Operational risk management
NIBC’s definition of operational risk is based on the Basel II definition. Operational risk is the risk of direct or indirect loss resulting from inadequate or failed processes or systems, from human error or external events including legal risk that affect NIBC’s reputation, operational earnings and/or have an adverse effect on capital value. In addition, reputation and strategic business risk are included as sub-categories of operational risk. For the organisation, both of these risk categories are driven by operational risk components.
The Operational Risk Manager (ORM) reports functionally to the CRO and is aligned with the activities of the Internal Audit department. The mission of the ORM is to actively promote a ‘no-surprises’ operating environment, which provides for the transparent and consistent management of operational risk across all activities of NIBC. The mission is undertaken in order to stimulate operational excellence, pro-actively manage operational risk, and meet legal and regulatory requirements.
The responsibility of monitoring and managing operational risk lies with the ORM and the business unit managers, who are responsible for implementing the enterprise-wide operational risk framework. The framework sets out the roles and responsibilities for management supervision, as well as those tools and methods used within NIBC for identifying, measuring, reporting, monitoring, and controlling operational risk. Sound Practices for the Management and Supervision of Operational Risk, published by the Basel Committee on Banking Supervision, has been used in the development of the operational risk framework to ensure robust and effective management and supervision. The framework is based on the principle that NIBC’s Managing Board and Supervisory Board and senior management are actively involved in risk management, and that NIBC’s risk management system is independent, conceptually sound and implemented with integrity. Finally, NIBC needs to ensure that there are sufficient resources available to execute the purpose and strategy of operational risk management and the business units, as well as implement control, compliance and audit functions.
Operational risk is managed at both group and divisional level. The Managing Board provides consistency and oversight of significant operational issues, and oversees the adoption of best practice across NIBC. At the divisional level and below, managers are responsible for adherence to the operational risk management policy framework, for oversight of all operational risks specific to the business, and for reporting of all operational events and losses. The ORM, working in conjunction with business unit managers, has developed tools to assist in managing, monitoring, reporting and reducing the effects of operational risk. The tools utilised by managers provide for an integrated view of the risk self-assessment, control identification, action planning, and event and loss registration. This integrated view assists in identifying, evaluating, and reducing operational risk and planning mitigation measures. The evaluation process assists in identifying emerging operational risk issues and determining how they should be pro-actively managed.
NIBC has sought to incorporate operational risk management into all its business processes. Operational risk is monitored on a daily basis as part of the ‘in control’ process and formal self assessments are performed annually. The self assessment forms the basis for the In Control and Responsibility Statement of the annual report. ‘In control’ reporting seeks to ensure that the operational risk management policy framework is integrated into the daily activities of all employees and that it forms an integral part of the internal control system. The reporting system is focused on control of the identified risks related to the operational execution of the different business activities.
