Use third-party outsourcing agreements to replace most internal controls performed by senior managers and business line managers.

Develop an internal approach to model the distribution of operational risk losses and use it to determine the bank's regulatory capital.

Require an independent review of the bank's operational risk management framework.

Designate the risk management function as the primary owner of risk exposures within each business line.