Citibank 2009 Annual Report Download - page 71

61
MANAGING GLOBAL RISK
RISK MANAGEMENT—OVERVIEW
Citigroup believes that effective risk management is of primary importance
to its success. Accordingly, Citigroup has a comprehensive risk management
process to monitor, evaluate and manage the principal risks it assumes in
conducting its activities. These include credit, market (including liquidity)
and operational risks (including legal and reputational exposures). Each of
credit, market and operational risk is discussed in more detail throughout
this section.
Citigroup’s risk management framework is designed to balance corporate
oversight with well-defined independent risk management functions.
Enhancements continued to be made to the risk management framework
throughout 2009 based on guiding principles established by Citi’s Chief
Risk Officer:
a common risk capital model to evaluate risks; •฀
a defined risk appetite, aligned with business strategy; •฀
accountability through a common framework to manage risks; •฀
risk decisions based on transparent, accurate and rigorous analytics; •฀
expertise, stature, authority and independence of risk managers; and •฀
empowering risk managers to make decisions and escalate issues. •฀
Significant focus has been placed on fostering a risk culture based on
a policy of “Taking Intelligent Risk with Shared Responsibility, Without
Forsaking Individual Accountability:”
“Taking intelligent risk” means that Citi must carefully measure and •฀
aggregate risks, must appreciate potential downside risks, and must
understand risk/return relationships.
“Shared responsibility” means that risk and business management must •฀
actively partner to own risk controls and influence business outcomes.
“Individual accountability” means that all individuals are ultimately •฀
responsible for identifying, understanding and managing risks.
The Chief Risk Officer, working closely with the Citi CEO and established
management committees, and with oversight from the Risk Management
and Finance Committee of the Board of Directors as well as the full Board of
Directors, is responsible for:
establishing core standards for the management, measurement and •฀
reporting of risk;
identifying, assessing, communicating and monitoring risks on a •฀
company-wide basis;
engaging with senior management and on a frequent basis on material •฀
matters with respect to risk-taking activities in the businesses and related
risk management processes; and
ensuring that the risk function has adequate independence, authority, •฀
expertise, staffing, technology and resources.
The risk management organization is structured so as to facilitate the
management of risk across three dimensions: businesses, regions and critical
products. Each of the company’s major business groups has a Business Chief
Risk Officer who is the focal point for risk decisions, such as setting risk
limits or approving transactions in the business. There are also Regional
Chief Risk Officers, accountable for the risks in their geographic areas,
who are the primary risk contacts for the regional business heads and local
regulators. In addition, the positions of Product Chief Risk Officers were
created for those areas of critical importance to Citigroup, such as real estate,
structured products and fundamental credit. The Product Chief Risk Officers
are accountable for the risks within their specialty and focus on problem
areas across businesses and regions. The Product Chief Risk Officers serve as
a resource to the Chief Risk Officer, as well as to the Business and Regional
Chief Risk Officers, to better enable the Business and Regional Chief Risk
Officers to focus on the day-to-day management of risks and responsiveness
to business flow.
In addition to revising the risk management organization to facilitate the
management of risk across these three dimensions, the risk organization also
includes the business management team to ensure that the risk organization
has the appropriate infrastructure, processes and management reporting.
This team includes:
the risk capital group, which continues to enhance the risk capital model •฀
and ensure that it is consistent across all our business activities;
the risk architecture group, which ensures the company has integrated •฀
systems and common metrics, and thereby allows us to aggregate and
stress-test exposures across the institution;
the infrastructure risk group, which focuses on improving our operational •฀
processes across businesses and regions; and
the office of the Chief Administrative Officer, which focuses on •฀
re-engineering, risk communications and relationships, including our
critical regulatory relationships.