Barclays 2014 Annual Report Download - page 212

210 I Barclays PLC Annual Report 2014 barclays.com/annualreport
Risk review
Risk performance
Operational risk
Overview
Operational risks are inherent in all the Group’s business activities and
are typical of any large enterprise. It is not cost-effective to attempt to
eliminate all operational risks and in any event it would not be possible
to do so. Small losses from operational risks are expected to occur and
are accepted as part of the normal course of business. More material
losses are less frequent and the Group seeks to reduce the likelihood of
these in accordance with its risk appetite.
The Operational Principal Risk comprises the following Key Risks: cyber
security risk, external suppliers, financial reporting, fraud, information,
legal, payments, people, premises and security, taxation, technology
and transaction operations. For definitions of these key risks see page
135. In order to ensure complete coverage of the potential adverse
impacts on the Group arising from operational risk, the operational risk
taxonomy extends beyond the operational key risks listed above to
cover areas included within conduct risk.
This section provides an analysis of the Group’s operational risk profile,
including events which have had a significant impact in 2014.
Summary of performance in the period
During 2014a, there was a reduction in total operational risk losses.
Total number of recorded incidents fell due to a reduction in the
number of significant loss events for external fraud and execution
delivery and process management.
Operational risk losses in 2014 were materially comprised of
further provisions for PPI (£1,270m) and a provision for ongoing
investigations and litigation relating to Foreign Exchange (£1,250m).
Operational risk profile
Within operational risk a high proportion of risk events have a low
associated financial cost and a very small proportion of operational risk
events will have a material impact on the financial results of the Group.
In 2014 85.3% of the Group’s net reportable operational risk events had
a loss value of £50,000 or less (2013: 81.8%) and accounted for only
1.6% (2013: 1.8%) of the Group’s total net loss impact.
The analysis below presents the Group’s operational risk events by
category:
Q The proportion of losses by amount within the clients, products and
business practices category remains the driver of the operational risk
profile at 95.1% (2013: 85.2%) and is heavily impacted by provisions
for PPI, and the ongoing investigations and litigation into Foreign
Exchange.
Q Execution, delivery and process management impacts reduced to
2.9% (2013: 10.3%). These events are typical of the banking industry
as a whole where high volumes of transactions are processed on a
daily basis. These are often fully or partially recovered, resulting in
low value net losses.
Q External fraud (75.0%) is the category with the highest frequency of
events where high volume, low value events are also consistent with
industry experience, driven by debit and credit card fraud. The
proportion of events of this type has increased although the actual
volume has in fact decreased; this is due to the greater reduction in
the volume of execution, delivery and process management events.
The Group’s operational risk profile is informed by bottom-up risk
assessments undertaken by each business unit and top-down
qualitative review from the Operational Risk & Control Committee.
External fraud and technology are highlighted as key operational risk
exposures. External fraud has increased driven by the higher number of
fraud events, particularly in credit card portfolios, and business growth,
whereas for technology there is an ongoing programme of work to
improve controls, through efficiency and automation, and a focus on
infrastructure resilience. Cyber security risk continues to be an area of
attention given the increasing sophistication and scope of potential
cyber-attack. Risks to technology and cyber security change rapidly
and require continued focus and investment.
For further information see Risk Management section (pages 135 and 136).
Operational risk is defined as any instance where there is
a potential or actual impact to the Group resulting from
inadequate or failed internal processes, people, systems,
or from an external event. The impacts to the Group can
be financial, including losses or an unexpected financial
gain, as well as non-financial such as customer
detriment, reputational or regulatory consequences.
All disclosures in this section (page 210) are unaudited unless otherwise stated
Note
a During 2014 the Group moved its operational risk reporting of events to align with the financial impact of the event rather than being based on date of sign-off in the system of
record. 2013 figures have been re-stated on this basis and due to timing difference between date of financial impact and recording of events some movement of prior year events
will be expected.
2014
2013
2.4
2.0
1.0
2.9
0.8
1.4
1.8
1.1
17.2
19.9
75.0
70.1
1.8
2.6
Business disruption and
system failures
Clients, products and
business practices
Damage to physical assets
Employment practices and
workplace safety
Execution, delivery and
process management
External fraud
Internal fraud
Operational risk events by risk category
% of total risk events by count
2014
2013
0.2
0.4
95.1
85.2
0.1
0.1
0.2
0.1
2.9
10.3
1.4
3.1
0.1
0.8
Business disruption and
system failures
Clients, products and
business practices
Damage to physical assets
Employment practices and
workplace safety
Execution, delivery and
process management
External fraud
Internal fraud
Operational risk events by risk category
% of total risk events by value