2012 Registration document and annual financial report - BNP Paribas

CORPORATE GOVERNANCEReport of the Chairman of the Board of Directors on the manner of preparation and organisationof the work of the Board and on the internal control procedures implemented by the c ompany2■ The implementation of standard controls for key business processeshas continued in the Group’s various entities, and has now reached alevel that is globally satisfactory.■ The system of management of procedures has been revised in orderto better define the responsibilities of the various parties involved andthe norms and standards that each entity must observe in terms offormalisation, validation and dissemination of procedures.■ Throughout the year, management has been extremely vigilant inmonitoring the implementation of recommendations issued by variousentities (General Inspection , Statutory Auditors and Regulators).■ Administrative authorisation was received to deploy the BNP Paribasmethod of calculating capital requirements for the operational riskof the ex-Fortis entities, which therefore allowed the use of a singleAdvanced Measurement Approach (AMA) for all the Group’s entitiesthat opted for that method.■ The manner of exercising second-level control over issues ofoperational risk and permanent control mechanisms during theprocess of validation of new activities and organisations has beenclarified. More generally, the function of supervising operational riskswas developed, by means of on site or cross-disciplinary reviewsintended to better analyse the risk profile of the entities or of abusiness line.The targets set for 2013 include industrialisation of the approach tothe management of operational risks and new developments in termsof oversight of the permanent control system by independent controlfunctions.Periodic controlThe project to upgrade General Inspection ’s information system carriedout with the central Information Technology and Processes (ITP) functionprogressed on schedule in 2012. The aim of this project is to develop asingle integrated tool to be used to apply a single methodology sharedby everyone throughout the General Inspection function (UNIK).The study of various GRC (Governance, Risks and Compliance) softwaresuites launched in 2011 ended with the signature of a contract with asoftware developer in June 2012. The second half of the year was devotedto joint work with the developer with a view to the delivery of a firstdemonstration version in the first half of 2013, which will be followedby the delivery of a production version in the second half of that year.In 2012, the revision of the various operational audit processes was alsoformalised and approved. In the last quarter of 2012, the majority ofauditors were trained in the new audit methodology.The implementation of this new methodology and of the tool, in 2013and 2014, will be accompanied by a cross-disciplinary plan to managethe change.The main methodological changes relate to the “finding” and“recommendation” model in line with the revision of riskassessment carried out in 2011. The structure of findings wasstandardised by the introduction of nine standard attributes enablingits location, causes and consequences to be determined. With regard tothe location of the finding, it is now established using two dimensions,one based on the Bank’s organisation (businesses, geographical areasand legal entities), the other based on a standardised nomenclature forthe Group’s activities in thirty-nine generic processes distributed in four“clusters”. Two other important amendments should also be mentioned:first, each finding no longer automatically gives rise to a recommendation,in which case the remedial actions are left to the initiative of the auditedentity, and secondly, findings and recommendations are no longer thesubject of an individual listing; only the missions will be listed.Still with a view to continuous progress in the quality of its work, theQuality Assurance Review (QAR) programme continued with six newassignments completed in 2012. Since its launch in November 2006,this programme has enabled the practices of all audit teams to bebenchmarked against professional standards and the referenceframework defined by the function.The same level of effort continued to be made in the area of vocationaltraining. Thus, 82,300 hours of training were provided in 2012 throughoutGeneral Inspection .The number of certified auditors (“Certified International Auditors” – “CIA”,“Certified Information System Auditors” – “CISA”, etc.) has increased by2.6% to 200. The ratio of certified auditors is 19% of total auditors, anincrease of 2% compared to 2011.2THE INTERNAL CONTROL WORKFORCEAt the end of 2012, the various internal control functions had the following workforce (in full-time equivalent staff - FTEs):2007 20082009(excludingFortis)2009(includingFortis) 2010 2011 2012Change2012- 2011Compliance (excluding PermanentControl/2OPC) 740 864 904 1,125 1,369 1,567 1,577 (1) +0.64%Permanent Control/Operational riskoversight (2OPC) 439 562 637 760 315 (2) 381 368 (1) -3.5%Group Risk Management 881 954 950 2,940 (3) 1,801 1,971 1,965 -0.3%Periodic Control 854 828 824 1,016 1,014 (4) 1,107 1,030 -7%TOTAL 2,914 3,208 3,315 5,841 4,499 5,026 4,940 -1.7%(1) End-of-year estimates.(2) After redeployment of employees (see explanations below).(3) Before redeployment of Fortis employees.(4) Including TEB (Turk Ekonomi Bankasi) employees.2012 Registration document and annual financial report - BNP PARIBAS 67