Citibank 2014 Annual Report Download - page 88

71
Supplementing the stress testing described above, independent risk
management, with assistance from its businesses and Finance function,
provides periodic updates to Citi’s senior management and Board of Directors
on significant potential areas of concern across Citi that can arise from risk
concentrations, financial market participants and other systemic issues.
These areas of focus are intended to be forward-looking assessments of the
potential economic impacts to Citi that may arise from these exposures.
The stress-testing and focus-position exercises described above supplement
the standard limit-setting and risk-capital exercises described below, as
these processes incorporate events in the marketplace and within Citi that
impact the firm’s outlook on the form, magnitude, correlation and timing
of identified risks that may arise. In addition to enhancing awareness
and understanding of potential exposures, the results of these processes
then serve as the starting point for developing risk management and
mitigation strategies.
In addition to Citi’s ongoing, internal stress testing described above, Citi
is also required to perform stress testing on a periodic basis for a number of
regulatory exercises, including the Federal Reserve Board’s Comprehensive
Capital Analysis and Review (CCAR) and the OCC’s Dodd-Frank Act Stress
Testing (DFAST). These regulatory exercises typically prescribe certain
defined scenarios under which stress testing should be conducted, and
they also provide defined forms for the output of the results. For additional
information, see “Risk Factors-Business and Operational Risks” above.
Risk Capital
Citi calculates and allocates risk capital across the Company in order to
consistently measure risk taking across business activities and to assess risk-
reward relationships. Risk capital is defined as the amount of capital required
to absorb potential unexpected economic losses resulting from extremely
severe events over a one-year time period.
•฀ “Economic losses” include losses that are reflected on Citi’s Consolidated
Statements of Income and fair value adjustments to the Consolidated
Financial Statements, as well as any further declines in value not captured
on the Consolidated Statements of Income.
•฀ “Unexpected losses” are the difference between potential extremely severe
losses and Citi’s expected (average) loss over a one-year time period.
•฀ “Extremely severe” is defined as potential loss at a 99.97% confidence
level, based on the distribution of observed events and scenario analysis.
The drivers of economic losses are risks which, for Citi, are broadly
categorized as credit risk, market risk and operational risk. Citi’s risk capital
framework is reviewed and enhanced on a regular basis in light of market
developments and evolving practices.
Citi’s Compliance Organization
Compliance is an independent control function within Franchise Risk and
Strategy that is designed to protect Citi not only by managing adherence
to applicable laws, regulations and other standards of conduct, but also
by promoting business behavior and activity that is consistent with global
standards for responsible finance.
While principal responsibility for compliance rests with business
managers and their teams, all employees of Citi are responsible for protecting
the franchise by (i) engaging in responsible finance; (ii) understanding
and adhering to the compliance requirements that apply to their day-
to-day activities, including Citi’s Code of Conduct and other Citi policies,
standards and procedures; and (iii) seeking advice from the Compliance
function with questions regarding compliance requirements and promptly
reporting violations of laws, rules, regulations, Citi policies or relevant
ethical standards. Citi’s compliance risk management starts with Citi’s
Board of Directors and senior management, who set the tone from the top by
promoting a strong culture of ethics, compliance and control.
Citi’s compliance program is based on the three lines of defense, as
described above.
Compliance Risk Appetite Framework
Guided by the principle of responsible finance, Citi seeks to eliminate,
minimize, or mitigate compliance risk. Compliance risk is the risk arising
from violations of, or non-conformance with, local, national, or cross-border
laws, rules, or regulations, Citi’s own internal policies and procedures, or
relevant ethical standards.
Citi manages its compliance risk appetite through a three-pillar approach:
•฀ Setting risk appetite: Citi establishes its compliance risk appetite by setting
limits on the types of business in which Citi will engage, the products
and services Citi will offer, the types of customers which Citi will service,
the counterparties with which Citi will deal, and the locations where Citi
will do business. These limits are guided by adherence to the highest
ethical standards.
•฀ Adhering to risk appetite: Citi manages adherence to its compliance
risk appetite through the execution of its compliance program, which
includes customer onboarding processes, product development processes,
transaction monitoring processes, conduct risk program, ethics program,
and new products, services, and complex transactions approval processes.
•฀ Evaluating the effectiveness of risk appetite controls: The business and
compliance evaluate the effectiveness of controls governing compliance
risk appetite through the Manager’s Control Assessment (MCA) processes;
compliance testing; compliance monitoring processes; compliance
risk assessments; compliance metrics related to key operating risks, key
risk indicators and control effectiveness indicators; and the Internal
Audit function.