Barclays 2015 Annual Report Download - page 142

140 I Barclays PLC Annual Report 2015 home.barclays/annualreport
Risk review
Risk management
Operational risk management
Roles and responsibilities
The prime responsibility for the management of operational risk and the
compliance with control requirements rests with the business and
functional units where the risk arises. The operational risk profile and
control environment is reviewed by business unit management through
specific meetings which cover governance, risk and control. Businesses
are required to report their operational risks on both a regular and an
event driven basis. The reports include a profile of the material risks that
may threaten the achievement of their objectives and the effectiveness
of key controls, material control issues, operational risk events and a
review of scenarios.
The Group Head of Operational Risk, as Principal Risk Officer, is
responsible for establishing, owning and maintaining an appropriate
Group-wide Operational Risk Framework and for overseeing the portfolio
of operational risk across the Group.
Operational risk management acts in a second line of defence capacity,
and is responsible for implementation of the framework and monitoring
operational risk events, risk exposures and material control issues.
Through attendance at Business Unit Governance, Risk and Controls
meetings, it provides specific risk input into the issues highlighted and
the overall risk profile of the business. Operational risk issues escalated
from these meetings are considered by the Group Principal Risk Officer
through the second line of defence review meetings, which also consider
material control issues and their effective remediation. Depending on
their nature, the outputs of these meetings are presented to the BRC or
the BAC.
Specific reports are prepared by businesses, Key Risk Officers and Group
Operational Risk on a regular basis for ORRF, BRC and BAC.
Risk and control self-assessments and key indicators
The Group identifies and assesses all material risks within each business
and evaluates the key controls in place to mitigate those risks. Managers
in the businesses use self-assessment techniques to identify risks,
evaluate the effectiveness of key controls in place, and assess whether
the risks are effectively managed within business risk appetite. The
businesses are then able to make decisions on what action, if any, is
required to reduce the level of risk to the Group. These risk assessments
are monitored on a regular basis to ensure that each business
continually understands the risks it faces.
Key Indicators (KIs) are metrics which allow the Group to monitor its
operational risk profile. KIs include measurable thresholds that reflect the
risk appetite of the business and are monitored to alert management
when risk levels exceed acceptable ranges or risk appetite levels and
drive timely decision making and actions.