Barclays 2015 Annual Report Download - page 132

130 I Barclays PLC Annual Report 2015 home.barclays/annualreport
Risk review
Risk management
Risk governance and assigning responsibilities
Responsibility for risk management resides at all levels of the Group,
from the Board and the Executive Committee down through the
organisation to each business manager and risk specialist. These
responsibilities are distributed so that risk/return decisions are taken at
the most appropriate level, as close as possible to the business, and are
subject to robust and effective review and challenge. Responsibilities for
effective review and challenge also reside at all levels.
The ERMF articulates a clear, consistent, comprehensive and effective
approach for the management of all risks in the Group and creates the
context for setting standards and establishing the right practices
throughout the Group. The ERMF sets out a philosophy and approach
that is applicable to the whole bank, all colleagues and to all types of
risk. It sets out the key activities required for all employees to operate
Barclays risk and control environment, with specific requirements for key
individuals, including the CRO and CEO, and the overall governance
framework designed to support its effective operation. See Risk Culture
in Barclays PLC 2015 Pillar 3 Report for more information.
The ERMF supports risk management and control by ensuring that there
is a:
 sustainable and consistent implementation of the three lines of
defence across all businesses and functions
 clear segregation of activities and duties performed by colleagues
across the Group
 framework for the management of Principal Risks
 consistent application of Barclays’ risk appetite across all Principal
Risks
 clear and simple policy hierarchy.
Three lines of defence
The enterprise risk management process is the ‘defence’, and organising
businesses and functions into three ‘lines’ enhances the E-R-M process
by formalising independence and challenge, while still promoting
collaboration and the flow of information between all areas. The three
lines of defence operating model enables the Group to separate risk
management activities:
First line: manage operational and business processes; design,
implement, operate, test and remediate controls.
First line activities are characterised by:
 ownership of and direct responsibility for the Group’s returns or
elements of Barclays’ results
 ownership of major operations, systems and processes fundamental
to the operation of the bank
 direct linkage of objective setting, performance assessment and
reward to financial performance.
Second line: oversee and challenge the first line and provide second
line risk management activity.
Second line activities are characterised by:
 oversight, monitoring and challenge of the first line of defence activities
 design, ownership or operation of Key Risk Control Frameworks
impacting the activities of the first line of defence
 operation of certain second line risk management activities (e.g.
financial rescue of a firm)
 no direct linkage of objective setting, performance assessment and
reward to revenue (measures related to mitigation of losses and
balancing risk and reward are permissible).
Third line: provide assurance that the E-R-M process is fit for
purpose, and that it is being carried out as intended.
Third line activities are characterised by:
 providing independent and timely assurance to the Board and
Executive Management over the effectiveness of governance, risk
management and control.
Following the annual review, in 2016, we have further refined the three
lines of defence model by clarifying that responsibilities for risk
management and control are defined in relation to the activities
individuals undertake as part of their role. The three key activities are:
‘Setting Policy and Conformance’ (second line); ‘Managing Operational
or Business Process’ (first and second line); and ‘Providing Independent
Assurance’ (third line). Second and third line activities have not changed,
however we have emphasised the key responsibilities of the first line,
which includes colleagues’ responsibility for understanding and owning
the process end to end, and designing, operating, testing and
remediating appropriate controls to manage those risks. Performed
appropriately and by all colleagues, together these responsibilities will
drive a stronger risk and control environment at Barclays, benefitting our
customers, clients, shareholders and regulators.
Board Risk
Committee
Board Audit
Committee
Board Reputation
Committee
Reporting and control
Treasury
Committee
■ sets policy/controls for liquidity
maturity transformation and
structural interest rate exposure
■ monitors the Group’s liquidity and
interest rate maturity mismatch
■ monitors usage of regulatory
and economic capital
■ oversees the management of
the Group’s capital plan
Operational Risk
Review Forum
■ reviews aggregate operational risk
profile and monitors individual
businesses/key risk appetite
■ reviews and monitors operational
risk capital
■ overviews risk events/risk
exposures by way of Risk Control
Self-Assessments (RCSAs)
■ monitors emerging themes
■ monitors Group/BU risk profile
and control environment
(including assessment of
key risks)
■ reviews and monitors material
control issues for remediation
■ reviews lessons learnt summaries
and recommendations
Conduct and Reputational
Risk Committee
■ assesses quality of the application
of the Conduct and Reputational
Risk Control Frameworks
■ recommends risk appetite and
sets policies to ensure consistent
adherence to that appetite
■ reviews known and emerging
reputational and conduct related
risks to consider if action is
required
■ proactively considers reputational
and conduct related issues that
arise as a result of business
activity and from external factors
Financial Risk
Committee
■ monitors risk profile with
respect to financial risk appetite
■ debates and agrees actions on
the financial risk profile and risk
strategy across the Group
■ considers issues escalated by
Risk Type Heads and Business
Risk Directors
Funding Risk Operational Risk Conduct Risk
(including Reputation Risk)
Credit Risk
Market Risk