Morgan Stanley 2010 Annual Report Download - page 123

Operational Risk.
Operational risk refers to the risk of financial or other loss, or potential damage to a firm’s reputation, resulting
from inadequate or failed internal processes, people, systems, or from external events (e.g., fraud, legal and
compliance risks or damage to physical assets). The Company may incur operational risk across the full scope of
its business activities, including revenue generating activities (e.g., sales and trading) and control groups (e.g.,
information technology and trade processing). Legal and compliance risk is included in the scope of operational
risk and is discussed below under “Legal Risk.”
The Company has established an operational risk management process to identify, measure, monitor and control
risk across the Company. Effective operational risk management is essential to reducing the impact of
operational risk incidents and mitigating legal, regulatory and reputational risks. The framework is continually
evolving to account for changes in the Company and in response to the changing regulatory and business
environment landscape. The Company has implemented operational risk data and assessment systems to monitor
and analyze internal and external operational risk events, business environment and internal control factors and
perform scenario analysis. The collected data elements are incorporated in the operational risk capital model. The
model encompasses both quantitative and qualitative elements. Internal loss data and scenario analysis results are
direct inputs to the capital models while external operational incidents, business environment internal control
factors and metrics are indirect inputs to the model.
Primary responsibility for the management of operational risk is with the business segments, the control groups
and the business managers therein. The business managers generally maintain processes and controls designed to
identify, assess, manage, mitigate and report operational risk. Each business segment has a designated
operational risk coordinator. The operational risk coordinator regularly reviews operational risk issues and
reports to senior management within each business. Each control group also has a designated operational risk
coordinator and a forum for discussing operational risk matters with senior management. Oversight of
operational risk is provided by regional risk committees and senior management. In the event of a merger, joint
venture, divestiture, reorganization, or creation of a new legal entity, a new product or a business activity,
operational risks are considered, and any necessary changes in processes or controls are implemented.
The independent Operational Risk Department (“ORD”) works with the business segments and control groups to
help ensure a transparent, consistent and comprehensive program for managing operational risk within each area
and across the Company globally. ORD is responsible for facilitating, designing, implementing and monitoring
the company-wide operational risk program.
Business Continuity Management is responsible for identifying key risks and threats to the Company’s resiliency
and planning to ensure a recovery strategy and required resources are in place for the resumption of critical
business functions following a disaster or other business interruption. Disaster recovery plans are in place for
critical facilities and resources on a company-wide basis, and redundancies are built into the systems as deemed
appropriate. The key components of the Company’s disaster recovery plans include: crisis management; business
recovery plans; applications/data recovery; work area recovery; and other elements addressing management,
analysis, training and testing.
The Company maintains an information security program that coordinates the management of information
security risks and satisfies regulatory requirements. Information security policies are designed to protect the
Company’s information assets against unauthorized disclosure, modification or misuse. These policies cover a
broad range of areas, including: application entitlements, data protection, incident response, Internet and
electronic communications, remote access and portable devices. The Company has also established policies,
procedures and technologies to protect its computers and other assets from unauthorized access.
The Company utilizes the services of external vendors in connection with the Company’s ongoing operations.
These may include, for example, outsourced processing and support functions and consulting and other
professional services. The Company manages its exposures to the quality of these services through a variety of
117