Citibank 2015 Annual Report Download - page 128

110
OPERATIONAL RISK
Operational risk is the risk of loss resulting from inadequate or failed internal
processes, systems or human factors, or from external events. It includes the
reputation and franchise risk associated with business practices or market
conduct in which Citi is involved. Operational risk is inherent in Citi’s
global business activities, as well as the internal processes that support those
business activities, and can result in losses arising from events related to the
following, among others:
• fraud, theft and unauthorized activity;
• employment practices and workplace environment;
• clients, products and business practices;
• physical assets and infrastructure; and
• execution, delivery and process management.
Citi manages operational risk consistent with the overall framework
described in “Managing Global Risk—Overview” above. The goal is to keep
operational risk at appropriate levels relative to the characteristics of Citi’s
businesses, the markets in which it operates, its capital and liquidity, and the
competitive, economic and regulatory environment.
To anticipate, mitigate and control operational risk, Citi maintains a
system of policies and has established a consistent framework for monitoring,
assessing and communicating operational risks and the overall operating
effectiveness of the internal control environment across Citigroup. As part of
this framework, Citi has established a manager’s control assessment process
(as described under “Compliance, Conduct and Legal Risk—Compliance
Risk” below) to help managers self-assess significant operational risks
and key controls and identify and address weaknesses in the design and/
or operating effectiveness of internal controls that mitigate significant
operational risks.
Each major business segment must implement an operational risk
process consistent with the requirements of this framework. The process for
operational risk management includes the following steps:
• identify and assess key operational risks;
• design controls to mitigate identified risks;
• establish key risk indicators;
• implement a process for early problem recognition and timely escalation;
• produce comprehensive operational risk reporting; and
• ensure that sufficient resources are available to actively improve the
operational risk environment and mitigate emerging risks.
As new products and business activities are developed, processes are
designed, modified or sourced through alternative means and operational
risks are considered.
An Operational Risk Management Committee has been established to
provide oversight for operational risk across Citigroup and to provide a
forum to assess Citi’s operational risk profile and ensure actions are taken
so that Citi’s operational risk exposure is actively managed consistent
with Citi’s risk appetite. The Committee seeks to ensure that these actions
address the root causes that persistently lead to operational risk losses and
create lasting solutions to minimize these losses. Members include Citi’s
Chief Risk Officer and Citi’s Head of Operational Risk and senior members
of their organizations. These members cover multiple dimensions of risk
management and include business and regional Chief Risk Officers and
senior operational risk managers.
In addition, Risk management, including Operational Risk Management,
works proactively with the businesses and other independent control
functions to embed a strong operational risk management culture and
framework across Citi. Operational Risk Management engages with
the businesses and the respective Chief Risk Officers to ensure effective
implementation of the Operational Risk Management framework by
focusing on (i) identification, analysis and assessment of operational risks;
(ii) effective challenge of key control issues and operational risks; and
(iii) anticipation and mitigation of operational risk events.
Information about the businesses’ operational risk, historical operational
risk losses and the control environment is reported by each major business
segment and functional area. The information is summarized and reported
to senior management, as well as to the Audit Committee of Citi’s Board
of Directors.
Operational risk is measured and assessed through risk capital. Projected
operational risk losses under stress scenarios are also required as part of the
Federal Reserve Board’s CCAR process.