Morgan Stanley 2015 Annual Report Download - page 125

Risk Oversight Committee, regional risk committees and senior management. In the event of a merger; joint venture;
divestiture; reorganization; or creation of a new legal entity, a new product or a business activity, operational risks are
considered, and any necessary changes in processes or controls are implemented.
The Operational Risk Department is independent of the divisions and reports to the Chief Risk Officer. The Operational Risk
Department provides oversight of operational risk management and independently assesses, measures and monitors
operational risk. The Operational Risk Department works with the divisions and control groups to help ensure a transparent,
consistent and comprehensive framework for managing operational risk within each area and across the Company. The
Operational Risk Department scope includes oversight of technology and data risks (e.g., cybersecurity) and supplier
management (vendor risk oversight and assessment) program. Furthermore, the Operational Risk Department supports the
collection and reporting of operational risk incidents and the execution of operational risk assessments; provides the
infrastructure needed for risk measurement and risk management; and ensures ongoing validation and verification of the
Company’s advanced measurement approach for operational risk capital.
Business Continuity Management is responsible for identifying key risks and threats to the Company’s resiliency and
planning to ensure that a recovery strategy and required resources are in place for the resumption of critical business
functions following a disaster or other business interruption. Disaster recovery plans are in place for critical facilities and
resources on a Company-wide basis, and redundancies are built into the systems as deemed appropriate. The key components
of the Company’s Business Continuity Management Program include: crisis management; business recovery plans;
applications/data recovery; work area recovery; and other elements addressing management, analysis, training and testing.
The Company maintains an information security program that coordinates the management of information security risks and
is designed to address regulatory requirements. Information security policies are designed to protect the Company’s
information assets against unauthorized disclosure, modification or misuse. These policies cover a broad range of areas,
including: application entitlements, data protection, incident response, Internet and electronic communications, remote access
and portable devices. The Company has also established policies, procedures and technologies to protect its computers and
other assets from unauthorized access.
In connection with its ongoing operations, the Company utilizes the services of external vendors, which it anticipates will
continue and may increase in the future. These services include, for example, outsourced processing and support functions
and consulting and other professional services. The Company manages its exposures to these services through a variety of
means such as the performance of due diligence, consideration of operational risk, implementation of service level and other
contractual agreements, and ongoing monitoring of the vendors’ performance. The Company maintains a supplier risk
management program with policies, procedures, organization, governance and supporting technology that satisfies regulatory
requirements. The program is designed to ensure that adequate risk management controls over the services exist, including,
but not limited to information security, operational failure, financial stability, disaster recoverability, reputational risk,
safeguards against corruption and termination.
Liquidity and Funding Risk.
Liquidity and funding risk refers to the risk that the Company will be unable to finance its operations due to a loss of access
to the capital markets or difficulty in liquidating its assets. Liquidity and funding risk also encompasses the Company’s
ability to meet its financial obligations without experiencing significant business disruption or reputational damage that may
threaten the Company’s viability as a going concern. Market or idiosyncratic stress events may negatively affect the
Company’s liquidity and may impact its ability to raise new funding. Generally, the Company incurs liquidity and funding
risk as a result of its trading, lending, investing and client facilitation activities.
The Company’s Liquidity Risk Management Framework is critical to helping ensure that the Company maintains sufficient
liquidity reserves and durable funding sources to meet its daily obligations and to withstand unanticipated stress events. In
2015, the Company established the Liquidity Risk Department as a distinct area in Risk Management to oversee and monitor
liquidity and funding risk. The Liquidity Risk Department is independent of the business units and reports to the Chief Risk
Officer. The Liquidity Risk Department ensures transparency of material liquidity and funding risks, compliance with
established risk limits and escalation of risk concentrations to appropriate senior management. To execute these
responsibilities, the Liquidity Risk Department establishes limits in line with the Company’s risk appetite, identifies and
119