Barclays 2005 Annual Report Download - page 76

Risk management
Management of operational risk and business risk
Operational and business risks are inherent in Barclays operations and
are typical of any large enterprise.
Operational Risk is the risk of direct or indirect losses resulting from
inadequate or failed internal processes or systems, human factors,
or from external events. Major sources of operational risk include:
operational process reliability, IT security, outsourcing of operations,
dependence on key suppliers, implementation of strategic change,
integration of acquisitions, fraud, error, customer service quality,
regulatory compliance, recruitment, training and retention of staff,
and social and environmental impacts.
Business Risk is the risk of adverse outcomes resulting from a weak
competitive position or from poor choice of strategy, markets,
products, activities or structures. Major potential sources of business
risk include: revenue volatility due to factors such as macroeconomic
conditions; inflexible cost structures; uncompetitive products or
pricing; and structural inefficiencies.
Barclays is committed to the advanced management of operational
and business risks. In particular, we are implementing advanced
management and measurement approaches for operational risk
to strengthen control, improve customer service and minimise
operating losses.
It is not cost effective to attempt to eliminate all operational and
business risks and in any event it would not be possible to do so.
Events of small significance are expected to occur and are accepted as
inevitable; events of material significance are rare and the Group seeks
to reduce the risk from these in a framework consistent with its agreed
risk appetite.
Responsibility for and Control of Operational Risk
Barclays has a Group Operational Risk Framework, which is consistent
with and part of the Group Internal Control and Assurance Framework.
Minimum control requirements have been established for all key areas
of identified risk. The risk categories relevant to operational and
business risks are: Brand Management, Capital, Change, Corporate
Responsibility, Financial Crime, Financial Reporting, Taxation and
Budgeting, Legal, Operations, People, Regulatory Compliance, Strategic
and Technology.
Responsibility for implementing and overseeing these policies is to be
found throughout the organisation as follows:
•The prime responsibility for the management of operational risk
and the compliance with control requirements rests with the
business and functional units where the risk arises. Frontline risk
managers are widely distributed throughout the Group in business
units. They service and support these areas assisting line managers
in managing these risks.
•Business Risk Directors in each business are responsible for
overseeing the implementation of and compliance with
Group policies.
•Governance and Control Committees in each business monitor
control effectiveness. The Group Governance and Control
Committee receives reports from the committees in the businesses
and considers Group-wide control issues and their risk mitigation.
•In the corporate centre, the Operational Risk Director oversees the
range of operational risks across the Group in accordance with the
Group Operational Risk Framework.
•The Internal Audit function provides assurance for operational
risk control across the organisation and reports to the Board and
senior management.
The Management and Measurement of Operational Risk
Risk Assessment – A consistent approach to the identification and
assessment of key risks and controls is undertaken across all business
units. Scenario analysis and self-assessment techniques are widely
used by business management for risk identification and for evaluation
of control effectiveness and monitoring capability. Business
management determines whether particular risks are effectively
managed within business risk appetite and otherwise take remedial
action. The risk assessment process is consistent with COSO principles.
Risk Event Data Collection and Reporting – A standard process is used
Group-wide for the recognition, capture, assessment, analysis and
reporting of risk events. This process is used to help identify where
process and control requirements are needed to reduce the recurrence
of risk events. Risk events are loaded onto a central database and
reported monthly to the Operational Risk Executive Committee.
Barclays also uses a database of external public risk events to assist in
risk identification and assessment.
Reporting – Business units are required to report on both a regular and
an event-driven basis. The reports include a profile of the key risks to
their business objectives, control issues of Group-level significance,
and operational risk events. Specific reports are prepared on a regular
basis for the Risk Oversight Committee, the Board Risk Committee and
the Board Audit Committee. In particular the Group Operational Risk
Profile Report is provided quarterly to the Risk Oversight Committee.
Economic Capital – Methodologies are used for both operational and
business risks to calculate risk sensitive capital allocations. These are
allocated to business units which incur risk-based capital charges,
as a consequence, providing an incentive to manage the risk within
appetite levels. Additional investment is being made to enhance the
Operational Risk Capital model to improve risk sensitivity and to obtain
approval to apply the Advanced Measurement Approach (AMA)
under the Basel II Accord when that option first becomes available
in 2008.
Barclays PLC
Annual Report 2005
74