RBS 2012 Annual Report Download - page 118

116
Business review Risk and balance sheet management continued
Risk appetite and risk governance continued
Risk organisation*
The Group has an independent risk management function (‘RBS Risk
Management’) which manages risk through independent challenge and
oversight of the customer-facing businesses and support functions. It
provides an overarching risk control framework linked to the risk appetite
of the Group.
The Head of Restructuring and Risk is the Group Chief Risk Officer, who
leads this function through the strategic setting and execution of its
responsibilities. The Head of Restructuring and Risk reports to the Group
Chief Executive and the Board Risk Committee, with a right of access to
the Chairman.
RBS Risk Management is designed to align as closely as possible with
the customer-facing businesses and support functions while maintaining
an appropriate level of independence, which underpins the Group’s
approach to risk management and is reinforced through the Group by
appropriate reporting lines.
Within RBS Risk Management, Group functional heads (e.g. the Group
Chief Credit Officer for the credit risk discipline, the Group Head of
Operational Risk for the operational risk discipline) report directly into the
Head of Restructuring and Risk and are responsible for firm-wide risk
appetite and standards under their respective disciplines. For example,
Group Compliance is responsible for conduct risk policy ownership,
change management, assurance and training frameworks at Group level,
including anti-money laundering, sanctions, terrorist financing, anti-
bribery and corruption.
Risk management within divisions focuses on all material risks including
credit, market, operational, regulatory and country risk, and business
activities. Liquidity risk and the day-to-day management of liquidity and
funding of the book is Group Treasury’s responsibility.
Oversight of risk within divisions is the responsibility of the relevant
divisional Chief Risk Officer (CRO), with input from the relevant Group
heads of function. This involves ensuring that:
x All activities undertaken by the individual divisions are consistent
with the Group’s risk appetite targets;
x Group policies and resulting operating frameworks, including
delegated authorities and limits, are complied with through effective
monitoring and exception reporting; and
x There is the effective operation of Group-wide risk processes such
as the Group Policy Framework and the New Product Risk
Assessment Process.
Divisional CROs have a direct functional reporting line to the Deputy
Group CRO.
The Head of Restructuring and Risk and the Deputy Group CRO have a
direct involvement in the selection, appointment or removal of divisional
CROs and Group functional heads and also have responsibility for their
ongoing performance assessment and management.
Divisions mirror the Group set-up for risk management, i.e. the Divisional
Executive Committees are responsible for setting and owning their risk
appetite within Group constraints. The Divisional Risk Committees
oversee the businesses relative to divisional and Group risk appetite and
focus on ensuring that risks are adequately monitored and controlled.
The Divisional CROs provide independent oversight to this process, with
support from the Group Chief Risk Officer, the Deputy Group CRO and
Group functional heads as appropriate. Additional challenge and
oversight is provided by Group functional heads on an ongoing basis and
by Divisional Risk and Audit Committees on a periodic review basis.
For more information on risk governance and a presentation of the
Group’s risk committees, refer to pages 117 to 120. For a summary of the
main risk types faced by the Group and how it manages each of them,
refer to pages 122 to 126.
Three lines of defence
Having a strong three lines of defence model is important in a strong
control environment. The Executive Committee approved a refreshed
model in February 2012 and work is underway to embed this across the
Group. The model’s main purpose is to define accountabilities and
responsibilities for managing risk across the Group.
*unaudited