Citibank 2008 Annual Report Download - page 57

MANAGING GLOBAL RISK
RISK MANAGEMENT
The Company believes that effective risk management is of primary
importance to its success. Accordingly, the Company has a comprehensive
risk management process to monitor, evaluate and manage the principal
risks it assumes in conducting its activities. These risks include credit,
market liquidity and operational, including legal and reputational
exposures.
Citigroup’s risk management framework is designed to balance corporate
oversight with well-defined independent risk management functions.
Enhancements were made to the risk management framework
throughout 2008 based on guiding principles established by the Chief Risk
Officer:
• a common Risk Capital model to evaluate risks;
• a defined risk appetite, aligned with business strategy;
• accountability through a common framework to manage risks;
• risk decisions based on transparent, accurate and rigorous analytics;
• expertise, stature, authority and independence of Risk Managers; and
• empowering Risk Managers to make decisions and escalate issues.
Significant focus has been placed on fostering a risk culture based on a
policy of “Taking Intelligent Risk with Shared Responsibility, without
forsaking Individual Accountability.”
• “Taking intelligent risk” means that Citi must carefully identify, measure
and aggregate risks, and must fully understand downside risks.
• “Shared responsibility” means that individuals own and influence
business outcomes, including risk controls.
• “Individual accountability” means individuals held ourselves
accountable to actively manage risk.
The Chief Risk Officer, working closely with the Citi CEO, established
management committees, Citi’s Audit and Risk Management Committee and
Citi’s Board of Directors, is responsible for:
• establishing core standards for the management, measurement and
reporting of risk;
• identifying, assessing, communicating and monitoring risks on a
company-wide basis;
• engaging with senior management and the Board of Directors on a
frequent basis on material matters with respect to risk-taking activities in
the businesses and related risk management processes; and
• ensuring that the risk function has adequate independence, authority,
expertise, staffing, technology and resources.
Changes were made to the risk management organization in 2008 to
facilitate the management of risk across three dimensions: businesses,
regions and critical products.
Each of the major business groups has a Business Chief Risk Officer who
is the focal point for risk decisions (such as setting risk limits or approving
transactions) in the business.
There are also Regional Chief Risk Officers, accountable for the risks in
their geographic area, and who are the primary risk contact for the regional
business heads and local regulators.
In addition, the position of Product Chief Risk Officers was created for
those areas of critical importance to Citigroup such as real estate, structured
credit products and fundamental credit. The Product Risk Officers are
accountable for the risks within their specialty and they focus on problem
areas across businesses and regions. The Product Risk Officers serve as a
resource to the Chief Risk Officer, as well as to the Business and Regional
Chief Risk Officers, to better enable the Business and Regional Chief Risk
Officers to focus on the day-to-day management of risks and responsiveness
to business flow.
In addition to changing the risk management organization to facilitate
the management of risk across these three dimensions, the risk organization
also includes the newly-created Business Management team to ensure that
the risk organization has the appropriate infrastructure, processes and
management reporting. This team includes:
• the risk capital group, which continues to enhance the risk capital model
and ensure that it is consistent across all our business activities;
• the risk architecture group, which ensures we have integrated systems and
common metrics, and thereby allows us to aggregate and stress test
exposures across the institution;
• the infrastructure risk group, which focuses on improving our operational
processes across businesses and regions; and
• the office of the Chief Administrative Officer, which focuses on
re-engineering risk communications and relationships, including our
critical regulatory relationships.
RISK AGGREGATION AND STRESS TESTING
While the major risk areas are described individually on the following pages,
these risks often need to be reviewed and managed in conjunction with one
another and across the various businesses.
The Chief Risk Officer, as noted above, monitors and controls major risk
exposures and concentrations across the organization. This means
aggregating risks, within and across businesses, as well as subjecting those
risks to alternative stress scenarios in order to assess the potential economic
impact they may have on the Company.
During 2008, comprehensive stress tests were implemented across Citi for
mark-to-market, available-for-sale, and accrual portfolios. These firm-wide
stress reports measure the potential impact to the Company and its
component businesses of very large changes in various types of key risk
factors (e.g., interest rates, credit spreads), as well as the potential impact of
a number of historical and hypothetical forward-looking systemic stress
scenarios.
Supplementing the stress testing described above, Risk Management,
working with input from the businesses and Finance, provides enhanced
periodic updates to senior management and the Board of Directors on
significant potential exposures across Citigroup arising from risk
concentrations (e.g., residential real estate), financial market participants
51