Annual Report & Accounts 2009 - Anglo Irish Bank

Operational risk
Operational risk is the risk of loss arising from inadequate controls and procedures, unauthorised activities, outsourcing, human
error, systems failure and business continuity. In the case of legal risk, this includes the risk of loss due to litigation arising from
errors, omissions and acts by the Bank in the conduct of business. Operational risk is inherent in every business organisation
and covers a wide spectrum of issues.
The Group's management of its exposure to operational risk is governed by a policy prepared by Group Risk Management and
approved by the Risk and Compliance Committee. The policy specifies that the Group operates such measures of risk
identification, assessment, monitoring and management as are necessary to ensure that operational risk management is
consistent with the strategic goals of the Group. It is designed to safeguard the Group's assets while allowing sufficient
operational freedom to conduct the Group's business. The policy document also sets out the responsibilities of senior
management, the requirement for reporting of operational risk incidents and the role of Group Internal Audit in providing
independent assurance.
The operational risk management process consists of the setting of strategic objectives, the identification of risks and the
implementation of action plans to mitigate the risks identified. Recognising that operational risk cannot be entirely eliminated,
the Group implements risk mitigation controls including fraud prevention, contingency planning, information security and
incident management. Where appropriate this strategy is further supported by risk transfer mechanisms such as insurance.
The business units and support functions assess their operational risk profile on a semi-annual basis. The output of these
assessments are consolidated by Group Risk Management and presented to the Risk and Compliance Committee. The process
serves to ensure that key operational risks are proactively identified, evaluated, monitored and reported, and that appropriate
action is taken. In addition, the Risk and Compliance Committee receives monthly information on significant operational risk
incidents.
Reputational risk
Reputational risk is the risk of an adverse perception of the Group on the part of any stakeholder arising from an event or
transaction of, or related to, the Group.
Directors and employees are made aware of the role they have in maintaining the Bank’s reputation, and of their
responsibilities and duties from a customer service, regulatory and ethical perspective. Independent control functions including
Group Compliance, Company Secretarial, Group Finance, Group Risk Management and Group Internal Audit are responsible for
ensuring compliance with relevant internal and external requirements, and are resourced with appropriately experienced and
qualified teams. New products are reviewed by Group Compliance to ensure that they are clear, transparent and comply with
both duties of care to customers and regulatory requirements. Comprehensive and timely procedures are in place to deal with
customer complaints.
Compliance and regulatory risk
An independent Group Compliance function ('Group Compliance') is responsible for the overall management of compliance
and regulatory risk for the Group. The CRO is currently seeking suitably qualified candidates to fulfil the role of Head of Group
Compliance who will report to the CRO with oversight by the Risk and Compliance Committee.
Management and Group Compliance are responsible for the Group's compliance with all relevant regulations and good
practice guidelines in each of the jurisdictions in which the Group operates. This includes ensuring that all of the Group’s
personnel are aware of, and take steps to comply with, Group policies and procedures. Non-compliance can give rise to
reputational loss, legal or regulatory sanctions or material financial loss.
Anglo Irish Bank
Annual Report & Accounts 2009
Group Compliance is charged with defining and identifying regulatory and compliance risks and developing a programme for
the Group that includes the implementation and review of specific policies and procedures, and the monitoring and education
of Group staff on regulatory and compliance matters. This programme is risk-based and the Head of Group Compliance is
responsible for ensuring appropriate coverage and co-ordination with other Group functions. The function liaises with all
relevant external supervisory bodies.
The Group is subject to substantial regulation in all of the jurisdictions in which it operates. In addition to prudential regulatory
guidelines on capital, liquidity, risk concentrations, deposit protection and consumer protection, banks are also subject to
specific legislation regarding, but not limited to, money laundering, insider dealing and market regulation. Group Compliance
co-ordinates the Group's regulatory and legal responsibilities and works closely with Group Finance, Group Risk Management,
Group Company Secretarial and Group Internal Audit.
129