Barclays 2004 Annual Report Download - page 70

Risk management
Management of operational risk and business risk
68
Operational and business risks are inherent in Barclays operations and
are typical of any large enterprise.
Operational Risk is the risk of direct or indirect losses resulting from
inadequate or failed internal processes or systems, human factors,
or from external events. Major sources of operational risk include:
operational process reliability, IT security, outsourcing of operations,
dependence on key suppliers, implementation of strategic change,
integration of acquisitions, fraud, error, customer service quality,
regulatory compliance, recruitment, training and retention of staff,
and social and environmental impacts.
Business Risk is the risk of adverse outcomes resulting from a weak
competitive position or from poor choice of strategy, markets,
products, activities or structures. Major potential sources of business
risk include: revenue volatility due to factors such as macro-economic
conditions; inflexible cost structures; uncompetitive products or
pricing; and structural inefficiencies.
Barclays is committed to the advanced management of operational
and business risks. In particular, we are implementing advanced
management and measurement approaches for operational risk
to strengthen control, improve customer service and minimise
operating losses.
It is not cost effective to attempt to eliminate all operational and
business risks and in any event it would not be possible to do so.
Events of small significance are expected to occur and are accepted as
inevitable; events of material significance are rare and the Group seeks
to reduce the risk from these in a framework consistent with its agreed
risk appetite.
Responsibility for and Control of Operational Risk
Barclays has a Group Operational Risk Framework, which is consistent
with and part of the Group Internal Control and Assurance Framework.
Board Governance Standards have been established for all key areas of
identified risk. These Standards are high-level articulations of the
Board’s risk control requirements. The Standards applicable to
operational and business risks are: Brand Management, Capital
Planning, Corporate Responsibility, Financial Crime, Financial
Reporting, Tax and Budgeting, Legal, Operations, People Management,
Regulatory Compliance, Change and Strategic Planning.
Responsibility for implementing and overseeing these policies is to be
found throughout the organisation as follows:
•The prime responsibility for the management of operational risk
and the compliance with Board Governance Standards rests with
the business and functional units where the risk arises. Front-line
risk managers are widely distributed throughout the Group in
business units. They service and support these areas assisting line
managers in managing these risks.
•Business Risk Directors in each business are responsible for
overseeing the implementation of and compliance with
Group policies.
•Governance and Control Committees in each business monitor
control effectiveness. The Governance and Control Committee
receives reports from the committees in the businesses and
considers Group-wide control issues and their risk mitigation.
•A Standard Owner agrees responsibility for each Board Governance
Standard, agrees policy and provides advice to business managers
Group-wide. Each monitors and reports upon the application of
their Standard.
•In the corporate centre, the Operational Risk Director oversees the
range of operational risks across the Group in accordance with the
Group Operational Risk Framework.
•The Internal Audit function provides assurance for operational
risk control across the organisation and reports to the Board and
senior management.
The Management and Measurement of Operational Risk
Risk Assessment – A consistent approach to the identification and
assessment of key risks and controls is undertaken across all business
units. Scenario analysis and self-assessment techniques are widely
used by business management for risk identification and for evaluation
of control effectiveness and monitoring capability. Business
management determines whether particular risks are effectively
managed within business risk appetite and otherwise take remedial
action. The risk assessment process is consistent with COSO principles.
Risk Event Data Collection and Reporting – A standard process is used
Group-wide for the recognition, capture, assessment, analysis and
reporting of risk events. This process is used to identify where process
and control requirements are needed to reduce the recurrence of risk
events. Risk events are loaded onto a central database and reported
monthly to the Risk Oversight Committee.
Barclays also uses a database of external public risk events to assist in
risk identification and assessment.
Reporting – Business units are required to report on both a regular
and an event-driven basis. The reports include a profile of the key risks
to their business objectives, control issues of Group-level significance,
and operational risk events. Specific reports are prepared on a regular
basis for the Risk Oversight Committee, the Board Risk Committee and
the Board Audit Committee. In particular the Group Operational Risk
Profile Report is provided quarterly to the Risk Oversight Committee.
Economic Capital – Methodologies are used for both operational and
business risks to calculate risk sensitive capital allocations. These are
allocated to business units which incur risk-based capital charges,
as a consequence, providing an incentive to manage the risk within
appetite levels. Additional investment is being made to enhance the
Operational Risk Capital model to improve risk sensitivity and to
obtain approval to apply the Advanced Measurement Approach (AMA)
under the Basel II Accord when that option first becomes available
in 2008.