3  While operational risks are identified as part of the branch's overall risk assessment process, the effectiveness of the branch's operational controls is separately evaluated under ROCA.