996 - Banca Antonveneta

• attributing the regular segment used to measurecredit risk to this data;• assigning the Business Line on the basis of theaforesaid segment and the nature of the product towhich the profitability data refers.b. Collection and preservation of operationalrisk datab.1 Management of historical operational riskeventsBanca Antonveneta has devised, regulated and activateda historical operational risk event management processwhich provides for specific stages dedicated to theidentification, investigation and management ofoperational loss events, involving the following entitiesin a structured way:• the Risk Collectors, the internal Bank roles that areresponsible for detecting and analysing operationalrisk events;• the Operational Risk Management (ORM) Office,whose tasks include the support to Risk Collectors aswell as the collection, control, preservation andtreatment of information.b.2 Operational Risk Assessment ProcedureBanca Antonveneta has also activated a process calledOperational Risk Assessment Procedure (ORAP). Its aimis to identify and assess in the early stages operational,legal and reputation risks generated by changesconnected with the introduction or significantamendment of products, processes, activities, systemsand organisational procedures and propose actions thatcan mitigate the risks identified and the acceptance ofthe residual risk.The main roles involved in the ORAP are:• the Business Owner, who proposes the change andrequests the activation of the ORAP;• the Stakeholders, who are affected by the changeand appointed to identify and analyse the risks;• the Operational Risk Management, which coordinatesthe procedure while also assessing its correctness,completeness and overall quality;• the Operational Risk Sub-Committee, which resolveson the acceptance of the risk brought to itsattention.c. Evaluation of risk exposureDuring the annual risk exposure evaluation process, arisk profile is attributed to the overall activity and to thevarious operational macro areas of the Bank. Thisprofile defines the residual risk in quality terms as high,medium or low. It is assigned through the joint analysisof the information coming from the collection andpreservation of operational risk data and from themanagement use process.d. Reporting systemBanca Antonveneta has established and activated itsown reporting system that provides and ensures theongoing availability of appropriate information onoperational risks to the management bodies and to themanagers of the functions involved.e. Management useBanca Antonveneta attaches great importance to themanagement of operational risks, with particularreference to the critical situations ensuing from thecollection processes and from the evaluation of riskexposure.In order to deal with these critical areas, a managementuse process has been established which aims atidentifying the most suitable mitigation areas, always incompliance with the “cost/benefits” principle that cansometimes lead to the acceptance of the risk.Once the critical risks have been proven by the ORMoffice, in accordance with this process a Risk Owner andStakeholders are identified and entrusted with theplanning and implementation of mitigating actions.In cases of particular significance, the process providesfor the involvement of a working table called “Risk andControl Table”, which is attended by the Risk Owner andBanca Antonveneta’s main control structures.In 2007 the management use process was activatedwhen necessary. Currently, analyses have been startedto define actions that can mitigate the main operationalrisks to which Banca Antonveneta is exposed.Internal control systemBanca Antonveneta has defined and activated its owninternal control system, which is composed of:• a process to self-evaluate the adequacy of theoperational risk management;• internal review, which includes in its inspectionscope also the system to manage operational riskand the self-evaluation process, on which it cancarry out specific assessments if it deems itnecessary. On an annual basis, the internal reviewfunction is required to perform an independentevaluation of the adequacy of the operational riskmanagement system and the self-evaluationprocess.361