Barclays 2012 Annual Report Download - page 345

The strategic report Governance Risk review Financial review Financial statements Risk management Shareholder information
The Operational Risk Committee (ORC) is the senior executive body
responsible for the oversight and challenge of Operational risk in
Barclays. Group Operational Risk Executive Committee (GOREC) is a
sub-committee of the ORC, the output of which is presented to the
Board Risk Committee (BRC).
In addition, Governance and Control Committees (G&CCs) in each
business monitor control effectiveness. The Group G&CC receives
reports from these committees and considers Group-significant control
issues and their remediation. The Group G&CC presents to the Board
Audit Committee (BAC).
Businesses are required to report their Operational risks on both a
regular and an event-driven basis. The reports include a profile of the
material risks to their business objectives and the effectiveness of key
controls, control issues of Group-level significance, operational risk
events and a review of scenarios and capital. Specific reports are
prepared on a regular basis for ORC, BRC and BAC.
The Internal Audit function provides further independent review and
challenge of the Group’s operational risk management controls,
processes and systems and reports to the Board and senior
management.
Operational risk management framework
The Barclays Operational risk framework is a key component of GICAF
and has been designed to meet a number of external governance
requirements including Basel, the Capital Requirements Directive and
Turnbull guidance as an evaluation framework for the purposes of
Section 404(a) of the Sarbanes-Oxley Act. It also supports the
Sarbanes-Oxley requirements.
The Operational risk framework includes the following elements:
Risk assessments
Barclays identifies and assesses all material risks within each business
and evaluates the key controls in place to mitigate those risks.
Managers in the businesses use self-assessment techniques to identify
risks, evaluate the effectiveness of key controls in place and assess
whether the risks are effectively managed within business risk appetite.
The businesses are then able to make decisions on what, if any, action
is required to reduce the level of risk to Barclays. These risk
assessments are monitored on a regular basis to ensure that each
business continually understands the risks it faces.
Risk events
An operational risk event is any circumstance where, through the lack
or failure of a control, Barclays has actually, or could have, made a loss.
The definition includes situations in which Barclays could have made a
loss, but in fact made a gain, as well as incidents resulting in
reputational damage or regulatory impact only.
A standard threshold is used across the Group for reporting risk events
and as part of our analysis we seek to identify where improvements are
needed to processes or controls, to reduce the recurrence and/or
magnitude of risk events.
Barclays also uses a database of external risk events which are publicly
available and is a member of the Operational risk data eXchange
(ORX), a not-for-profit association of international banks formed to
share anonymous loss data information. Barclays uses this external loss
information to support and inform risk identification, assessment and
measurement.
Key indicators
Key Indicators (KIs) are metrics which allow Barclays to monitor its
operational risk profile. KIs include measurable thresholds that reflect
the risk appetite of the business. KIs are monitored to alert
management when risk levels exceed acceptable ranges or risk
appetite levels and drive timely decision making and actions.
Key Risk Scenarios
By combining data from risk events, risk assessments and key
indicators with that from audit findings, expert management
judgement and other internal data sources, Barclays is able to generate
Key Risk Scenarios (KRSs). These scenarios identify the most significant
operational risks across the Group. The KRSs are validated at business
and Group level to ensure that they appropriately reflect the level of
operational risk the business faces.
Barclays shares and receives an anonymous sub-set of KRS information
with member banks of ORX in order to compare and contrast scenario
analysis with peers.
Insurance
As part of its risk management approach, the Group also uses
insurance to mitigate the impact of some operational risks.
Operational risk appetite
Barclays approach to determining appetite for Operational risk
combines both quantitative measures and qualitative judgement, in
order to best reflect the nature of non financial risks.
The monitoring and tracking of Operational risk measures is
supplemented with qualitative review and discussion at senior
management executive committees on the action being taken to
improve controls and reduce risk to an acceptable level.
Operational risk appetite is aligned to the Group’s Risk Appetite
Framework.
Reporting
The ongoing monitoring and reporting of Operational risk is a key
component of an effective Operational Risk Framework. Reports are
used by the Operational risk function and by business management to
understand, monitor, manage and control operational risks and losses.
Operational risk measurement
The Operational risk capital model uses the outputs of the risk
management tools to measure Barclays operational risk exposure, and
in particular, Key Risk Scenarios. The model estimates the frequency
and severity of operational risk losses for each risk type to provide a
distribution of potential losses over a year for Barclays as a whole. This
process takes into account the possibility of correlations i.e. impacts
from different risks occurring together. The model generates a
regulatory capital requirement, which is determined to a level of 99.9%
confidence. Once the overall level of regulatory capital for the Group
has been established it is allocated, on a risk sensitive basis, to
businesses.
barclays.com/annualreport Barclays PLC Annual Report 2012 I 343