Barclays 2010 Annual Report Download - page 71

Internal Audit is responsible for the independent review of risk management
and the control environment. Its objective is to provide reliable, valued
and timely assurance to the Board and Executive Management over the
effectiveness of controls, mitigating current and evolving high risks and in
so doing enhancing the controls culture within the Group. The Board Audit
Committee reviews and approves Internal Audit’s plans and resources, and
evaluates the effectiveness of Internal Audit.
An assessment by external advisers is also carried out periodically.
In addition to the Committees shown in the chart, there is a Brand and
Reputation Committee reviewing emerging issues with potentially
significant reputational impact.
Risk management responsibilities are laid out in the Principal Risks Policy,
which covers the categories of risk in which the Group has its most
significant actual or potential risk exposures.
The Principal Risks Framework:
– creates clear ownership and accountability;
– ensures the Group’s most significant risk exposures are understood and
managed in accordance with agreed risk appetite (for financial risks)
and risk tolerances (for non-financial risks); and
– ensures regular reporting of both risk exposures and the operating
effectiveness of controls.
Each of the Principal Risks, which are set out on pages 74 to 81, is owned
by a senior individual within Barclays, known as the Group Principal Risk
Owner (GPRO). The GPRO is required to document, communicate and
maintain a risk control framework which makes clear the mandated
control requirements in managing exposures to that Principal Risk, for
every business across the firm.
These control requirements are given further specification, according
to the business unit or risk type, to provide a complete and appropriate
system of internal control.
Business unit and Group centre function heads are responsible for
obtaining ongoing assurance that the controls they have put in place
to manage the risks to their business objectives are operating effectively.
Six-monthly reviews support the regulatory requirement for the Group
to make a statement about its system of internal controls (the ‘Turnbull’
statement), in the Annual Report and Accounts.
GPROs report their assessments of the risk exposure and control
effectiveness to Group-level oversight committees. Their assessments
form the basis of the reports that go to the Board Risk Committee.
Risk Appetite
Risk Appetite is defined as the level of risk that Barclays is prepared to
sustain whilst pursuing its business strategy, recognising a range of
possible outcomes as business plans are implemented. Barclays framework
combines a top-down view of its capacity to take risk with a bottom-up
view of the business risk profile associated with each business area’s
medium term plans. The appetite is ultimately approved by the Board.
The Risk Appetite framework consists of two elements: ‘Financial Volatility’
and ‘Mandate & Scale’.
Taken as a whole, the Risk Appetite framework provides a basis for the
allocation of risk capacity across Barclays Group.
Financial Volatility
Financial Volatility is defined as the level of potential deviation from expected
financial performance that Barclays is prepared to sustain at relevant points
on the risk profile.
The Board sets the Group’s financial volatility risk appetite in terms of
broad financial objectives (ie ‘top down’) on through the cycle, 1 in 7 and
1 in 25 severity levels. The Group’s risk profile is assessed via a ‘bottom-up’
analysis of the Group’s business plans to establish the financial volatility.
If the projections entail too high a level of risk (i.e breach the top-down
financial objectives at the through the cycle, 1 in 7 or 1 in 25 level),
management will challenge each area to rebalance the risk profile to bring
the bottom-up risk appetite back within top-down appetite. Performance
against Risk Appetite usage is measured and reported to the Executive
Committee and the Board regularly throughout the year.
To measure the risk entailed by the business plans, management
estimates the potential earnings volatility from different businesses under
various scenarios, represented by severity levels:
– expected loss: the average losses based on measurements over
many years
– 1 in 7 (moderate) loss: the worst level of losses out of a random sample
of 7 years
– 1 in 25 (severe) loss: the worst level of losses out of a random sample
of 25 years
Risk Appetite concepts (diagram not to scale)
Extreme Stress
Mean
Loss
Severe Stress
Potential size of loss in one year
Moderate
Stress
Economic capital
Probability of loss
Expected
Loss
Barclays PLC Annual Report 2010 www.barclays.com/annualreport10 69
Strategy Performance Financial statements Shareholder informationRisk management and governanceAbout Barclays