As a minimum—
| (A) | a bank shall have in place board approved policies and procedures in order to determine— |
| (i) | the circumstances under which external data such as public data and/or pooled industry data should be used in addition to internal data; |
| (ii) | the methodologies that should be used in order to incorporate the relevant external data, such as scaling or qualitative adjustments, |
provided that the bank's operational risk measurement system shall incorporate relevant external data when there is reason to believe that the bank is exposed to infrequent, yet potentially severe, losses.
| (B) | the external data referred to in item (A) above shall include information in respect of— |
| (i) | the actual loss amounts; |
| (ii) | the scale of business operations where the loss event occurred; |
| (iii) | the causes of and circumstances surrounding the loss event; |
| (iv) | any other information that would assist the bank in assessing the relevance of the loss event and/or data; |
| (C) | a bank's policies and procedures relating to the use of external data shall be subject to regular independent review and appropriate internal audit coverage. |
