Goldman Sachs 2013 Annual Report Download - page 107

Management’s Discussion and Analysis
Operational Risk Management
Overview
Operational risk is the risk of loss resulting from
inadequate or failed internal processes, people and systems
or from external events. Our exposure to operational risk
arises from routine processing errors as well as
extraordinary incidents, such as major systems failures.
Potential types of loss events related to internal and external
operational risk include:
‰clients, products and business practices;
‰execution, delivery and process management;
‰business disruption and system failures;
‰employment practices and workplace safety;
‰damage to physical assets;
‰internal fraud; and
‰external fraud.
We maintain a comprehensive control framework designed
to provide a well-controlled environment to minimize
operational risks. The Firmwide Operational Risk
Committee, along with the support of regional or entity-
specific working groups or committees, provides oversight
of the ongoing development and implementation of our
operational risk policies and framework. Operational Risk
Management is a risk management function independent of
our revenue-producing units, reports to the firm’s chief risk
officer, and is responsible for developing and implementing
policies, methodologies and a formalized framework for
operational risk management with the goal of minimizing
our exposure to operational risk.
Operational Risk Management Process
Managing operational risk requires timely and accurate
information as well as a strong control culture. We seek to
manage our operational risk through:
‰the training, supervision and development of our people;
‰the active participation of senior management in
identifying and mitigating key operational risks across
the firm;
‰independent control and support functions that monitor
operational risk on a daily basis, and implementation of
extensive policies and procedures, and controls designed
to prevent the occurrence of operational risk events;
‰proactive communication between our revenue-
producing units and our independent control and support
functions; and
‰a network of systems throughout the firm to facilitate the
collection of data used to analyze and assess our
operational risk exposure.
We combine top-down and bottom-up approaches to
manage and measure operational risk. From a top-down
perspective, the firm’s senior management assesses
firmwide and business level operational risk profiles. From
a bottom-up perspective, revenue-producing units and
independent control and support functions are responsible
for risk management on a day-to-day basis, including
identifying, mitigating, and escalating operational risks to
senior management.
Our operational risk framework is in part designed to
comply with the operational risk measurement rules under
Basel II and has evolved based on the changing needs of our
businesses and regulatory guidance. Our framework
comprises the following practices:
‰risk identification and reporting;
‰risk measurement; and
‰risk monitoring.
Internal Audit performs an independent review of our
operational risk framework, including our key controls,
processes and applications, on an annual basis to assess the
effectiveness of our framework.
Goldman Sachs 2013 Annual Report 105