Citigroup Inc.

OPERATIONAL RISKOperational risk is the risk of loss resulting from inadequate or failed internalprocesses, systems or human factors, or from external events. It includes thereputation and franchise risk associated with business practices or marketconduct in which Citi is involved. Operational risk is inherent in Citigroup’sglobal business activities and, as with other risk types, is managed throughan overall framework designed to balance strong corporate oversight withwell-defined independent risk management. This framework includes:• recognized ownership of the risk by the businesses;• oversight by Citi’s independent risk management; and• independent review by Citi’s Audit and Risk Review (ARR).The goal is to keep operational risk at appropriate levels relative to thecharacteristics of Citigroup’s businesses, the markets in which the Companyoperates its capital and liquidity, and the competitive, economic andregulatory environment. Notwithstanding these controls, Citigroup incursoperational losses.FrameworkTo monitor, mitigate and control operational risk, Citigroup maintainsa system of comprehensive policies and has established a consistentframework for assessing and communicating operational risk and theoverall effectiveness of the internal control environment across Citigroup.An Operational Risk Council provides oversight for operational risk acrossCitigroup. The Council’s membership includes senior members of theChief Risk Officer’s organization covering multiple dimensions of riskmanagement, with representatives of the Business and Regional Chief RiskOfficers’ organizations and the business management group. The Council’sfocus is on identification and mitigation of operational risk and relatedincidents. The Council works with the business segments and the controlfunctions with the objective of ensuring a transparent, consistent andcomprehensive framework for managing operational risk globally.Each major business segment must implement an operational riskprocess consistent with the requirements of this framework. The process foroperational risk management includes the following steps:• identify and assess key operational risks;• establish key risk indicators;• produce a comprehensive operational risk report; and• prioritize and assure adequate resources to actively improve theoperational risk environment and mitigate emerging risks.The operational risk standards facilitate the effective communicationand mitigation of operational risk both within and across businesses. Asnew products and business activities are developed, processes are designed,modified or sourced through alternative means and operational risks areconsidered. Information about the businesses’ operational risk, historicallosses, and the control environment is reported by each major businesssegment and functional area, and is summarized and reported to seniormanagement as well as the Risk Management and Finance Committee ofCiti’s Board of Directors and the full Board of Directors.Measurement and Basel IITo support advanced capital modeling and management, the businessesare required to capture relevant operational risk capital information. Anenhanced version of the risk capital model for operational risk has beendeveloped and implemented across the major business segments as a steptoward readiness for Basel II capital calculations. The risk capital calculationis designed to qualify as an “Advanced Measurement Approach” underBasel II. It uses a combination of internal and external loss data to supportstatistical modeling of capital requirement estimates, which are thenadjusted to reflect qualitative data regarding the operational risk and controlenvironment.Information Security and Continuity of BusinessInformation security and the protection of confidential and sensitivecustomer data are a priority for Citigroup. Citi has implemented anInformation Security Program in accordance with the Gramm-Leach-BlileyAct and regulatory guidance. The Information Security Program is reviewedand enhanced periodically to address emerging threats to customers’information.The Corporate Office of Business Continuity, with the support of seniormanagement, continues to coordinate global preparedness and mitigatebusiness continuity risks by reviewing and testing recovery procedures.126