ING Direct 2009 Annual Report Download - page 238

ING Group – Non-financial risks
Information (Technology) risk
ING has fully reviewed and updated its IT risk policy and minimum standards and aligned it with regulatory and (external) international
ISO standards. All IT-related staff worldwide were informed about the changes in policy and standards and e-learning is being developed.
ING’s quarterly monitoring process through NFRD was also aligned with the new policy and standards.
Continued risk mitigation efforts were made in the IT risk domain worldwide as IT is a key resource and enabler for ING businesses.
Managing IT risk is amongst ING’s key management priorities. The Executive IT Risk Steering Committee is chaired by ING’s CEO.
ING developed a Risk Forecasting methodology that shows over time the effects on the risk profile of Business Units from ongoing and
intended mitigating actions. In the course of 2009, forecasting has been implemented successfully for the Information (Technology) area.
Continuity risk
A continuity risk forecasting model has been introduced. Through this model, Management can determine if current actions are sufficient
to maintain the continuity risks at an acceptable level or if additional mitigation projects are necessary. Furthermore an overall Group value
chain ranking list for critical products and services has been introduced in which management can prioritise supporting activities. Because
of the worldwide influenza (H1N1) pandemic outbreak special focus has been put on business continuity planning and crisis management
using a realistic scenario of a staff absence of 50%.
COMPLIANCE RISKS
Compliance Risk is defined as the risk of damage to ING’s integrity as a result of failure (or perceived failure) to comply with relevant laws,
regulations, internal policies, procedures and ethical standards. In addition to reputational damage, failure to effectively manage
Compliance Risk could expose ING to fines, civil and criminal penalties, and payment of damages, court orders and suspension or
revocation of licenses, which would adversely impact customers, staff and shareholders of ING.
ING believes that fully embedded Compliance Risk Management preserves and enhances the trust of its customers, shareholders and staff.
Being trusted is essential to building sustainable businesses. ING’s Business Principles set the foundation for the high ethical standards ING
expects of all our business activities.
ING’s Business Principles require all staff at every level to conduct themselves, not only in compliance with laws and regulations, but also by
acting with integrity, being open and clear, respectful, and responsible.
Clear and practical policies and procedures are embedded in ING business processes in all Business Lines. Systems are in place to enable
management to track current and emerging Compliance Risk issues, to communicate these to internal and external stakeholders, and to
drive continuous improvement. ING understands that good Compliance Risk Management involves understanding and delivering on the
expectations of customers and other stakeholders, thereby strengthening the quality of key relationships.
The Scope of the Compliance Risk Management function
The Compliance Risk Management function focuses on managing the risks arising from laws, regulations and standards which are specific
to the financial services industry. The Compliance Risk Management function actively educates and supports the business in managing
areas including anti-money laundering, preventing terrorist financing, conflicts of interest, proper sales and trading conduct and protection
of customer interest.
ING separates Compliance Risk into four conduct-related integrity risk areas. These are shown below with examples of the sub-risks in
each risk area:
Client Related Integrity Risk
Personal Conduct
Related Integrity Risk
Organisational Conduct
Related Integrity Risk
Financial Services Conduct
Related Integrity Risk
Money laundering•
Terrorist financing•
Political or reputational •
exposed person
Client engagements or •
transactions with (ultra) high
risk countries
Market abuse & personal •
trading
Breaches of the ING Business •
Principles or local code of
conduct
Outside positions by ING •
officers
Gifts or entertainment given or •
received; bribery.
External incident reporting•
Organisational conflicts of •
interest, market abuse and
insider trading.
Anti-trust/competition law•
New or modified products and •
services (e.g. customer base,
design) and governance
changes
Agreed sector /industry •
standards.
Regulatory registration and •
reporting requirements
Third party intermediaries as •
representatives of ING
Marketing, sales & •
Marketing, sales & trading
conduct
Conduct of advisory business •
Complaint handling•
Transparency of product •
offerings (e.g. costs,
disclosures).
Risk management (continued)
2.1 Consolidated annual accounts
ING Group Annual Report 2009
236