ING Direct 2015 Annual Report Download - page 213

Contents
Who we are
Report of the
Management
Board
Corporate
Governance
Consolidated
annual accounts
Parent company
annual accounts
Other
information
Additional
information
Notes to the Consolidated annual accounts of ING Bank - continued
Legal risk is defined as the risk related to (i) a failure (or perceived failure) to adhere to applicable laws, regulations and standards, (ii)
contractual liabilities or contractual obligations that are defaulted or cannot be enforced as intended, or are enforced in an
unexpected or adverse way, and (iii) liability (tort) towards third parties due to an act or omission contributable to ING Bank
(potentially) resulting in impairment of ING Bank’s integrity, leading to damage to ING Bank’s reputation, legal or regulatory sanctions,
or financial loss.
Given the heavy reliance on IT systems in financial institutions, controls that monitor the various aspects of IT risk, such as integrity
and confidentiality, are embedded in ING Bank’s risk and control framework.
Main developments in 2015
Internal and external fraud
ING Bank is continuously working on strengthening its global fraud resilience including enhanced collaboration against cybercrime.
Exploring and combining existing data search tools that can be used for monitoring or early detection of fraudulent incoming and
outgoing payments is becoming more and more important in fraud prevention. They are being further developed into an effective set
of organisational controls.
The risk of clients and ING Bank staff being targeted by fraudsters using social engineering techniques to execute payments has
increased. Efforts are undertaken to mitigate the risk of CEO impersonation fraud such as creating awareness for customers and staff
about this type of fraud. ING Bank continues to strengthen its control environment as fraudsters are increasingly shifting their interest
to the end-user. ING Bank continues to stringently monitor both this type of fraud and new emerging fraud methodologies.
Cybercrime
Cybercrime is a continuous threat to companies in general and to financial institutions specifically. Both the frequency and the
intensity of attacks increase on a global scale. ING Bank continued building on its Cybercrime Resilience Programme moving to further
enhance the control environment to protect, detect and respond to e-banking fraud, Distributed Denial of Service (DDoS) and targeted
attacks (also called Advanced Persistent Threats). Additional controls are being embedded in the organisation as part of the overall
internal control framework and re-assessed against existing and new threats.
ING Bank is continuously working on strengthening its global cybercrime resilience including strengthened collaboration against
cybercrime with the financial industry, law enforcement authorities, government (e.g. National Cyber Security Center) and Internet
Service Providers (ISPs).
Compliance risk
Compliance risk is defined as the risk of impairment of ING Bank’s integrity as a result of failure (or perceived failure) to comply with
applicable laws, regulations, ING Bank policies and minimum standards and the ING Values as part of the Orange Code. We aim to
effectively manage compliance risks that could expose ING Bank to reputational damage, fines, civil and criminal penalties, payment
of damages, court orders and suspension or revocation of licenses that would adversely impact our customers, staff, shareholders and
other stakeholders.
Within NFR, the Bank Compliance Risk Management function established a compliance control framework in which controls are
defined based on laws, regulations and standards that are part of the internal control framework of ING Bank. To support
management in mitigating compliance risks, the Bank Compliance Risk Management function actively educates and supports the
business in managing compliance risks related to e.g. money laundering, terrorist financing, sanction and export control compliance,
conflicts of interests, mis-selling, corruption and protection of customers’ interests.
ING Bank categorises compliance risk into four conduct-related integrity risk areas:
• Client conduct related integrity risk is the risk ING Bank is exposed to through our clients;
• Personal conduct related integrity risk is the risk of compromising ING Bank through non-compliant employee behaviour, aiming to
promote individual integrity of all employees and to create an overall culture that is led by integrity;
• Financial Services conduct related integrity risk is the risk that business practices and systems compromise ING Bank as a
participant in the financial services industry taking into account its high standards when carrying on business and at all times
striving to observe the letter as well as the spirit of the law; and
• Organisational conduct related integrity risk, is the risk of compromising ING Bank or its businesses through deficiencies in
management, supervision and/or the effectiveness of governance structures.
The controls to mitigate the compliance risks associated with the above mentioned risk areas are designed and embedded in day-to-
day processes. The effectiveness of the controls as designed is tested periodically, and senior management is aware about their
responsibility to ensure their processes are compliant with applicable laws and regulations, ING Bank’s internal policies and the Orange
Code.
ING Bank Annual Report 2015 211