Barclays 2012 Annual Report Download - page 344

Operational risk management overview (audited)
Operational Risk is defined as the risk of direct or indirect impacts
resulting from human factors, inadequate or failed internal processes
and systems or external events. Recognising the impact operational
risk may have on the Group a new Board Conduct, Reputation and
Operational Risks Committee will be created in 2013.
The management of Operational Risk has two key objectives:
 To minimise the impact of losses suffered in the normal course of
business (expected losses) and to avoid or reduce the likelihood of
suffering an extreme (or unexpected) loss; and
 To improve the effective management of the Barclays Group and
strengthen its brand and external reputation.
Barclays is committed to the management and measurement of
operational risk and was granted a waiver by the FSA to operate an
Advanced Measurement Approach (AMA) for operational risk under
Basel 2, which commenced in January 2008. The majority of the Group
calculates regulatory capital using AMA, however, in specific areas we
apply the Basic Indicator Approach. In certain joint ventures and
associates, Barclays may not be able to apply the AMA.
Areas where the Group is working towards the rollout of AMA and the
Basic Indicator Approach is applied are: the Africa RBB businesses,
including Barclays Bank Mozambique and National Bank of Commerce
(Tanzania); Barclays Bank PLC Pakistan; Barclays Investment and Loans
India Limited; the new to bank business activities acquired from
Lehman Brothers; and the portfolios of assets purchased from
Woolworths Financial Services in South Africa, Citi Cards Portugal and
Italy, Standard Life Bank, MBNA Corporate Cards, Upromise, RCI, Egg
Cards, EdCon, SallreMae and Ameriprice.
Barclays works to benchmark its internal operational risk practices with
peer banks and to drive the development of advanced operational risk
techniques across the industry.
Organisation and structure
Operational Risk is one of four Principal Risks in the Barclays Principal
Risks Policy and comprises a number of specific Key Risks defined as
follows:
 CyberSecurity: Risk of loss or detriment to Barclays business and
customers as a result of actions committed or facilitated through the
use of networked information systems;
 External supplier: Inadequate selection and ongoing management of
external suppliers;
 Financial reporting: Reporting mis-statement or omission within
external financial or regulatory reporting;
 Fraud: Dishonest behaviour with the intent to make a gain or cause a
loss to others;
 Information: Inadequate protection of Barclays information in
accordance with its value and sensitivity;
 Legal: Failure to identify and manage legal risks;
 Product: Inadequate design, assessment and testing of products/
services;
 Payment process: Failure in operation of payments processes;
 People: Inadequate people capabilities, and/or performance/reward
structures, and/or inappropriate behaviours;
 Premises & security: Unavailability of premises (to meet business
demand) and/or safe working environments, and inadequate
protection of physical assets, employees and customers against
external threats;
 Regulatory: Failure or inability to comply fully with the laws,
regulations or codes applicable specifically to the financial services
industry;
 Taxation: Failure to comply with tax laws and practice which could
lead to financial penalties, additional tax charges or reputational
damage;
 Technology: Failure to develop and deploy secure, stable and reliable
technology solutions; and
 Transaction operations: Failure in the management of critical
transaction processes.
These risks may result in financial and/or non-financial impacts
including legal/regulatory breaches or reputational damage.
For more information on Legal, Regulatory and Taxation risks
please see pages 112-115.
The Operational Risk Framework comprises a number of elements
which allow Barclays to manage and measure its Operational Risk
profile and to calculate the amount of Operational Risk capital that
Barclays needs to hold to absorb potential losses. The minimum,
mandatory requirements for each of these elements are set out in the
Group Operational Risk policies. This framework is implemented across
the Group: vertically, through the organisational structure with all
businesses required to implement and operate an Operational Risk
framework that meets, as a minimum, the requirements detailed in
these operational risk policies; and horizontally, with the Group Key Risk
Owners required to monitor information relevant to their Key Risk from
each Operational Risk framework element.
Barclays operates with a robust system of internal control that seeks
to ensure that business is transacted and risk taken without exposure
to unacceptable potential losses or reputational damage. To this end,
Barclays has implemented the Group Internal Control and Assurance
Framework (GICAF) which is aligned with the internationally
recognised Committee of Sponsoring Organisations of the Treadway
Commission Framework (COSO).
The prime responsibility for the management of operational risk and
the compliance with control requirements rests with the business and
functional units where the risk arises. Operational risk managers are
widely distributed throughout the Group and support these areas,
assisting line managers in understanding and managing their risks.
The Operational Risk Director (or equivalent) for each business is
responsible for ensuring the implementation of and compliance with
Group Operational Risk policies.
The Group Operational Risk Director is responsible for establishing,
owning and maintaining an appropriate Group-wide Operational Risk
Framework and for overseeing the portfolio of Operational Risk across
the Group.
barclays.com/annualreport342 I Barclays PLC Annual Report 2012
Risk management
Operational risk management