Barclays 2015 Annual Report Download - page 141

home.barclays/annualreport Barclays PLC Annual Report 2015 I 139
Risk review
Risk management
Operational risk management
Overview
The management of operational risk has two key objectives:
 minimise the impact of losses suffered, both in the normal course of
business (small losses) and from extreme events (large losses)
 improve the effective management of the Group and strengthen its
brand and external reputation.
The Group is committed to the management and measurement of
operational risk and was granted a waiver by the FSA (now the PRA) to
operate an Advanced Measurement Approach (AMA) for operational risk
under Basel II, which commenced in January 2008. The majority of the
Group calculates regulatory capital requirements using AMA (93% of
capital requirements); however, in specific areas, the Basic Indicator
Approach (7%) is applied. The Group works to benchmark its internal
operational risk management and measurement practices with peer
banks and to drive the further development of advanced techniques.
The Group is committed to operating within a strong system of internal
control that enables business to be transacted and risk taken without
exposing the Group to unacceptable potential losses or reputational
damage. The Group has an overarching framework that sets out the
approach to internal governance. This guide establishes the mechanisms
and processes by which the Board directs the organisation, through
setting the tone and expectations from the top, delegating authority and
monitoring compliance.
Organisation and structure
Operational risk comprises a number of specific Key Risks defined as
follows:
 external supplier: inadequate selection and ongoing management of
external suppliers
 financial crime: failure to comply with anti-money laundering,
anti-bribery, anti-corruption and sanctions policies. In early January
2016, the oversight of financial crime was transferred to Group
Compliance
 financial reporting: reporting misstatement or omission within external
financial or regulatory reporting
 fraud: dishonest behaviour with the intent to make a gain or cause a
loss to others
 information: inadequate protection of the Group’s information in
accordance with its value and sensitivity
 legal: failure to identify and manage legal risks
 payments process: failure in operation of payments processes
 people: inadequate people capabilities, and/or performance/reward
structures, and/or inappropriate behaviours
 premises and security: unavailability of premises (to meet business
demand) and/or safe working environments, and inadequate
protection of physical assets, employees and customers against
external threats
 taxation: failure to comply with tax laws and practice which could lead
to financial penalties, additional tax charges or reputational damage
 technology (including cyber security): failure to develop and deploy
secure, stable and reliable technology solutions which includes risk of
loss or detriment to Barclays’ business and customers as a result of
actions committed or facilitated through the use of networked
information systems
 transaction operations: failure in the management of critical
transaction processes.
In order to ensure complete coverage of the potential adverse impacts
on the Group arising from operational risk, the operational risk taxonomy
extends beyond the operational key risks listed above to cover areas
included within conduct risk. For more information on conduct risk
please see pages 141 and 142.
These risks may result in financial and/or non-financial impacts including
legal/regulatory breaches or reputational damage.
Board Risk
Committee
Board Audit
Committee
Reporting and control
Governance Risk Committee
■ agrees and monitors businesses’ operational
risk appetite
■ reviews individual key risk types within the
business
■ monitors risk profile and control environment
(incl. assessment
of key risks)
Operational Risk Review Forum
■ reviews aggregate operational risk profile
and monitors individual businesses/
key risk appetite
■ reviews and monitors operational risk capital
■ overviews risk events/risk exposures
by way of RCSAs
■ monitors emerging themes
■ monitors Group/businesses’ risk profile
and control environment (including
assessment of key risks)
■ reviews and monitors material control
issues for remediation
■ reviews lessons learnt summaries
and recommendations
Operational risk
Any instance where there is a potential or
actual impact to the Group resulting from
inadequate or failed internal processes,
people, systems, or from an external event.
The impacts to the Group can be financial,
including losses or an unexpected financial
gain, as well as non-financial such as
customer detriment, reputational or
regulatory consequences.
The Strategic Report Governance Risk review Financial review Financial statements Shareholder information