Citibank 2009 Annual Report Download - page 108

98
OPERATIONAL RISK
Operational risk is the risk of loss resulting from inadequate or failed internal
processes, systems or human factors, or from external events. It includes the
reputation and franchise risk associated with business practices or market
conduct in which Citi is involved. Operational risk is inherent in Citigroup’s
global business activities and, as with other risk types, is managed through
an overall framework designed to balance strong corporate oversight with
well-defined independent risk management. This framework includes:
recognized ownership of the risk by the businesses; •฀
oversight by independent risk management; and •฀
independent review by Citi’s Audit and Risk Review (ARR). •฀
The goal is to keep operational risk at appropriate levels relative to the
characteristics of Citigroup’s businesses, the markets in which the company
operates its capital and liquidity, and the competitive, economic and
regulatory environment. Notwithstanding these controls, Citigroup incurs
operational losses.
Framework
To monitor, mitigate and control operational risk, Citigroup maintains a
system of comprehensive policies and has established a consistent, value-
added framework for assessing and communicating operational risk and the
overall effectiveness of the internal control environment across Citigroup.
An Operational Risk Council provides oversight for operational risk across
Citigroup. The Council’s membership includes senior members of the
Chief Risk Officer’s organization covering multiple dimensions of risk
management with representatives of the Business and Regional Chief Risk
Officers’ organizations and the Business Management Group. The Council’s
focus is on further advancing operational risk management at Citigroup
with a focus on proactive identification and mitigation of operational risk
and related incidents. The Council works with the business segments and the
control functions to help ensure a transparent, consistent and comprehensive
framework for managing operational risk globally.
Each major business segment must implement an operational risk
process consistent with the requirements of this framework. The process for
operational risk management includes the following steps:
identify and assess key operational risks; •฀
establish key risk indicators; •฀
produce a comprehensive operational risk report; and •฀
prioritize and assure adequate resources to actively improve the •฀
operational risk environment and mitigate emerging risks.
The operational risk standards facilitate the effective communication
and mitigation of operational risk both within and across businesses. As
new products and business activities are developed, processes are designed,
modified or sourced through alternative means and operational risks are
considered. Information about the businesses’ operational risk, historical
losses, and the control environment is reported by each major business
segment and functional area, and is summarized and reported to senior
management as well as the Risk Management and Finance Committee of
Citi’s Board of Directors and the full Board of Directors.
Measurement and Basel II
To support advanced capital modeling and management, the businesses
are required to capture relevant operational risk capital information. An
enhanced version of the risk capital model for operational risk has been
developed and implemented across the major business segments as a
step toward readiness for Basel II capital calculations. The risk capital
calculation is designed to qualify as an “Advanced Measurement Approach”
under Basel II. It uses a combination of internal and external loss data to
support statistical modeling of capital requirement estimates, which are
then adjusted to reflect qualitative data regarding the operational risk and
control environment.
Information Security and Continuity of Business
Information security and the protection of confidential and sensitive
customer data are a priority for Citigroup. Citi has implemented an
Information Security Program that complies with the Gramm-Leach-Bliley
Act and other regulatory guidance. The Information Security Program
is reviewed and enhanced periodically to address emerging threats to
customers’ information.
The Corporate Office of Business Continuity, with the support of senior
management, continues to coordinate global preparedness and mitigate
business continuity risks by reviewing and testing recovery procedures.