Morgan Stanley 2009 Annual Report Download - page 114

Consumer Lending Activities.
With respect to first mortgages and second mortgages, including HELOC (“mortgage lending”), a loan
evaluation process is adopted within a framework of credit underwriting policies and collateral valuation. The
Company’s underwriting policy is designed to ensure that all borrowers pass an assessment of capacity and
willingness to pay, which includes an analysis of applicable industry standard credit scoring models (e.g., FICO
scores), debt ratios and reserves of the borrower. Loan-to-collateral value ratios are determined based on
independent third-party property appraisal/valuations, and security lien position is established through title/
ownership reports. Historically all mortgages were originated to be sold or securitized. Eligible conforming loans
are currently sold to the government-sponsored enterprises while most jumbo and HELOC loans will be held for
investment in the Company’s portfolio.
Operational Risk.
Operational risk refers to the risk of financial or other loss, or potential damage to a firm’s reputation, resulting
from inadequate or failed internal processes, people, systems or from external events (e.g., external or internal
fraud, legal and compliance risks, damage to physical assets). The Company may incur operational risk across
the full scope of its business activities, including revenue generating activities (e.g., sales and trading) and
support functions (e.g., information technology and facilities management). Legal and compliance risk is
included in the scope of operational risk and is discussed below under “Legal Risk.”
The goal of the Company’s operational risk management framework is to establish company-wide operational
risk standards related to risk measurement, monitoring and management. Operational risk policies establish a
framework to reduce the likelihood and/or impact of operational incidents as well as to mitigate legal, regulatory
and reputational risks. The framework continually responds to changing regulatory and business environment
landscape. As a foundation for the Basel II Advanced Measurement Approach, an enhanced risk-based capital
model has been developed for the calculation of capital related to operational risk. This model encompasses both
quantitative and qualitative elements, including internal and external operational incidents, metrics, risk and
control self-assessments, and scenario analysis.
The Operational Risk Oversight Committee, a company-wide committee, is chaired by the Company’s Chief
Risk Officer and assists the FRC in executing its responsibilities for oversight of operational risk, including
evaluating assessments of risk exposure, reviewing the Company’s significant operational risk exposures,
recommending and overseeing company-wide remediation efforts, review and evaluation of current event risk
issues, and establishing company-wide operational risk program standards related to risk measurement,
monitoring and management.
The Company’s Operational Risk Manager oversees, monitors, measures, analyzes and reports on operational
risk across the Company. The Operational Risk Manager is independent of the business segments and is
supported by the company-wide Operational Risk Department. The Operational Risk Manager is also responsible
for facilitating, designing, implementing and monitoring the company-wide operational risk program. The
Operational Risk Department works with the business segments and control groups to help ensure a transparent,
consistent and comprehensive framework for managing operational risk within each area and across the
Company globally.
Primary responsibility for the management of operational risk is with the business segments, the control groups
and the business managers therein. The business managers, generally, maintain processes and controls designed
to identify, assess, manage, mitigate and report operational risk. As new products and business activities are
developed and processes are designed and modified, operational risks are considered. Each business segment has
a designated operational risk coordinator. The operational risk coordinator regularly reviews operational risk
issues and reports with senior management within each business. Each control group also has a designated
operational risk coordinator, or equivalent, and a forum for discussing operational risk matters and/or reports
with senior management. Oversight of operational risk is provided by business segment and regional risk
committees and the Operational Risk Oversight Committee.
110