RBS 2008 Annual Report Download - page 121

Operational risk events by category – % of total by value
The charts below show that execution, delivery, and process management accounted for over 60% of losses by value during 2008. This differs from
2007 where a single large value event meant that clients, products and business practices was the largest category. The data is on a statutory basis.
Clients, product and business practices
Execution, delivery and process management
External fraud
Other
2008 2007
RBS Group Annual Report and Accounts 2008120
Business review continued
Financial crime
Financial crime remains a big challenge for the Group, especially given
the sophistication of the criminal fraternity. However, the Group
continues to respond to such threats, by continuing to invest in people
and processes for both detective and preventative measures especially
relating to card fraud and cyber crime. Key initiatives include changes
to authentication of payments, ATM security, software enhancements
and improvement in counterfeit detection.
Physical security environment
The number of physical attacks on our retail business was broadly static
in 2008 compared with 2007. Business plans and controls have been
enhanced to reflect the increase in size of the global business during
the year, for example changes to retail and ATM security and sharing
best practice with competitors and law enforcement agencies.
Information security
The Group is committed to protecting customer and Group information.
Under a Group-wide policy framework, Group Information Security is
developing, maintaining and implementing policies and systems to
secure such information. All employees and agents of the Group are
responsible for the protection of Group assets, systems and information.
All customer information is treated as confidential and appropriate
security is applied to protect the information. The Group Information
Security Policies are aligned to international standards and regulatory
requirements.
The Group recognises information security, relating to the loss of
confidentiality, integrity or availability of our information and systems, as
a specific risk, which is managed through a Group Information Security
Policy. This is reviewed annually and includes processes for managing
and ensuring compliance with the policy. The same standards apply to
information controlled by the Group or managed by authorised third
parties. The Group continues to invest in programmes to enhance and
maintain information security controls and systems. For example, during
2008, security reviews on third party suppliers and vendors were
significantly increased.
Business continuity
The management of crisis situations and the need to ensure the
continuity of business across the Group is a key activity within the risk
function. A consistent crisis and incident management framework has
been rolled out across the Group, to ensure that any incident is
identified, managed and resolved through skilled divisional, country,
regional and global teams. A six step methodology is in place within the
Group for managing incidents.
Key risks and threats that the Group is consistently monitoring from the
crisis and incident management perspective include pandemics,
terrorism, environmental impacts and technology disruptions.
Business continuity plans have been implemented to ensure that the
Group can continue key services, products and operations.