Barclays 2006 Annual Report Download - page 94

Risk management
Operational risk and business risk management
Operational risk and business risk management
Operational and business risks are inherent in Barclays operations and
are typical of any large enterprise.
Operational risk is the risk of direct or indirect losses resulting from
inadequate or failed internal processes or systems, human factors,
or from external events. Major sources of operational risk include:
operational process reliability, IT security, outsourcing of operations,
dependence on key suppliers, implementation of strategic change,
integration of acquisitions, fraud, error, customer service quality,
regulatory compliance, recruitment, training and retention of staff,
and social and environmental impacts.
Business risk is the risk of adverse outcomes resulting from a weak
competitive position or from poor choice of strategy, markets, products,
activities or structures. Major potential sources of business risk include:
revenue volatility due to factors such as macroeconomic conditions;
inflexible cost structures; uncompetitive products or pricing; and
structural inefficiencies.
Barclays is committed to the advanced management of operational
and business risks. In particular, we are implementing improved
management and measurement approaches for operational risk to
strengthen control, improve customer service and minimise operating
losses. In addition, this investment is being made to improve risk
sensitivity, to enhance the Operational Risk Capital model and to obtain
approval to apply the Advanced Measurement Approach under the
Basel II Accord when that option first becomes available in 2008.
Barclays works closely with peer banks to benchmark our internal
Operational Risk practices and to drive the development of advanced
Operational Risk techniques across the industry.
It is not cost effective to attempt to eliminate all operational and business
risks and in any event it would not be possible to do so. Events of small
significance are expected to occur and are accepted as inevitable; events
of material significance are rare and the Group seeks to reduce the risk
from these in a framework consistent with its agreed Risk Appetite.
Responsibility for and control of operational risk
Barclays has a Group Operational Risk Framework, which is consistent
with and part of the Group Internal Control and Assurance Framework.
Minimum control requirements have been established for all key areas
of identified risk. The risk categories relevant to operational and
business risks are: Financial Crime, Financial Reporting, Taxation, Legal,
Operations, People, Regulatory Compliance, Technology, Brand
Management, Change, Corporate Responsibility and Strategic.
Responsibility for implementing and overseeing these policies is to be
found throughout the organisation as follows:
•The prime responsibility for the management of operational risk and
the compliance with control requirements rests with the business
and functional units where the risk arises. Frontline risk managers
are widely distributed throughout the Group in business units. They
service and support these areas assisting line managers in managing
these risks.
•Business Risk Directors in each business are responsible for
overseeing the implementation of and compliance with
Group policies.
•Governance and Control Committees in each business monitor
control effectiveness. The Group Governance and Control
Committee receive reports from the committees in the businesses
and considers Group-wide control issues and their risk mitigation.
•In the corporate centre, the Operational Risk Director oversees the
range of operational risks across the Group in accordance with the
Group Operational Risk Framework.
•The Internal Audit function provides assurance for operational risk
control across the organisation and reports to the Board and senior
management.
The management and measurement of operational risk
A consistent approach to the identification and assessment of key risks
and controls is undertaken across all business units. Self-assessment
techniques are used by business management for risk identification
and for evaluation of control effectiveness and monitoring capability.
Business management determines whether particular risks are
effectively managed within business risk appetite and otherwise take
remedial action. The risk assessment process is consistent with the
principles in the integrated framework published by the Committee
of Sponsoring Organisations of the Treadway Commission (COSO).
Risk event data collection and reporting
A standard process is used Group-wide for the recognition, capture,
assessment, analysis and reporting of risk events. This process is used
to help identify where process and control requirements are needed to
reduce the recurrence of risk events. Risk events are loaded onto a
central database and reported monthly to the Operational Risk
Executive Committee.
Barclays also uses a database of external public risk events and is part
of a consortium of international banks that share anonymised loss data
information to assist in risk identification and assessment.
Key risk scenarios
Using the above components of the Operational Risk Framework
we generate Key Risk Scenarios which identify our most significant
operational risks across the Group. It is these that are the main input
to our economic capital model.
Reporting
Business units are required to report on both a regular and an event-
driven basis. The reports include a profile of the key risks to their
business objectives, control issues of Group-level significance, and
operational risk events. Specific reports are prepared on a regular basis
for the Risk Oversight Committee, the Board Risk Committee and the
Board Audit Committee. In particular the Group Operational Risk Profile
Report is provided quarterly to the Risk Oversight Committee.
Economic capital
Methodologies are used to model both operational and business risk
exposures. These are allocated, on a risk sensitive basis, to business
units in the form of economic capital charges, providing an incentive to
manage these risks within appetite levels.
Barclays PLC
Annual Report 2006
90