TD Bank 2014 Annual Report Download - page 89

TD BANK GROUP ANNUAL REPORT 2014 MANAGEMENT’S DISCUSSION AND ANALYSIS 87
WHO MANAGES OPERATIONAL RISK
Operational Risk Management is an independent function that designs
and maintains the Bank’s overall operational risk management frame-
work. This framework sets out the enterprise-wide governance
processes, policies and practices to identify and assess, measure,
control, and monitor and report operational risk. Risk Management
provides reporting of the Bank’s operational risk exposures to senior
management through the Operational Risk Oversight Committee,
the ERMC and the Risk Committee of the Board.
The Bank also maintains program groups who oversee specific enter-
prise wide operational risk policies that require dedicated mitigation
and control activities. These policies govern the activities of the corpo-
rate functions responsible for the management and appropriate over-
sight of business continuity and crisis/incident management, supplier
risk management, financial crime risk management, project change
management, technology risk management, and information security.
The senior management of individual business units is responsible
for the day-to-day management of operational risk following the
Bank’s established operational risk management policies. Within each
business segment and corporate area, an independent risk manage-
ment function uses the elements of the operational risk management
framework according to the nature and scope of the operational risks
inherent in the area. The senior executives in each business unit partici-
pate in a Risk Management Committee that oversees operational risk
management issues and initiatives.
Ultimately, every employee has a role to play in managing opera-
tional risk. In addition to policies and procedures guiding employee
activities, training is available to all staff regarding specific types of
operational risks and their role in helping to protect the interests and
assets of the Bank.
HOW TD MANAGES OPERATIONAL RISK
The Operational Risk Management Framework outlines the internal
risk and control structure to manage operational risk and includes risk
appetite, limits, governance, policies, and processes. The Operational
Risk Management Framework is maintained by Risk Management and
supports alignment with TD’s risk appetite for operational risk. The
framework incorporates sound industry practices and meets regulatory
requirements. Key components of the framework include:
Governance and Policy
Management reporting and organizational structures emphasize
accountability, ownership, and effective oversight of each business
unit, and each corporate area’s operational risk exposures. In addition,
the expectations of the Risk Committee of the Board and senior
management for managing operational risk are set out by enterprise-
wide policies and practices.
Risk and Control Self-Assessment
Internal control is one of the primary lines of defense in safeguarding
the Bank’s employees, customers, assets, and information, and in
preventing and detecting errors and fraud. Annually, management
undertakes comprehensive assessments of key risk exposures and
the internal controls in place to reduce or offset these risks. Senior
management reviews the results of these evaluations to ensure that
risk management and internal controls are effective, appropriate,
and compliant with the Bank’s policies.
Operational Risk Event Monitoring
In order to reduce the Bank’s exposure to future loss, it is critical that
the Bank remains aware of and responds to its own and industry oper-
ational risks. The Bank’s policies and processes require that operational
risk events be identified, tracked, and reported to the appropriate level
of management to ensure that the Bank analyzes and manages such
risks appropriately and takes suitable corrective and preventative
action. The Bank also reviews, analyzes, and benchmarks TD against
industry operational risk losses that have occurred at other financial
institutions using information acquired through recognized industry
data providers.
Risk Reporting
Risk Management, in partnership with senior management, regularly
monitors risk-related measures and the status of risk throughout the
Bank to report to senior business management and the Risk Committee
of the Board. Operational risk measures are systematically tracked,
assessed, and reported to ensure management accountability and
attention are maintained over current and emerging issues.
Insurance
Operational Risk Management includes oversight of the effective use
of insurance aligned with the Bank’s risk management strategy and risk
appetite. To provide the Bank with additional protection from loss, Risk
Management manages a comprehensive portfolio of insurance and
other risk mitigating arrangements. The insurance terms and provisions,
including types and amounts of coverage in the portfolio, are continu-
ally assessed to ensure that both the Bank’s tolerance for risk and,
where applicable, statutory requirements are satisfied. The manage-
ment process includes conducting regular in-depth risk and financial
analysis and identifying opportunities to transfer elements of TD’s risk
to third parties where appropriate. The Bank transacts with external
insurers that satisfy the Bank’s minimum financial rating requirements.
Technology, Information and Cyber Security
Virtually all aspects of the Bank’s business and operations use technol-
ogy and information to create and support new markets, competitive
products and delivery channels, and other business developments.
The key risks are associated with the operational availability, integrity,
confidentiality, and security of the Bank’s information, systems, and
infrastructure. These risks are actively managed through enterprise-
wide technology risk and information security management programs
using industry best practices and the Bank’s operational risk manage-
ment framework. These programs include robust threat and vulnerabil-
ity assessments, as well as security and disciplined change
management practices.
Business Continuity and Crisis/Incident Management
During incidents that could disrupt the Bank’s business and operations,
Business Continuity Management supports the ability of senior manage-
ment to continue to manage and operate their businesses, and provide
customers access to products and services. The Bank’s robust enter-
prise-wide business continuity management program includes formal
crisis management protocols and continuity strategies. All areas of the
Bank are required to maintain and regularly test business continuity
plans designed to respond to a broad range of potential scenarios.
Supplier Management
A third party supplier/vendor is an entity that supplies a particular
product or service to or on behalf of the Bank. The benefits of leverag-
ing third parties include access to leading technology, specialized
expertise, economies of scale, and operational efficiencies. While these
relationships bring benefits to the Bank’s businesses and customers,
the Bank also needs to manage and minimize any risks related to the
activity. The Bank does this through an enterprise-level third-party risk
management program that guides third-party activities throughout
the life cycles of the arrangements and ensures the level of risk
management and senior management oversight is appropriate
to the size, risk, and importance of the third-party arrangement.
Project Management
The Bank has established a disciplined approach to project manage-
ment across the enterprise coordinated by the Bank’s Enterprise Project
Management Office (EPMO). This approach involves senior manage-
ment governance and oversight of the Bank’s project portfolio and
leverages leading industry practices to guide TD’s use of standardized
project management methodology, defined project management
accountabilities and capabilities, and project portfolio reporting and
management tools to support successful project delivery.