Barclays 2007 Annual Report Download - page 114

Risk management
Financial crime risk management
112 Barclays PLC Annual Report 2007
Fraud risk
The Group establishes and operates a fraud risk control framework which
measures overall fraud risk exposure and controls. Together with Group-
wide policies, this directs how fraud is managed.
The Group Financial Crime Management team (GFCM) is responsible for
delivering the overall fraud strategy and providing oversight to Group and
Business Units in order to manage fraud risk. The strategy is designed to:
– Identify emerging threats in order that effective controls are embedded
across the Group and build up capability to manage risk.
– Identify and manage fraud incidents, ensuring regulatory and legal
conformance, appropriate escalation and control issues are addressed
to prevent further loss.
– Work proactively to highlight areas of concern in order that remediation
can take place.
GFCM assesses the fraud risk of existing and emerging products, services,
processes and jurisdictions to drive down fraud losses as turnover/growth
increases. It also represents Barclays at trade, industry and Government
bodies providing a conduit to maximise the flow of information and
intelligence. GFCM also provides technical expertise to business areas
whether to drive through Group solutions or provide assistance with
specific incidents and investigations.
Business Units, together with product holders and channels identify their
appetite for fraud loss which informs and determines the overall fraud
plan. Objectives are then set around these plans.
At a business level, fraud risk/loss committees track fraud (and in some
cases operational) loss. The Barclays Group Fraud Risk profile is exercised
regularly through the review and challenge of the net losses and key risk
metrics; these are then viewed against the overall Fraud Risk Profile (Fraud
Oversight Committee).
Fraud is reported monthly to senior management both within the Business
Units and to Group who provide a global oversight of fraud loss. Fraud is
measured against plan for both net and gross losses and in line with the
Principal Risk Policy; Key Risk Indicators (KRIs) are embedded in order that
overall exposure can be established.
As a result of this process, fraud performance both at Business Unit and
Group level can be measured and appropriate action taken to minimise or
track significant issues.
Externally there are ‘in country’ industry-wide forums to which Barclays
contributes and in some cases can benchmark performance, controls and
current and emerging issues.
Barclays overall reported fraud losses fell in 2007, with most of the
reduction coming from significant falls in internet banking fraud.
As part of its efforts to enhance security, Barclays offers all its personal
customers complimentary internet security software to reduce phishing
attacks. The Group has also rolled out two-factor authentication
technology using the new PINsentry device to make online transactions
more secure. Enhanced transaction profiling has further improved our
ability to identify where customer accounts have been targeted by
fraudsters and take preventative action to protect funds.
Following the loss of personal data, including bank details, by both
Government agencies and other third parties, data protection and security
was a prominent theme in 2007. Barclays treats any incident of this nature
with the utmost importance and has worked closely with industry and the
Government to take steps to:
– Reassure customers and provide points of contact for help and guidance.
– Protect any customer accounts, whose details may have been
compromised.
– Develop a standard approach for dealing with accounts that may be
impacted by data security breaches.
Security risk
Group Financial Crime Management (GFCM) also manages security risk.
Its fundamental objective is to allow Barclays to operate in a safe and
secure manner in all existing and potential future markets.
In pursuit of this objective, the Security Risk team gathers and shares
current threat assessments across business areas, using intelligence from
Security and Government Agencies and ‘in country’ teams. It ensures that
suitable policies and control systems are in place to protect Group
business and that plans to protect high-risk personnel are fit for purpose
and in line with accepted best practice.
Barclays has developed and continues to improve a robust people
screening process to protect the bank from those people who want to
harm the organisation, by either joining as staff members or becoming
involved with its operations.
Security Risk is regularly reported by the businesses and reviewed via
the Security Risk Management Committee, whose objectives are to:
– Consider the latest management information and security threat
assessments.
– Drive forward mitigating action to protect the Group from potential
threats.
– Provide guidance to the design and effectiveness of the overall Barclays
Security Risk framework.
– Ensure all Security Risk workstreams have been effectively integrated
and implemented.
– Monitor corporate security profiles against the agreed plan, tracking
issues in order that remedial action can be taken.