ING Direct 2011 Annual Report Download - page 267

Risk management continued
ING Insurance Eurasia
The Operational risk function works with the Operational Risk Management (ORM) Scorecard process to evaluate yearly the embedding
level of the ORM Framework in each business. Policies and minimum standards governing the framework are kept in the policy house.
During 2011 Operational Risk started with the implementation of this policy house in which the existing policies are kept in a well
structured and easy to access manner.
Risk appetite is defined as the risk level management is prepared to tolerate. The operational risk appetite levels are set by the management
team of ING Insurance Eurasia. Via Non-Financial Risk Committees (NFRC’s) it is ensured that responsible line managers mitigate the risks
that are not within the risk appetite. Incidents and operational risks are tracked and reported on a quarterly basis to management in the
Non-Financial Risk Dashboard.
Integrated risk assessments are performed at least once a year to determine the completeness of the risks in scope and the level of the risks.
Mitigating actions are taken on those risks that are identified as risks beyond the risk appetite level. Status of the mitigating actions is tracked.
To ensure an independent Operational risk function and the possibility for the Operational risk officers to be impartial and objective when
advising business management on Operational Risk in their Business Unit and Region, a dual reporting line, directly to Chief Risk Officer of
their business and functionally to the next higher level Operational risk Officer, is in place. The head of Operational risk ultimately reports
directly to the Deputy Chief Risk Officer.
ECONOMIC CAPITAL
Economic Capital ING Insurance Eurasia (99.5% undiversified) by Risk Category
2011 2010
Operational Risk 640 633
COMPLIANCE RISK
Compliance Risk is defined as the risk of damage to ING Insurance Eurasia’s integrity as a result of failure (or perceived failure) to comply
with relevant laws, regulations, internal policies, procedures and ethical standards. In addition to reputational damage, failure to effectively
manage Compliance Risk could expose ING Insurance Eurasia to fines, civil and criminal penalties, and payment of damages, court orders
and suspension or revocation of licenses, which would adversely impact customers, staff and shareholders of ING Insurance Eurasia.
ING Insurance Eurasia separates Compliance Risk into four conduct-related integrity risk areas: client conduct, personal conduct,
organisational conduct as well as conduct required because of laws and regulations in the financial services industry. In addition to
effective reporting systems, ING Insurance Eurasia has a Whistleblower procedure which encourages staff to speak up if they know
of or suspect a breach of external regulations or internal policies or Business Principles.
As a result of frequent evaluation of all businesses from economic, strategic and risk perspectives, ING Insurance Eurasia continues to
believe that doing businesses in Myanmar, North Korea, Sudan, Syria, Iran and Cuba should be discontinued. ING Insurance Eurasia has
a policy not to enter into new relationships with clients from these countries and processes remain in place to discontinue existing
relationships involving these countries.
ING Insurance Eurasia performs a due diligence process when developing products and invests considerably in the maintenance of risk
management, legal and compliance procedures to monitor current sales practices. Customer protection regulations as well as changes in
interpretation and perception by both the public at large and governmental authorities of acceptable market practices might influence
client expectations. The risk of potential reputational and financial impact from products and sales practices exists because of the market
situation, customer expectations, reported incidents and regulatory activity. As part of ING Insurance Eurasia’s customer centric
commitment, Compliance Risk Management and the business work closely together to optimise both products and services to meet
the customers’ needs.
ING Insurance Eurasia Compliance Risk Management has developed a framework governing the process of identifying, assessing,
mitigating, monitoring and reporting compliance risks. The Compliance function works with the ORM Scorecard process to evaluate yearly
the level in which the Compliance Risk Management Framework is embedded in each business.
To ensure an independent compliance function and the possibility for the Compliance Officers to be impartial and objective when advising
business management on Compliance Risk in their Business Unit and Region, a dual reporting line, directly to General Management of
their business and functionally to the next higher level Compliance Officer, is in place.
Main developments in 2011
• Building Customer Trust – As part of ING Insurance Eurasia’s customer centric commitment, Compliance Risk Management and the
business worked closely together to optimise both products and services to meet the customers’ needs.
• Learning – Continuous education and awareness training was provided through face-to-face training sessions and online learning tools.
1 Who we are 2 Report of the Executive Board 3 Corporate governance 4 Consolidated annual accounts 5 Parent company annual accounts 6 Other information 7 Additional information
265ING Group Annual Report 2011