Annual report 2009 - Santander

1442. Integral control of risksGrupo Santander launched in 2008 the function of integralcontrol of risks, anticipating the new regulatory requirements,then being discussed in the main organisations and forums–Basel Committee, CEBS, FSF, etc–, as well as therecommendations on best risk management practicesformulated by various public and private bodies.In July 2009, the Basel Committee required banks to put thefunction into effect immediately.Organisation, mission and featuresof internal control of risksThe organisation of this function is part of the directorategeneral of integral control and internal validation of risk.This function supports the Group’s governance bodies in riskmanagement and control.Particular attention is paid to credit risk (including the risks ofconcentration and counterparty); market risk (including liquidityrisk as well as structural risks of interest rates and exchangerates); operational and technology risks and risk of complianceand reputational risk.Integral control of risks is based on:• Module 1) Ensure that the management and control systemsof the various risks inherent in Grupo Santander’s activity meetthe most demanding criteria and the best practices observedin the industry and/or required by regulators.• Module 2) Ensure that senior management has at its disposalan integral vision of the profile of the various risks assumedand that these risks are in line with the previously agreedappetite for risks.• Module 3) Supervise compliance in time and form with therecommendations drawn up for risk management mattersfollowing inspections by internal auditing and by thesupervisors to whom Santander is subject.Internal control of risk supports the work of the risks committee,providing it with the best practices in risk management.The main features of this function are:• Global and corporate scope: all risks, all businesses, allcountries;• It is configured as a third layer of control, following the one bythe person responsible for managing and controlling each riskin the sphere of each business or functional unit (first layer ofcontrol) and the corporate control of each risk (second layer).This ensures the vision and thus integral control of all risksincurred during the year.• Special attention is paid to the development of best practicesin the sphere of the financial industry, in order to be able toincorporate within Santander and at once any advancesdeemed opportune.• Both the information available as well as the resources thatGrupo Santander assigns to controlling the various risks areoptimised, avoiding overlapping.Methodology and toolsIn order to systemise the function and adjust it to Santander’sspecific needs, internal development of methodology and toolsto support it was completed. This makes application of themethodology traceable. The methodology and the tools arearticulated through the three modules previously referred to forall risks treated:• Module 1) A guide of tests or reviews exists for each risk. Itconsists of more than 650 tests (for all the risks), divided inspheres of control (for example, corporate governance,organisational structure, management systems, integration inmanagement, technology environment, contingency plans andbusiness continuity, etc).Applying the tests and obtaining the relevant evidence whichis assessed and enables the parameters of control of thevarious risks to be homogenised is done every six months.New tests are incorporated where needed. The support tool isthe risk control monitor, which is a repository of the results ofeach test and of their work papers.• Module 2) A synthetic control panel is being designed, alongwith the corresponding tool, to enable senior management tomonitor the various risks assumed and their degree ofadjustment to the previously formulated risk appetites.• Module 3) The SEGRE tool is used to track therecommendations made by internal auditing and by thesupervisors regarding risk control and management and it alsoincludes the recommendations by integral control. Use of thistool is coordinated with the relevant risk control areas so thatmonitoring is optimised.The Bank of Spain can access these tools if it so wishes.Annual Report 2009 Risk management