2012 Registration document and annual financial report - BNP Paribas

RISKS AND CAPITAL ADEQUACYOperational risk5■■Steering Centre for European Law, a joint French and Belgian unitresponsible for all issues involving European law and competitionlaw for the entire Group,Legal Internal Control Committee, whose focuses include overseeingoperational risk and internal audit recommendations;■ Legal Practice Groups by business line and specific-issue workinggroups aimed at strengthening cooperation between specialist lawyersand proposing cross-functional legal risk management policies;■ internal procedures and databases providing a framework for (i)managing legal risk in liaison with the Compliance f unction for allmatters which also fall under its responsibility, and (ii) overseeingthe activities of the Group’s legal staff and operating staff involved inlegal areas. At the end of 2004, a procedures database detailing allinternal procedures was set up on the Group Intranet and is availableto all Group employees;■ a knowledge management system aimed at both legal and operatingstaff and broader training opportunities for the Group’s legalcommunity;■ internal risk reporting tools and analytical models, which are upgradedon an ongoing basis by Group Legal Department and contribute to theidentifying, assessing and analysing operational risk.In a difficult economic environment marked by increasing regulations andheavier regulatory requirements, as well as an increase in litigation, theLegal f unction must be able to take a global view and optimise its abilityto become involved and take action.The Legal f unction’s new management and working methods wereimplemented and tested in 2012. A review is currently in progress onpotential changes to its method of involvement in the litigation andregulatory fields and extending the links between the Legal f unctionsof certain specialist business lines and foreign territories. Meanwhile,the Legal f unction has focused on clarifying its areas of involvementand responsibility levels and on creating new areas of cooperation withthe Group’s business lines. This work is facilitated by the fact that theChief Legal Officer (or a representative) sits on both the Internal ControlCoordination Committee and the Compliance Committee as a permanentmember.In addition, the Legal f unction, in liaison with the Purchasing f unction,has drawn up a pragmatic, broader legal outsourcing policy with a viewto combining quality with cost control.Tax riskIn each country where it operates, BNP Paribas is bound by specific localtax regulations applicable to companies engaged for example in banking,insurance or financial services.The Group Tax Department is a global function, responsible for overseeingthe consistency of the Group’s tax affairs. It also shares responsibilityfor monitoring global tax risks with Group Finance. The Group TaxDepartment performs controls to ensure that tax risks remain at anacceptable level and are consistent with the Group’s reputation andprofitability objectives.To ensure its mission, the Group Tax Department has established:■ a network of dedicated tax specialists in 16 countries completed by taxcorrespondents covering other countries where the Group operates;■ a qualitative data reporting system in order to manage tax risks andassess compliance with local tax laws;■ regular reporting to Group Executive Management on the use madeof delegations of authority and compliance with internal standards.The Group Tax Department co-chairs the Tax Coordination Committeewith Group Finance. The committee also includes the Compliance f unctionand may involve the core businesses when appropriate. It is responsiblefor analysing key tax issues for the Group. In addition, Group Finance isobliged to consult the Group Tax Department on any tax issues arisingon transactions processed.Lastly, the Group Tax Department has drawn up procedures coveringall core businesses, designed to ensure that tax risks are identified,addressed and controlled appropriately.Information securityInformation, and digital data in particular, is a key commodity for banksand effective management of information security risk is vital in an eraof near full-scale migration to electronic media, growing demand forswift online processing of ever more sophisticated transactions, andwidespread use of the internet or multiple networks as the primaryinterface between a bank and its individual or institutional customers.Information security incidents experienced by the banking and credit/payment card industries, their cost and media disclosure in variouscountries requires the Group to continuously strengthen its ability toanticipate, prevent, protect, detect and react in order to counter themajor threats and track regulations and case law on data protection.The Group’s information security policy is set out in a corpus of referencedocuments geared to its various needs, both functional and technical.These documents include the general security policy; more specifi cpolicies for various issues related to information systems security;ISO 27001 requirements; practical guides to security requirements;operational procedures and all documents intended to raise theawareness of employees and users of the Group’s information systems.52012 Registration document and annual financial report - BNP PARIBAS 311