Annual REPORT

NOTES TO THE FINANCIAL STATEMENTS (Continued)
ANNUAL REPORT AND FINANCIAL STATEMENTS
FOR THE YEAR ENDED 31 DECEMBER 2015
4 FINANCIAL MANAGEMENT OBJECTIVES AND POLICIES (Continued)
(d)
Other risks (Continued)
ii) Operational risk (Continued)
How we manage operational risk
Our operational risk management framework is designed to ensure key risk exposures are proactively managed
within acceptable levels. It incorporates best practice and meets regulatory guidelines through:
· Governance and Policy: Management as well as Committee reporting and organisational structures emphasise
accountability, ownership and effective oversight of each business unit’s operational risk exposures.
Furthermore, the Board Risk Management Committee and Senior Management’s expectations are set out via
enterprise-wide policies.
· Risk and Control Self-Assessment: Through quarterly comprehensive assessments of our key operational risk
exposures and internal control environments, Senior Management is able to evaluate.
· its effectiveness and implement appropriate additional corrective actions where needed, to offset or reduce
unacceptable risks.
· Operational Risk Event Monitoring: Our policies require that internal and industry-wide operational risk
events are identified, tracked, and reported to the right levels to ensure they are analysed appropriately and
corrective action taken in a timely manner.
· Risk Reporting: Significant operational risk issues together with measures to address them are tracked,
assessed and reported to Senior Management and the Board of Directors to ensure accountability is maintained
over current and emerging risks.
· Insurance: A comprehensive portfolio of insurance and other risk mitigating arrangements are maintained
with the type and level of insurance coverage continually assessed to ensure both risk tolerance and statutory
requirements are met. This includes identifying opportunities for transferring our risks to third parties
where appropriate.
· Technology and Information: The key risks here revolve around our reliance on technology and information
and their impact on operational availability, integrity and security of our information data and systems /
infrastructure. Our risk framework and programs use best practice and include robust threat and vulnerability
assessments, as well as security and change management practices.
· Business Continuity Management: Business Continuity Management supports the ability of Senior Management
to continue to operate their businesses, and provide customer access to products and services in times
of disruptions. This program includes formal crisis management protocols and continuity strategies. All key
functions of the Group are regularly tested to confirm their contingency plan designs are able to respond to a
broad range of potentially disruptive scenarios.
iii) Compliance risk
Compliance risk refers to the potential of loss arising from non-compliance with laws, rules, regulations, obligatory
practices / standards, contractual agreements, or other legal requirements including the effectiveness of preventing
and handling litigation. It is not actively or deliberately pursued in the expectation of a return but occurs
in the normal course of our business operations.
The Group meets high standards of compliance with policy, legal and regulatory requirements in all business
dealings and transactions. As a result of high financial business regulation we are exposed to regulatory and legal
risks in virtually all our activities. Failure to comply with regulation not only poses a risk of censure and litigation
but may lead to serious reputational risks. Financial penalties and costs related to litigation may also substantially
erode the Bank’s earnings.
75