Barclays 2014 Annual Report Download - page 137

barclays.com/annualreport Barclays PLC Annual Report 2014 I 135
Overview
The management of operational risk has two key objectives to:
Q Minimise the impact of losses suffered, both in the normal course of
business (small losses) and from extreme events (large losses); and
Q Improve the effective management of the Group and strengthen its
brand and external reputation.
The Group is committed to the management and measurement of
operational risk and was granted a waiver by the FSA (now the PRA) to
operate an Advanced Measurement Approach (AMA) for operational
risk, which commenced in January 2008. The majority of the Group
calculates regulatory capital requirements using AMA (93% of capital
requirements); however, in specific areas, the Basic Indicator Approach
(7%) is applied. The Group works to benchmark its internal operational
risk management and measurement practices with peer banks and to
drive the further development of advanced techniques.
Organisation and structure
The Group is committed to operating within a strong system of internal
control that enables business to be transacted and risk taken without
exposing itself to unacceptable potential losses or reputational
damage. The key elements of the Group’s system of internal control,
which is aligned to the recommendations of the Committee of
Sponsoring Organizations of the Treadway Commission’s (COSO)
Internal Control – Integrated Framework, are set out in the risk control
frameworks relating to each of the Group’s Key Risks and in the Group
Operational Risk Framework.
Operational risk comprises a number of specific Key Risks defined as
follows:
Q Cyber security: risk of loss or detriment to the Group’s business and
customers as a result of actions committed or facilitated through the
use of networked information systems
Q External supplier: inadequate selection and ongoing management of
external suppliers
Q Financial reporting: reporting misstatement or omission within
external financial or regulatory reporting
Q Fraud: dishonest behaviour with the intent to make a gain or cause a
loss to others
Q Information: inadequate protection of the Group’s information in
accordance with its value and sensitivity
Q Legal: failure to identify and manage legal risks
Q Payments: failure in operation of payments processes
Q People: inadequate people capabilities, and/or performance/reward
structures, and/or inappropriate behaviours
Q Premises and security: unavailability of premises (to meet business
demand) and/or safe working environments, and inadequate
protection of physical assets, employees and customers against
external threats
Q Taxation: failure to comply with tax laws and practice which could
lead to financial penalties, additional tax charges or reputational
damage
Q Technology: failure to develop and deploy secure, stable and reliable
technology solutions
Q Transaction operations: failure in the management of critical
transaction processes
In order to ensure complete coverage of the potential adverse impacts
on the Group arising from operational risk, the operational risk
taxonomy extends beyond the operational key risks listed above to
cover areas included within conduct risk. For more information on
conduct risk please see pages 137 and 138.
Board Audit Committee Board Conduct Operational and Reputational Risk Committee
Operational Risk & Control Committee
■ Chaired by the Chief Risk Officer
■ Review, challenge and recommend operational risk appetite
■ Monitor the operational risk profile against appetite
■ Debate potential developing operational risk issues
■ Review effectiveness of Operational Risk Frameworks
Operational risk
Any instance where there is a potential or actual impact
to the Group resulting from inadequate or failed internal
processes, people, systems, or from an external event.
The impacts to the Group can be financial, including
losses or an unexpected financial gain, as well as
non-financial such as customer detriment, reputational
or regulatory consequences.
Risk review
Risk management
Operational risk management
The Strategic Report Financial review Financial statements Shareholder information
Risk review
Governance