RBS 2012 Annual Report Download - page 284

282
Business review Risk and balance sheet management continued
Other risks
Operational risk*
Operational risk is the risk of loss resulting from inadequate or failed
internal processes, people and systems, or from external events. It is an
integral and unavoidable part of the Group’s business as it is inherent in
the processes it operates to provide services to customers and meet
strategic objectives.
Operational risk management
The objective of operational risk management is not to remove
operational risk altogether, but to manage it to an acceptable level, taking
into account the cost of minimising the risk against the resultant reduction
in exposure. Strategies to manage operational risk include avoidance,
transfer, acceptance and mitigation by controls.
In 2012, the Group continued to make good progress in enhancing its
operational risk framework and risk management capabilities. Details of
developments undertaken and planned are set out below along with the
key processes through which the Group manages operational risk.
In 2013, through further embedding the enhanced operational risk
framework and tools and improving framework linkages, operational risk
will be managed on a more forward-looking basis.
Governance, structure and risk appetite
Governance and structure
Group Operational Risk is an independent function reporting to the Head
of Restructuring & Risk. It is responsible for the design and maintenance
of the operational risk policy standards.
The standards, which are incorporated in the Group Policy Framework
(GPF), provide the direction for delivering effective operational risk
management and are designed to allow the consistent identification,
assessment, management, monitoring and reporting of operational risk
across the Group.
The Operational Risk Executive Committee acts upon all operational risk
matters, and reviews and monitors the operational risk profile across the
Group, in line with risk appetite. It oversees, manages and monitors
operational risk strategies and frameworks, and reviews operational risk
policy. It escalates and reports necessary items to the Group Risk
Committee.
Operational risk appetite, policy and frameworks are reviewed regularly at
the Executive Risk Forum to satisfy oversight responsibilities and, as
appropriate, other senior committees.
Risk appetite
The Group’s operational risk appetite statement is agreed by the Group
Board. It comprises a number of specific measures of risk, such as:
x The maximum operational risk losses the Group is prepared to
accept. For 2012, this was expressed as a percentage of the
Group’s estimated gross income but will transition to a more
forward-looking expected loss measure during 2013 following the
development of the operational risk model; and
x Aggregate loss targets at specific confidence levels.
To confirm that the Group operates within the set risk appetite, the high-
level statement is supplemented by specific tolerances for different types
of operational risk. The GPF sets out how to manage risk within
acceptable limits, which in turn enables the Group to operate within the
overall risk appetite and the specific tolerances.
Operational risk cycle and key management tools
The operational risk cycle comprises four stages:
x identification of risks;
x assessment or measurement of the scale of risks;
x management or control of risks to prevent their recurrence or
minimise the potential impact; and
x monitoring and reporting of risks.
Although the operational risk tools encompass all stages of the risk cycle,
they can be broadly categorised as follows:
Identification and assessment
Risk and control assessments
Risk and control assessments are used to identify and assess material
operational risks and key controls across all business areas. To provide a
consistent categorisation of risks and controls across the Group and to
support identification of risk concentrations, all risks and controls are
mapped to the Group-wide risk taxonomy and the newly developed
control catalogue.
The process is designed to confirm that risks are effectively managed in
line with stated risk appetite, prioritised and documented. Controls are
tested frequently to verify and validate that they remain fit for purpose
and operate effectively.
Risk assessments are often conducted in a workshop environment,
bringing together subject matter experts and key stakeholders from
across the division and key functions. This approach has led to a more
complete view of the risk profile and more informed decisions.
During 2013, the focus will be on the continued implementation and
embedding of risk assessments across the Group. This includes the
strengthening of links between risk assessments and other elements of
the Group operational risk framework. In addition, risk assessments will
increasingly be utilised to identify single points of failure.
New product risk assessment process
The Group’s new product risk assessment process is designed to
identify, assess and approve the risks associated with new products prior
to launch.
Several process enhancements were made during 2012, which
strengthened the interaction between business, risk and specialist areas.
Reporting has been established and work has started to enhance the
inventory of products provided by the Group.
*unaudited