Citibank 2013 Annual Report Download - page 87

69
MANAGING GLOBAL RISK
Risk Management—Overview
Citigroup believes that effective risk management is of primary importance to
its overall operations. Accordingly, Citi’s risk management process has been
designed to monitor, evaluate and manage the principal risks it assumes
in conducting its activities. Specifically, the activities that Citi engages
in—and the risks those activities generate—must be consistent with Citi’s
underlying commitment to the principles of “Responsible Finance.” For
Citi, “Responsible Finance” means conduct that is transparent, prudent and
dependable, and that delivers better outcomes for Citi’s clients and society.
In order to achieve these principles, Citi establishes and enforces
expectations for its risk-taking activities through its risk culture, defined
roles and responsibilities (the “Three Lines of Defense”), and through its
supporting policies, procedures and processes that enforce these standards.
Citi’s Risk Culture. Citi’s risk management framework is designed to
balance business ownership and accountability for risks with well defined
independent risk management oversight and responsibility. Citi’s risk
management framework is based on the following principles established by
Citi’s Chief Risk Officer:
•฀฀a defined risk appetite, aligned with business strategy;
•฀฀accountability through a common framework to manage risks;
•฀฀risk decisions based on transparent, accurate and rigorous analytics;
•฀฀a common risk capital model to evaluate risks;
•฀฀expertise, stature, authority and independence of risk managers; and
•฀฀risk managers empowered to make decisions and escalate issues.
Significant focus has been placed on fostering a risk culture based on
a policy of “Taking Intelligent Risk with Shared Responsibility, without
Forsaking Individual Accountability”:
•฀฀“Taking intelligent risk” means that Citi must identify, measure and
aggregate risks, and it must establish risk tolerances based on a full
understanding of concentrations and “tail risk.”
•฀฀“Shared responsibility” means that all individuals collectively bear
responsibility to seek input and leverage knowledge across and within the
“Three Lines of Defense.”
•฀฀“Individual accountability” means that all individuals must actively
manage risk, identify issues, and make fully informed decisions that take
into account all risks to Citi.
Roles and Responsibilities. While the management of risk is the collective
responsibility of all employees, Citi assigns accountability into three lines
of defense:
•฀฀First line of defense: The business owns all of its risks, and is responsible
for the management of those risks.
•฀฀Second line of defense: Citi’s control functions (e.g., Risk, Compliance,
etc.) establish standards for the management of risks and effectiveness
of controls.
•฀฀Third line of defense: Citi’s Internal Audit function independently provides
assurance, based on a risk-based audit plan approved by the Board
of Directors, that processes are reliable, and governance and controls
are effective.
The Chief Risk Officer, with oversight from the Risk Management and
Finance Committee of the Board of Directors, as well as the full Board of
Directors, is responsible for:
•฀฀establishing core standards for the management, measurement and
reporting of risk;
•฀฀identifying, assessing, communicating and monitoring risks on a
company-wide basis;
•฀฀engaging with senior management on a frequent basis on material
matters with respect to risk-taking activities in the businesses and related
risk management processes; and
•฀฀ensuring that the risk function has adequate independence, authority,
expertise, staffing, technology and resources.
Risk Management Organization
As set forth in the chart below, the risk management organization is
structured so as to facilitate the management of risk across three dimensions:
businesses, regions and critical products.
Each of Citi’s major business groups has a Business Chief Risk Officer who
is the focal point for risk decisions, such as setting risk limits or approving
transactions in the business. The majority of the staff in Citi’s independent
risk management organization report to these Business Chief Risk Officers.
There are also Chief Risk Officers for Citibank, N.A. and Citi Holdings.
Regional Chief Risk Officers, appointed in each of Asia, EMEA and
Latin America, are accountable for all the risks in their geographic areas
and are the primary risk contacts for the regional business heads and
local regulators.