Barclays 2013 Annual Report Download - page 418

Risk management
Operational risk management continued
The Operational Risk Framework comprises a number of elements
which allow Barclays to manage and measure its Operational risk
profile and to calculate the amount of Operational risk capital that
Barclays needs to hold to absorb potential losses. The minimum,
mandatory requirements for each of these elements are set out in the
Group Operational Risk Policies. This framework is implemented across
the Group:
 vertically, through the organisational structure with all businesses
required to implement and operate an Operational risk framework
that meets, as a minimum, the requirements detailed in these
operational risk policies; and
 horizontally, with the Group Key Risk Officers required to monitor
information relevant to their Key Risk from each Operational risk
framework element.
The prime responsibility for the management of operational risk and
the compliance with control requirements rests with the business and
functional units where the risk arises. Operational risk partners are
widely distributed throughout the Group and support these areas,
assisting line managers in understanding and challenging the
effectiveness of management of risks that they own.
The Operational Risk Director (or equivalent) for each business is
responsible for ensuring the implementation of and compliance with
Group Operational Risk policies.
The Group Operational Risk Director is responsible for establishing,
owning and maintaining an appropriate Group-wide Operational Risk
Framework and for overseeing the portfolio of Operational Risk across
the Group. The Operational Risk & Control Committee (OR&CC) is the
senior executive body responsible for the oversight and challenge of
Operational Risk and the control environment in Barclays. The outputs
of the OR&CC are presented to the Board Conduct, Reputation and
Operational Risk Committee (BCRORC).
In addition, specific operational risk committees or governance and
control committees at the business level, monitor the risk and control
environment. The OR&CC receives reports from these committees and
considers Group-significant control issues and their remediation. In
addition, the OR&CC presents control issues to the Board Audit
Committee (BAC).
Businesses are required to report their operational risks on both a
regular and an event-driven basis. The reports include a profile of the
material risks to their business objectives and the effectiveness of key
controls, control issues of Group-level significance, operational risk
events and a review of scenarios and capital. Specific reports are
prepared on a regular basis for OR&CC, BCRORC and BAC.
The Internal Audit function provides further independent review and
challenge of the Group’s operational risk management controls,
processes and systems and reports to the Board and senior
management.
Operational risk management (audited)
The Barclays Operational Risk framework is a key component of the
Enterprise Risk Management Framework and has been designed to
meet a number of external governance requirements including the
Basel Capital Accord, the Capital Requirements Directive and Turnbull
guidance as an evaluation framework for the purposes of Section 404
of the Sarbanes-Oxley Act. It also supports the Sarbanes-Oxley
requirements.
The operational risk framework includes the following elements:
Risk and control self-assessments
Barclays identifies and assesses all material risks within each business
and evaluates the key controls in place to mitigate those risks.
Managers in the businesses use self-assessment techniques to identify
risks, evaluate the effectiveness of key controls in place and assess
whether the risks are effectively managed within business risk appetite.
The businesses are then able to make decisions on what, if any, action
is required to reduce the level of risk to Barclays. These risk
assessments are monitored on a regular basis to ensure that each
business continually understands the risks it faces.
Risk events
An operational risk event is any circumstance where, through the lack
or failure of a control, Barclays has actually, or could have, made a loss.
The definition includes situations in which Barclays could have made a
loss, but in fact made a gain, as well as incidents resulting in
reputational damage or regulatory impact only.
A standard threshold is used across the Group for reporting risk events
and part of the analysis includes the identification of improvements to
processes or controls, to reduce the recurrence and/or magnitude of
risk events. For significant events, both financial and non-financial, this
analysis includes the completion of a formal lessons learnt.
Barclays also uses a database of external risk events which are publicly
available and is a member of the Operational RiskData eXchange
(ORX), a not-for-profit association of international banks formed to
share anonymous loss data information. Barclays uses this external loss
information to support and inform risk identification, assessment and
measurement.
Key indicators
Key Indicators (KIs) are metrics which allow Barclays to monitor its
operational risk profile. KIs include measurable thresholds that reflect
the risk appetite of the business. KIs are monitored to alert
management when risk levels exceed acceptable ranges or risk
appetite levels and drive timely decision making and actions.
barclays.com/annualreport
416 Barclays PLC Annual Report 2013