Barclays 2009 Annual Report Download - page 135

www.barclays.com/annualreport09 Barclays PLC Annual Report 2009 133
Risk management
Operational risk management
Operational risk is the risk of direct or indirect losses resulting from
human factors, external events, and inadequate or failed internal
processes and systems. Operational risks are inherent in the Group’s
operations and are typical of any large enterprise. Major sources of
operational risk include: operational process reliability, IT security,
outsourcing of operations, dependence on key suppliers, implementation
of strategic change, integration of acquisitions, fraud, human error,
customer service quality, regulatory compliance, recruitment, training
and retention of staff, and social and environmental impacts. Barclays
is committed to the advanced measurement and management of
operational risks. In particular, it has implemented improved management
and measurement approaches for operational risk to strengthen control,
improve customer service and minimise operating losses. Barclays was
granted a Waiver to operate an Advanced Measurement Approach
(AMA) under Basel II, which commenced in January 2008.
The Group’s operational risk management framework aims to:
– Understand and report the operational risks being taken by the Group.
– Capture and report operational errors made.
– Understand and minimise the frequency and impact, on a cost benefit
basis, of operational risk events.
– Manage residual exposures using insurance.
Organisation and structure
Barclays works to benchmark our internal operation risk practices with peer
banks and to drive the development of advanced operational risk techniques
across the industry. It is not cost effective to attempt to eliminate all
operational risks and in any event it would not be possible to do so. Events
of small significance are expected to occur and are accepted as part of the
normal course of business; events of material significance are rare and
the Group seeks to reduce the risk from these in accordance with its agreed
Risk Appetite.
Barclays has a Group Operational Risk Framework, which is consistent
with and part of the Group Internal Control and Assurance Framework.
Minimum control requirements have been established for all key areas of
identified risk by ‘Principal Risk’ owners (see page 82). The risk categories
relevant to operational risks are Financial Crime, Financial Reporting,
Taxation, Legal, Operations, People, Regulatory and Technology. In addition,
the following risk categories are used for business risk: Brand Management,
Corporate Responsibility, Strategic and Major Change. Responsibility for
implementing and overseeing these policies is positioned with Group
Principal Risk Owners. The prime responsibility for the management of
operational risk and the compliance with control requirements rests with the
business and functional units where the risk arises. Front line risk managers
are widely distributed throughout the Group in business units. They service
and support these areas, assisting line managers in managing these risks.
Business Risk Directors in each business are responsible for overseeing
the implementation of and compliance with Group policies. Governance
and Control Committees in each business monitor control effectiveness.
The Group Governance and Control Committee receives reports from the
committees in the businesses and considers Group-significant control
issues and their remediation. In the Group Centre, each Principal Risk is
owned by a senior individual who liaises with Principal Risk owners within
the businesses. In addition, the Operational Risk Director oversees the
range of operational risks across the Group in accordance with the Group
Operational Risk Framework. Business units are required to report on both
a regular and an event-driven basis. The reports include a profile of the
material risks to their business objectives, control issues of Group-level
significance, and operational risk events. Specific reports are prepared on
a regular basis for the Group Risk Oversight Committee, the Board Risk
Committee and the Board Audit Committee. The Internal Audit function
provides further assurance for operational risk control across the
organisation and reports to the Board and senior management.
Measurement and capital modelling
Barclays applies a consistent approach to the identification and assessment
of key risks and controls across all business units. Managers in the
businesses use self-assessment techniques to identify risks, evaluate
control effectiveness and monitor performance. Business management
determines whether particular risks are effectively managed within business
Risk Appetite and otherwise takes remedial action. The risk assessment
process is consistent with the principles in the integrated framework
published by the Committee of Sponsoring Organisations of the Treadway
Commission (COSO).
A standard process is used Group-wide for the recognition, capture,
assessment, analysis and reporting of risk events. This process is used to
help identify where process and control requirements are needed to reduce
the recurrence of risk events. Risk events are captured in a central database
and reported monthly to the Group Operational Risk Executive Committee.
Barclays also uses a database of external public risk events and is a
member of the Operational Risk Data Exchange (ORX), an association of
international banks that share anonymised loss data information to assist
in risk identification, assessment and modelling.