Citibank 2010 Annual Report Download - page 128

126
OPERATIONAL RISK
Operational risk is the risk of loss resulting from inadequate or failed internal
processes, systems or human factors, or from external events. It includes the
reputation and franchise risk associated with business practices or market
conduct in which Citi is involved. Operational risk is inherent in Citigroup’s
global business activities and, as with other risk types, is managed through
an overall framework designed to balance strong corporate oversight with
well-defined independent risk management. This framework includes:
recognized ownership of the risk by the businesses; •฀
oversight by Citi’s independent risk management; and •฀
independent review by Citi’s Audit and Risk Review (ARR).•฀
The goal is to keep operational risk at appropriate levels relative to the
characteristics of Citigroup’s businesses, the markets in which the Company
operates its capital and liquidity, and the competitive, economic and
regulatory environment. Notwithstanding these controls, Citigroup incurs
operational losses.
Framework
To monitor, mitigate and control operational risk, Citigroup maintains
a system of comprehensive policies and has established a consistent
framework for assessing and communicating operational risk and the
overall effectiveness of the internal control environment across Citigroup.
An Operational Risk Council provides oversight for operational risk across
Citigroup. The Council’s membership includes senior members of the
Chief Risk Officer’s organization covering multiple dimensions of risk
management, with representatives of the Business and Regional Chief Risk
Officers’ organizations and the business management group. The Council’s
focus is on identification and mitigation of operational risk and related
incidents. The Council works with the business segments and the control
functions with the objective of ensuring a transparent, consistent and
comprehensive framework for managing operational risk globally.
Each major business segment must implement an operational risk
process consistent with the requirements of this framework. The process for
operational risk management includes the following steps:
identify and assess key operational risks; •฀
establish key risk indicators; •฀
produce a comprehensive operational risk report; and •฀
prioritize and assure adequate resources to actively improve the •฀
operational risk environment and mitigate emerging risks.
The operational risk standards facilitate the effective communication
and mitigation of operational risk both within and across businesses. As
new products and business activities are developed, processes are designed,
modified or sourced through alternative means and operational risks are
considered. Information about the businesses’ operational risk, historical
losses, and the control environment is reported by each major business
segment and functional area, and is summarized and reported to senior
management as well as the Risk Management and Finance Committee of
Citi’s Board of Directors and the full Board of Directors.
Measurement and Basel II
To support advanced capital modeling and management, the businesses
are required to capture relevant operational risk capital information. An
enhanced version of the risk capital model for operational risk has been
developed and implemented across the major business segments as a step
toward readiness for Basel II capital calculations. The risk capital calculation
is designed to qualify as an “Advanced Measurement Approach” under
Basel II. It uses a combination of internal and external loss data to support
statistical modeling of capital requirement estimates, which are then
adjusted to reflect qualitative data regarding the operational risk and control
environment.
Information Security and Continuity of Business
Information security and the protection of confidential and sensitive
customer data are a priority for Citigroup. Citi has implemented an
Information Security Program in accordance with the Gramm-Leach-Bliley
Act and regulatory guidance. The Information Security Program is reviewed
and enhanced periodically to address emerging threats to customers’
information.
The Corporate Office of Business Continuity, with the support of senior
management, continues to coordinate global preparedness and mitigate
business continuity risks by reviewing and testing recovery procedures.