RBS 2011 Annual Report Download - page 246

244 RBS Group 2011
Risk management: Compliance risk* continued
Anti-Money Laundering
During 2011, RBS continued to enhance its Anti Money Laundering
(AML) Change Programme across the Group. Key developments include:
xAnew cohesive target operating model to support the capability
required and reviewed divisional AML capabilities against the target
operating model to identify and analyse gaps;
xAframework for understanding and managing compliance and
conduct risk, including the introduction of a clear Group-level
conduct risk appetite statement and the design of a new conduct risk
policy framework; and
xAn enhanced global whistle-blowing service ‘Right Call’ that allows
all employees, irrespective of location, to escalate any concerns
outside of their normal line management. Whistle-blowing call
volumes have increased since the launch and the new framework is
afurther positive step to help the Group identify and manage
compliance risk.
Reputational risk*
Reputational risk is the risk of brand damage arising from financial and
non-financial events due to a failure to meet stakeholders’ expectations of
the Group’s performance and behaviour.
Such loss in reputation has the potential to put the entire business at risk.
It could also lead to negative publicity, loss of revenue, costly litigation or
adecline in the customer base.
Reputational risk can arise from actions taken by the Group or a failure to
take action, such as failing to assess the environmental, social or ethical
impacts of clients or projects to which the Group has provided products or
services.
The Group seeks to safeguard its reputation by considering the impact on
the value of its franchise from how it conducts business, its choice of
customers and the way stakeholders view the Group. Managing the
Group’s reputation is the joint responsibility of all employees, and
reputational considerations should, as part of standard practice, be
integrated into the Group’s day-to-day decision making structures.
Currently the Group manages reputational risk through a number of
functions, such as divisions, Group Communications, Group
Sustainability and an Environmental, Social and Ethical (ESE) risk
management function. The latter function is responsible for assessing
ESE risks associated with business engagements and business divisions.
The Board has ultimate responsibility for managing any impact on the
reputation of the Group arising from its operations. The Group
Sustainability Committee (established at the beginning of 2010) sets the
overall strategy and approach for the management of Group
sustainability. However, all parts of the Group take responsibility for
reputation management.
The risk is viewed as material given the central nature of the Group’s
market reputation in the strategic risk objectives.
Business risk*
Business risk is the potential risk of revenues being lower than expected
and/or operating costs being higher than expected. It is influenced by a
variety of factors, including pricing, sales volumes, input costs,
regulations and the prevailing market and economic environment.
The Group seeks to minimise its exposure to business risk, subject to its
wider strategic objectives (e.g. return on equity). As a large financial
services group, it recognises and values the potential diversification
benefits associated with differences in the nature and timing of potential
business risk across its portfolio of businesses.
Business risk is identified, measured and managed through the Group’s
bi-annual strategic planning cycles. Expected profiles for revenues and
costs are determined, on a bottom-up basis, through strategic plans and
expectations of the external environment. These profiles are tested
against a range of stress scenarios and factors to identify the key risk
drivers behind any potential volatility, along with management actions to
address and manage them.
The Group Board has ultimate responsibility for the impact of any
volatility in revenues and costs on the Group’s performance. Business
risk is incorporated within the Group’s risk appetite target for earnings
volatility, with an assessment of volatility in revenues and costs a key
component in determining whether the Group and its underlying
businesses are within risk appetite.
The management of business risk lies primarily with divisional and
business unit strategic teams, with oversight at the Group level from the
Finance, Strategy and Risk functions. Elements of business risk (e.g.
regulatory changes) also overlap with other areas and are managed by
the appropriate risk functions.
The risk is viewed as material given the central nature of unexpected
changes in revenues and costs on the Group’s ability to achieve its
strategic objectives.
*unaudited
Business review Risk and balance sheet management continued