Aviva 2009 Annual Report Download - page 59

57
Performance review
Aviva plc Risk management continued
Annual Report and Accounts 2009
— Strategic risks include issues such as customer, brand,
products and markets as well as any risks to our business
model arising from changes in our market and risks arising
from mergers and acquisitions.
— Operational risks arise from inadequate or failed internal
processes, or from people and systems or from external
events. This includes business protection, information
technology, people, legal and regulatory compliance risks.
We operate within a three lines of defence model. Primary
responsibility for risk identification and management lies with
business management (the 1st line of defence). Support for and
challenge on the completeness and accuracy of risk assessment,
risk reporting and adequacy of mitigation plans are performed
by specialist risk functions (the 2nd line of defence).
Independent and objective assurance on the robustness of the
risk management framework and the appropriateness and
effectiveness of internal control is provided by group internal
audit (the 3rd line of defence).
We employ effective processes to identify, assess, mitigate,
manage and monitor the risks to which we are exposed. We
make appropriate decisions to limit and control the impact the
risks may have on our strategic objectives.
We set limits to manage our material risks to ensure we
stay within our risk appetite (the amount of risk we are willing
to accept). To work out how “material” a risk is to our business
we assess its size and scale based on how likely it is to occur and
what potential impact it would have on our business and our
stakeholders if it were to occur. Most importantly, when risks
are outside of appetite, we agree what actions need to be taken
to manage the risks.
What risk management activity happens in Aviva?
To ensure that risks are effectively identified and assessed and
that appropriate controls and responses are in place, our risk
management activity needs to operate through clearly defined
and agreed structures and processes.
At Aviva, we support and coordinate all group-wide risk
management activities through a central risk team, led by the
group chief risk officer. In each of our regions, regional chief
risk officers ensure that the regional risk profiles remain within
the limits set centrally.
The regional chief risk officers work with business
management to ensure that our risk management framework is
being used consistently across all our businesses. They also work
with the group chief risk officer to coordinate and communicate
decisions that are taken at a group level.
As well as working with the regions, the central risk team is
also responsible for managing group risk governance and oversight.
Risk management framework
At group centre, the Risk Management Framework enables us
to understand all the material risks that we currently face and
to identify early emerging risks. This knowledge helps the risk
teams to provide effective challenge and support to the regions
and its businesses.
The central risk team monitors these risk exposures on a
regular basis with a specific focus on financial risks via regular
reporting to the Group Executive Committee and, as part of the
performance management process, senior management review
risk management information to ensure the successful delivery
of our business objectives.
As well as the ongoing monitoring activities the central risk
team produces a formal quarterly risk report for the Risk and
Regulatory Committee of the board and the various risk
oversight committees.
Corporate responsibility
Governance
Shareholder information
Financial statements IFRS
Financial statements MCEV
Other information
Corporate governance and oversight
Our Risk Governance Framework allocates responsibility for the
oversight of risk management to a number of committees at
group centre with the Group Asset Liability Committee (ALCO)
and the Group Operational Risk Committee (ORC) providing
a key focus on financial and operational risk. The group centre
committees are in turn supported by similar governance
structures in the regions. These relationships are summarised
in the diagram below.
Board
— Set strategic objectives
— Monitor performance
— Set and uphold values
Group
— Set risk policies
— Monitor performance
— Oversee risk management
— Provide challenge
— Recommend risk activity
Region
— Oversee risk management
— Monitor regional risk profile
— Operate in line with policy
— Report to Group
Aviva plc Board
Audit
Committee
Risk and
Regulatory
Committee
CSR
Committee
Disclosure
Committee
Group Executive
Committee
Group ALCO Group ORC
ALCO ORC
Sub-committees Sub-committees
Regional
ExCo
Regional Risk
Committee
These committees monitor the aggregate risk profile, provide
challenge and recommend risk management activity and
ensure that our ris0k policies are used to manage risk to
agreed standards.
Board oversight is maintained on a regular basis through
its Risk and Regulatory Committee (RRC). The group chief risk
officer is a member of the Group Executive Committee and has
a reporting line to the group chief executive and to the RRC
with access to the RRC chairman, assuring independence of
the function.
Policies and procedures
We have formal risk policies that ensure a consistent approach
to the management of all our risks across all the businesses and
locations in which we operate. These risk policies define our risk
appetite and set out risk management and control standards for
the group’s worldwide operations. The risk policies also set out
the roles and responsibilities of businesses, regions, policy
owners, and the risk oversight committees.
As our business needs to change and respond to market
conditions and customer needs, we regularly monitor the
appropriateness of our risk policies and risk appetite to ensure
they remain up-to-date. This helps to provide assurance to the
various risk oversight committees that there are appropriate
controls in place for all our core business activities, and that
the processes for managing risk are understood and followed
consistently across our global businesses.
Risk and economic capital
We already use economic capital models within our decision-
making and were early adopters of stress and scenario analysis
across the risks we face, making us well placed for the
forthcoming Solvency 2 regulatory regime. However, the use
of models is balanced with sound business judgement.
The Financial Services Authority (FSA) requires Aviva
to assess its economic capital requirements to ensure that
it adequately reflects business and control risks. In turn
this analysis supports our strategic planning and decision-
making processes.
Performance review