Citibank 2011 Annual Report Download - page 128

106
OPERATIONAL RISK
Operational risk is the risk of loss resulting from inadequate or failed internal
processes, systems or human factors, or from external events. It includes the
reputation and franchise risk associated with business practices or market
conduct in which Citi is involved. Operational risk is inherent in Citigroup’s
global business activities and, as with other risk types, is managed through
an overall framework designed to balance strong corporate oversight with
well-defined independent risk management. This framework includes:
฀ recognized ownership of the risk by the businesses;
฀ oversight by Citi’s independent risk management; and
฀ independent review by Citi’s Audit and Risk Review (ARR).
The goal is to keep operational risk at appropriate levels relative to the
characteristics of Citigroup’s businesses, the markets in which it operates, its
capital and liquidity, and the competitive, economic and regulatory environment.
Notwithstanding these controls, Citigroup incurs operational losses.
Framework
To monitor, mitigate and control operational risk, Citigroup maintains
a system of comprehensive policies and has established a consistent
framework for assessing and communicating operational risk and the
overall effectiveness of the internal control environment across Citigroup.
An Operational Risk Council provides oversight for operational risk across
Citigroup. The Council’s membership includes senior members of the
Chief Risk Officer’s organization covering multiple dimensions of risk
management, with representatives of the Business and Regional Chief Risk
Officers’ organizations and the business management group (see “Managing
Global Risk—Risk Management—Overview” above). The Council’s focus
is on identification and mitigation of operational risk and related incidents.
The Council works with the business segments and the control functions
with the objective of ensuring a transparent, consistent and comprehensive
framework for managing operational risk globally.
Each major business segment must implement an operational risk
process consistent with the requirements of this framework. The process for
operational risk management includes the following steps:
฀ identify and assess key operational risks;
฀ establish key risk indicators;
฀ produce a comprehensive operational risk report; and
฀ prioritize and assure adequate resources to actively improve the
operational risk environment and mitigate emerging risks.
The operational risk standards facilitate the effective communication
and mitigation of operational risk both within and across businesses. As
new products and business activities are developed, processes are designed,
modified or sourced through alternative means and operational risks are
considered. Enterprise risk management, a newly formed organization
within Citi’s independent risk management, proactively assists the businesses,
operations and technology and the other independent control groups in
enhancing the effectiveness of controls and managing operational risks
across products, business lines and regions.
Information about the businesses’ operational risk, historical losses and
the control environment is reported by each major business segment and
functional area, and is summarized and reported to senior management
as well as the Risk Management and Finance Committee of Citi’s Board of
Directors and the full Board of Directors.
Measurement and Basel II
To support advanced capital modeling and management, the businesses
are required to capture relevant operational risk capital information. A risk
capital model for operational risk has been developed and implemented
across the major business segments as a step toward readiness for Basel II
capital calculations. The risk capital calculation is designed to qualify as an
“Advanced Measurement Approach” under Basel II. It uses a combination
of internal and external loss data to support statistical modeling of capital
requirement estimates, which are then adjusted to reflect qualitative data
regarding the operational risk and control environment.
Information Security and Continuity of Business
Information security and the protection of confidential and sensitive customer
data are a priority for Citigroup. Citi has implemented an Information Security
Program in accordance with the Gramm-Leach-Bliley Act and regulatory
guidance. The Information Security Program is reviewed and enhanced
periodically to address emerging threats to customers’ information.
The Corporate Office of Business Continuity, with the support of senior
management, continues to coordinate global preparedness and mitigate
business continuity risks by reviewing and testing recovery procedures.