RBS 2008 Annual Report Download - page 120

119RBS Group Annual Report and Accounts 2008
In 2008, the Group introduced a new self-certification process, which
requires management to regularly monitor and report on the internal
control framework for which they are responsible and regularly review
and confirm its adequacy and effectiveness. This includes certifying
compliance with the requirements of Group policies.
The ORPP requires each business unit to determine appropriate
mitigation techniques to reduce its risk exposure to an acceptable level,
and that the adequacy and effectiveness of controls and other risk
mitigants (e.g. insurance) are tested regularly and the results
documented. Where unacceptable control weaknesses are identified,
action plans must be produced and tracked to completion.
The Group purchases insurance to provide the business with financial
protection against specific losses and to comply with statutory or
contractual requirements. Insurance is primarily used as an additional
risk mitigation tool in controlling the Group’s exposures. However, as
insurance only provides protection against financial loss once a risk has
crystallised, it is used as a complement to other controls.
10%
20%
30%
40%
50%
60%
Clients,
product and
business
practices
% of 2007 loss
events (counts)
% of 2008 loss
events (counts)
Disasters
and
public
safety
Employment
practices and
workplace
safety
Execution,
delivery and
process
management
External
fraud
Internal
fraud
Malicious
damage
Technology
and
infrastructure
failures
Operational risk events by risk category – % of total risk events by count
The chart below shows a similar distribution of loss event numbers across the risk categories in 2008 as those in 2007.
Operational risk metrics
Reporting forms an integral part of operational risk management. The
Group’s risk management processes are designed to ensure that
operational risk issues are identified, escalated and managed on a
timely basis. Operational risk exposures for each division are reported
through monthly risk and control reports, which provide detail on the
risk exposures and action plans for each significant business process.
Operational risk events that have an actual or potential financial impact
in excess of £1 million, or which have a material impact on the Group’s
reputation or customers, are escalated and reported to divisional and
Group executive.
The graph below shows the operational risk events by category and
value for 2007 and 2008, for the Group on a statutory basis.