Salz Review - Wall Street Journal

Salz Review
An Independent Review of Barclays’ Business Practices
154
12.20 We consider that the Group-wide management and Board Risk Committee oversight
of these risks would be improved if the management information provided included
a more granular assessment of risk against appetite to identify divergence.
Recommendation 28: Risk culture and control framework
To develop a consistently strong risk culture, Barclays should communicate
clear statements as to its Group risk appetite for all types of risk; embed
adherence to Group risk appetite into all business units; reinforce limits with
strong management action for breaches; and embed risk and compliance criteria
in performance evaluations, and in remuneration and promotion decisions.
Barclays should review its control framework and ensure that it covers all risk
types and clearly articulates roles and responsibilities across the three lines of
defence. The business (front office) responsibility for risk should be reinforced.
Barclays should endeavour to embed the framework consistently in all its
businesses.
Conduct and Operational Risk
12.21 Conduct and operational risk management in the banking industry are less mature
than credit and market risk management. While Barclays has not had a formal
conduct risk framework, it has had an operational risk framework for some time and
has developed its capability to quantify operational risk losses and capital.
12.22 Following the incidents described in Section 6, in June 2012 Barclays enhanced its
product approval process, with approvals required at various points in the product
development process. It required a product risk assessment considering control
environment reliability, intended customer outcomes and internal capabilities. In
addition, Barclays introduced a product review process to review continually the
suitability of existing products.
12.23 Both internal control and regulatory compliance concerns suggest, however, that
conduct and operational risk have not been managed as the framework intended.
― The extent of control and compliance issues in the investment bank following
the Lehman acquisition suggests that management may not have adequately
prioritised operational risk matters in the integration plan.
― Barclays has complex systems which have not been integrated and necessitate
manual intervention, including in critical areas such as risk-weighted asset
calculations, client money segregation and transaction reporting.
― Operational indicators for risks, which are difficult to quantify, are less well
developed, reducing the effectiveness of key management and Board
Committees.
12.24 As we noted in Section 6, there were also several crystallised conduct risk matters:
― Barclays’ fine for attempted LIBOR manipulation in the investment bank;