Annual report 2009 - Dexia.com

Risk managementManagement reportConsolidatedfinancial statementsAnnual financial statementsAdditional informationOperational riskDefinitionDexia defines operational risk as follows: operational risk isthe risk of financial or non-financial impact resulting frominadequate or failed internal processes, people and systems,or from external events. The definition includes IT, legal andcompliance risk but excludes strategic risk.Dexia’s definition of operational risk is based on, but notrestricted to, the one used by the Basel Committee, whichfocuses on losses (negative financial impacts). Dexia’s policyalso requires the collection of events which lead to financialgains.GovernanceThe Operational Risk Management framework relies on stronggovernance with clearly defined roles and responsibilities.The Management Board, organised on a weekly basis, regularlyreviews the evolution of the risk profile of the differentGroup activities and takes the required decisions.The Risk Policy Committee, a strategic committee with representativesof the Management Board, approves Group-widepolicies. This committee is organised on a quarterly basis.The Operational Risk Guidelines Committee, chaired quarterlyby the Group Chief Risk Officer, details the approved policiesin guidelines adapted to business activities, and transversallyreviews the operational risk events and related analysis.The Operational Risk Management Committee, chairedmonthly by the Head of Group Operational Risk, ensuresthe development of a consistent Group-wide operational riskframework integrating Business Continuity and Crisis Management,Information Security and Insurance.The Line Management function is primarily responsible foroperational risk management. For their activity field theyappoint Operational Risk Correspondents whose role is tocoordinate the collection of risk event data and the Risk andControl Self-Assessment, with the support of the local OperationalRisk Management function.Management of the riskThe operational risk framework relies on the followingelements:Operational risk event data collectionThe systematic capture and monitoring of risk events is oneof the most important requirements stated by the Basel Committee,whatever the approach chosen for the capital calculation(Standardised or Advanced Measurement Approach):“Data on a bank’s historical loss experience could providemeaningful information for assessing the bank’s exposure tooperational risk and developing a policy to mitigate/controlthe risk”.As a consequence, the continuous collection of risk eventdata enables Dexia both to be compliant with regulatoryrequirements, and to obtain very valuable informationin order to improve the quality of the internal control system.Strict guidelines have been defined and deployed atGroup level in terms of reporting, in order to ensure thatthe most important information is escalated in due time toSenior Management (in particular, the compulsory declarationthreshold has been set at EUR 2,500). The most significantevents including a risk mitigation action plan defined by theLine Management are reported to the Management Board bythe Operational Risk function.Over the last 3 years, the split of the total amount of lossesamong standard event types is the following:InternalfraudExternalfraudBusiness Disruptionand System Failures11%19%1%12%Clients,Products &Business Practices54%~0%3%Damage toPhysical AssetsEmploymentPractices andWorkplaceSafetyExecution,Delivery &ProcessManagementThe largest proportion of the losses is due to Execution,Delivery & Process Management events, which also representthe majority of all events, present in all businesses and supportfunctions. These events and the related action plans arereviewed on a quarterly basis with the key stakeholders (inparticular the Operations & IT line).The proportion of frauds increased in 2009 in the retail bankingactivities. Global mitigating plans have been approved bythe Management Board, so that existing processes can beadapted to all threats.Other categories remain limited in number and amount.Major events when they occur are of course subject tothe definition of corrective actions approved by the SeniorManagement.64Dexia Annual report 2009