RBS 2009 Annual Report Download - page 174

Business review continued
RBS Group Annual Report and Accounts 2009172
Fraud prevention
Fraud remains a big challenge to the Group, and the rest of the financial
services industry. The Group continues to respond to this threat,
continually investing in people and processes for both detective and
preventative measures, especially in relation to the impact of organised
crime against the Group. Key initiatives are focused on solutions for
payment fraud, ATM security, identification of counterfeit documentation
and online banking protection for our customers. This has resulted in
multi-million pound savings and, through close working ties with law
enforcement agencies, handing down of significant custodial sentences.
Physical security
The Group has implemented strong measures to protect our customers,
our staff and our assets from physical harm. These measures are kept
under constant review in response to changing threats. In particular, in
2009 there has been a significant rise in demonstrations against the
Group in relation to the increased media attention the Group has
received. Robust processes are in place to ensure the safety of
customers and staff during these demonstrations.
Information security
The Group is committed to protecting customer and Group information
with regard to loss of confidentiality, integrity and availability. All
employees and agents of the Group are responsible for the protection
of Group assets, systems and information. All customer information is
treated as confidential and appropriate security is applied to protect the
information.
Additionally, the Group’s Information Security Policy is reviewed regularly
and includes processes for managing and monitoring compliance with
the policy. The same standards apply to information controlled by the
Group or managed by authorised third parties. The Group continues to
invest in programmes to enhance and maintain information security
controls and systems. For example, during 2009, we completed security
reviews on all of our high risk third parties as well as externally facing
and hosted websites.
Business continuity
The need to ensure the continuity of business across the Group and the
management of crisis situations is a key activity within the risk function.
Key risks and threats that the Group is consistently monitoring from a
business continuity perspective include pandemics, terrorism,
environmental impacts and technology disruptions. Business continuity
plans are in place to ensure that the Group can continue key products,
services, and operations.
A consistent crisis management framework has been developed that
includes a six step methodology and allows incidents to be managed
and resolved through skilled divisional, country, regional and global
teams.
Other risks*
All the disclosures in this section (pages 172 to 173) are unaudited and
indicated with an asterisk (*).
Regulatory risk
Regulatory risk is managed by designing, maintaining and implementing
policies and systems in order to ensure effective compliance with all
regulatory and legal requirements in all the jurisdictions in which the
Group operates.
The Group’s approach to regulatory risk has three distinct elements:
•The review of potential changes in regulation to ensure that the
Group addresses the risks arising from such changes and responds
appropriately;
•The monitoring of compliance with existing rules and regulations and
the mitigation of the consequences of any inadvertent non-
compliance; and
•The management of effective relationships with regulators to ensure
constructive engagement.
Operational risk* continued
Operational risk events by category – % of total by value
The charts below show a similar distribution of losses by value across the risk categories, captured at the date the event occurred and updated as
losses crystallise.
* unaudited