RBS 2010 Annual Report Download - page 204

Risk management: Operational risk* continued
Physical security
The Group continues to implement strong security measures to ensure
the safety of staff, the Group’s customers and businesses from physical
harm. Against an ever changing threat environment, these measures are
kept under constant review and adapted accordingly. The past year has
seen protests groups continue to target the Group (most notably Climate
Camp in August 2010); robust processes are in place to ensure the
safety of customers and staff during these demonstrations. The Group
also continues to mitigate against the threat posed by international
related terrorism.
Information security
The Group is committed to protecting customer, employee and Group
information with regard to the loss of confidentiality, integrity and
availability. This extends to all physical and electronic information. All
employees and related third parties of the Group are responsible for the
protection of Group assets, systems and information. All customer
information is treated as confidential and appropriate security is applied
to protect the information. Additionally, the Group’s information security
policy is reviewed regularly and includes processes for managing and
monitoring compliance with the policy. The same standards apply to
information controlled by the Group or managed by authorised third
parties.
The Group continues to invest in programmes to enhance and maintain
information security controls and systems. For example, during 2010 the
Group have risk assessed the externally facing websites and penetration
tested those websites that contain confidential, high-risk Group data and
established an assurance team to implement an ongoing programme of
third party reviews.
Business continuity
The need to ensure the continuity of business across the Group and the
management of crisis situations is a key activity within the risk function.
Key risks and threats that the Group is consistently monitoring from a
business continuity perspective include pandemics, terrorism,
environmental impacts and technology disruptions. Business continuity
plans are in place to ensure that the Group can continue key products,
services, and operations. A consistent crisis management framework has
been developed that includes a six step methodology and allows
incidents to be managed and resolved through skilled global teams.
All business continuity plans, related activities and systems are tested
annually. The plan data is validated every 6 months and where the
impact on business is high, the validation frequency is increased to every
3months.
Regulatory risk*
Regulatory risk arises from the non-adherence to international and
national rules and regulations. The Group manages regulatory risk
through a regulatory risk and compliance framework that seeks to ensure
the Group is in compliance with all banking, securities, insurance and
anti-money laundering regulations defined by more than 120 different
regulatory bodies and central banks across the world. This framework
comprises global regulatory risk policies, tracking of regulatory
developments, training and awareness, assurance and monitoring and
regulatory relationship management.
Global regulatory risk policies
Within the Group Policy Framework (GPF), regulatory risk and
compliance policies define minimum standards for all businesses to
adhere to on a global basis. These policies are primarily driven by the
rules and regulations set by the FSA as the Group’s lead regulator.
These global minimum standards are supplemented by division specific
policies where appropriate (product specific or local market specific
requirements).
Regulatory developments
Regulatory environments are constantly evolving and it is critical that the
Group both understands early on the drivers for this change and be able
to assess the potential impact of prospective rules and regulations on the
different businesses. The regulatory developments tracker seeks to
identify, track and monitor all such material changes and ensure that an
appointed senior executive is responsible for assessing the potential
impacts on the Group’s business. Such activity supports both effective
engagement in the regulatory consultation process, and planning for the
introduction of new or changed rules and regulations.
During the last 12 months the Group has experienced unprecedented
levels of prospective rules and regulations particularly in the area of
prudential regulation (capital, liquidity, governance and risk management),
and to the treatment of systemically important entities, in particular
through initiatives on recovery and resolution plans (‘living wills’) - see
page 398 for regulatory developments and reviews.
Training and awareness
Maintaining compliance with existing rules and regulations requires a
continued investment in professional training and maintaining risk
awareness. The group undertakes extensive training both with group
wide learning initiatives (e.g. anti-money laundering) as well as divisional
or product specific training. To support the professional development of
the Group’s regulatory risk staff the Group has a comprehensive
progressive training programme that is deployed on a global basis.
Assurance and monitoring
Assurance and monitoring activities are key to ensuring that the Group
can demonstrate ongoing compliance with existing rules and regulations.
Such activities are conducted in both the first line and second line of
defence. Work to design, implement and embed enhanced monitoring
tools was undertaken in 2010 and will continue into 2011.
Regulatory relationship management
The Group is committed to working with its regulators in an open and
constructive way as it deals with both the evolution of regulatory
frameworks as well as the ongoing compliance to existing rules and
regulations. The regulatory relationship management tool is used to track,
record, monitor and report on all material regulatory engagement to
ensure that activities remain co-ordinated across the Group - see page
397 for a description of the key regulatory and supervisory bodies with
which the Group engages.
*unaudited
RBS Group 2010202
Business review continued