ING Direct 2015 Annual Report Download - page 156

Contents
Who we are
Report of the
Management
Board
Corporate
Governance
Consolidated
annual accounts
Parent company
annual accounts
Other
information
Additional
information
Notes to the Consolidated annual accounts of ING Bank - continued
Risk identification
Risk identification is a joint effort of the commercial business and the risk management functions. Its goal is to detect potential new
risks and determine changes in known risks. Regular risk identification is essential for both the effectiveness and efficiency of risk
management. Potential risks that are not identified, will not be controlled and monitored and may lead to surprises later. Known risks
may have changed over time and as a consequence the existing mitigating measures and monitoring may be inadequate or obsolete.
Risk identification is performed periodically. In case of material internal or external change, additional ad-hoc risk identification can be
performed.
Risk assessment and control
Each identified risk is assessed to determine the importance, or risk level, of the risk for the ING Bank entity in scope. This enables the
entity to decide which of the identified risks need control measures and how strict or tolerant these measures must be. Known risks
are re-assessed to either confirm the risk level or detect change.
The importance of a risk is assessed based on the likelihood the risk materialises and the subsequent financial or reputational impact
should the risk occur. Unlikely risks with a potentially high impact need to be controlled. For a risk that is likely to happen regularly, but
is expected to have a modest financial impact, business management may decide to not mitigate and accept the consequences when
it happens.
Risks can be controlled by mitigating measures that either lower the likelihood the risk occurs, or measures that lower the impact
when they occur. The ultimate measure to lower risk is to stop the activity or service that causes the risk (risk avoidance). Risk
controlling/mitigating measures are defined and maintained at both Bank wide and local level.
Monitoring and reporting
With the monitoring of the risk control measures, ING Bank continuously checks if they are executed, complied with, have the
expected mitigating effects and follow the development of the risks and their risk levels. Adequate risk reporting provides senior and
local management with the information they need to manage risk.
Risk appetite framework
ING Bank uses an integrated risk management approach for its banking activities. The Management Board Banking uses the bank risk
appetite framework to set both boundaries for the Medium Term Plan (MTP) budget process and to monitor and manage the actual
risk profile in relation to the risk appetite.
ING Bank Annual Report 2015 154