Morgan Stanley 2014 Annual Report Download - page 153

risk management and independently assesses, measures and monitors operational risk. The Company’s
Operational Risk Department works with the divisions and control groups to help ensure a transparent, consistent
and comprehensive framework for managing operational risk within each area and across the Company. The
Company’s Operational Risk Department scope includes the information and technology risk oversight program
(e.g., cybersecurity) and supplier management (vendor risk oversight and assessment) program. Furthermore, the
Company’s Operational Risk Department supports the collection and reporting of operational risk incidents and
the execution of operational risk assessments; provides the infrastructure needed for risk measurement and risk
management; and ensures ongoing validation and verification of the Company’s advanced measurement
approach for operational risk capital.
Business Continuity Management is responsible for identifying key risks and threats to the Company’s resiliency
and planning to ensure that a recovery strategy and required resources are in place for the resumption of critical
business functions following a disaster or other business interruption. Disaster recovery plans are in place for
critical facilities and resources on a company-wide basis, and redundancies are built into the systems as deemed
appropriate. The key components of the Company’s disaster recovery plans include: crisis management; business
recovery plans; applications/data recovery; work area recovery; and other elements addressing management,
analysis, training and testing.
The Company maintains an information security program that coordinates the management of information
security risks and satisfies regulatory requirements. Information security policies are designed to protect the
Company’s information assets against unauthorized disclosure, modification or misuse. These policies cover a
broad range of areas, including: application entitlements, data protection, incident response, Internet and
electronic communications, remote access and portable devices. The Company has also established policies,
procedures and technologies to protect its computers and other assets from unauthorized access.
In connection with its ongoing operations, the Company utilizes the services of external vendors, which it
anticipates will continue and may increase in the future. These services include, for example, outsourced
processing and support functions and consulting and other professional services. The Company manages its
exposures to these services through a variety of means such as the performance of due diligence, consideration of
operational risk, implementation of service level and other contractual agreements, and ongoing monitoring of
the vendors’ performance. The Company maintains a supplier risk management program with policies,
procedures, organization, governance and supporting technology. The programs are designed to ensure adequate
risk management controls over the services exist, including but not limited to information security, operational
failure, financial stability, disaster recoverability, reputational risk, safeguards against corruption, and
termination.
Legal and Compliance Risk.
Legal and compliance risk includes the risk of legal or regulatory sanctions, material financial loss including
fines, penalties, judgments, damages and/or settlements, or loss to reputation that the Company may suffer as a
result of failure to comply with laws, regulations, rules, related self-regulatory organization standards and codes
of conduct applicable to its business activities. This risk also includes contractual and commercial risk such as
the risk that a counterparty’s performance obligations will be unenforceable. The Company is generally subject
to extensive regulation in the different jurisdictions in which it conducts its business (see also “Business—
Supervision and Regulation” in Part I, Item 1 and “Risk Factors” in Part I, Item 1A). The Company has
established procedures based on legal and regulatory requirements on a worldwide basis that are designed to
facilitate compliance with applicable statutory and regulatory requirements. The Company, principally through
its Legal and Compliance Division, also has established procedures that are designed to require that the
Company’s policies relating to business conduct, ethics and practices are followed globally. In connection with
its businesses, for example, the Company has and continuously develops various procedures addressing issues
such as regulatory capital requirements, sales and trading practices, new products, information barriers, potential
conflicts of interest, structured transactions, use and safekeeping of customer funds and securities, lending and
credit granting, anti-money laundering, information security, privacy and recordkeeping. In addition, the
149