Annual report 2010 - Dexia.com

Risk managementManagement reportConsolidatedfinancial statementsAdditional information Annual financial statementsOperational riskDexia policyDexia operational risk policy consists in identifying andassessing on a regular basis the existing risks and currentcontrols in order to check that the acceptance level definedper activity line is respected. If not, adequate governance shallbe put in place and lead to efficient and/or corrective actionsto return to acceptable situation.A connection has been recently decided between theoperational risk management and the permanent controlshould lead to a reinforced monitoring of risk indicators.Risk measures and managementThe operational risk framework relies on the followingelements:Operational risk event data collectionThe systematic capture and monitoring of risk events isone of the most important requirements stated by theBasel Committee, whatever the approach chosen for thecapital calculation (Standardised or Advanced MeasurementApproach): “Data on a bank’s historical loss experience couldprovide meaningful information for assessing the bank’sexposure to operational risk and developing a policy tomitigate/control the risk”.As a consequence, the continuous collection of risk eventdata enables Dexia both to be compliant with regulatoryrequirements, and to obtain very valuable information in orderto improve the quality of the internal control system. Strictguidelines have been defined and deployed at Group level interms of reporting, in order to ensure that the most importantinformation is escalated in due time to Senior Management(in particular, the compulsory declaration threshold has beenset at EUR 2,500). The Management Board receives a reporton the main events, including an action plan enabling risks tobe reduced, defined by the bank’s Middle Management.Over the last 3 years, the split of the total amount of lossesamong standard event types is the following:Business Disruptionand System FailuresExecution,Delivery &ProcessManagement49.5%EmploymentPractices andWorkplaceSafety1.2 %3.0%19.2%9.5%17.2%0.4%Damage toPhysical AssetsInternalfraudExternalfraudClients,Products &Business PracticesThe largest proportion of the losses is due to Execution, Deliveryand Process Management events, which also represent themajority of all events, present in all businesses and supportfunctions. These events and the related action plans arereviewed on a quarterly basis with the key stakeholders (inparticular Operations & IT activity lines). As a matter of fact,most important events of this type observed in 2009 did notoccur again in 2010.The proportion of frauds increased in 2009 in the retailbanking activities. Global mitigating plans have been approvedby the Management Board, so that existing processes can beadapted to all threats.Other categories remain limited in number and amount.The main events are of course subject to corrective actionsapproved by the management bodies.Self-assessment of risks and associated controlsIn addition to building a history of losses, it is also necessaryto determine the exposure of Dexia to main risks through riskmapping of all significant activities. To do this, all the entitiesof the Dexia Group perform bottom-up self-assessmentexercises regarding risks and associated controls. They can leadto the definition of mitigation actions. They provide a goodview of the most important risk areas in the different entitiesand activities, with the objective of reporting the results toManagement across the organisation. These exercises arerepeated each year.Information security and business continuitymanagementInformation security policy and the related informationsecurity guidelines, standards and practices aim to secureDexia’s information assets (1) .Security programmes and well-defined responsibilitiesensure that all business activities are organised in a secureenvironment.As required by the Group business continuity policy, businesslines are required to make impact analyses for critical business,to define and document recovery plans and ensure thatbusiness continuity plans are tested and updated at least oncea year. On the basis of regular reporting, the ManagementBoard validates recovery strategies, residual risks, and actionplans for continuous improvement.From the same point of view, an assessment of the businesscontinuity mechanisms took place in 2010 for all Dexiasubsidiaries.Management of insurance policiesThe mitigation of the operational risks to which Dexiais exposed is also guaranteed by subscription to Groupinsurance policies, covering professional liability, fraud, theftand business interruption. Through an insurance policyelaborated for the whole Group, the aim is moreover toestablish insurance guidelines regarding the different riskswithin the Group and to be implemented at Group and entitylevels. It is also a matter of providing a centralised frameworkfor negotiations with brokers and insurance companies.(1) Information or data representing value to the company which musttherefore be properly protected.88 Dexia Annual report 2010