Risk Control Self Assesment RCSA Loss Event Database LED Key Indicator KI Issue Action Management IAM

10 Consolidated Financial Statements 09 Cross Reference of Annual Report Award 2016 Criteria 08 Corporate Social Responsibility 07 Integrated Corporate Governance 06 Corporate Governance

4. Operational Risk

A. Qualitative Disclosure

Operational risk is the risk due to insufficiency andor failed internal processes, human error, system failure, andor the presence of external events which affecting the operations of Bank Mandiri. Operational risk can lead to other risks such as reputation risk, strategic risk, legal risk, market risk, credit risk, compliance risk, liquidity risk, the risk of intragroup transactions and insurance risks. The management of operational risk effectively and consistently can minimize the emergence of other risks. Operational risk is inherent in all activitiesoperations of Bank Mandiri while running business process. Bank Mandiri implemented the Operational Risk Management effectively to reduce the frequency andor impact of operating losses. In general, the implementation of the Operational Risk Management is expected to give positive impact to Bank Mandiris stakeholders. Operational Risk Management Organization The implementation of operational risk management involves all elements in Bank Mandiri, including the Board of Directors with active supervision by the Board of Commissioners. To that end, the Board of Commissioners and Board of Directors understand the risks faced by Bank Mandiri, and plays an important role in supporting and overseeing the success of its application in all operational units.

1. Risk Management Committee

is a committee which formed to assist the Board of Directors in performing the function of monitoring and control, among others through policy discussion, define strategies and procedures related to the Operational Risk Management of Bank Mandiri, monitoring risk profile and risk management to establish risk appetite. 2. The Builder Unit of Operational Risk System, Retail IT Operational Risk Group and Wholesale Operational of Risk Group , is the Operational Risk Management Unit, which responsible for formulating policies, strategies, frameworks and operational risk management tools as well as doing the implementation thereof.

3. Working Unit Risk Owner

, responsible for managing operational risk according to the authority and scope of work in every units, especially in ensuring that the control effectiveness have been carried out in accordance with the standard guidelines for operational activities.

4. ORM Coordinator

, monitor and review the effectiveness adequacy of operational risk management processes inherent to every activity and perform tests of controls against the assessment control by Risk Owner periodically.

5. Internal Audit

, provides independent, objective assurance and consulting services to give added value and improve the operational quality of Bank Mandiri. Operational Risk Management Mechanism Bank Mandiri has set policies and procedures for managing operational risk refers to the regulatory provisions and international best practices, particularly of Basel Committee recommendations. Policies and procedures for the implementation of operational risk management for the entire unit in Bank Mandiri, among others, Bank Mandiri Risk Management Policy KMRBM, SPO Operational Risk Management, Technical Guidelines for Operational Risk Management ORM Tools, and SPO Products or Activities. To support the process of managing operational risk, Bank Mandiri uses ORM Tools namely:

1. Risk Control Self Assesment RCSA

RCSA is used for the identification and assessment of operational risk exposure and effectiveness of the control of Bank Mandiri. RCSA is a proactive approach in measuring risk since it involves all the activities and operational control. RCSA processes performed by used Assessment Top Risk method, where Working Units will be more focused in identifying, measuring, monitoring, and control contained in the core process.

2. Loss Event Database LED

LED is the data of operational risk incident on every working unit. The result of the recording of LEDs used as one factor of risk profile assessment and operating loss of Bank Mandiri. The purposes of LED recording is to provide a map of operational risk loss of Bank Mandiri, prevent reoccurrence of operational incidents, and as one of the inputs in determining the operational risk profile.

3. Key Indicator KI

Key Indicator KI is a quantitative indicator which used as an early warning signal to changestrends of risk or operational risk control effectiveness. Determination of KI aims that all working units exert control over core competency processes which have high operational risk to set mitigation measures.

4. Issue Action Management IAM

IAM aims to facilitate the ease of identification and follow- on issues in which the action plan should be carried out in accordance to the timelines and responsible parties and also to facilitate monitoring progress of action plan completion. The results of identification, assessment, monitoring and controlling of risk exposure was integrated with i-Mors Independent Operational Risk Integrated System which has been implemented in all working units risk owners. As the output of operational risk management process, every working units produce risk profile report which used as the basis in making Bank Mandiris operating risk profile. The report of operational risk profile was drafted through the identification of major process in all working units according to the activity, segments, products and services that run through ORM Forum, questionnaires, interviews one on one meeting, or other appropriate media. 03 Company at a Glance 04 Management Discussion and Analysis on Companys Performance 05 Review of Business Support Function 01 Main Highlights 02 Management Report The report of operational risk profile of Bank Mandiri which has validated by the Internal Audit unit and approved by the Board of Directors and Board of Commissioners, further reported to the regulator periodically. Profile of Operational Risk of Bank Mandiri used as part of the determination of Bank Mandiris soundness or the report of Risk-Based of Bank Mandiri Rating RBBR which is submitted to the regulator. Implementation of Operational Risk Management In 2016, the implementation of Bank Mandiris Risk management were focused on four strengthening aspects, namely:

1. Risk Awareness Program