Citigroup Inc.

MANAGING GLOBAL RISKRISK MANAGEMENT—OVERVIEWCitigroup believes that effective risk management is of primary importanceto its overall operations. Accordingly, Citigroup has a comprehensive riskmanagement process to monitor, evaluate and manage the principal risksit assumes in conducting its activities. These include credit, market andoperational risks, which are each discussed in more detail throughoutthis section.Citigroup’s risk management framework is designed to balance corporateoversight with well-defined independent risk management functions.Enhancements continued to be made to the risk management frameworkthroughout 2010 based on guiding principles established by Citi’s ChiefRisk Officer:• a common risk capital model to evaluate risks;• a defined risk appetite, aligned with business strategy;• accountability through a common framework to manage risks;• risk decisions based on transparent, accurate and rigorous analytics;• expertise, stature, authority and independence of risk managers; and• empowering risk managers to make decisions and escalate issues.Significant focus has been placed on fostering a risk culture based ona policy of “Taking Intelligent Risk with Shared Responsibility, WithoutForsaking Individual Accountability”:• “Taking intelligent risk” means that Citi must carefully measure andaggregate risks, must appreciate potential downside risks, and mustunderstand risk/return relationships.• “Shared responsibility” means that risk and business management mustactively partner to own risk controls and influence business outcomes.• “Individual accountability” means that all individuals are ultimatelyresponsible for identifying, understanding and managing risks.The Chief Risk Officer, working closely with the Citi CEO and establishedmanagement committees, and with oversight from the Risk Managementand Finance Committee of the Board of Directors as well as the full Board ofDirectors, is responsible for:• establishing core standards for the management, measurement andreporting of risk;• identifying, assessing, communicating and monitoring risks on acompany-wide basis;• engaging with senior management on a frequent basis on materialmatters with respect to risk-taking activities in the businesses and relatedrisk management processes; and• ensuring that the risk function has adequate independence, authority,expertise, staffing, technology and resources.The risk management organization is structured so as to facilitate themanagement of risk across three dimensions: businesses, regions and criticalproducts. Each of Citi’s major business groups has a Business Chief RiskOfficer who is the focal point for risk decisions, such as setting risk limits orapproving transactions in the business. There are Business Chief Risk Officersfor Global Commercial, Global Consumer, Institutional Clients Groupand the Private Bank. The majority of the staff in Citi’s independent riskmanagement organization report to these Business Chief Risk Officers. Thereare also Chief Risk Officers for Citibank, N.A. and Citi Holdings.Regional Chief Risk Officers, appointed in each of Asia, EMEA andLatin America, are accountable for all the risks in their geographic areasand are the primary risk contacts for the regional business heads and localregulators. In addition, the positions of Product Chief Risk Officers arecreated for those risk areas of critical importance to Citigroup, currently realestate and structural market risk as well as fundamental credit. The ProductChief Risk Officers are accountable for the risks within their specialty andfocus on problem areas across businesses and regions. The Product ChiefRisk Officers serve as a resource to the Chief Risk Officer, as well as to theBusiness and Regional Chief Risk Officers, to better enable the Business andRegional Chief Risk Officers to focus on the day-to-day management of risksand responsiveness to business flow.In addition to revising the risk management organization to facilitate themanagement of risk across these three dimensions, independent risk alsoincludes the business management team to ensure that the risk organizationhas the appropriate infrastructure, processes and management reporting.This team includes:• the risk capital group, which continues to enhance the risk capital modeland ensure that it is consistent across all business activities;• the risk architecture group, which ensures the company has integratedsystems and common metrics, and thereby allows Citi to aggregate andstress-test exposures across the institution;• the infrastructure risk group, which focuses on improving Citi’soperational processes across businesses and regions; and• the office of the Chief Administrative Officer, which focuses on reengineeringand risk communications, including maintaining criticalregulatory relationships.Each of the Business, Regional and Product Chief Risk Officers, as wellas the heads of the groups in the business management team report to Citi’sChief Risk Officer, who reports directly to the Chief Executive Officer.81