Risk governance structures

The Group maintains a risk governance structure that strengthens risk evaluation and management, whilst also positioning the Group to manage the changing regulatory environment in an efficient and effective manner.

Download larger version of chart (PDF 166KB)

Board and committees

The board, assisted by its committees, the risk oversight committee, the group executive committee, and the group audit committee, approves the Group’s overall risk management framework. The board also reviews the Group’s aggregate risk exposures and concentrations of risk to seek to ensure that these are consistent with the board’s appetite for risk. The role of the board, audit committee and risk oversight committee are shown in the Corporate governance section, and further key risk oversight roles are described below.

The group executive committee, assisted by the group business risk committee and the group asset and liability committee, supports the group chief executive in ensuring the effectiveness of the Group’s risk management framework and the clear articulation of the Group’s risk policies, whilst also reviewing the Group’s aggregate risk exposures and concentrations of risk. The group executive committee’s duties are described in greater detail in the Corporate governance section. The group executive committee members are also members of the group business risk committee which is chaired by the group chief executive. The group asset and liability committee, which is chaired by the deputy group chief executive, includes members of the group executive committee as well as the heads of products and markets and group market risk. The group business risk committee is supported by the following:

• Compliance and Operational Risk Committee
• Group Credit Risk Committee
• Group Change Management Committee

These committees are further supported by a number of specialist risk committees covering the Group’s risk types in detail.

Group executive directors have primary responsibility for measuring, monitoring and controlling risks within their areas of accountability and are required to establish control frameworks for their businesses that are consistent with the Group’s high level policies and within the parameters set by the board, group executive committee and group risk. Compliance with policies and parameters is overseen by the risk oversight committee, the group business risk committee, the group asset and liability committee, group risk and the divisional risk officers.

Reflecting the importance the Group places on risk management, risk is one of the five principal criteria that it includes within its balanced scorecard on which individual staff performance is judged. Business executives have specified risk management objectives, and incentive schemes take account of performance against these.

Risk management oversight

The chief risk director, a member of the group executive committee and reporting directly to the group chief executive, oversees and promotes the development and implementation of a consistent group wide risk management framework. The chief risk director, supported by group risk, provides objective challenge to the Group’s senior management.

Divisional risk officers provide oversight of risk management activity within each of the Group’s divisions. Reporting directly to the group executive directors responsible for the divisions and the chief risk director, their day-to-day contact with business management, business operations and risk initiatives seeks to provide an effective risk oversight mechanism.

The director of group audit provides the required independent assurance to the audit committee and the board that risks within the Group are recognised, monitored and managed within acceptable parameters. Group audit is fully independent of group risk, seeking to ensure objective challenge to the effectiveness of the risk governance framework.

Business risk management

Line management are directly accountable for the management of risks arising from the Group’s business. A key objective is to ensure that business decisions strike an appropriate balance between risk and reward, consistent with the Group’s risk appetite. The senior executive team and board receive regular briefings and guidance from the chief risk director to ensure awareness of the overarching risk management framework and a clear understanding of their accountabilities for risk and internal control.

All business units, divisions and group functions complete a control self-assessment annually (described in the Corporate governance section), reviewing the effectiveness of their internal controls and putting in place enhancements where appropriate. Managing directors and group executive directors certify the accuracy of their assessment.

Business risk management forms part of a tiered risk management model, as shown above with the divisional risk officers providing oversight and challenge, as described above, and the chief risk director and group committees establishing the group wide perspective.

This approach seeks to provide the Group with an effective mechanism for developing and embedding risk policies and risk management strategies which are aligned with the risks faced by its businesses. It also facilitates effective communication on these matters across the Group.