ING Direct 2009 Annual Report Download - page 236

ING Group – Non-financial risks
Clear and accessible policies and minimum standards are embedded in ING business processes in all business lines. An infrastructure is
in place to enable management to track incidents and operational risk issues. A comprehensive system of internal controls creates an
environment of continuous improvement in managing operational risk. ING uses this knowledge (including lessons learned from incidents)
to improve the control of key processes.
Organisation of Operational Risk Management
The General Manager Corporate Operational Risk Management (CORM) reports directly to the CRO and is responsible for managing
operational risks and developing and establishing the Operational Risk Framework within ING Group, ING Bank and ING Insurance. The
General Manager Corporate ORM also establishes and approves the policies and minimum standards, and assists and supports the
Executive Board in managing ING’s operational risks. The ORM function is organised along functional reporting lines. The Business Line
operational risk managers report functionally to the General Manager CORM.
The CORM function consists of functional departments for Operational risks (including policies, systems, SOX testing, capital allocation
and reporting), for Information (Technology) risks and for Security & Investigations. The CORM function is responsible for developing
and communicating ING’s operational risk framework, policies, minimum standards and guidelines. The corporate function advises the
Executive Board and senior management, supports the business line ORM staff, monitors the quality of operational risk management
and leads the group-wide reporting of operational risks to the Executive Board.
ORM uses a layered functional approach within business lines to ensure systematic and consistent implementation of the group-wide
ORM framework, policies and minimum standards. The local and regional/division ORM Officer has the responsibility to assist local and
regional/division management in managing operational risk. The business line ORM officer has a monitoring role in the operational risk
management process and manages and supervises all functional activities of the ORM officers in the business line and region/division.
To avoid potential conflicts of interests, it is imperative that the ORM officer is impartial and objective when advising business management
on operational risk matters in their business unit or business line. To facilitate this, a strong functional reporting line to the next higher level
ORM officer is in place. The functional reporting line has clear accountabilities with regard to objective setting, remuneration, performance
management and appointment of new ORM staff.
Operational risk framework
ING has developed a comprehensive framework supporting and governing the process of identifying, mitigating, measuring and
monitoring operational risks thus reflecting the stages described in the Enterprise Risk Management model of COSO (Committee of
Sponsoring Organisations of the Treadway Commission).
1. Governance1. Governance
6. Control activities
7. Information & Communication
6. Risk monitoring
2. Objective setting
3. Event identification
4. Risk assessment
5. Risk response
At all levels in the organisation Operational Risk Committees (ORC’s) are established that identify, measure and monitor the operational
risks of the region or business unit with appropriate quality of coverage (granularity) and to ensure that appropriate management action is
taken by the responsible line managers at the appropriate level of granularity. ORC’s, chaired by the business management, steer the risk
management activities of the first and second line of defence in their entities. On a group level the Operational & Residual Risk Committee
approves the operational risk capital model.
Risk management (continued)
2.1 Consolidated annual accounts
ING Group Annual Report 2009
234