ING Direct 2008 Annual Report Download - page 215

ING GROUP – NON-FINANCIAL RISKS
In addition to the above financial risks (credit, market, insurance and liquidity risk) the next paragraphs describe the non-financial risks,
being operational and compliance risks.
OPERATIONAL RISKS
Operational risk is the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from
external events. It includes the related risk of reputation loss, as well as legal risk whereas strategic risks are not included. Effective
operational risk management leads to more stable business processes (including IT systems) and lower operational risk costs.
ING recognises the following operational risk areas:
Control risk• is the risk of loss due to non-adherence to business policies or guidelines. Control risks can lead to losses incurred due to
non-compliance with controls established in connection with items such as governance procedures, new product approval procedures,
and/or project management methods. Control risk can stem from improper or insufficient monitoring of entities or activities.
The risk of a loss caused by unauthorised employee activities, including -but not limited to- unauthorised approvals or overstepping •
of authority are considered unauthorised activity risk.
Processing risk• deals with the risk of losses due to failed transaction processing or process management. These events are normally
not intentional and usually involve documenting or completing current business transactions.
Employment practice risk• is the risk of loss due to actions which are consistent with employment, health or safety laws, or agreements,
from payment of personal injury claims or from diversity/discrimination events. Managing this risk means: meeting health and
workplace regulations; preventing discrimination and harassment; and in case this does happen, taking adequate counter measures.
Personal and physical security risk• is the risk of criminal and environmental threats that might endanger the security of ING personnel
(within and outside ING locations, while travelling or being expatriated) and ING assets or might have an impact on the ING
organisation.
Information (Technology) risk• is the risk of loss due to inadequate information security, resulting in a loss of information confidentiality
and/or integrity and/or availability. Aspects of information (technology) risks are user access controls, platform security controls, change
management controls, sourcing controls, security monitoring controls and fundamental information security controls.
Continuity risk• is the risk of events (e.g. natural disasters, power outages, terrorism) leading to a situation that threatens the
continuation of business (including people and assets).
Internal and external fraud risk• is the risk of loss due to deliberate abuse of procedures, systems, assets, products and/or services of ING
by those who intend to deceitfully or unlawfully benefit themselves or others.
Clear and accessible policies and minimum standards are embedded in ING business processes in all business lines. An infrastructure is
in place to enable management to track incidents and operational risk issues. A comprehensive system of internal controls creates an
environment of continuous improvement in managing operational risk. ING uses this knowledge (including lessons learned from
incidents) to improve the control of key processes.
Organisation of Operational Risk Management
The General Manager Corporate Operational Risk management (CORM) reports directly to the CRO and is responsible for managing
operational risks and developing and establishing the Operational Risk Framework within ING Group, ING Bank and ING Insurance. The
General Manager Corporate ORM also establishes and approves the Minimum Standards, and assists and supports the Executive Board
in managing ING’s operational risks. The ORM function is organised along functional reporting lines. The Business Line operational risk
managers report functionally to the General Manager CORM.
The CORM function consists of functional departments for operational risks & risk reporting, for Information (Technology) risks, for
Security & Investigations and for SOX testing. The CORM function is responsible for developing and communicating ING’s operational risk
framework, policies, minimum standards and guidelines. The corporate function advises the business line ORM staff, monitors the quality
of operational risk management and co-ordinates the group-wide reporting of operational risks to the Executive Board.
ORM uses a layered functional approach within business lines to ensure systematic and consistent implementation of the group-wide
ORM framework, policies and minimum standards. The local and regional/division ORM Officer has the responsibility to assist local and
regional/division management in managing operational risk. The business line ORM officer has a monitoring role in the operational risk
management process and manages and supervises all functional activities of the ORM officers in the business line and region/division.
To avoid potential conflicts of interests, it is imperative that the ORM officer is impartial and objective when advising business
management on operational risk matters in their business unit or business line. To facilitate this, a strong functional reporting line to
the next higher level ORM officer is in place. The functional reporting line has clear accountabilities with regard to objective setting,
remuneration, performance management and appointment of new ORM staff.
213
ING Group Annual Report 2008