Citibank 2014 Annual Report Download - page 132

115
OPERATIONAL RISK
Operational risk is the risk of loss resulting from inadequate or failed internal
processes, systems or human factors, or from external events. It includes the
reputation and franchise risk associated with business practices or market
conduct in which Citi is involved. Operational risk is inherent in Citigroup’s
global business activities, as well as the internal processes that support those
business activities, and can result in losses arising from events related to the
following, among others:
•฀ fraud,฀theft฀and฀unauthorized฀activities;
•฀ employment฀practices฀and฀workplace฀environment;
•฀ clients,฀products฀and฀business฀practices;
•฀ physical฀assets฀and฀infrastructure;฀and
•฀ execution,฀delivery฀and฀process฀management.
Operational Risk Management
Citi’s operational risk is managed through the overall framework described
in “Managing Global Risk—Overview” above.
The goal is to keep operational risk at appropriate levels relative to the
characteristics of Citigroup’s businesses, the markets in which it operates,
its capital and liquidity, and the competitive, economic and regulatory
environment.
To anticipate, mitigate and control operational risk, Citigroup
maintains a system of policies and has established a consistent framework
for monitoring, assessing and communicating operational risks and the
overall operating effectiveness of the internal control environment across
Citigroup. As part of this framework, Citi has established a Manager’s Control
Assessment process (as described under “Citi’s Compliance Organization”
above) to help managers self-assess key operational risks and controls and
identify and address weaknesses in the design and/or operating effectiveness
of internal controls that mitigate significant operational risks.
As noted above, each major business segment must implement an
operational risk process consistent with the requirements of this framework.
The process for operational risk management includes the following steps:
•฀ identify฀and฀assess฀key฀operational฀risks;
•฀ design฀controls฀to฀mitigate฀identified฀risks;
•฀ establish฀key฀risk฀and฀control฀indicators;
•฀ implement฀a฀process฀for฀early฀problem฀recognition฀and฀timely฀escalation;
•฀ produce฀a฀comprehensive฀operational฀risk฀report;฀and
•฀ ensure฀that฀sufficient฀resources฀are฀available฀to฀actively฀improve฀the฀
operational risk environment and mitigate emerging risks.
As new products and business activities are developed, processes are
designed, modified or sourced through alternative means and operational
risks are considered.
An Operational Risk Council provides oversight for operational risk across
Citigroup. The council’s members include senior members of Citi’s Franchise
Risk and Strategy group and Citi’s Chief Risk Officer’s organization covering
multiple dimensions of risk management, with representatives of the
Business and Regional Chief Risk Officers’ organizations. The council’s focus
is on identification and mitigation of operational risk and related incidents.
The council works with the business segments and the control functions
(e.g., Compliance, Finance, Risk and Legal) with the objective of ensuring
a transparent, consistent and comprehensive framework for managing
operational risk globally.
In addition, Operational Risk Management, within Citi’s Franchise
Risk and Strategy group, proactively assists the businesses, operations and
technology and the other independent control groups in enhancing the
effectiveness of controls and managing operational risks across products,
business lines and regions.
Operational Risk Measurement and Stress Testing
As noted above, information about the businesses’ operational risk, historical
operational risk losses and the control environment is reported by each major
business segment and functional area. The information is summarized and
reported to senior management, as well as to the Audit Committee of Citi’s
Board of Directors.
Operational risk is measured and assessed through risk capital (see
“Managing Global Risk—Risk Capital” above). Projected operational risk
losses under stress scenarios are also required as part of the Federal Reserve
Board’s CCAR process.