Citibank 2012 Annual Report Download - page 134

112
OPERATIONAL RISK
Operational risk is the risk of loss resulting from inadequate or failed internal
processes, systems or human factors, or from external events. It includes the
reputation and franchise risk associated with business practices or market
conduct in which Citi is involved. Operational risk is inherent in Citigroup’s
global business activities, as well as its internal processes that support those
business activities, and can result in losses arising from events related to the
following, among others:
•฀ fraud, theft and unauthorized activities;
•฀ employment practices and workplace environment;
•฀ clients, products and business practices;
•฀ physical assets and infrastructure; and
•฀ execution, delivery and process management.
Operational Risk Management
Citi’s operational risk is managed through an overall framework designed
to balance strong corporate oversight with well-defined independent risk
management. This framework includes:
•฀ recognized ownership of the risk by the businesses;
•฀ oversight by Citi’s independent risk management and control functions; and
•฀ independent assessment by Citi’s Internal Audit function.
The goal is to keep operational risk at appropriate levels relative to the
characteristics of Citigroup’s businesses, the markets in which it operates, its
capital and liquidity, and the competitive, economic and regulatory environment.
To monitor, mitigate and control operational risk, Citigroup maintains a
system of policies and has established a consistent framework for assessing
and communicating operational risks and the overall effectiveness of the
internal control environment across Citigroup. As part of this framework,
Citi has established a “Manager’s Control Assessment” program to help
managers self-assess key operational risks and controls and identify and
address weaknesses in the design and/or effectiveness of internal controls that
mitigate significant operational risks.
As noted above, each major business segment must implement an
operational risk process consistent with the requirements of this framework.
The process for operational risk management includes the following steps:
•฀ identify and assess key operational risks;
•฀ design controls to mitigate identified risks;
•฀ establish key risk and control indicators;
•฀ implement a process for early problem recognition and timely escalation;
•฀ produce a comprehensive operational risk report; and
•฀ ensure that sufficient resources are available to actively improve the
operational risk environment and mitigate emerging risks.
As new products and business activities are developed, processes are
designed, modified or sourced through alternative means and operational
risks are considered.
An Operational Risk Council provides oversight for operational risk across
Citigroup. The Council’s membership includes senior members of Citi’s
Franchise Risk and Strategy group and the Chief Risk Officer’s organization
covering multiple dimensions of risk management, with representatives of
the Business and Regional Chief Risk Officers’ organizations. The Council’s
focus is on identification and mitigation of operational risk and related
incidents. The Council works with the business segments and the control
functions (e.g., Compliance, Finance, Human Resources and Legal) with the
objective of ensuring a transparent, consistent and comprehensive framework
for managing operational risk globally.
In addition, Enterprise Risk Management, within Citi’s independent risk
management, proactively assists the businesses, operations and technology
and the other independent control groups in enhancing the effectiveness
of controls and managing operational risks across products, business lines
and regions.
Operational Risk Measurement and Stress Testing
As noted above, information about the businesses’ operational risk,
historical operational risk losses and the control environment is reported by
each major business segment and functional area and is summarized and
reported to senior management, as well as to the Audit Committee of Citi’s
Board of Directors.
Operational risk is measured and assessed through risk capital
(see “Managing Global Risk—Risk Capital” above). The approach to capital
modeling is designed to be generally consistent with Basel II advanced
measurement approaches standards (see “Capital Resources and Liquidity—
Capital Resources—Regulatory Capital Standards” above). Projected
operational risk losses under stress scenarios are also required as part of the
Federal Reserve Board’s CCAR process.