ING Direct 2008 Annual Report Download - page 216

2.1 Consolidated annual accounts
Operational risk framework
ING has developed a comprehensive framework supporting and governing the process of identifying, mitigating, measuring and
monitoring operational risks thus reflecting the stages described in the COSO model (Committee of Sponsoring Organisations of the
Treadway Commission). Generic mandatory controls are described in the ORM policy house. The policies have been refreshed in 2008
and are structured in line with the risk areas. Each policy has one or more minimum standards.
1. Governance1. Governance
6. Control activities
7. Information & Communication
8. Risk monitoring
2. Objective setting
3. Event identification
4. Risk assessment
5. Risk response
At all levels in the organisation Operational Risk Committees (ORCs) are established that identify, measure and monitor the operational
risks of the region or business unit with appropriate quality of coverage (granularity) and to ensure that appropriate management action
is taken by the responsible line managers at the appropriate level of granularity. ORCs, chaired by the business management, steer the
risk management activities of the first and second line of defence in their entities. On a group level the Operational & Residual Risk
Committee approves the operational risk capital model.
The operational risk appetite within ING is defined as the acceptable and authorised maximum level of risk, in each of the operational
risk areas that must be adhered to in order for ING to achieve its business plan within approved budgets. This risk appetite is monitored
quarterly through the Non-Financial Risk Dashboard which reports the key risk exposures.
Processes are in place to identify key threats, vulnerabilities and the associated risks which might cause adverse events. Event
identification is performed proactively and precedes a risk assessment. Different techniques for event identification exist within ING,
e.g. the Integrated Risk Assessment (IRA), scenario analysis, external events inventories, internal event analysis (e.g. based on information
from incident reporting), key risk indicator events and threat scans.
At least once a year all business units perform an integrated risk assessment with involvement of other risk departments such as
Compliance and Legal.
Based on the results of the risk assessment, response measures must be determined for the identified risks. Risk response actions balance
the expected cost for implementing these measures with the expected benefits regarding the risk reduction. Risk response can be
achieved through several combinations of mitigation strategies, for example reducing likelihood of occurrence, reducing impact, risk
avoidance, risk acceptance or through the transfer of risk. Tracking takes place through the global Audit Outstanding scan system.
Certain operational risks can best be transferred to the insurance market if risks are high but difficult to mitigate internally. In order to
protect ING against financial consequences of uncertain operational events ING has acquired insurance policies issued by third-party
insurers with world-wide cover for (Computer) Crime, Professional Liability, Directors and Officers Liability, Employment Practices Liability
and Fiduciary Liability. The portion of the risks that ING retains is of a similar magnitude to the risk retained for casualty business-related
catastrophe exposures.
Control activities are defined as the control measures that have been implemented and are maintained. Generic mandatory controls are
described in the ORM policy house.
Management at all levels in the organisation periodically need information on their key operational risks (including compliance and legal
risks) and mitigating actions. In order to make it easier for management to access this kind of information, the Non-Financial Risk
Dashboard (NFRD) was developed and rolled out in 2008 to all business units.
Risk management (continued)
ING Group Annual Report 2008
214