Experian 2016 Annual Report Download - page 16

14
Risk appetite
We assess the level of risk and our
associated risk appetite, to ensure
appropriate focus on the risks we face.
Risks are targeted for assessment
based upon gross risk and measured
based upon net risk, using our pre-
defined scoring methodology. Risks
are then prioritised for mitigation by
considering these scores against our
risk tolerance and appetite. The principal
risks, of which there are currently
ten, are reviewed by the Board and
Audit Committee on an ongoing basis,
and monitored by the Executive Risk
Management Committee. The Board
established risk appetite statements
for those principal risks that the Board
felt would benefit from articulation of
an objective risk appetite statement.
Behind certain statements, initial risk
metrics are being identified, which will
show whether we are working within
our tolerance and whether additional
executive attention may be required.
These metrics are being incorporated
within our quarterly reporting activities.
Our culture
The Board is aware that effective risk
management depends on behaviours.
We are now four years into our Heart
of Experian initiative, which is a way
to express the ties that bind our
organisation together, wherever we are
and whatever we do. Our core DNA –
Connect, Protect, Create – reflects what
we do and the way we work:
• Connect – bringing our people
together, to make a difference for
our clients and communities.
• Protect – how our people take
care of sensitive personal and
commercial information.
• Create – how everyone’s ideas
matter, in creating smart and
insightful ways to help consumers
and organisations.
In parallel, we recognise the behavioural
benefits that clear expectations bring to
the business. As such, we are reinforcing
our compliance culture with policies
and procedures across the business,
and wrapping this within a broader
‘One Experian’ way of working.
Future developments
In the coming year, we plan to refine our
risk management framework, as well as
our risk appetite metrics and reporting,
to further improve our risk management
monitoring. We are also evolving our
Three Lines of Defence model, where
operational management provides
the first line of defence, the Risk and
Governance teams provide the second
line of defence and Internal Audit is the
third line of defence. The enhancement
to our second line of defence will,
over time, increase the evidence and
visibility we have of the operational
effectiveness of critical business
processes. This will provide further
opportunities to strengthen and improve
our business, helping to ensure that we
are positioned to deliver a competitive,
consistent, quality service and product
to our clients. We are also developing
a software solution to give managers
an enhanced tool for monitoring their
risks; provide better live data reporting
across the Group; and give our principal
governance teams an integrated tool to
support their enhanced second line of
defence risk assessment and reporting.
Our risk landscape continues to change
as both the business and regulatory
environments evolve. The pace of
change, and the need for greater visibility
across the organisation, continue to
grow and the risk function and practices
are developing to meet these challenges.
Principal risks and uncertainties
The table on the following pages sets
out what the Board believes to be
the principal risks and uncertainties
facing Experian, the mitigating actions
for each, trending of the inherent risk
environment and an update on any
changes in the profile of each risk
during the course of the year ended
31 March 2016. The risks are arranged
in order of risk priority. The list is not
exhaustive and it is likely to change
during the current financial year,
as some risks may assume greater
importance and others may become
less significant.
For the purposes of assessing the
Group’s viability, the directors focused
on three principal risks which are
critical to our success. These risks
are summarised below and further
discussed in the Viability statement.
• Loss or inappropriate use of
consumer personal identifiable
information leading to brand
damage, legal penalties and
class action litigation.
• Significant regulatory changes or
restrictions to our business through
law changes or enforcement, leading
to changes in how we operate
our business.
• Adverse and unpredictable business
and financial markets, such as
Brazil, that may result in economic
deterioration, currency weakness
or restrictions.
Strategic report •
Principal risks – identifying
and managing risk continued
Principal risks – identifying and managing risk