Morgan Stanley 2015 Annual Report Download - page 124

(3) At December 31, 2015, the benefit of collateral received against counterparty credit exposure was $10.4 billion in the United Kingdom (“U.K.”), with 99% of
collateral consisting of cash and U.K. and U.S. government obligations, and $5.9 billion in France with 99% of collateral consisting of cash and government
obligations of France. The benefit of collateral received against counterparty credit exposure in the other countries totaled approximately $7.0 billion, with
collateral primarily consisting of cash and government obligations of Germany, U.S. and France. These amounts do not include collateral received on secured
financing transactions.
(4) Amounts represent CDS hedges (purchased and sold) on net counterparty exposure and lending executed by trading desks responsible for hedging counterparty
and lending credit risk exposures for the Company. Amounts are based on the CDS notional amount assuming zero recovery adjusted for any fair value
receivable or payable.
(5) In addition, at December 31, 2015, the Company had exposure to these countries for overnight deposits with banks of approximately $4.3 billion.
Country Risk Exposure Related to Brazil. At December 31, 2015, the Company’s country risk exposures in Brazil included
net exposures of $4,561 million (shown in the above table). The Company’s sovereign net exposures in Brazil were
principally in the form of local currency government bonds held onshore to support client activity. The $1,025 million
(shown in the above table) of exposures to non-sovereigns were diversified across both names and sectors.
Country Risk Exposure Related to China. At December 31, 2015, the Company’s country risk exposures in China included
net exposures of $3,255 million (shown in the above table) and overnight deposits with international banks of $438 million.
The $2,981 million (shown in the above table) of exposures to non-sovereigns were diversified across both names and sectors
and were primarily concentrated in high-quality positions with negligible direct exposure to onshore equities.
Operational Risk.
Operational risk refers to the risk of loss, or of damage to the Company’s reputation, resulting from inadequate or failed
processes, people and systems or from external events (e.g., fraud, theft, legal and compliance risks or damage to physical
assets). Operational risk relates to the following risk event categories as defined by Basel II: internal fraud; external fraud,
employment practices and workplace safety; clients, products and business practices; business disruption and system failure;
damage to physical assets; and execution, delivery and process management. The Company may incur operational risk across
the full scope of its business activities, including revenue-generating activities (e.g., sales and trading) and support and
control groups (e.g., information technology and trade processing). Legal and compliance risk is discussed below under
“Legal and Compliance Risk.”
The Company has established an operational risk framework to identify, measure, monitor and control risk across the
Company. Effective operational risk management is essential to reducing the impact of operational risk incidents and
mitigating legal and reputational risks. The framework is continually evolving to account for changes in the Company and to
respond to the changing regulatory and business environment. The Company has implemented operational risk data and
assessment systems to monitor and analyze internal and external operational risk events, to assess business environment and
internal control factors and to perform scenario analysis. The collected data elements are incorporated in the operational risk
capital model. The model encompasses both quantitative and qualitative elements. Internal loss data and scenario analysis
results are direct inputs to the capital model, while external operational incidents, business environment and internal control
factors are evaluated as part of the scenario analysis process.
In addition, the Company employs a variety of risk processes and mitigants to manage its operational risk exposures. These
include a strong governance framework, a comprehensive risk management program and insurance. Operational risks and
associated risk exposures are assessed relative to the risk tolerance established by the Board and are prioritized accordingly.
The breadth and range of operational risk are such that the types of mitigating activities are wide-ranging. Examples of
activities include enhancing defenses against cyberattacks; use of legal agreements and contracts to transfer and/or limit
operational risk exposures; due diligence; implementation of enhanced policies and procedures; exception management
processing controls; and segregation of duties.
Primary responsibility for the management of operational risk is with the business segments, the control groups and the
business managers therein. The business managers maintain processes and controls designed to identify, assess, manage,
mitigate and report operational risk. Each of the business segments has a designated operational risk coordinator. The
operational risk coordinator regularly reviews operational risk issues and reports to the Company’s senior management
within each business. Each control group also has a designated operational risk coordinator and a forum for discussing
operational risk matters with the Company’s senior management. Oversight of operational risk is provided by the Operational
118