Barclays 2014 Annual Report Download - page 138

136 I Barclays PLC Annual Report 2014 barclays.com/annualreport
Risk review
Risk management
Operational risk management
Roles and responsibilities
The prime responsibility for the management of operational risk and
the compliance with control requirements rests with the business and
functional units where the risk arises. The Operational Risk function
acts in a second line of defence capacity and provides oversight and
challenge of the business operational risk profile escalating issues as
appropriate.
The Head of Operational Risk is responsible for establishing, owning
and maintaining an appropriate Group-wide Operational Risk
Framework and for overseeing the portfolio of Operational Risk across
the Group. The Operational Risk & Control Committee (OR&CC) is the
senior executive body responsible for the oversight and challenge of
operational risk and the control environment. Depending on their
nature, the outputs of the OR&CC are presented to the BCORR or the
BAC.
At the business level, operational risk is monitored by executive
management through specific meetings which cover governance, risk
and control. Businesses are required to report their operational risks on
both a regular and an event-driven basis. The reports include a profile
of the material risks that may threaten the achievement of their
objectives and the effectiveness of key controls, material control issues,
operational risk events and a review of scenarios and capital.
Operational risk management is represented at these business
meetings and provides specific risk input into the issues highlighted
and the overall risk profile of the business. Operational risk issues
escalated from these meetings are considered at the OR&CC and from
time to time businesses are required to present a deep-dive of their
operational risk and control environment. The committee then
considers material control issues and their effective remediation. On
control issues the OR&CC additionally presents to the BAC.
Specific reports are prepared by businesses, Key Risk Officers and
Operational Risk on a regular basis for OR&CC, BCORR and BAC.
Risk and control self-assessments and key indicators
The Group identifies and assesses all material risks within each
business and evaluates the key controls in place to mitigate those risks.
Managers in the businesses use self-assessment techniques to identify
risks, evaluate the effectiveness of key controls in place, and assess
whether the risks are effectively managed within business risk appetite.
The businesses are then able to make decisions on what, if any, action
is required to reduce the level of risk to the Group. These risk
assessments are monitored on a regular basis to ensure that each
business continually understands the risks it faces.
Key indicators (KIs) are metrics which allow the Group to monitor its
operational risk profile. KIs include measurable thresholds that reflect
the risk appetite of the business and are monitored to alert
management when risk levels exceed acceptable ranges or risk
appetite levels and drive timely decision-making and actions.