TlB Annual Report 2009 - Triodos Bank

Risk Management and Compliance
Triodos Bank uses and maintains a framework
of systems, procedures, limits,
reports and checks to manage the risks it
faces. The structure and organisation of its
business processes comply with the applicable
legislation and regulations for financial
institutions and Triodos Bank’s sustainability
aims. The three lines of defence model is the
basis for managing the risks within the Group.
The business units and departments are responsible
for managing their own risks (first line of
defence). Group Risk Management and local
risk officers (second line of defence) support and
advise the business units and departments in
embedding these processes in the organisation.
Finally, Group Audit (third line of defence)
periodically assess the design and effectiveness
of internal processes and controls.
Risk management is monitored on a day-to-day
basis by Group Risk Management. The head of
this department reports directly to the Executive
Board of Triodos Bank. The Group Risk
Management department’s primary task is to
support the business in identifying, assessing,
mitigating and monitoring their risks. It also
analyses risks, prepares policies and guidelines
and coordinates the management of the operational,
credit, market and liquidity risks facing
Triodos Bank. Other major responsibilities are
to make sure that all business units and departments
embed a coherent risk framework, and to
guarantee that professional knowledge in a
number of relevant fields is properly managed.
To support this role, the organisation is continuously
building an enterprise risk management
framework. This framework is developed by
Group Risk Management under the responsibility
of the cfo. In line with this framework risk
co-ordinators at each of the Bank’s business
units are appointed to align the overall enterprise
risk framework into the business.
Group risk management policies are approved
by Triodos Bank’s Executive Board on the
advice of the responsible risk manager and
consultation of the International Management
Counsel (imc). The Executive Board has assigned
an advisory responsibility for balance sheet
management and related risks to the Assets and
Liabilities Committee that operates under the
responsibility of the cfo.
Triodos Bank has performed an impact analysis
of the Dutch Banking Code of the Dutch
Bankers’ Association (nvb). Recommendations
of the Code are all being considered for implementation
in 2010. One of the initiatives relates
to the extending of the Audit Committee to an
Audit & Risk Committee as a subcommittee of
the Supervisory Board.
OPERATIONAL RISK
In the course of its normal business, Triodos
Bank runs operational risks. These risks relate
to losses the Bank could incur as a result of
inadequate or failing internal processes, systems,
human behaviour or external events. Triodos
Bank tries to limit these risks as much as possible
by making sure there are clear policies,
reports and procedures in place for all business
processes. Numerous control measures are
embedded in it-systems and recorded in monitoring
procedures and work instructions.
Training, level of experience and involvement
of the co-workers all support this, because
people are key in the success of a risk management
process. Nevertheless, the size of the
organisation involves a limited dependency on
certain key individuals. The Operational Risk
Framework has been updated based on the
Enterprise Risk Framework. While the framework
has been written, the policies that come
from it will be ready by the end of 2010. The
operational risk framework uses several tools
and technologies to identify, measure, mitigate
and monitor risks on an operational, tactical
and strategic level.
Triodos Bank started the first phase of the
implementation of a product approval process
to assess new projects, products and (any
outsourcing of) processes, which systematically
maps out risks. This process takes into account
our duty of care to clients, and Triodos Bank’s
substantial objective, such as screening for
environmental criteria.
A special part of Operational Risk Management
is it Security and Business Continuity. Activities
to manage risks related to these subjects are
executed under the responsibility of the coo.
In 2009, live tests have been performed on
Business Continuity in addition to the annual
TRIODOS BANK - ANNUAL REPORT 2009 53