Salz Review - Wall Street Journal

Salz Review
An Independent Review of Barclays’ Business Practices
150
12. Management Oversight and Risk Management
12.1 What uniquely distinguishes banks from other companies is their role in risk transfer
and risk management. As Walter Wriston famously said: “… managing risk … is the
business of banking.” 237
The Three Lines of Defence Model
12.2 For any bank, the business practices associated with risk management and
management oversight are critical. Banks use a ‘Three Lines of Defence model’ as
the standard approach for the design and implementation of risk and control
frameworks. The ‘first line’ is the business management. They are fully responsible
for ensuring that a risk and control environment is established as part of day-to-day
operations. The ‘second line’ comprises the control functions such as Risk,
Compliance, Legal, and the non-advisory parts of Finance and HR. These functions
collectively provide oversight of the control environment by setting frameworks and
establishing, implementing and enforcing policies and procedures. The ‘third line’ is
Internal Audit as the independent provider of assurance.
12.3 While the concept is straightforward, its implementation is more difficult in complex
global organisations. All the more so where the operating model is relatively
decentralised, as at Barclays. Such decentralised organisations can blur the distinction
between the first and second lines of defence, since control functions exist (and
often report) within business units. Where control functions feel greater affinity to
the business unit they are supposed to control, they can lose the degree of
independence they need to perform their roles effectively.
12.4 The ‘operating model’ – how authority is delegated, the degree of decentralisation,
how the bank’s various businesses are managed, how decisions are made, and the
role of the Group Centre at Barclays – is critical to the management oversight of risk.
There have been periodic shifts in the level of decision making at the Group Centre
but, for most of the past 10 to 15 years, there has been considerable delegation of
authority. 238
12.5 After John Varley became Group Chief Executive in 2004, he increased delegation,
setting up two powerful business clusters. He described in 2007 how he
“decentralised operations so that many more decisions are made locally”. 239 Each
cluster had a Chief Executive who was, as John Varley put it in the 2006 Annual
Report, “the single point of strategic direction and control” for the businesses in that
cluster. The underlying philosophy of this operating model, for the most part, was
one of ‘devolution’ with the Group Centre providing strategic leadership,
237 Attributed to Walter Wriston, ex-CEO and Chairman of CitiCorp by the Economist in 1993 (“Survey of
International Bankers: A comedy of errors” April 1993) though other sources also attribute the quote to
John Pierpoint Morgan.
238 “Since I joined Barclays in 1996, it has been run on a relatively decentralised basis”, Bob Diamond Speech
to UBS Global Financial Services Conference, May 2012.
239 “Barclays’ Global Acceleration”, strategy+business, May 2007; http://www.strategybusiness.com/article/07216?pg=all.