Experian 2016 Annual Report Download - page 15

13
Tone at the top
Business strategy
Consumers at the
heart of what we do
A culture of
winning together
Disciplined capital
allocation
A powerful
brand
Great client
outcomes
Leading, innovative
products
Risk management
Our risk management framework
The Board is responsible for maintaining
and reviewing the effectiveness of
our risk management activities from
a financial, operational and strategic
perspective. These activities are
designed to identify and manage,
rather than eliminate, the risk of failure
to achieve business objectives or to
successfully deliver our business
strategy. Our risk management
framework supports the successful
running of the business, by identifying
and where possible managing risks
to an acceptable level and delivering
assurance on these.
The risk management framework has
been built to identify, evaluate, analyse,
mitigate and monitor those risks that
threaten the successful achievement of
our business strategy and objectives,
within our risk appetite. More detail
regarding the specific actions and
processes underlying each element of
the risk management process can be
found in the Governance section.
Risks are owned and managed within the
business, and formally reviewed at least
every quarter. To supplement business
self-assessments, global governance
teams form a second line of defence,
executing information security, regulatory
compliance and business continuity
risk and control reviews. Internal Audit
provides a third line of defence, by
executing independent and objective risk
and control assessments. The results
of these reviews feed into the quarterly
reporting cycle. Risks are overseen and
supervised through the Executive and
regional risk management committees.
Our risk identification processes follow
a dual approach, seeking to identify
risks using:
• A bottom-up approach at a
business unit or country level.
This approach identifies those risks
which threaten an individual business
unit activity and are managed
by the business unit. To provide
visibility of wider issues within the
business, these are consolidated
at the regional and global level.
Higher rated risks are escalated
to the regional and Executive risk
management committees.
• A top-down approach at the
global level. This approach
identifies those principal risks which
threaten delivery of our strategy
and objectives. The diagram above
summarises our principal risk profile.
During the year under review, we began
deployment of a global issue tracking
system that consolidates the monitoring
and reporting of active risk remediation
action plans. Action items are prioritised,
monitored, reported and escalated
based upon standard criteria.
Principal risk profile
• Loss or inappropriate
use of data and systems
• New legislation or changes in
regulatory enforcement
• Increasing competition
• Failure to comply with laws
and regulations
• Adverse and unpredictable
financial markets or fiscal
developments
• Business conduct risk
• Non-resilient IT/business
environment
• Undesirable investment
outcomes
• Dependency on highly
skilled personnel
• Data ownership,
access and integrity
IMPACT
LIKELIHOOD
Sustaining a
culture
of integrity and
ethical values
Commitment
to maintaining a
strong risk and
control culture
Commitment
to competency
Risk management
Evaluate
AnalyseMitigate
IdentifyMonitor
Risk
appetite
Strategic report •Principal risks – identifying and managing risk