280Bulletin of Monetary Economics and Banking, Volume 20, Number 3, January 2018

I. INTRODUCTION

Referring to Law Number 10 of 1998 regarding the amendment of Law Number 7 of 1992 concerning banking, the Bank is a business entity that collects funds from the community and distributes it back to the community in other forms in order to improve the living standard of the community. One part of the activities, undertaken by the Bank, is to collect funds from the community and serve the financial transactions of customers. However, the business activities undertaken by the Bank cannot be separated from risks both calculated and unpredicted.

Based on the above phenomenon, it is necessary to manage risk in order to anticipate potential risks in fund management and customer transaction services. Referring to Bank Indonesia regulation Number 11/25/PBI/2010 amendment of PBI Number 5/8/PBI/2003 on May 19, 2003, concerning the Application of Risk Management for Commercial Banks, there are eight types of risks that must be managed or considered by banks which are the credit risk, market risk, operational risk, liquidity risk, compliance risk, legal risk, reputation risk, and strategic risk.

The phenomenon of the online banking application, in Indonesia, is in line with the increase in mobile device users that have become part of people’s life. The online banking offers an easy access to banking services such as account opening, transfer, bill payment, or other financial planning. The emergence of new companies, based on financial technology (fin-tech) in the financial industry competition where they make technological innovations and products very quickly, demand the banking industry to make adjustments in the business processes and infrastructure that were originally processed manually or offline into the automation process or online with the aim of speeding up services to customers and surviving within the competition (Bank Indonesia, 2016). This change in bank services will create good value and customer experience to the eyes of the customers, and with the improvement of infrastructure can be utilized as a supporting tool in online banking risk management.

Compared to the conventional banking services, where the customers or potential customers must approach the Bank to conduct transactions, online banking services are perceived to be easier and more flexible. Changing the manual process to digital allows a more flexible process, where customers who initially have to go to the Bank office, which provides more comfort through the use of channels that work with the Bank (Eistert et al., 2013). The use of online banking technology has potential risks that must be managed and considered by the Bank. Bank Indonesia (BI) and the Financial Services Authority (OJK) acting as regulators in the financial industry apply some rules regarding online banking implementation. Some of these rules are as follows:

1)PBI 9/15/2007 On Implementation of Risk Management in the Use of

Information Technology by Commercial Banks, the regulation in the account opening process is set forth in PBI 14/27 / PBI / 2012 concerning the

Implementation of Anti Money Laundering and Counter-Terrorism Financing

Program for Commercial Banks where Mandatory Commercial Banks must do Customer Due Diligent (CDD) and Enhancement Due Diligent (EDD) towards prospective customers in order to apply Know Your Customer (KYC) principles.

Online Banking Implementation: Risk Mapping Using Erm Approach	281

2)POJK Number 01/POJK.07/2013 on August 6, 2013, regarding Consumer Financial Services Protection and SE OJK Number 12/SEOJK.07/2014 on Information Submission in The Framework of Product and/or Financial Services Marketing aims at Bank to deliver related information on the financial services used by prospective customers in a transparent manner by explaining the risks attached to each Bank product to be used by the customer.

The scope of this study covers the risk mapping of online banking application

with the Enterprise Risk Management (ERM) approach. Stages of the process were undertaken following the eight ERM frameworks which are internal environment, objective setting, event identification, risk assessment, risk response, control, information and communication, and monitoring. The reason for using ERM method in this research is to get a comprehensive picture of the integration process between the Bank’s business objectives, the risks inherent in the business process, as well as the risk mitigation strategy chosen to keep the business process running. The expected output of this online banking risk mapping can be useful for the Bank in managing the risk of online banking services.

The second part of this paper presents a literature review related to online banking risks. The third section describes the data and methodology used. The fourth section presents the results of the discussion on online banking risk mapping, while the fifth section presents the conclusions of this study.

II. THEORY

2.1. The Linkage between Risks and Online Banking

The concept of online banking technology is not just a switch from an offline system to an online system, but also provision of both added value and convenience to the community as well as speed in terms of accessing banking services through technology. The online banking combines two parts, namely the external part associated with the customer experience and the internal part associated with operational processes that are effective and efficient (Eistert et al., 2013).

The use of technology in business processes is closely related to risk. The ease of accessing digital information and that of connections through mobile devices lead to growing risks in the use of technology. The balance between risk management and business processes is important where the use of technology should be an opportunity for business growth, while failure in risk management will harm the business (Baldwin & Shiu, 2010).

The broad concept of risk is an essential foundation for understanding risk management concepts and techniques. Studying the various definitions found in the literature is expected to improve the understanding of the concept of risk which becomes increasingly clear. Some of these differences in the definition of risk are due to the fact that the subject of risk is very complex with many different fields causing different understanding. The risk is divided into three senses: possibility, uncertainty, and the probability of an outcome that is different to the expected outcome (Diversitas, 2008). The systematic management of risks is covered in the concept of risk management. Risk management is a strategy that every industry must adapt to anticipate potential emerging losses that include risk identification activities, risk measurement, risk mapping, risk management, and risk control

282Bulletin of Monetary Economics and Banking, Volume 20, Number 3, January 2018

(Djohanputro, 2008). Risk management also has other objectives such as obtaining greater effectiveness and efficiency by controlling risk in every company activity (Darmawi, 2006).

The risk categories that exist in online banking include transaction risk, compliance risk, reputation risk, and information security risk (Osunmuyiwa, 2013). While the adoption of e-banking will lead to potential operational and reputation risks (Ndlovu & Sigola, 2013). In addition, the authors argue that the potential for fraud and information security risk are some of the biggest challenges in addition to investment costs for e-banking infrastructure that requires a high cost.

One of the risks that arise from the implementation of online banking is the information security. A common problem affecting information security is the lack of a Bank in implementing controls that lead to a loss in terms of privacy, causing misuse of client confidential information that may affect clients trust in transactions using e-banking (Omariba, Masese, & Wanyembi, 2012). Customer knowledge of security in IT is a factor affecting security in internet banking access. The higher the customer knowledge about information security, the more diligent they will be in conducting activities through the internet (Zanoon & Gharaibeh, 2013).

2.2.Online banking risk mapping using the Enterprise Risk Management (ERM) method

Underlying the author’s thinking is that (COSO-ERM, 2004) any organization is established to generate value for the stakeholders. All of the organizations face uncertainty and challenges and the function of management is to determine how much uncertainty is received as a compensation for increasing the value of the firm.

The framework of the ERM presents four-goal categories and eight components related to corporate entities as the objects of ERM analysis. The four categories of corporate objectives include strategic, operational, reporting, and compliance. Meanwhile, the eight components related to the corporate entity include the internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, and monitoring - all of the ERM activities must be monitored and evaluated as the basis of subsequent development.

(Cormican, 2014) in his research on “Integrated Enterprise Risk Management: From Process to Best Practice” stated that the critical success factor of the ERM is the result of proper identification and risk grouping. This research used primary data obtained through interview and questionnaire filling. The result of this research is about the application of ERM, in theory, the practice of which has not been applied to Industry.

(Osunmuyiwa, 2013) in his research on “Online Banking and The Risk Involved” reviewed the implementation of online banking services that will provide the customers with the convenience and flexibility in accessing banking services via the Internet at home or elsewhere without having to come to the bank. In addition to these ease and flexibility factors, there are potential risks that arise in connection with this online banking application including strategic risk,

Online Banking Implementation: Risk Mapping Using Erm Approach	283

transaction risk, compliance risk, reputation risk, and information security risk. (Sarma & Singh, 2010) in his journal about “Risk Analysis and Applicability of

Biometric Technology for Authentication”, one of the ways to mitigate risks is to apply security access using biometric authentication such as fingerprint detection, face, voice, body movement, and others. This study discusses how risk mitigation uses biometrics without using the ERM.

(Bahl, 2012) in his paper on “E-Banking: Challenges and Policy Implication” review the implementation of e-banking as a new opportunity for the banking industry. Although some countries have successfully implemented e-banking, to further refine the implementation of e-banking macroeconomic policy is required to determine the terms of cost and sustainability. Table 1 presents some of the previous research that has been done regarding the implementation of online banking and ERM.

Table 1.

Previous Research Related to Online Banking and ERM

Title	Authors	Methods	Results
Integration of Risk	Isabela Ribeiro	SWOT and	The research was conducted in
Management into	Damaso Maia &	ERM	public company where the obtained
Strategic Planning: A	George Montgomery		result was the biggest risk caused by
New Comprehensive	Machado Chaves		strategic risk. The company failed
Approach	(2016)		to integrate risk management to
			company strategies.
Integrated Enterprise	Kathryn Cormican	ERM	The critical success factors of the ERM
Risk Management:	(2014)		are the results of risk identification
From Process to Best			and grouping.
Practice
Risk Mapping in the	Helen Wiryani, Noer	ERM	The strategy that needs to be
Tannery Industry with	Azam Achsani,		developed for effective risk mitigation
ERM Approach	Lukman M. Baga		for PT XYZ is to prioritize the
	(2013)		handling of the highest risk first and
			then to lower risk.
Implementation	Mellisa and Fidelis	ERM	The ERM implementation helps
of Enterprise Risk	Arastyo Andono		CV.ABC in finding risks at high,
Management in	(2013)		medium, and low levels. Risks that
order to Improve			are classified as high risk are risks that
the Effectiveness of			must be considered by management
Operational Activities			and should be handled as soon as
of CV Anugerah Berkat			possible. The risk classified as medium
Calindojaya			risk has not a significant impact on the
			company. The risk that is classified as
			low risk is a risk that comes after the
			medium and high risks.
Report on The Current	Mark Beasley, Bruce	ERM	There are still many companies that
State of Enterprise Risk	Branson, Bonnie		have not carefully taken care of risks,
Oversight	Hancock (2015)		especially those related to strategies.
			The need to evaluate the process of
			risk management is based on the
			volume and complexity and the events
			experienced by the company

284Bulletin of Monetary Economics and Banking, Volume 20, Number 3, January 2018

Table 1.

Previous Research Related to Online Banking and ERM - Continued

Title	Authors	Methods	Results
Online Banking and	Lufolabi	Literature	The potential risks that arise in
The Risk Involved	Osunmuyiwa (2013)	review	connection with the implementation
			of this online banking include risks
			such as strategic risk, transaction risk,
			compliance risk, reputation risk, and
			information security risk.
Internet Banking:	Gunajit Sarma and	Literature	One way to mitigate security risks
Risk Analysis and	Pranav Kumar Singh	review	related to online banking system
Applicability of	(2010)		access is through the application
Biometric Technology			of security access using biometric
for Authentication			authentication such as fingerprint
			detection, face, voice, body movement,
			and others.
Internet Banking,	Bilal Ahmad Sheikh	Literature	Access security model of the internet
Security Models, and	and Dr. P. Rajmohan	review	banking that is currently widely used
Weakness	(2015)		is based on user identification and
			authentication methods. However, if
			the Bank does not mitigate the risk of
			data loss and access security, it will
			result in fraud. The new solution to
			strengthen the access security is using
			biometric authentication
The Role and	Mojtaba Mali,	ERM	The most vulnerable risk is security
Importance of Risk	Hossein Niavand, and		risk related to transaction security,
Management In	Farzaneh Haghighat		customer data security, and user
Internet Banking	Nia (2014)		access security. These risks need to
			be identified, classified, and risk
			assessments involving management
			in banks that have the competence to
			determine potential risks
E-Banking: Challenges	Dr. Sarita Bahl (2012)		The implementation of e-banking as
and Policy Implication			a new opportunity in the banking
			industry. Although some countries
			have successfully implemented
			e-banking, to further refine the
			implementation of e-banking,
			macroeconomic policy is required
			to determine the terms of cost and
			sustainability

III. METHODOLOGY

The types of data used in this study are primary and secondary data. The collected primary data were obtained from interviews and questionnaires, while secondary data were obtained through the publication of annual reports, financial reports, and other sources related to this research. The implementation of this research was conducted at Bank XYZ Head Office as an object that has implemented online banking.

Online Banking Implementation: Risk Mapping Using Erm Approach	285

Sampling for primary data was done with a specific purpose (purposive sampling) i.e. the sample taken with the purpose and certain considerations addressed to the respondents who will be interviewed in depth. The respondents, in this study, are internal Bank XYZ who have competency, capacity, and experience in the field of operational and risk management processes including risk management division, operational division, and business division. Each division provided as much as two respondents at the managerial level and two respondents at the head of unit level. Thus, a total of respondents 12 respondents was used. The respondents were selected to represent their respective divisions and directly involved in the creation of operational processes and online banking risk assessment process at Bank XYZ.

Research stages started from the data collection through the questionnaire filling which was done by conducting in-depth interviews to obtain information about the potential risks and risk mitigation that will be done. This research was conducted by using the descriptive approach in the form of the case study which was a detailed study (and in-depth related) of the object to be studied. Risk research carried out through the ERM (Enterprise Risk Management) method adapts to the ERM framework for obtaining risk mapping of the implementation of online banking.

IV. RESULTS AND ANALYSIS

The online banking risk mapping, at Bank XYZ, was conducted using the ERM framework. The stages of the implementation in this research were conducted by referring to the eight components of ERM, namely internal environment, objective setting, event identification, risk assessment, risk response, control, information, and communication, monitoring.

4.1. ERM 1: Internal Environment

The implementation of online banking services, at Bank XYZ, is done by focusing on serving the smartphone user segment. This is in line with the company’s goal of improving service to customer oriented and utilizing digital technology. Bank XYZ’s governance is implemented by applying Good Corporate Governance (GCG) which is to identify and control risk to improve the existing business process and apply the four eyes principles in which every process is done by dual control. Every business process, that is executed, must have standardized rules set forth in the form of policies or procedures and set its periodic evaluation plan.

4.2. ERM 2: Objective Setting

The objective setting of Bank XYZ can be seen from the four priority sides based on the ERM framework which includes Strategic Objective, Operating Objective, Reporting Objective, and Compliance Objective. In the strategic objective, XYZ Bank took the initiative to innovate in finance by developing online banking business that utilizes smartphone media to be able to provide financial and non-financial transactions to the community. In the operating objective, Bank

286Bulletin of Monetary Economics and Banking, Volume 20, Number 3, January 2018

XYZ continuously improves the Bank’s operational processes to enhance the effectiveness and efficiency of work processes and costs, in addition to conducting periodic evaluations of work processes that have been previously applied. In the reporting objective provides transparent and accurate reports for both internal and external parties. This is necessary so that the company can take appropriate steps for decision making and as accountability to stakeholders. The compliance objective complies with the regulations set by the government and regulator (BI and OJK) as well as the rules applicable regionally and internationally to be in line with the established Bank Business Plan.

4.3. ERM 3: Event Identification

The risk identification process of the online banking application at Bank XYZ is based on the deposition of risk categories based on BI and OJK rules covering credit risk, market risk, operational risk, liquidity risk, compliance risk, legal risk, reputation risk, and strategic risk. The risk identification process is conducted through in-depth interviews with those who have competencies in the areas of risk and operational processes. Based on the results of the identification, 55 potential risks from the implementation of online banking at Bank XYZ were observed. Table 2 presents potential risk obtained based on the identification results.

			Table 2.
			Risk Identification Results
	Risk Categories	Risks No	Risks Identification
		R1	Banks are bankrupt and customer funds are non-refundable
	Liquidity risks
		R2	The customer keeps funds in small amount and short term, so the
			Bank does not get big fund in the long-term
		R3	The Customer feeling the obligation to pay the loan to the Bank is
			reduced because it is not directly related to the Bank
		R4	The Customer does not make any loan payments to the Bank
		R5	Bank does not conduct customer analysis for customer who
	Credit risks		applies for loan
		R6	The Bank can not provide customer loan data or information for
			reporting
		R7	Lack of transparency on loan product information to customers
			leading to customer complaints
		R8	A change of policy from the government or regulator related to
			credit regulations
	Market risks	R9	Changes in the value of the Rupiah (currency)
		R10	Changes in interest rates

Online Banking Implementation: Risk Mapping Using Erm Approach	287

Table 2.

Risk Identification Results - Continued

Risk Categories	Risks No	Risks Identification
	R11	Fail to achieve product sales target
	R12	Fail to develop products according to customers' needs
	R13	Fail to acquire new customers
	R14	Fail in prioritizing strategy
Strategic risks	R15	Competitors get a large market share
	R16	The Bank's fails to build an integrated network system with
		partners
	R17	Top management that has the capability to provide strategic
		direction, withdraw from the company
	R18	Partner work is not in line with agreement
	R19	Customer can not transact due to forgotten PIN or User ID
	R20	The absence of clear procedures and business processes
	R21	The controlling process of the activity that has been executed does
		not exist yet
	R22	The password or PIN length is very complicated
	R23	Customer fails to make transactions via ATM
	R24	Less effective process
	R25	Error doing data input caused by lack of information on the input
		procedure
	R26	The political situation that leads to riots or demonstrations
	R27	Natural disasters on a national scale
Operational risks	R28	Theft of Bank information by Customer/Internal Party/External
		Parties
		The customer can not access the transaction through online
	R29	banking due to the absence of the network or trouble with the
		system provider (down)
	R30	Bank systems are vulnerable to viruses or malware
	R31	SMS or Email delivery as transaction proof failed to be sent
	R32	Failure to store customer data and back it up
	R33	Theft of customer user ID by external parties
	R34	The fraud perpetrator acts on behalf of the client and unlawfully
		accesses the customer's account

	R35	Fraud actor that acts on behalf of the Bank and requests User ID or
		Password of the customer for fraud

288Bulletin of Monetary Economics and Banking, Volume 20, Number 3, January 2018

Table 2.

Risk Identification Results - Continued

	Risk Categories	Risks No	Risks Identification
		R36	Fraud perpetrators work with Bank employees to link ATMs with
			personal account numbers or other accounts
		R37	Fraud perpetrators use other domains to access the Bank system
		R38	The Customer denies transactions that have been made
		R39	The Customer has made an initial deposit for opening an account,
			but the account opening is rejected by the Bank
		R40	The Bank system is hijacked by external parties
		R41	Employees open fake accounts with customers to get incentives
		R42	The Customer can not provide identity cards and other mandatory
			documents
		R43	Customers do not receive ATM cards
		R44	The Bank does not have backup for Customer data
		R45	Fraud is detrimental to customers
		R46	Failed transaction
	Reputation Risks	R47	Customer's location of the transaction does not receive signal
		R48	Customer complaints services are long
		R49	Employees of the Bank require remuneration to the Customer for
			the services provided
		R50	The Bank does not fulfill the data fulfillment obligation for KYC
			Customer
	Compliance Risks
		R51	Rule changes from the regulator
		R52	Rules of BI and/or OJK that cannot be fulfilled by the Bank
		R53	The Bank cannot resolve the dispute with the Customer
		R54	Lack of clauses in the agreement made by the Bank with the
	Legal risks		Customer

	R55	Changes in laws and regulations that cause the Bank to change all
		or part of its agreement with the customer
	Source: Processed Data of Bank XYZ (2016)

4.4.ERM 4: Risk Assessment

The next stage of risk identification is risk assessment based on probability and impact. The categorization of risks based on probability is divided into five scales i.e. very low, low, medium, high, and very high (Godfrey, 1996). The impact scale indicator refers to the criteria of risk probability indicators established by internal Bank XYZ. The indicators are obtained based on historical data of events within a period of one year (2016-2017) i.e. based on data of customer’s complaints audit and internal complaints of bank related to system or IT. Table 3 represents risk indicators based on probability.

290Bulletin of Monetary Economics and Banking, Volume 20, Number 3, January 2018

Table 4.

Risk Indicator based on Impacts - Continued

						Guidelines
No	Categories										Scale
		Financial	Regulatory			Reputation		Legal		Information
										security
3	Serious	Profit is	•	There is	•	Submission	•	The existence	•	Classification	3
		reduced		a written		of complaints		of an error in		of internal
		20% - ≤ 30%		reprimand		to at least two		the agreement		data/
				from the		local/national		clause (minor)		information
				regulator		Media	•	There is no	•	Leakage
			•	No	•	Customer		violation of		of data/
				penalties		complaints		the law		information
						increased	•	There is no		that does
						from 20.1%		claim from the		not provide
						- 30%		Customer		benefits to
										external
										parties
4	Critical	Profit is	•	There is at	•	Submission	•	The existence	•	Classification	4
		reduced		least one		of complaints		of an error in		of internal
		30% - ≤ 40%		written		to at least		the agreement		data/
				reprimand		two Local/		clause (major)		information
				from the		national	•	There is no	•	Data leak/
				regulator		medias		violation of		information
			•	There are	•	Customer		the law		that provides
				penalties		complaints	•	There is no		benefits to
						increased		claim from the		external
						from 30.1% to		Customer		parties
						40%
	5	Profit is	•	There are	•	Submission of	•	The existence of	•	Classification	5
Catastrophic		reduced >		written		complaints to		a violation of		of confidential
		40%		reprimands		at least 3 local /		the law		data/
				from the		national medias	•	The existence of		information
				regulator	•	Customer		a claim from the	•	Data leak/
				> 1		complaints		Customer		information
			•	There are		increased> 40%				that provides
				penalties						benefits to
										internal and/or
										external parties

Source : Bank XYZ processed Data (2016)

Having determined the risk indicators based on both the probability and impact, the next step is scoring which is carried out to determine the risk level of each identified potential risk. The level of risk is divided into five categories of risk level as follows: High (H), Medium to High (MH), Medium (M), Low to Medium (LM), and Low (L). Table 5 presents the result of risk scoring of each identified potential risk.

	Online Banking Implementation: Risk Mapping Using Erm Approach						293
			Table 5.
			Risk Scoring Results - Continued
	Risk					Total	Risk
		No	Risk Identification	Score P	Score D	Score
	Categories						Levels
						(P x D)
			Fraud perpetrator acts on behalf
		R35	of the Bank and requests User ID	2	5	10	MH
			or Password of the customer for
			fraud
			Fraud perpetrators work with
		R36	Bank employees to link ATMs with	2	5	10	MH
			personal account numbers or other
			accounts
		R37	Fraud perpetrators use other	1	5	5	MH
			domains to access the Bank system
		R38	The Customer denies transactions	1	5	5	MH
			that have been made
			The Customer has made an initial
		R39	deposit for opening an account,	1	4	4	MH
			but the account opening is rejected
			by the Bank
		R40	The Bank system is hijacked by	1	5	5	MH
			external parties
		R41	Employees open fake accounts	1	5	5	MH
			with customers to get incentives
			The Customer can not provide
		R42	identity cards and other	5	1	5	M
			mandatory documents
		R43	Customers do not receive ATM	5	3	15	MH
			cards
		R44	The Bank does not have backup	1	5	5	MH
			for Customer data
		R45	Fraud is detrimental to customers	2	5	10	MH
		R46	Failed transaction	4	3	12	MH
		R47	Customer's location of the	4	3	12	MH
			transaction does not receive signal
		R48	Customer complaints services are	3	5	15	H
			long
			Employees of the Bank require
		R49	remuneration to the Customer for	2	3	6	M
			the services provided
			The Bank does not fulfill the data
		R50	fulfillment obligation for KYC	1	4	4	MH
	Compliance		Customer
	Risks	R51	Rule changes from the regulator	1	4	4	MH
		R52	Rules of BI and/or OJK that cannot	1	4	4	MH
			be fulfilled by the Bank

294Bulletin of Monetary Economics and Banking, Volume 20, Number 3, January 2018

Table 5.

Risk Scoring Results - Continued

	Risk					Total	Risk
		No	Risk Identification	Score P	Score D	Score
	Categories						Levels
						(P x D)
		R53	The Bank cannot resolve the	1	5	5	MH
			dispute with the Customer
			Lack of clauses in the agreement
		R54	made by the Bank with the	1	4	4	MH
	Legal Risks		Customer
			Changes in the laws and
		R55	regulations that cause the Bank to	1	5	5	MH
			change all or part of its agreement

with the customer

Source: Bank XYZ processed Data (2016)

Once the risk score results are obtained, we can proceed to make the risk map according to the five risk levels. To make the differentiation easier, the five levels of risk were divided into several colors: High (H) red, Medium to High (MH) orange, Medium (M) yellow, Low to Medium (LM) dark green, and Low (L) green. Figure 1 represents the results of the risk mapping that has been done.

Figure 1. Results of Risk Mapping prior to Mitigation

		Negligble (1)	Marginal (2)	Serious (3)	Critical (4)	Catastrophic (5)
	Frequent
		R42	R2, R19, R29	R43	R13	R4
	(5)
	Probable			R46, R47
	(4)
	Occasional	R9, R22, R31	R3		R5, R15	R48
	(3)
	Remote		R23	R49	R11	R7, R35, R36,
	(2)					R45
					R6, R8, R12, R14,	R1, R18, R21,
						R24, R28, R32,
	Improbable				R27, R30, R39,
		R17, R26	R10, R16	R20, R25		R33, R34, R37,
	(1)				R50, R51, R52,
						R38, R40, R41,
					R54
						R44, R53, R55

Source: Processed data of Bank XYZ (2016)

4.5. ERM 5: Risk Response

Based on the results of the risk mapping that has been done, the risk mitigation measure can be carried out. The identified potential risks are risk mitigation measures so that each risk can be monitored and not shifted towards a higher