Citibank 2014 Annual Report Download - page 85

68
MANAGING GLOBAL RISK
Overview
Citigroup believes that effective risk management is of primary importance to
its overall operations. Accordingly, Citi’s risk management process has been
designed to monitor, evaluate and manage the principal risks it assumes in
conducting its activities. Specifically, the activities that Citi engages in—and
the risks those activities generate—must be consistent with Citi’s underlying
commitment to the principles of “responsible finance” and in line with Citi’s
risk appetite. For Citi, responsible finance means conduct that is transparent,
prudent and dependable, and that delivers better outcomes for Citi’s
clients and society. Citi’s risk appetite framework includes principle-based
qualitative boundaries to guide behavior and quantitative boundaries within
which the firm will operate, including capital strength and earnings power.
Citi selectively takes risks in support of its underlying customer-centric
business strategy, while striving to ensure it operates within the principles
of responsible finance. Reaching the goal of becoming an indisputably
strong and stable institution goes beyond financial performance; ethics is an
area where Citi has zero tolerance for breaches. Citi evaluates and rewards
employees with specific consideration to their risk behaviors, including
transparency, communication and escalation of concerns.
Citi’s risks are generally categorized into credit risk, market risk,
operational risk and country and cross-border risk. Compliance risk can be
found in all of these risk types.
Citi’s risk programs are based on three lines of defense: (i) business
management, (ii) independent control functions and (iii) Internal Audit.
•฀ Business Management. Each of Citi’s businesses, including in-business
risk personnel, own and manage the risks, including compliance risks,
inherent in or arising from the business, and are responsible for having
controls in place to mitigate key risks, performing manager assessments
of internal controls, and promoting a culture of compliance and control.
• Independent Control Functions. Citi’s independent control functions,
including Compliance, Finance, Legal and Risk, set standards according
to which Citi and its businesses are expected to manage and oversee risks,
including compliance with applicable laws, regulatory requirements,
policies and standards of ethical conduct. In addition, among other
things, the independent control functions provide advice and training
to Citi’s businesses and establish tools, methodologies, processes
and oversight of controls used by the businesses to foster a culture of
compliance and control and to satisfy those standards.
•฀฀Internal Audit. Citi’s Internal Audit function independently reviews
activities of the first two lines of defense discussed above based on a
risk-based audit plan and methodology approved by the Citigroup Board
of Directors.
Citi’s Risk Management Organization
Citi’s Risk function is an independent control function within Franchise
Risk and Strategy. Citi’s Chief Risk Officer, with oversight from the Risk
Management Committee of the Citigroup Board of Directors, as well as the
full Board of Directors, is responsible for:
•฀ establishing core standards for the management, measurement and
reporting of risk arising from business risk taking activities and the
macroeconomic and market environments;
•฀ identifying, assessing, communicating and monitoring risks on a
company-wide basis;
•฀ engaging with senior management on a frequent basis on material
matters with respect to risk-taking activities in the businesses and related
risk management processes; and
•฀ ensuring that the Risk function has adequate independence, authority,
expertise, staffing, technology and resources.
As set forth in the chart below, Citi’s independent risk management
organization is structured to facilitate the management of risk across three
dimensions: businesses, regions and critical products.
Each of Citi’s major businesses has a Business Chief Risk Officer who is
the focal point for risk decisions, such as setting risk limits or approving
transactions in the business. The majority of staff in Citi’s risk management
organization report to these Business Chief Risk Officers. There are also Chief
Risk Officers for Citibank, N.A. and the Citi Holdings segment.
Regional Chief Risk Officers, for each of Asia, EMEA and Mexico and
Latin America, are accountable for the risks in or affecting their geographic
areas, including the legal entities in their region, and are the primary risk
contacts for the regional business heads and local regulators.
Citi also has Product Chief Risk Officers for those risk areas of critical
importance to Citi, currently fundamental credit, market and real estate risk,
treasury, model validation and systemic risks. Product Chief Risk Officers
are accountable for the risks within their specialties across businesses and
regions. Product Chief Risk Officers also serve as a resource to Citi’s Chief
Risk Officer, as well as to the Business and Regional Chief Risk Officers, to
better enable the Business and Regional Chief Risk Officers to focus on day-
to-day management of risks and responsiveness to the business. The Head of
the Risk Governance Group ensures the ongoing development, enhancement
and implementation of a proactive, prudent, and effective risk management
framework and organization.
Each of the Business, Regional, Legal Entity and Product Chief Risk
Officers reports to Citi’s Chief Risk Officer, who has a direct reporting line to
the Risk Management Committee of the Citigroup Board of Directors and
a dual reporting line to both Citi’s Chief Executive Officer and the Head of
Franchise Risk and Strategy.