Barclays 2013 Annual Report Download - page 417

Operational Risk Management Overview
Operational Risk is defined as the risk of direct or
indirect impacts resulting from human factors,
inadequate or failed internal processes and systems
or external events. During 2013 the Board Conduct,
Reputation and Operational Risk Committee was
established and met to consider the impacts that
operational risk may have on the Group.
These disclosures are unaudited unless otherwise stated
Overview (audited)
The management of operational risk has two key objectives:
1. To minimise the impact of losses suffered, both in the normal
course of business (small losses) and from extreme events (large
losses).
2. To improve the effective management of the Group and strengthen
its brand and external reputation.
Barclays is committed to the measurement and management of
operational risk and was granted a waiver by the FSA (now the PRA) to
operate an Advanced Measurement Approach (AMA) for operational
risk under Basel 2, which commenced in January 2008. The majority of
the Group calculates regulatory capital requirements using AMA (93%
of capital requirements), however, in specific areas we apply the Basic
Indicator Approach (7%). Barclays works to benchmark its internal
operational risk management and measurement practices with peer
banks and to drive the further development of advanced techniques.
Organisation and structure (audited)
Barclays is committed to operating within a strong system of internal
control that enables business to be transacted and risk taken without
exposing itself to unacceptable potential losses or reputational
damage. Barclays has an overarching framework that sets out Barclays
approach to internal governance (‘the Barclays Guide’). The Barclays
Guide establishes the mechanisms and processes by which the Board
directs the organisation, through setting the tone and expectations
from the top, delegating its authority and monitoring compliance.
A key component of the Barclays Guide is the Enterprise Risk
Management Framework (ERMF). The purpose of the ERMF is to
identify and set minimum requirements in respect of the main risks to
achieving the Group’s strategic objectives and to provide reasonable
assurance that internal controls are effective. The key elements of the
Group’s system of internal control, which is aligned to the
recommendations of The Committee of Sponsoring Organizations of
the Treadway Commission, Internal Control – Integrated Framework
(COSO), are set out in the risk control frameworks relating to each of
the Group’s Key Risks and in the Group Operational Risk Framework.
Operational Risk is one of six Principal Risks in the EMRF and comprises
a number of specific Key Risks defined as follows:
 CyberSecurity: Risk of loss or detriment to Barclays’ business and
customers as a result of actions committed or facilitated through the
use of networked information systems;
 External supplier: Inadequate selection and ongoing management of
external suppliers;
 Financial reporting: Reporting mis-statement or omission within
external financial or regulatory reporting;
 Fraud: Dishonest behaviour with the intent to make a gain or cause a
loss to others;
 Information: Inadequate protection of Barclays’ information in
accordance with its value and sensitivity;
 Legal: Failure to identify and manage legal risks;
 Payments: Failure in operation of payments processes;
 People: Inadequate people capabilities, and/or performance/reward
structures, and/or inappropriate behaviours;
 Premises & security: Unavailability of premises (to meet business
demand) and/or safe working environments, and inadequate
protection of physical assets, employees and customers against
external threats;
 Product: Inadequate design, assessment and testing of products/
services;
 Regulatory: Failure or inability to comply fully with the laws,
regulations or codes applicable specifically to the financial services
industry;
 Taxation: Failure to comply with tax laws and practice which could
lead to financial penalties, additional tax charges or reputational
damage;
 Technology: Failure to develop and deploy secure, stable and reliable
technology solutions; and
 Transaction operations: Failure in the management of critical
transaction processes.
These risks may result in financial and/or non-financial impacts
including legal/regulatory breaches or reputational damage. For more
information on Legal, Regulatory and Taxation risks please see
pages 136 to 140.
Risk management
Operational risk management
barclays.com/annualreport Barclays PLC Annual Report 2013 415
The Strategic Report Governance Risk review Financial review Financial statements Shareholder informationRisk management