RBS 2010 Annual Report Download - page 202

Risk management: Operational risk* continued
Through the three lines of defence model the Group obtains assurance
that the standards in the GPF are being adhered to. GPF defines
requirements for testing and gathering evidence which demonstrates that
each division and function is appropriately controlled.
GPF is owned and managed by the Group’s operational risk function and
relies upon the operational risk framework for effective implementation
and ongoing maintenance.
Three lines of defence model
To ensure appropriate responsibility is allocated for the management, reporting and escalation of operational risk, the Group operates a three lines of
defence model which outlines principles for the roles, responsibilities and accountabilities for operational risk management.
1st line of defence
The business
2nd line of defence
Operational risk
3rd line of defence
Group Internal Audit
Accountable for the ownership and day-to-day
management and control of operational risk.
Responsible for implementing processes in
compliance with Group policies.
Responsible for testing key controls and
monitoring compliance with Group policies.
Responsible for the implementation and
maintenance of the operational risk framework,
tools and methodologies.
Responsible for oversight and challenge on the
adequacy of the risk and control processes
operating in the business.
Responsible for providing independent
assurance on the design, adequacy and
effectiveness of the Group’s system of internal
controls.
The Group’s Operational Risk Policy Standards (ORPS) are incorporated
in the GPF. They provide the direction for delivering effective operational
risk management and are designed to enable the consistent identification,
assessment, management, monitoring and reporting of operational risk
across the Group.
The three lines of defence model and the ORPS apply throughout the
Group and are implemented taking into account the nature and scale of
the underlying business. The following key operational risk management
techniques are included in the ORPS;
xRisk and control assessments: business units identify and assess
operational risks to ensure that they are effectively managed,
prioritised, documented and aligned to risk appetite;
xScenario analysis: scenarios for operational risk are used to assess
the possible impact of extreme but plausible operational risk loss
events. Scenario assessments provide a forward looking basis for
managing exposures that are beyond the Group’s risk appetite;
xLoss data management: each business unit’s internal loss data
management process captures all operational risk loss events above
certain minimum thresholds. The data is used to enhance the
adequacy and effectiveness of controls, identify opportunities to
prevent or reduce the impact of recurrence, identify emerging
themes, enable formal loss event reporting and inform risk and
control assessments and scenario analysis. Escalation of individual
events to senior management is determined by the seriousness of
the event. Operational loss events are categorised under the
following headings:
- clients, products and business practices;
- technology and infrastructure failures;
- employment practices and workplace safety;
- internal fraud;
- external fraud;
- execution, delivery and process management;
- malicious damage; and
- disaster and public safety.
xNew product approval process: this process ensures that all new
products or significant variations to existing products are subject to a
comprehensive risk assessment. Products are evaluated and
approved by specialist areas and are subject to executive approval
prior to launch; and
xSelf certification process: this requires management to monitor and
report regularly on the internal control framework for which they are
responsible, confirming its adequacy and effectiveness. This
includes certifying compliance with the requirements of Group
policies.
Each business unit must manage its operational risk exposure within an
acceptable level, testing the adequacy and effectiveness of controls and
other risk mitigants (for example, insurance) regularly and documenting
the results. Where unacceptable control weaknesses are identified,
action plans must be produced and tracked to completion. The Group
purchases insurance to provide the business with financial protection
against specific losses and to comply with statutory or contractual
requirements. Insurance is used as a risk mitigation tool in controlling the
Group’s exposures providing protection against financial loss once a risk
has crystallised.
*unaudited
RBS Group 2010200
Business review continued