RBS 2009 Annual Report Download - page 172

Business review continued
RBS Group Annual Report and Accounts 2009170
Operational risk*
All the disclosures in this section (pages 170 to 172) are unaudited and
indicated with an asterisk (*). Operational risk is the potential for
financial loss, damage to reputation, or impact upon customers resulting
from fraud; human error; ineffective or inadequately designed
processes or systems; improper behaviour; or external events.
Operational risk is an integral and unavoidable part of the Group’s
business as it is inherent in the processes it operates to provide
services to customers and generate profit for shareholders.
An objective of operational risk management is not to remove
operational risk altogether, but to manage the risk to an acceptable
level, taking into account the cost of minimising the risk as against the
resultant reduction in exposure. Strategies to manage operational risk
include avoidance, transfer, acceptance and mitigation by controls.
To ensure appropriate responsibility is allocated for the management,
reporting and escalation of operational risk, the Group operates a three
lines of defence model which outlines principles for the roles,
responsibilities and accountabilities for operational risk management.
The three lines of defence model and the Operational Risk Policy
Standards apply throughout the Group and are implemented taking into
account the nature and scale of the underlying business. The standards
provide the direction for delivering effective operational risk
management. They comprise principles and processes that enable the
consistent identification, assessment, management, monitoring and
reporting of operational risk across the Group. The objectives of the
standards are to protect the Group from financial loss or damage to its
reputation, its customers or staff and to ensure that it meets all
necessary regulatory and legal requirements.
The Operational Risk Policy Standards are supported by the following
key operational risk management techniques:
•Risk and control assessments: business units identify and assess
operational risks to ensure that they are effectively managed,
prioritised, documented and aligned to risk appetite;
•Scenario analysis: scenarios for operational risk are used to assess
the possible impact of extreme but plausible operational risk loss
events. Scenario assessments provide a forward looking basis for
managing exposures that are beyond the Group’s risk appetite;
•Loss data management: each business unit’s internal loss data
management process captures all operational risk loss events above
certain minimum thresholds. The data is used to enhance the
adequacy and effectiveness of controls, identify opportunities to
prevent or reduce the impact of recurrence, identify emerging
themes, enable formal loss event reporting and inform risk and
control assessments and scenario analysis. Escalation of individual
events to senior management is determined by the seriousness of
the event. Operational loss events are categorised under the
following headings:
– Clients, products and business practices;
– Technology and infrastructure failures;
– Employment practices and workplace safety;
– Internal fraud;
– External fraud;
– Execution, delivery and process management;
– Malicious damage; and
– Disaster and public safety.
•Key risk indicators: business units monitor key risk indicators against
their material risks. These indicators are used to monitor the
operational risk profile and exposure to losses against thresholds
which trigger risk management actions;
1st line of defence
The Business
Accountable for the ownership and
day-to-day management and control of
operational risk.
Responsible for implementing processes
in compliance with Group policies.
Responsible for testing key controls and
monitoring compliance with Group policies.
2nd line of defence
Operational Risk
Responsible for the implementation and
maintenance of the operational risk
framework, tools and methodologies.
Responsible for oversight and challenge
on the adequacy of the risk and control
processes operating in the business.
3rd line of defence
Group Internal Audit
Responsible for providing independent
assurance on the design, adequacy
and effectiveness of the Group’s system
of internal controls.
Operational risk – three lines of defence model
* unaudited