Barclays 2009 Annual Report Download - page 92

90 Barclays PLC Annual Report 2009 www.barclays.com/annualreport09
Risk management
Barclays risk management strategy
continued
Internal Audit is responsible for the independent review of risk
management and the control environment. Its objective is to provide
reliable, valued and timely assurance to the Board and Executive
Management over the effectiveness of controls, mitigating current and
evolving high risks and in so doing enhancing the controls culture within the
Group. The Board Audit Committee reviews and approves Internal Audit’s
plans and resources, and evaluates the effectiveness of Internal Audit.
An assessment by external advisers is also carried out periodically.
In addition to the Committees shown in the chart, there is a Brand and
Reputation Committee reviewing emerging issues with potentially
significant reputational impact.
Risk management responsibilities are laid out in the Principal Risks
Policy, which covers the categories of risk in which the Group has its most
significant actual or potential risk exposures.
The Principal Risks Framework:
– creates clear ownership and accountability;
– ensures the Group’s risk exposures are understood and managed in
accordance with agreed risk appetite (for financial risks) and risk
tolerances (for non-financial risks); and
– ensures regular reporting of both risk exposures and the operating
effectiveness of controls.
Each Principal Risk is owned by a senior individual within Barclays, known as
the Principal Risk Owner (PRO) who is required to document, communicate
and maintain a risk control framework which makes clear the mandated
control requirements in managing that Principal Risk, for every business
across the firm.
These control requirements are given further specification, according to
the business unit or risk type, to provide a complete and appropriate system
of internal control.
Business unit and Group centre heads are responsible for obtaining
ongoing assurance that the controls they have put in place to manage the
risks to their business objectives are operating effectively. Six-monthly
reviews support the regulatory requirement for the Group to make a
statement about its system of internal controls (the ‘Turnbull’ statement),
in the Annual Report and Accounts.
PROs report their assessments of the risk exposure and control
effectiveness to Group-level oversight committees. Their assessments
form the basis of the reports that go to the Board Risk Committee.
Setting and using Risk Appetite
Risk Appetite is the level of risk the Group chooses to take in pursuit of its
business objectives.
As part of the yearly planning process, we add up our estimated bad
debts charges and ask ourselves if that potential level of credit loss is
consistent with our strategy, with our business position, and with our
capital.
The starting point is the total expected credit loss, assuming the base
case economic forecast. To gain a more rounded understanding of the risk,
the Group estimates credit losses based on the kind of stressed conditions
that can be expected to occur approximately once every seven years
(moderate stress) and once every 25 years (severe stress). These potentially
larger but increasingly less likely levels of loss are illustrated in the Risk
Appetite concepts chart below.
Principal Risks Other Level 1 Risks
Retail Credit
Wholesale Credit
Market
Capital
Liquidity
Operations
Financial Crime
Technology
People
Regulatory
Financial Reporting
Legal
Taxation
Strategic
Change
Corporate Sustainability
Brand Management
Extreme Stress
Mean
Loss
Severe Stress
Moderate
Stress
Economic capitalExpected
Loss
Potential size of loss in one year
Probability of loss
Risk Appetite concepts (diagram not to scale)