Barclays 2013 Annual Report Download - page 382

Risk management
Barclays risk management strategy continued
The ERMF includes those risks incurred by Barclays that are
foreseeable, continuous, and material enough to merit establishing
specific bank-wide control frameworks. These are known as Key Risks
and are grouped into six Principal Risks. Conduct and Reputation risks
were reclassified as Principal Risks in 2013. See Principal Risks on
page 384 for more information.
A clear and consistent control framework entails specific
responsibilities. As a result, not only has the definition of the three lines
of defence been clarified (see three lines of defence below) but its
scope has been extended to all businesses and functions. This creates
the proper context for setting standards and establishing the right
practices throughout the bank. See Barclays’ risk culture – enabling the
‘Go-To’ bank on pages 378 and 379 for more information.
Three lines of defence
The three lines of defence operating model enables Barclays to
separate risk management activities between those parties that:
1. Own and take risk, and implement controls (first line);
2. Oversee and challenge the first line, provide second line risk
manactivity and support controls (second line); and
3. Provide assurance that the E-R-M process is fit for purpose, and
that it is being carried out as intended (third line).
The Enterprise Risk Management process is the ‘defence’ and
organising businesses and functions into three ‘lines’ enhances the
E-R-M process by formalising independence and challenge, whilst still
promoting collaboration and the flow of information between all areas:
First Line: Own and take risk, and implement controls
First line activities are characterised by:
 Ownership of and direct responsibility for Barclays’ returns or
elements of Barclays’ P&L; or
 Ownership of major operations, systems and processes fundamental
to the operation of the bank; or
 Direct linkage of objective setting, performance assessment and
reward to P&L performance.
With respect to risk management the first line responsibilities include:
 Taking primary accountability for risk identification, ownership,
management and control (including performance of portfolios,
trading positions, operational risks, etc.) within approved mandate,
as documented under the Key Risk Control Frameworks, including
embedding a supportive risk culture;
 Collaborating with second line on implementing and improving risk
management processes and controls;
 Monitoring the effectiveness of risk controls and the risk profile
compared to the approved risk appetite; and
 Maintaining an effective control environment across all risks,
processes and operations arising from the business, including
implementing standards to meet Group policies.
Second Line: Oversee and challenge the first line, provide second line
risk management activity and support controls
Second line activities are characterised by:
 Oversight, monitoring and challenge of the first line of defence
activities;
 Design, ownership or operation of Key Risk Control Frameworks
impacting the activities of the first line of defence;
 Operation of certain second line risk management activities; and
 No direct linkage of objective setting, performance assessment and
reward to revenue (measures related to mitigation of losses and
balancing risk and reward are permissible).
With respect to risk management the second line of defence
responsibilities include:
 Defining the Enterprise Risk Management Framework;
 Establishing the control environments for the Key Risks, including Key
Risk Control Frameworks, policies, and standards;
 Defining delegated discretions and set limits within the control
frameworks to empower risk taking by the first line;
 Assisting in the direction of the portfolio to achieve performance
against risk appetite;
 May define and operate approval processes for certain decisions
within the second line to protect the Bank from material risks;
 Communicating, educating and advising the first line on their
understanding of the risk framework and its requirements;
 Collaborating with the first line to support business growth and drive
an appropriate balance between risk and reward without diminishing
the independence from the first line; and
 Reporting on the effectiveness of the risk and control environment to
executive management and Board committees.
Third line: Provide assurance that the E-R-M process is fit for purpose,
and that it is being carried out as intended
Third line activities are characterised by:
 Providing independent and timely assurance to the Board and
Executive Management over the effectiveness of governance, risk
management and control.
With respect to risk management the third line of defence
responsibilities include:
 Assessing the effectiveness of risk management and risk mitigation
in the context of the current and expected business environment;
and
 Acting independently and objectively, without taking responsibility
for the operations of the bank or the definition of the Enterprise Risk
Management Framework and Group policies.
Governance (audited)
Governance Structure
Risk exists when the outcome of taking a particular decision or course
of action is uncertain and could potentially impact whether, or how
well, we deliver on our objectives.
Barclays faces risks throughout its business, every day, in everything it
does. Some risks we choose to take after appropriate consideration –
like lending money to a customer. Other risks may arise from
unintended consequences of internal actions, for example an IT system
failure or poor sales practices. Finally, some risks are the result of
events outside the Bank but which impact our business – such as major
exposure through trading or lending to a market counterparty which
later fails.
All employees must play their part in the Bank’s risk management,
regardless of position, function or location, and are required to be
familiar with risk management policies that are relevant to their
activities, know how to escalate actual or potential risk issues, and have
a role appropriate level of awareness of the Enterprise Risk
Management Framework, risk management process and governance
arrangements.
barclays.com/annualreport
380 Barclays PLC Annual Report 2013