Barclays 2008 Annual Report Download - page 136

134 Barclays PLC Annual Report 2008 |Find out more at www.barclays.com/annualreport08
Risk management
Financial crime risk management
Fraud risk and security risk
Fraud risk
The Group establishes and operates a fraud risk framework which
measures overall fraud risk exposure and controls. Together with the
Group-wide policies and reporting, this structure directs how fraud is
managed.
GFCM is responsible for delivering the overall Group Fraud Strategy
by providing oversight to Group and business units in the management
of fraud risk.
The Group Fraud Strategy is designed to:
– Contain existing risks through effective measurement, monitoring and
robust anti-fraud systems, in line with the expansion of the bank
– Identify emerging threats in order that effective fraud controls are
embedded across the Group along with increased capability to
manage risk
– Identify and manage fraud incidents, ensuring regulatory and legal
conformance, appropriate escalation and resolution of control issues
to prevent further loss
– Share fraud trends, intelligence and knowledge across the Group and
between government bodies, law enforcement agencies, financial
institutions and other key stakeholders
GFCM assesses fraud risk across existing and emerging products,
channels, and jurisdictions. It has embedded a robust fraud reporting
framework which tracks current exposure to identify risk and ensure
adequate risk management capability and controls.
The Group’s business units identify their appetite for fraud loss which
informs and determines the overall fraud plan. Objectives are set around
these plans and performance is monitored through reporting and
oversight via appropriate Governance Committees at both business unit
and Group level.
Barclays undertakes regular benchmarking performance reviews
with relevant peer groups and maintains a conduit to ensure a two-way
exchange of information and intelligence at government, trade and
industry levels.
The Barclays Group Fraud Risk profile is tracked regularly through the
review and challenge of the net losses and key risk metrics; these are then
viewed against the overall Fraud Risk Profile (at the Fraud Risk Oversight
Committee).
Aggregated fraud data is reported monthly to senior management.
The performance of the business in combating fraud losses is measured
against plan in line with the Principal Risk Policy. Key Risk Indicators are
embedded in order that overall exposure can be established. As a result
of this process, fraud can be measured and appropriate action taken to
minimise or track significant issues.
Barclays overall reported fraud losses increased in 2008 in line with
industry trends. Whilst industry and proprietary initiatives (online and
Chip/PIN) have continued to pay dividends and reduce exposure in some
areas, fraud increased in other areas and in geographies that do not have
Chip and PIN technology.
In 2008, the Group implemented a new global fraud application
system aimed at preventing first-party fraud.
Compromised customer details continue to be a significant threat
globally. GFCM continues to work closely with industry and other
associated bodies to:
– Protect any customer whose details may be compromised
– Develop a standard approach for dealing with accounts that may be
impacted by any data compromise or security breach
– Reassure customers and provide points of contact for help and
guidance.
Security risk
GFCM manages security risk. Its fundamental objective is to allow Barclays
to operate in a safe and secure manner in all existing and potential future
markets.
In pursuit of this objective, the security risk team gathers and shares
current threat assessments across business areas, using intelligence from
security and government agencies and in-country teams. It ensures that
suitable policies and control systems are in place to protect Group
business and high-risk personnel.
Barclays has developed and continues to improve a robust Group-
wide people-screening process to protect the Group from those people
who want to harm the organisation, by either joining as staff members or
becoming involved with its operations.
Security risk is regularly reported by the businesses and reviewed via
the Security Risk Management Committee, whose objectives are to:
– Consider the latest management information and security threat
assessments
– Drive forward mitigating action to protect the Group from potential
threats
– Provide guidance to the design and effectiveness of the overall Barclays
Security Risk framework
– Ensure all security risk workstreams have been effectively integrated
and implemented
– Monitor corporate security profiles against the agreed plan, tracking
issues in order that remedial action can be taken