Barclays 2010 Annual Report Download - page 139

Risk management
Operational risk management
All disclosures in this section (pages 137 and 138) are unaudited
Operational Risk is defined as the risk of direct or indirect
impacts resulting from human factors, inadequate or
failed internal processes and systems or external events.
Operational risks are inherent in the Group’s business
activities and are typical of any large enterprise. It is not
cost effective to attempt to eliminate all operational risks
and in any event it would not be possible to do so. Losses
from operational risks of small significance are expected
to occur and are accepted as part of the normal course of
business. Those of material significance are rare and the
Group seeks to reduce the likelihood of these in accordance
with its Risk Appetite.
Overview
The management of Operational Risk has two key objectives:
– To minimise the impact of losses suffered in the normal course
of business (expected losses) and to avoid or reduce the likelihood of
suffering a large extreme (or unexpected) loss.
– To improve the effective management of the Barclays Group and
strengthen its brand and external reputation.
Barclays is committed to the management and measurement of
operational risk and was granted a waiver to operate an Advanced
Measurement Approach (AMA) for Operational Risk under Basel II,
which commenced in January 2008. The majority of the Group calculates
regulatory capital using AMA, however in specific areas we apply the
Standardised approach or Basic Indicator approach. In certain joint
ventures and associates, Barclays may not be able to apply the AMA.
Areas where the roll-out of AMA is still continuing and the Standardised
approach is currently applied are Barclays Bank Mozambique, National
Bank of Commerce (Tanzania), and the portfolio of assets purchased from
Woolworths Financial Services in South Africa, Citi Cards and Standard Life
Bank, while these are integrated into our infrastructure.
Areas where the Group is working towards the rollout of AMA and the
Basic Indicator approach is applied are Barclays Bank PLC Pakistan, Barclays
Bank LLC Russia, Barclays Investment and Loans India Limited, the ABSA
Africa businesses and the ‘new-to-bank’ business activities acquired from
Lehman Brothers.
Barclays works to benchmark its internal operational risk practices with
peer banks and to drive the development of advanced operational risk
techniques across the industry.
Structure and governance
The Operational Risk framework comprises a number of elements which
allow Barclays to manage and measure its Operational Risk profile and to
calculate the amount of Operational Risk capital that Barclays needs to
hold to absorb potential losses. The minimum, mandatory requirements
for each of these elements are set out in the Group Operational Risk
policies. This framework is implemented: vertically, through the
organisational structure with all Business Units required to implement and
operate an operational risk framework that meets, as a minimum, the
requirements detailed in these operational risk policies; and laterally, with
Group Principal Risk Owners required to ensure that the Group Operational
Risk policies are reflected in the Control Framework for their Principal Risk.
Barclays operates within a robust system of internal control that enables
business to be transacted and risk taken without exposure to
unacceptable potential losses or reputational damage. To this end,
Barclays has implemented the Group Internal Control and Assurance
Framework (GICAF) which is aligned with the internationally recognised
Committee of Sponsoring Organisations of the Treadway Commission
Framework (COSO).
The prime responsibility for the management of operational risk and the
compliance with control requirements rests with the business and
functional units where the risk arises. Front line risk managers are widely
distributed throughout the Group. They service and support these areas,
assisting line managers in managing their risks.
The Operational Risk Director (or equivalent) for each Business Unit is
responsible for ensuring the implementation of and compliance with
Group Operational Risk policies.
The Group Operational Risk Director is responsible for establishing, owning
and maintaining an appropriate Group wide Operational Risk Framework
and for overseeing the portfolio of Operational Risk across the Group.
The Group Operational Risk Executive Committee (GOREC) assists with
the oversight of Operational Risk. GOREC is a sub-committee of the Group
Risk Oversight Committee (GROC), which presents to the Board Risk
Committee (BRC).
In addition, Governance and Control Committees (G&CCs) in each
business monitor control effectiveness. The Group G&CC receives reports
from these committees and considers Group-significant control issues and
their remediation. The Group G&CC presents to the Board Audit
Committee (BAC).
Business units are required to report their Operational Risks on both a
regular and an event-driven basis. The reports include a profile of the
material risks to their business objectives and the effectiveness of key
controls, control issues of Group-level significance, operational risk events
and a review of scenarios and capital. Specific reports are prepared on a
regular basis for GOREC, GROC, BRC and BAC.
The Internal Audit function provides further independent review and
challenge of the Group’s operational risk management controls, processes
and systems and reports to the Board and senior management.
Barclays PLC Annual Report 2010 www.barclays.com/annualreport10 137
Strategy Performance Financial statements Shareholder informationRisk management and governanceAbout Barclays