Barclays 2007 Annual Report Download - page 111

Risk management
Operational risk management
Barclays PLC Annual Report 2007 109
Operational risk management
Operational risk is the risk of direct or indirect losses
resulting from human factors, external events, and
inadequate or failed internal processes and systems.
Operational risks are inherent in Barclays operations and are
typical of any large enterprise. Major sources of operational
risk include: operational process reliability, IT security,
outsourcing of operations, dependence on key suppliers,
implementation of strategic change, integration of
acquisitions, fraud, human error, customer service quality,
regulatory compliance, recruitment, training and retention
of staff, and social and environmental impacts.
Barclays is committed to the advanced management
of operational risks. In particular, it has implemented
improved management and measurement approaches for
operational risk to strengthen control, improve customer
service and minimise operating losses. Barclays was
granted a Waiver to operate an Advanced Measurement
Approach (AMA) under Basel II, which commenced in
January 2008.
The Group’s operational risk management framework
aims to:
– Understand and report the operational risks being taken
by the Group.
– Capture and report operational errors made.
– Understand and minimise the frequency and impact,
on a cost benefit basis, of operational risk events.
Barclays works closely with peer banks to benchmark our internal
Operational Risk practices and to drive the development of advanced
Operational Risk techniques across the industry. It is not cost effective to
attempt to eliminate all operational risks and in any event it would not be
possible to do so. Events of small significance are expected to occur and
are accepted as inevitable; events of material significance are rare and the
Group seeks to reduce the risk from these in a framework consistent with
its agreed Risk Appetite.
Organisation and structure
Barclays has a Group Operational Risk Framework, which is consistent
with and part of the Group Internal Control and Assurance Framework.
Minimum control requirements have been established for all key areas
of identified risk by ‘Principal Risk’ owners (see page 85). The risk
categories relevant to operational risks are Financial Crime, Financial
Reporting, Taxation, Legal, Operations, People, Regulatory, Technology
and Change. In addition the following risk categories are used for business
risk: Brand Management, Corporate Responsibility and Strategic.
Responsibility for implementing and overseeing these policies is
positioned throughout the organisation. The prime responsibility for
the management of operational risk and the compliance with control
requirements rests with the business and functional units where the risk
arises. Frontline risk managers are widely distributed throughout the
Group in business units. They service and support these areas, assisting
line managers in managing these risks.
Business Risk Directors in each business are responsible for overseeing
the implementation of and compliance with Group policies. Governance
and Control Committees in each business monitor control effectiveness.
The Group Governance and Control Committee receives reports from the
committees in the businesses and considers Group-wide control issues
and their remediation.
In the corporate centre, each Principal Risk is owned by a senior individual
who liaises with Principal Risk owners within the businesses. In addition,
the Operational Risk Director oversees the range of operational risks across
the Group in accordance with the Group Operational Risk Framework.
Business units are required to report on both a regular and an event-driven
basis. The reports include a profile of the key risks to their business
objectives, control issues of Group-level significance, and operational risk
events. Specific reports are prepared on a regular basis for the Group Risk
Oversight Committee, the Board Risk Committee and the Board Audit
Committee. In particular, the Group Operational Risk Profile and Group
Operating Committee Report is provided quarterly to the Group Risk
Oversight Committee. The Internal Audit function provides further
assurance for operational risk control across the organisation and
reports to the Board and senior management.
Operational risk measurement and capital modelling
Barclays applies a consistent approach to the identification and assessment
of key risks and controls across all business units. Managers in the businesses
use self-assessment techniques to identify risks, evaluate control
effectiveness and monitor capability. Business management determines
whether particular risks are effectively managed within business risk
appetite and otherwise takes remedial action. The risk assessment
process is consistent with the principles in the integrated framework
published by the Committee of Sponsoring Organisations of the Treadway
Commission (COSO).
A standard process is used Group-wide for the recognition, capture,
assessment, analysis and reporting of risk events. This process is used
to help identify where process and control requirements are needed to
reduce the recurrence of risk events. Risk events are loaded onto a central
database and reported monthly to the Operational Risk Executive Committee.
Barclays also uses a database of external public risk events and is a
member of the Operational Risk Data Exchange (ORX), an association of
international banks that share anonymised loss data information to assist
in risk identification, assessment and modelling.
By combining internal data, including internal loss experience, risk and
control assessments, key indicators and audit findings, with external loss
data and expert management judgement, Barclays is able to generate Key
Risk Scenarios (KRSs), which identify the most significant operational risks