Barclays 2008 Annual Report Download - page 132

130 Barclays PLC Annual Report 2008 |Find out more at www.barclays.com/annualreport08
Risk management
Operational risk management
Organisation and structure
Operational risk is the risk of direct or indirect losses resulting from human
factors, external events, and inadequate or failed internal processes and
systems. Operational risks are inherent in the Group’s operations and are
typical of any large enterprise. Major sources of operational risk include:
operational process reliability, IT security, outsourcing of operations,
dependence on key suppliers, implementation of strategic change,
integration of acquisitions, fraud, human error, customer service quality,
regulatory compliance, recruitment, training and retention of staff, and
social and environmental impacts. Barclays is committed to the advanced
measurement and management of operational risks. In particular, it has
implemented improved management and measurement approaches for
operational risk to strengthen control, improve customer service and
minimise operating losses. Barclays was granted a Waiver to operate an
Advanced Measurement Approach (AMA) under Basel II, which
commenced in January 2008.
The Group’s operational risk management framework aims to:
– Understand and report the operational risks being taken by the Group.
– Capture and report operational errors made.
– Understand and minimise the frequency and impact, on a cost benefit
basis, of operational risk events.
Barclays works closely with peer banks to benchmark our internal
operational risk practices and to drive the development of advanced
operational risk techniques across the industry. It is not cost effective to
attempt to eliminate all operational risks and in any event it would not be
possible to do so. Events of small significance are expected to occur and
are accepted as inevitable; events of material significance are rare and the
Group seeks to reduce the risk from these in a framework consistent with
its agreed Risk Appetite.
Barclays has a Group Operational Risk Framework, which is consistent
with and part of the Group Internal Control and Assurance Framework.
Minimum control requirements have been established for all key areas of
identified risk by ‘Principal Risk’ owners (see page 78). The risk categories
relevant to operational risks are Financial Crime, Financial Reporting,
Taxation, Legal, Operations, People, Regulatory and Technology. In
addition the following risk categories are used for business risk: Brand
Management, Corporate Responsibility, Strategic and Change.
Responsibility for implementing and overseeing these policies is
positioned with Group Principal Risk Owners. The prime responsibility for
the management of operational risk and the compliance with control
requirements rests with the business and functional units where the risk
arises. Front line risk managers are widely distributed throughout the
Group in business units. They service and support these areas, assisting
line managers in managing these risks.
Business Risk Directors in each business are responsible for
overseeing the implementation of and compliance with Group policies.
Governance and Control Committees in each business monitor control
effectiveness. The Group Governance and Control Committee receives
reports from the committees in the businesses and considers Group-
significant control issues and their remediation. In the Group Centre, each
Principal Risk is owned by a senior individual who liaises with Principal Risk
owners within the businesses. In addition, the Operational Risk Director
oversees the range of operational risks across the Group in accordance
with the Group Operational Risk Framework. Business units are required to
report on both a regular and an event-driven basis. The reports include a
profile of the material risks to their business objectives, control issues of
Group-level significance, and operational risk events. Specific reports are
prepared on a regular basis for the Risk Oversight Committee, the Board
Risk Committee and the Board Audit Committee. The Internal Audit
function provides further assurance for operational risk control across
the organisation and reports to the Board and senior management.