Citibank 2015 Annual Report Download - page 82

64
MANAGING GLOBAL RISK
OVERVIEW
For Citi, effective risk management is of primary importance to its overall
operations. Accordingly, Citi’s risk management process has been designed to
monitor, evaluate and manage the principal risks it assumes in conducting
its activities. Specifically, the activities that Citi engages in, and the risks
those activities generate, must be consistent with Citi’s mission and value
proposition, the key principles that guide it, and Citi's risk appetite.
Risk management must be built on a foundation of ethical culture.
Under Citi’s mission and value proposition, which was developed by Citi’s
senior leadership and distributed throughout the firm, Citi strives to serve as
a trusted partner to its clients by responsibly providing financial services that
enable growth and economic progress while earning and maintaining the
public’s trust by constantly adhering to the highest ethical standards. As such,
Citi asks all employees to ensure that their decisions pass three tests: they
are in clients’ interests, create economic value and are always systemically
responsible. Additionally, Citi evaluates employees’ performance against
behavioral expectations set out in Citi’s leadership standards, which were
designed in part to effectuate Citi’s mission and value proposition. Other
culture-related efforts in connection with conduct risk, ethics and leadership,
escalation, and treating customers fairly help Citi to execute its mission and
value proposition.
Four key principles—common purpose, responsible finance, ingenuity,
and leadership—guide Citi as it performs its mission. Citi’s risk appetite,
which is approved by the Citigroup Board of Directors, specifies the aggregate
levels and types of risk the Board and management are willing to assume
to achieve Citi’s strategic objectives and business plan, consistent with
applicable capital, liquidity, and other regulatory requirements.
Citi selectively takes risks in support of its underlying business strategy,
while striving to ensure it operates within its mission and value proposition
and risk appetite.
Citi’s risks are generally categorized and summarized as follows:
• Credit risk is the risk arising from an obligor’s failure to meet the terms
of any contract or otherwise perform as agreed. Credit risk is found in
all activities in which settlement or repayment depends on counterparty,
issuer, or borrower performance.
• Liquidity risk is the risk arising from an inability to meet obligations
when they come due. Liquidity risk includes the inability to access
funding sources or manage fluctuations in funding levels. Liquidity risk
also results from a failure to recognize or address changes in market
conditions that affect Citi’s ability to liquidate assets quickly and with
minimal loss in value.
• Market risk is the risk of potential losses arising from changes in the
value of Citi’s assets and liabilities resulting from changes in market
variables, such as interest rates.
• Operational risk is the risk of loss resulting from inadequate or failed
internal processes, systems, or human factors, or from external events.
• Country risk is the risk that an event in a country (precipitated by
developments within or external to a country) will impair the value of
Citi’s franchise or will adversely affect the ability of obligors within that
country to honor their obligations. Country risk events may include
sovereign defaults, banking crises, currency crises, currency convertibility
and/or transferability restrictions, or political events.
• Compliance risk is the risk arising from violations of, or non-
conformance with, local, national, or cross-border laws, rules, or
regulations, our own internal policies and procedures, or relevant
standards of conduct.
• Conduct risk is the risk that Citi’s employees or agents may, intentionally
or through negligence, harm customers, clients, or the integrity of the
markets, and thereby the integrity of Citi.
• Legal risk includes the risk of loss, whether financial or reputational,
due to legal or regulatory actions, proceedings, or investigations, or
uncertainty in the applicability or interpretation of contracts, laws,
or regulations.
• Reputational risk is the risk to current or anticipated earnings, capital, or
franchise or enterprise value arising from negative public opinion.
Citi manages its risks through each of its three lines of defense:
(i) business management, (ii) independent control functions and
(iii) Internal Audit. The three lines of defense collaborate with each other in
structured forums and processes to bring various perspectives together and to
steer the organization toward outcomes that are in clients’ interests, create
economic value and are systemically responsible.
First Line of Defense: Business Management
Each of Citi’s businesses owns its risks and is responsible for assessing and
managing its risks. Each business is also responsible for having controls
in place to mitigate key risks, assessing internal controls and promoting a
culture of compliance and control. In doing so, a business is required to
maintain appropriate staffing and implement appropriate procedures to
fulfill its risk governance responsibilities.
The CEOs of each region and business report to the Citigroup CEO. The
Head of Operations and Technology and the Head of Productivity, who are
considered part of the first line of defense, also report to the Citigroup CEO.
Businesses at Citi organize and chair many committees and councils
that cover risk considerations with participation from independent control
functions, including committees or councils that are designed to consider
matters related to capital, assets and liabilities, business practices, business
risks and controls, mergers and acquisitions, the Community Reinvestment
Act and fair lending and incentives.