ING Direct 2015 Annual Report Download - page 212

Contents
Who we are
Report of the
Management
Board
Corporate
Governance
Consolidated
annual accounts
Parent company
annual accounts
Other
information
Additional
information
Notes to the Consolidated annual accounts of ING Bank - continued
Business units and departments perform regular BEAs and Risk & Control Self-Assessments (RCSAs) to identify and assess risks. These
are conducted with involvement of the business and their ORM, Compliance and Legal departments. Based on the results of the risk
assessment, response measures must be determined for the identified risks beyond the risk appetite. Risk response actions balance
the expected cost for implementing these measures with the expected benefits regarding the risk reduction.
Risk response can be achieved through several combinations of mitigation strategies, for example reducing likelihood of occurrence,
reducing impact, risk avoidance, risk acceptance or through the transfer of risk. Tracking takes place through ING Bank’s central risk
management system.
The yearly objective setting process for both business management and NFR professionals aims to keep improving the management
of non-financial risk throughout ING Bank to ensure that ING Bank stays in control of its current and future non-financial risks.
Advanced Measurement Approach (AMA)
ING Bank has an Operational Risk Capital model in place in which the risk profile is closely tailored to the internal risk profile of ING Bank
and its divisions, by using scenario data for capturing severe risks and internal loss and RCSA data for capturing day-to-day risks. The
business has a strong role in assessing scenario severities and the ORM function in validating the results. The internal data are
combined with external loss data (ORX) in the AMA capital calculation. In April 2013 ING Bank obtained accreditation for use of its
enhanced AMA model for regulatory supervision purposes. ING Bank reports the regulatory capital numbers on a quarterly basis. The
AMA capital for the fourth quarter of 2015 amounts to EUR 3,451 million. For the fourth quarter of 2014 the AMA capital amounted to
EUR 2,700 million. The increase reflects higher operational RWA mainly caused by a model recalibration (EUR 277 million) and the
increased impact of external loss data (EUR 317 million).
Risk mitigations
ING Bank is currently not using any insurance or risk transfer mechanisms for the mitigation of risk in the context of the AMA capital
calculation.
Operational risk
Operational risk is defined as the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and
systems or from external events.
ING Bank categorises non-financial risks in a number of risk areas. In addition to compliance risk, other risk areas include Information
(Technology) risk, continuity risk, control risk, internal and external fraud risk, unauthorised activity risk, personal and physical security
risk, processing risk and employment practice risk.
• Information (Technology) risk is the risk of loss, including reputational risk due to inadequate information security resulting in a loss
of information, confidentiality and/or integrity and/or availability;
• Continuity risk is the risk of loss due to events (e.g. natural disasters, power outages, terrorism) leading to a situation that
threatens ING's business continuity;
• Control risk is the risk of loss due to not complying with (operational, legal, compliance) controls set through governance
procedures and/or project management methods caused by improper or insufficient monitoring (testing) on entities, legal
structures or activities;
• Internal fraud risk is the risk of loss due to deliberate abuse of procedures, systems, assets, products and/or services of ING by
those employees who intend to deceitfully or unlawfully benefit themselves or others;
• External fraud risk is the risk of loss due to deliberate abuse of procedures, systems, assets, products and/or services of ING by
external parties who intend to deceitfully or unlawfully benefit themselves or others;
• Unauthorised activity risk is the risk of loss due to unauthorised employee activities, approvals or overstepping of authority caused
by intentional human behaviour;
• Personal and physical security risk is the risk of criminal and environmental threats that might endanger the security or safety of
ING personnel at work, people in ING locations, ING assets, or assets entrusted to ING, or might have an impact on the ING
organisation's confidentiality, integrity or availability;
• Processing risk is the risk of loss due to unintentional human error during (transaction) processing. Processing risk deals with the
risk of losses due to failed transaction processing, process management, or contractual liabilities;
• Employment practice risk is the risk of loss due to acts inconsistent with employment, health laws, or agreements, from payment
of personal injury claims, or from diversity/discrimination events.
Operational risk includes the related risk of reputation loss, as well as legal risk but strategic risks are not included.
Reputational risk is defined as the potential that adverse publicity regarding ING Bank’s business practices and associations, whether
accurate or not, will cause a loss of confidence in the integrity of ING Bank. Reputational risk is multidimensional and reflects the
perception of other market participants, like customers, counterparties, shareholders, investors or regulators that can adversely affect
ING Bank’s ability to maintain existing, or establish new, business relationships and continued access to sources of funding (e.g.
through the interbank or securitisation markets).
ING Bank Annual Report 2015 210