2012 Registration document and annual financial report - BNP Paribas

5RISKSAND CAPITAL ADEQUACYOperational risk5■ widespread use of control plans: BNP Paribas has rolled out a process offormulating “control plans”, which have three objectives: harmonisingpractices, rationalising the system and standardising controls. Thispractice will also cover the Group’s international operations andthereby support its structure enhancements. It is based on a riskmapping exercise carried out to identify and quantify potential riskscenarios, involving all the Group’s core businesses, retail operationalentities, business lines and Group functions.Key players and governanceThe BNP Paribas Group’s objective is to implement a permanent controland operational risk management system organised around two typesof participants:■ heads of operational entities, who are on the front line of riskmanagement and implementation of systems to manage these risks;■ specialised teams, who are present at every level of the Group (corebusinesses, retail operational entities, functions, business lines) andcoordinated centrally by the 2OPC team (Oversight of OperationalPermanent Control), which is part of Group Compliance and aparticipant in the Group’s risk management process. These teamsare, in particular, responsible for:■coordinating throughout the areas within their remit the definitionand implementation of the permanent control and operational riskmanagement system, its standards and methodologies, reportingand related tools,■ acting as a second pair of eyes that is independent of the operationalmanagers to scrutinise operational risk factors and the functioningof the operational risk and permanent control system, and issuingwarnings, where appropriate.About 350 employees on a full-time equivalent basis are responsible forthese supervisory activities.Issues that arise in relation to permanent operational risk managementand business continuity are discussed with the Group’s ExecutiveCommittee on a regular basis, and periodically with the Internal ControlCoordination Committee. This committee is chaired by the InternalControl Coordinator and brings together key players in the internalcontrol process. The Group’s core businesses, retail operational entities,business lines and functions tailor this governance structure to their ownorganisations, with the participation of Executive Management. Mostother Group entities, particularly the major subsidiaries, have set up asimilar structure.Scope and nature of risk reportingand measurementGroup Executive Committees, core businesses, retail operational entities,business lines and functions are tasked with overseeing the managementof operational and non-compliance risk and permanent control in theareas falling within their remit, in accordance with the Group’s operationalrisk framework. The committees validate the quality and consistency ofreporting data, examine their risk profile in light of the tolerance levelsset and assess the quality of risk control procedures in light of theirobjectives and the risks they incur. They monitor the implementation ofrisk mitigation measures.Operational risk management has developed a system of data collection ofactual or potential incidents using an approach structured by operationalprocess and entity (activities in a country and a single legal entity)focusing on the cause-and-effect chain behind events. This informationis used as the basis for risk mitigation and prevention measures.The most significant information is brought to the attention of staff atvarious levels of the organisation, up to and including executive anddecision-making bodies, in line with a predefined information reportingprocess.COMPONENTS OF OPERATIONALRISK RELATED TO LEGAL, TAXAND INFORMATION SECURITY RISKSLegal riskIn each country where it operates, BNP Paribas is bound by specific localregulations applicable to companies engaged in banking, insurance andfinancial services. The Group is notably required to respect the integrityof the markets and the primacy of clients’ interests.For many years, the Legal Department has had an overarchinginformation sharing and internal control system designed to anticipate,detect, measure and manage legal risks. More recently, the systemhas been substantially revised to adapt to changes in the Group andto promote a more proactive approach by the legal officers and theirteams, regardless of their business line and geographical territory. Thenew system is based on:■ governance bodies:■■■Executive Legal Affairs Committee, which defines and overseescompliance with the Legal Function’s overall strategy,Global Legal Committee, which coordinates and supervises theactivities of the Legal Function throughout the Group in all countriesthat have their own legal staff, and ensures that the Group’s legalpolicies are consistent and applied in a uniform manner,Global Litigation Practice Group, which brings together legal expertsfrom fourteen countries with a view to improving their ability tolook ahead and interact in the areas of litigation, pre-litigation andregulatory;■ specific committees, including:■ France and Europe Legislation Tracking Committees, which monitordraft legislation, and analyse, interpret and distribute throughoutthe Group the texts of new laws and regulations, as well as detailsof changes in French and European case law,3102012 Registration document and annual financial report - BNP PARIBAS