacy of policies, procedures, and limits; adequacy of processes and systems; and comprehensive internal control systems.

OTHER RISK PROFILE REPORT
Date known of conditions potentially causing significant losses to the financial condition of the BPR or date of request by the Financial Services Authority :
BPR Name :
Address :
Telephone Number :
Core Capital :
Total Assets :
Number of Branch Offices :
Activity as an issuer of ATM cards or debit cards : Yes/No (cross out one)
Table of Risk Levels per Type of Risk
No
Type of Risk *) Risk Level per
Type of Risk ) Explanation of
Inherent Risk *) Explanation of Quality of Risk Management Implementation ) 1 Credit Risk 2 Operational Risk 3 Compliance Risk 4 Liquidity Risk 5 Reputational Risk 6 Strategic Risk

Note:
*) Filled in with the type of Risk that has the potential to cause significant financial losses to the BPR or the type of Risk requested by the Financial Services Authority. ) Filled in with the Risk level per type of Risk based on the determination of the Risk level for each type of Risk as referred to in Chapter I Appendix II of the Circular Letter of the Financial Services Authority. *) Filled in with the BPR's explanation regarding Inherent Risk on the type of Risk that has the potential to cause significant financial losses to the BPR or the type of Risk requested by the Financial Services Authority. ) Filled in with the BPR's explanation regarding the quality of Risk Management implementation on the type of Risk that has the potential to cause significant financial losses to the BPR or the type of Risk requested by the Financial Services Authority.

REPORT ON THE REALIZATION OF THE ACTION PLAN
FOR THE IMPLEMENTATION OF RISK MANAGEMENT FOR BPR A. BPR Profile
BPR Name : ........................................................................
Address : ........................................................................
Telephone Number : ........................................................................
Core Capital : ........................................................................
Total Assets : ........................................................................
Number of Branch Offices : ........................................................................
Activity as an issuer of ATM cards or debit cards : Yes/No (cross out one) Note: Using BPR data as of June 30 for the first semester report and data as of December 31 of the previous year for the second semester report B. Realization of the Action Plan for the Implementation of Risk Management Period : …………………………………………………………………………………………. No Topic Period Planned Fulfillment*) Period Realization) Obstacles to Fulfillment (If Any) 1 Completeness of Organization and Risk Management Function a. Formation of Risk Management work units b. Appointment of Executive Officials responsible for the implementation of the Risk Management function
c. Formation of the Risk Management Committee
2 Preparation of internal regulations containing the authority and responsibility of the Board of Directors and Board of Commissioners related to the implementation of Risk Management 3 Preparation of policies and procedures containing:
a. Risk Management Policy, Risk Management procedures, and establishment of Risk limits b. Risk identification, measurement, monitoring, and control process
c. Risk Management information system
d. Internal control system e. New products and activities Note:
*) According to the fulfillment period of the action plan submitted in the action plan report.
) Period of fulfillment of the realization of the action plan.

This copy is consistent with the original
Legal Director 1
Legal Department signed
Yuliana
Determined in Jakarta on January 21, 2019
EXECUTIVE HEAD OF BANKING SUPERVISOR
FINANCIAL SERVICES AUTHORITY, signed
HERU KRISTIYANA

Implementation of Risk Management for Rural Banks

Implementation of Compliance Risk Management for Rural Banks

Assessment Criteria

RISK MANAGEMENT IMPLEMENTATION QUALITY ASSESSMENT MATRIX FOR LIQUIDITY RISK

RISK MANAGEMENT IMPLEMENTATION QUALITY ASSESSMENT MATRIX FOR REPUTATION RISK

RISK MANAGEMENT IMPLEMENTATION QUALITY ASSESSMENT MATRIX FOR STRATEGIC RISK

Lineage: In force

Similar documents from other regulators