ING Direct 2008 Annual Report Download - page 217

To ensure robust operational risk management ORM develops and communicates the ORM framework, policies and guidance throughout
ING Group and monitors the key risks of ING Group to ensure that ING’s risk policies and Minimum Standards are fully implemented.
Business units have to demonstrate that the appropriate steps have been taken to control their operational risk. ING applies scorecards to
measure the quality of management of the operational risk processes within a business unit. Scoring is based on the ability to demonstrate
that the required risk management processes are in place with the business units. The scorecards indicate the level of control within the
business units. These scorecards are integral part of ING’s Dutch Central Bank approved regulatory capital model (AMA).
The Operational Risk Capital model of ING is based on a Loss Distribution Approach (LDA). The Loss Distribution is based on both
external and internal loss data exceeding EUR 1 million. The model is adjusted for the scorecard results taking into account the specific
quality of control in a business line and the occurrence of large incidents (‘bonus/malus’). This provides an incentive to local (operational
risk) management to better manage operational risk. From 2008 onwards, the model is used for regulatory capital reporting purposes
as well. ING received approval for its Advanced Measurement Approach (AMA) from the Dutch Central Bank.
Developments in 2008
Enhancements of the Non-financial Risk Dashboard
The introduction of a Non-financial Risk Dashboard (NFRD) was given priority by the Chief Risk Officer (CRO) with the aim to keep focus
on the key risk exposures when looking at the risk faced by business. The objective of the NFRD is to deliver comprehensive and integrated
risk information on Operational, Compliance and Legal Risk, using a consistent approach and risk language at all levels in the organisation.
It gives management an overview of all key risks within their jurisdiction with forced ranking and a clear description of the risks and
responses so that they can balance priorities. This supports the ING strategy for making things ‘easier’ whereby management is better
able to manage risk and give priority where it is necessary.
Corporate Operational Risk Management, in close coordination with Group Compliance Risk Management and Corporate Legal, has been
rolling out the NFRD in the ING organisation. The NFRD covers all BUs in the ING organisation. A number of existing risk reports, e.g. the
IT Risk & Control report, Compliance report and the Incident report, have been integrated into the NFRD.
The NFR Dashboard was presented to the Executive Board and the Audit Committee in November 2008. As of the fourth quarter 2008
report, the quarterly NFRD will be a recurring agenda point in Executive Board and Audit Committee meetings.
Product Approval Process
ING has revised the Product Approval Process (PAP) Minimum Standard to ensure that adequate risk assessment procedures are executed
prior to the development and/or launch of new or modified products. The PAP ensures that adequate controls are put in place to manage
the inherent risks associated with new products, related processes and system implementation, and other initiatives.
IT Risk forecasting
An IT risk forecasting model is introduced to represent the expected IT risk profile after implementation of defined mitigating actions.
Through the model, management can determine if additional mitigation projects are necessary to reduce or to maintain the IT risks at
an acceptable level.
Continuity risk
As a risk response to mitigate the risk of power supply failure in one of the data centres ING accelerated an improvement programme
for the business continuity and disaster recovery capability and platform security of its data centres.
Fraud risks
Based on the Corporate Anti-Fraud policy each business unit had to conduct a fraud-risk assessment and translated this into an anti-fraud
implementation plan (to prevent both internal and external fraud). In reaction to the SocGen incident ING initiated a project aiming to
further mitigate all trading risk related fraud risks.
Refreshment of policies and standards
ORM policies and Minimum Standards have been further enhanced to fully encompass the integrated approach of Operational,
Compliance and Legal risks (between risk departments and along functional lines). All major IT risk policies and standards have been
re-assessed against the current internal and external threats and adapted consequently.
COMPLIANCE RISK
Compliance Risk is defined as the risk of damage to ING’s integrity as a result of failure (or perceived failure) to comply with relevant
laws, regulations, internal policies and procedures or ethical standards. In addition to reputational damage, failure to effectively manage
Compliance Risk can expose financial institutions to fines, civil and criminal penalties, payment of damages, court orders and suspension
or revocation of licenses. A failure (or perceived failure) can adversely impact customers, staff and shareholders of ING.
215
ING Group Annual Report 2008