Citibank 2013 Annual Report Download - page 137

119
OPERATIONAL RISK
Operational risk is the risk of loss resulting from inadequate or failed internal
processes, systems or human factors, or from external events. It includes the
reputation and franchise risk associated with business practices or market
conduct in which Citi is involved. Operational risk is inherent in Citigroup’s
global business activities, as well as the internal processes that support those
business activities, and can result in losses arising from events related to the
following, among others:
•฀ fraud,฀theft฀and฀unauthorized฀activities;
•฀ employment฀practices฀and฀workplace฀environment;
•฀ clients,฀products฀and฀business฀practices;
•฀ physical฀assets฀and฀infrastructure;฀and
•฀ execution,฀delivery฀and฀process฀management.
Operational Risk Management
Citi’s operational risk is managed through an overall framework designed
to balance strong corporate oversight with well defined independent risk
management. This framework includes:
•฀ recognized฀ownership฀of฀the฀risk฀by฀the฀businesses;
•฀ oversight฀by฀Citi’s฀independent฀control฀functions;฀and
•฀ independent assessment by Citi’s Internal Audit function.
The goal is to keep operational risk at appropriate levels relative to the
characteristics of Citigroup’s businesses, the markets in which it operates,
its capital and liquidity, and the competitive, economic and regulatory
environment.
To anticipate, mitigate and control operational risk, Citigroup maintains
a system of policies and has established a consistent framework for
monitoring, assessing and communicating operational risks and the overall
effectiveness of the internal control environment across Citigroup. As part
of this framework, Citi has established a “Manager’s Control Assessment”
program to help managers self-assess key operational risks and controls and
identify and address weaknesses in the design and/or effectiveness of internal
controls that mitigate significant operational risks.
As noted above, each major business segment must implement an
operational risk process consistent with the requirements of this framework.
The process for operational risk management includes the following steps:
•฀ identify฀and฀assess฀key฀operational฀risks;
•฀ design฀controls฀to฀mitigate฀identified฀risks;
•฀ establish฀key฀risk฀and฀control฀indicators;
•฀ implement฀a฀process฀for฀early฀problem฀recognition฀and฀timely฀escalation;
•฀ produce฀a฀comprehensive฀operational฀risk฀report;฀and
•฀ ensure that sufficient resources are available to actively improve the
operational risk environment and mitigate emerging risks.
As new products and business activities are developed, processes are
designed, modified or sourced through alternative means and operational
risks are considered.
An Operational Risk Council provides oversight for operational risk across
Citigroup. The Council’s membership includes senior members of Citi’s
Franchise฀Risk฀and฀Strategy฀group฀and฀the฀Chief฀Risk฀Officer’s฀organization฀
covering multiple dimensions of risk management, with representatives of
the Business and Regional Chief Risk Officers’ organizations. The Council’s
focus is on identification and mitigation of operational risk and related
incidents. The Council works with the business segments and the control
functions (e.g., Compliance, Finance, Human Resources and Legal) with the
objective of ensuring a transparent, consistent and comprehensive framework
for managing operational risk globally.
In addition, Enterprise Risk Management, within Citi’s Franchise Risk
and฀Strategy฀group,฀proactively฀assists฀the฀businesses,฀operations฀and฀
technology and the other independent control groups in enhancing the
effectiveness of controls and managing operational risks across products,
business lines and regions.
Operational Risk Measurement and Stress Testing
As noted above, information about the businesses’ operational risk, historical
operational risk losses and the control environment is reported by each major
business segment and functional area. The information is summarized and
reported to senior management, as well as to the Audit Committee of Citi’s
Board of Directors.
Operational risk is measured and assessed through risk capital (see
“Managing Global Risk—Risk Capital” above). Projected operational risk
losses under stress scenarios are also required as part of the Federal Reserve
Board’s CCAR process.