ING Direct 2011 Annual Report Download - page 278

Risk management continued
ING Insurance US
liquidity problems in distressed markets. Liquidity risk is measured through several metrics including ratios and cash flow scenario analysis,
in a base case and under several stressed scenarios.
OPERATIONAL RISK
Operational risk is defined as the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or
from external events. It includes the risk of reputation loss, as well as legal risk whereas strategic risks are not included. Operational risk
also includes IT risk.
For Operational Risk, ING Insurance US follows the ING Group framework governing the process of identifying, assessing, mitigating,
monitoring and reporting operational risks. The ING framework is based on the elements of the Enterprise Risk Management model of
COSO (Committee of Sponsoring Organisations of the Treadway Commission).
The Operational risk function works with the ING Operational Risk Management (ORM) Scorecard process to evaluate yearly the
embedding level of the Operational Risk Management Framework in each business. Policies and minimum standards governing the
framework are kept in the policy house. During 2011 Operational Risk started with the implementation of an ING Insurance US policy
house in preparing for a stand-alone public organisation.
Risk appetite is defined as the risk level management is prepared to tolerate. The operational risk appetite levels are set by ING Group
inthe form of a risk footprint. Via Operational Risk Committees (ORCs) it is ensured that responsible line managers mitigate the risks that
arenot within the risk appetite. Incidents and operational risks are tracked and on a quarterly basis reported to management in the
Non-Financial Risk Dashboard.
Integrated risk assessments are performed on an ongoing basis across the organisation. Mitigating actions are taken for those risks that
are identified as risks beyond the risk appetite level. Status of the mitigating actions is formally tracked.
To ensure an independent Operational risk function and the possibility for the Operational risk officers to be impartial and objective when
advising business management on Operational Risk, a dual reporting line, directly to ING Insurance US Chief Risk Officer and functionally
to the next higher level ING Group Operational Risk Officer, is in place. The head of Operational risk ultimately reports directly to the ING
Insurance US Chief Risk Officer.
ING INSURANCE US COMPLIANCE RISK
The ING Insurance US Compliance program and function are aligned with ING Group’s Compliance Risk Management Charter and
Framework and the related processes described elsewhere in this Report.
The Scope of the Compliance function
The ING Insurance US Compliance function focuses on managing the risks arising from laws, regulations and standards which are specific
to the financial services industry. The Compliance function actively educates and supports the business in managing compliance risks
including anti-money laundering, preventing terrorist financing, conflicts of interest, sales practices for insurance and investment products,
trading conduct and protection of customer interests.
The Compliance function
In ING Insurance US, the Compliance function is an independent control and risk management department. The ING Insurance US Chief
Compliance Officer reports directly to the ING Insurance US Chief Legal Officer, who is a member of the ING Insurance US Executive
Committee. The ING Insurance US Chief Compliance Officer also has a functional reporting line to the ING Group Chief Compliance Officer.
Compliance Risk Management Framework
ING Insurance US adheres to the ING Group Compliance Framework, which consists of three key components: the Compliance Risk
Management process, an Advisory component and the Scorecard. ING Insurance US Compliance executes a regular process of identifying,
assessing, mitigating, monitoring and reporting compliance risks. The Compliance function works with Operational Risk Management’s
annual evaluation process, assessing the implementation of compliance program elements within each business line andacross the
enterprise.
ING Insurance US also maintains a Whistleblower process, which encourages staff to speak up, without fear of reprisal, if they know ofor
suspect a breach of laws, regulations or internal policies. ING Insurance US also maintains a domestic “hotline” operated by a third-party
vendor that is available to all employees to report suspected misconduct, and reporting employees may elect to remain anonymous in
doing so.
276 ING Group Annual Report 2011