ING Direct 2015 Annual Report Download - page 211

Contents
Who we are
Report of the
Management
Board
Corporate
Governance
Consolidated
annual accounts
Parent company
annual accounts
Other
information
Additional
information
Notes to the Consolidated annual accounts of ING Bank - continued
The Head of NFR reports to the Chief Risk Officer (CRO) and is responsible for developing the framework of non-financial risk policies
and standards within ING Bank and for monitoring the quality of non-financial risk management in the divisions. Whilst the Head of
Corporate Operational Risk Management (CORM) reports to the Head of NFR, the Chief Compliance Officer reports functionally to the
CRO and hierarchically to the Head of NFR.
The Head of CORM provides management on country, divisional and bank level through the NFR Dashboard with an overview of key
risks within the non-financial risk areas including compliance risks, information security risks, continuity risks, control risks, fraud and
unauthorised activities risks and personal and physical security risks, enabling management to focus and set priorities.
The Chief Compliance Officer (CCO) is the general manager of the Bank Compliance Risk Management department and the Head of the
Compliance Risk Management function within the Bank. This is an independent function responsible for developing and establishing
the Bank-wide Compliance Risk Management charter & framework which establishes the policies and minimum standards for
managing compliance risks. The CCO assists and supports the Management Board Banking in managing ING Bank’s compliance risks
and control framework.
The NFR department uses a layered functional approach within divisions to ensure systematic and consistent implementation of the
framework of policies and minimum standards within ING Bank. To avoid potential conflicts of interests, it is imperative that the staff
working in the department is independent and objective when advising business management on non-financial risk matters in their
business unit or business line. To facilitate this, a strong functional reporting line to the next higher level within Operational Risk
Management (ORM) and Compliance is in place. The functional reporting line has clear accountabilities with regard to objectives
setting, remuneration, performance management and appointment of new staff as well as obligations to veto and escalate.
Framework
ING Bank has a comprehensive framework for operational and compliance risks. This supports and governs the process of identifying,
measuring, mitigating, monitoring and reporting non-financial risks thus reflecting the stages described in the Enterprise Risk
Management model of COSO (Committee of Sponsoring Organisations of the Treadway Commission).
The risk appetite (defined as the acceptable and authorised maximum level of risk) is set by the Bank NFRC. Adherence to this risk
appetite is monitored quarterly through the NFR Dashboard which reports the key non-financial risk exposures.
Processes are in place to identify key threats, vulnerabilities and the associated risks which might cause adverse events. Event
identification is performed proactively and precedes a risk assessment. Different techniques for event identification exist within ING
Bank, e.g. Risk & Control Self-Assessments, scenario analysis, external events inventories, internal events analyses (e.g. lessons learned
based on information from event reporting), key risk indicators and threat scans.
Risk & Control Self-Assessment
Identification and assessment of non-financial risks inherent to ING Bank products, activities, people, processes and systems provide
management with an understanding of the operational risk profile. Based on the identification and assessment, internal controls are
designed to support mitigation of risks to remain within the risk appetite.
Business Environment Assessment
The Business Environment Assessment (BEA) assesses all internal control factors and external factors that could influence the internal
and external operating environment and may lead to unacceptable operational risk exposure.
Scenario analysis
Scenario analysis is a process used to consider the impact of rare, significant, yet plausible future events, taking into consideration
alternative possible outcomes for those events, their severity and frequency. Input for scenario analysis includes the results of various
internal and external assessments such as the BEA. Scenario analysis is an important component in the calculation of operational risk
capital.
Internal events analyses
Analysis of internal non-financial loss data assists in identifying, quantifying, mitigating and monitoring operational risk exposure. It
provides insight into causes and effectiveness of associated controls.
External events inventories
External non-financial loss data provides valuable information about the losses experienced by other businesses, and assists ING Bank
to quantify its exposure to risk events that have not been experienced internally.
ING Bank Annual Report 2015 209