Introducing iDP - A next generation platform for ORX to launch high value risk applications. Standing for Innovation Data Platform, iDP is a first-of-a-kind digital platform on which ORX and other third parties can launch a new generation of risk management and risk data visualization applications. iDP brings these risk applications and your data together into one secure space. All apps on iDP are pre-validated and accredited, significantly reducing implementation time and cost. They all use a consistent data format, making it possible to ultimately create your own tailored, modular and integrated risk management ecosystem – the overall outcome being more powerful risk insights at lower cost. iDP has been built to ease the effort of securely conforming data for use across various applications and services. Security is at the heart of iDP - built on industrial AWS componentry, secure by design, it delivers extra layers of trust to your data and risk application management. Our layered security approach is built upon industry grade infrastructure, industry standard certification and with the institution in charge of its user-controlled Locked Box. IDP is neutral. It leaves the specifics of what apps are added and what they offer up to the Institutional users and the app producers. ORX will be a producer, developing apps for iDP that our members want, leveraging a growing library of industrial-grade tools, our ORX Industry data standards and exploiting the advantages of operating on modern infrastructure of on-demand cloud technology. The first of ORX’s applications for iDP – launching in Q4 2022 – is a risk control app, which shows visually where individual business line control systems have gaps compared to the ORX Industry study of over 60 of the World's leading Banks & Insurers (read more on page 6). In addition to ORX applications, iDP also provides the opportunity to deploy other apps from 3rd party risk and reg tech producers in a safe and consistent environment. We have the vision for iDP to unlock new opportunities for ORX and its members to advance and innovate risk management and for the industry as a whole. These opportunities are unlocked as we build out the ‘Risk as a Service’ Marketplace, a marketplace to discover and deploy accredited risk management solutions. With iDP, you are in control • You manage security and access to the Locked Box, and stored data is encrypted using user-controlled keys • You manage what data you store and what apps you use • You manage what data sharing and benchmarking you do with other users of iDP For more information about iDP, contact Mark Cooke mark.cooke@orx.org

1. Public
Innovation in risk
Luke Carrivick & Mark Cooke, ORX

2. Public
“You can’t be an analogue risk
manager in a digital bank”
Karin Griffin,
Head Non Financial Risk
Standard Bank

3. Public
Bringing together 100+ members from across the globe
EUROPE NORTH AMERICA AFRICA
SOUTH AMERICA
MIDDLE EAST
ASIA PACIFIC

4. Public
Innovation isn’t just about
having good ideas.
It’s about executing good ideas.
4
To innovate, you need:
✓ Ideas, skills, tools, data and capital
✓ The culture and capacity to take risks
✓ Scale to succeed and scale to
reward success

5. Public
Our mission at ORX is to advance the
practice of operational risk management.
5
We are thinking more ambitiously and
strategically about how we can help create
the conditions to make innovation happen.

6. Public
Optimise:
Improving the effectiveness and
efficiency of day-to-day risk
management.
In an environment where:
• You have data, experts
and tools
• The near future looks broadly
like the past
• We see very common
themes across the industry
Active:
Spotting the big new material
risks and experimenting.
In an environment where:
• You are unlikely to have data,
experts and tools
• The near future looks very
different to the past
• The only common theme we
see is experimentation

7. Public
Standards strategy
9,000+downloads
Formed using a new method of gathering data on practice, applying machine learning,
applying expert knowledge, publishing and then revising more frequently.
Nov 2019: Op Risk
Reference Taxonomy
Nov 2020: Cause &
Impact Reference
Taxonomy
May 2022: ORX
Reference Control
Library
Q1 2023: ORX Reference
Indicator Library
2024: Reference
Process & Critical
Service
Each reference standards builds on an integrates with the others

8. Public
Controls library
concept

9. Public
Common standards are a crucial
foundation to innovation.
They underpin scale in data and
scale in practice.
This is hugely important as we
seek to build new tools.

10. Public
Currently, we see three options for firms seeking to innovate…
10
1. Try to secure
scarce internal
resources…
2. Try and work with
traditional software
partners…
3. Try and work
with new risk tech
producers…
…but they’re hard to
find and in demand.
…but they’re often not
rising to the challenge.
…but barriers are
high, driving up costs.
Which led us to take a radically new approach

11. Public
11
The problems & opportunities led us to the idea of a platform
FI Community
Factory
Fin Tech Ecosystem
Lab-
box
Governance
Discover: Aggregates
demand and supply and
allows the best solutions
to scale easily.
Accelerate: Applications
work better with more
data, with data pooling
made possible.
Key features
Connect: Single
certificate validation.
Plug & play operation
allows speed and cost
reduction.
Innovate:
Support to a
Lab-box to
explore &
incubate
new ideas

12. Public
12
Two years on, the idea has become a reality…

13. Public
13
iDP will address adoption barriers across the end-to-end process
- from solution discovery to integration
iDP will enable financial institutions to significantly reduce the time and effort
required to discover, onboard and integrate risk & reg tech solutions (a
process that typically takes 18+ months).
INTEGRATE SOLUTIONS
DISCOVER SOLUTIONS ONBOARD SOLUTIONS
Single market Validation Data Tech Benchmark Connect
Security
Contracting

14. Public
14
iDP builds from a strong foundation of data platform &
tech marketplace, all in one highly secure environment
Risk as a service marketplace
User controlled locked box environment
Industrial grade security
Available in the marketplace on launch:
Risk control
benchmarking
3rd party
monitoring
Structured
scenarios
Limitless future potential to
grow the ecosystem

15. Public
15
iDP’s roadmap (2022 – 2026+)
JUNE 2022 2023 2023 - 2026
Q4 2022
2021 – May 22
Scale
iDP
Live iDP + data
pooling
Live iDP +
benchmarking
Working iDP Live
iDP
Validate & build
iDP
2023
Today
 Continued to
scale iDP as we
onboard more
users and
producers, in
addition to
expanding the
solution offering
across more
risk types
 Launched data
pooling
functionality to
enhance
solutions
already on iDP
and allow for
other future data
pooling
possibilities
 Re-platforming
ORX
applications
 Launched
benchmarking
functionality to
enhance
solutions
already on iDP
and allow for
other future
benchmarking
possibilities
 Launched an in-
production
version of the
platform
 Onboarded
3 producers:
ORX controls,
Elsware, Aylien
 Onboarded
pathfinders &
early adopters
 Developed an
initial working
version of iDP
that will
demonstrate
how it works
 Devised a
detailed iDP
roadmap
 Developed the
iDP design &
standards with
pathfinders
 Built iDP on
AWS toolset

16. Public
The ORX Risk Control app illustrates the vision behind iDP
The ORX Risk Control application will help map control instances to the ORX Reference Taxonomy
and Controls Library. By launching on iDP, the efficiency and value created for both financial
institutions and ORX as a producer are far greater than if ORX was to develop a standalone tool.
1 Easier onboarding due to:
✓ Consistent data, technical, security and contracts standards
✓ Easier data mapping driven by AWS machine learning tools delivering gap analysis
2 Ability to do benchmarking
A network of peers that users can choose
to dynamically and securely benchmark across
Opportunities for 2 and 3
increase as iDP expands
Delivering
greater
efficiency
and creating
new value
3 Enable integration
More easily integrate controls data into other risk and compliance apps
due to consistent standards used across all applications on the platform

17. Public
17
Thank you
Any questions?