RBS 2012 Annual Report Download - page 292

290
Business review Risk and balance sheet management continued
Other risks continued
Conduct risk*
Conduct risk is the risk that the conduct of the Group and its staff towards
its customers, or within the markets in which it operates, leads to
reputational damage and/or financial loss by breaching regulatory rules or
laws, or failing to meet customers’ or regulators’ expectations of the
Group. Activities through which conduct risk may arise include: personal
account dealing; privacy and data protection; conflicts of interest; money
laundering; and bribery and corruption.
Effective conduct risk management is not only a commercial imperative
for the Group. Customers, clients and counterparties demand it as a
precursor to building trust. It also reflects the changing regulatory
environment in the UK, with the establishment of the Financial Services
Conduct Business Unit (forerunner to the Financial Conduct Authority),
and the increasing focus of overseas regulators on conduct risk.
The Group’s compliance functions are responsible for monitoring the
management of conduct risk, including anti-money laundering (AML);
sanctions and terrorist financing; and anti-bribery and corruption. In doing
so, they design, implement and maintain an effective management
framework to enable consistent identification, assessment, monitoring
and reporting of conduct risk.
Policy design and implementation
Placing conduct risk at the centre of the Group’s philosophy promotes a
customer-oriented culture that informs and challenges business strategy,
delivers fair outcomes and promotes behaviours consistent with
regulatory and legal standards across its retail and wholesale markets.
The Group has established a defined and measurable appetite for
conduct risk to ensure commercial decisions take into account any
conduct risk implications. During 2012, the foundations of the Group’s
conduct risk framework were delivered. Key milestones were:
x Agreeing and establishing the Group’s conduct risk policies under
four pillars: employee conduct; corporate conduct; market conduct;
and conduct towards the Group’s customers. Each is designed to
provide high-level direction to the Group and is supported by the
Group’s Code of Conduct;
x Launching a phased roll-out of these policies, in order of materiality
and scheduled to complete in June 2013;
x Developing and delivering awareness initiatives and targeted
conduct risk training for each policy, aligned to the phased roll-out,
to assist businesses and executives in embedding the
understanding of conduct risk and provide the necessary clarity for
staff on their conduct risk requirements;
x Establishing effective leadership and a supporting governance
framework, with the participation of all divisions, to oversee the
Group’s conduct agenda, notably the new Conduct Risk Committee;
and
x Completion by the separate AML Change Programme of its Group-
wide gap analysis and benchmarking against enhanced policies,
including recording identified issues, establishing a new AML
organisational reporting and accountability hierarchy, initiating
comprehensive and continuing tailored staff training; and
establishing a global AML assurance programme.
Training and awareness
Maintaining compliance with existing rules and regulations requires
continued investment in professional training, as well as maintaining risk
awareness. During 2012, the Group continued to focus on strengthening
the capabilities of its compliance functions, at both Group and divisional
level. In addition, it facilitated training on conduct risk through Executive
education, including master classes and workshops, and computer-based
Group Policy Learning modules. Each module addresses the specific
regulatory content of relevant Group Policy Standards.
A comprehensive and progressive training programme supports the
professional development of the Group’s compliance teams. All members
of these teams are engaged in compliance eLearning, including a
mandatory ‘essentials’ course, and RBS Risk Academy, through which all
staff are required to complete foundation courses in other risk disciplines,
such as operational risk, market risk and retail credit risk. Formal training
is supplemented by regulatory familiarisation, designed to share
knowledge and support both personal development and technical training
across the Group’s wider risk community.
Assurance and monitoring
Assurance and monitoring activities are essential to ensure that the
Group can: demonstrate compliance with existing rules and regulations;
assess whether it is managing its conduct risks appropriately; and
determine whether key controls are fit for purpose and effective.
During 2012, as well as providing thematic process reviews and
assurance over specific compliance topics, the Group Compliance
assurance teams, working with its divisional counterparts, validated the
closure of issues it identified during the 2011 programme of Group-wide
assurance reviews, and identified common issues between divisions.
*unaudited