Aviva 2009 Annual Report Download - page 268

266
Aviva plc Notes to the consolidated financial statements continued
Annual Report and Accounts 2009
56 – Risk management continued
(f) Operational risk
Types of operational risk
Operational risk is the risk of loss, arising from inadequate or failed internal processes, or from people and systems,
or from external events. Operational risks include business protection, information technology, people, legal and regulatory
compliance risks.
Operational risk management
We process a large number of complex transactions across numerous and diverse products, and are highly dependent on the
proper functioning of information technology and communications systems. We are partially reliant on the operational processing
performance of our outsourced partners including certain servicing and IT functions. The long-term nature of our business means
that accurate records have to be maintained for significant periods. Significant resources are devoted to maintaining efficient and
effective operations within our framework of corporate responsibility, policies and business ethics code.
Our businesses are primarily responsible for identifying and managing operational risks in line with minimum standards of
control set out in our policies. Each operational risk is assessed by considering the potential impact and the probability of the event
occurring. Impact assessments are considered against financial, operational and reputation criteria.
Business management teams must be satisfied that all material risks falling outside our risk appetite are being mitigated,
monitored and reported to an appropriate level. Any risks with a high potential impact level are monitored centrally on a regular
basis. Businesses use key indicator data to help monitor the status of the risk and control environment. They also identify and
capture loss events; taking appropriate action to address actual control breakdowns and promote internal learning from these
occurrences.
The Group Operational Risk Committee (ORC) oversees the Group’s aggregate operational risk exposure on behalf of the
Group Executive Committee and reports to the Board Risk & Regulatory Committee. It makes recommendations on the risk
appetite that the Group can work within for operational risk, assesses and monitors overall operational risk exposures, identifying
any concentrations of operational risk across the Group, and in particular verifies that mitigating action plans are implemented.
The ORC operates a number of sub-committees which focus on specific areas of strategic and operational risk including customer,
brand, business protection, IT, people, legal and regulatory compliance.
(g) Strategic risk
We are exposed to a number of strategic risks. Our strategy needs to support our vision, purpose and objectives and be responsive
to both the external and internal environment, for example changes in the competitive landscape, customer behaviour, regulatory
changes, merger and acquisition opportunities and emerging trends (such as climate change, pandemic and improving longevity).
Strategic risk is explicitly considered throughout our strategic review and planning process. Developments are assessed during our
quarterly performance management process where all aspects of our risk profile are considered.
We closely monitor regulatory, legal and fiscal developments as well as actively engaging with external bodies to share the
benefit of our expertise in supporting responses to emerging risks to challenge developments that could be damaging to our
business and the industry as a whole.
(h) Brand and reputation risk
We are dependent on the strength of our brands, the brands of our partners and our reputation with customers and agents
in the sale of our products and services.
Our success and results are, to a certain extent, dependent on the strength of our brands and reputation. As part of our
ongoing “One Aviva, Twice the Value” strategy, we have been working to create a global Aviva brand, as well as rebrand
businesses in the UK under the Aviva name. While we as a group are well recognised, we are vulnerable to adverse market and
customer perception. We operate in an industry where integrity, customer trust and confidence are paramount. We are exposed
to the risk that litigation, employee misconduct, operational failures, the outcome of regulatory investigations, press speculation
and negative publicity, disclosure of confidential client information, inadequate services, amongst others, whether or not founded,
could impact our brands or reputation. Any of our brands or our reputation could also be affected if products or services
recommended by us (or any of our intermediaries) do not perform as expected (whether or not the expectations are founded)
or the customer’s expectations for the product change.
One of the FSA’s strategic objectives is to help customers get a fair deal through its “treating customers fairly” principle.
Examples of “treating customers fairly” include: products and services targeted to meet customers’ needs and which perform in
line with what customers have been led to expect; clear information (and advice where relevant); good service; and making sure
there are no unfair barriers that prevent customers from getting access to their money, changing products or making a successful
insurance claim. The FSA regularly checks that we are meeting the requirement to treat our customers fairly and we make use of
various metrics to assess our own performance, including customer advocacy, retention and complaints. Failure to meet these
requirements could also impact our brands or reputation.
If we do not manage successfully the perception of our brands and reputation, it could cause existing customers or agents
to withdraw from our business and potential customers or agents to be reluctant or elect not to do business with us. This would
adversely impact our business and results of operations.