RBS 2011 Annual Report Download - page 240

238 RBS Group 2011
Risk management: Operational risk* continued
By assessing extreme but plausible events, scenario analysis is an
important component in the operational risk framework, providing senior
management with valuable insight into systemic risk that could
significantly impact its financial performance if these events were to
occur. Using its forward-looking nature, senior management cross-
examines various risk topics against a range of circumstances and
assumptions.
Similar to risk assessments, scenarios are run in a workshop
environment, bringing business, risk and control experts together and
thereby ensuring that risk management is approached holistically.
Stress testing
During the economic downturn, there has been an increase in large
operational risk losses within the banking industry.
Consequently, the Group enhanced its approach to assessing the impact
of the economic cycle on its operational risk losses in 2011, by
specifically assessing the impact of the FSA's published Anchor II
scenario, which describes a series of country-specific shocks around the
world on:
xExpected levels of operational risk losses; and
xUnexpected levels of operational risk losses, by stressing its existing
portfolio of operational risk scenarios.
The impact of the FSA Anchor II scenario on the Group's operational risk
capital, as calculated under the standardised approach, was also
projected based on the outputs of the Group’s stress-testing exercises.
During 2012, additional operational risk scenarios will be run, further
broadening the Group's understanding of its exposures to tail risks.
Management, monitoring and reporting
Issues management
The objective of the operational risk issues management framework is
the adoption of a consistent approach to the identification, capture,
classification, monitoring, closure and acceptance of operational risk
issues and associated actions across the Group, in accordance with the
Group’s three lines of defence model.
Significant enhancements were made to the issues management process
during 2010 including rollout of a single repository for capturing issues
and actions; mapping issues to GPF; and a tightening of governance over
issue management. These improvements were further embedded during
2011, through training and assurance reviews.
The enhancements have improved risk management by allowing Group-
wide analyses of all operational risk issues. In certain cases, this has
resulted in global assurance reviews focused on specific areas, helping to
identify operational risks to be mitigated.
Event and loss data management
Event and loss data management (ELDM) covers the discovery,
escalation, capture, investigation, approval and closure, and reporting
and analysis of operational risk events and loss data. It also provides for
the clear, simple, quick and consistent communication of operational risk
events that meet defined threshold criteria to those members of the
Group’s senior management and Executives who need to know of these
events.
During 2011, an enhanced EDLM process was launched to promote
consistency in the management of operational risk events and the
collection of loss data across the Group. It included the introduction of a
single repository to capture all events and loss data in the Group and the
establishment of thresholds above which operational risk events will
trigger a risk assessment.
The improvements in approach, and use of a single Group-wide
database, have enhanced the completeness and accuracy of the Group’s
internal loss data, and therefore better inform the Group’s operational risk
profile.
At the start of 2012, the robustness of the historic data migrated into the
new repository will be reviewed to confirm its suitability as an input to
capital modelling. In addition, the process will be further enhanced to
ensure continued compliance with changing regulatory and industry
standards regarding the collection of internal loss data.
Insurance
The Group purchases insurance to provide the business with financial
protection against specific losses and to comply with statutory or
contractual requirements. Insurance is used as a risk mitigation tool in
controlling the Group’s exposures, providing protection against financial
loss once a risk has crystallised.
Reporting and monitoring
Reporting and monitoring forms an integral part of all of the Group’s
operational risk management processes, which are designed to ensure
that risks and issues are identified, escalated and managed on a timely
basis. Exposures for each division are reported through monthly risk and
control reports, which provide detail on the risk exposures and action
plans. Enhancements made to reporting and monitoring during the year
include analysing operational risk events, losses and issues against the
GPF components; this has led to better identification of areas requiring
management focus and remediation.
*unaudited
Business review Risk and balance sheet management continued