GENERAL MEETING DRAFT - Bankier.pl

The mission of the Group Operational Risk Committee is to define proposals and opinions for the Group
Risk Committee, for:
� the Group risk appetite, including the goals and criteria of the operational risk capital allocation in
the Group;
� the structure and definition of operational risk limits and their allocation to the Business Units and
the Entities of the Group;
� the internal model for operational risk measurement for regulatory capital purposes;
� specific operational risk strategies
The Group Operational Risk Committee meets with approval functions instead for the following topics:
� guidelines and special policies on operational risk topics;
� corrective actions for balancing the Group operational risk positions, including the mitigation
actions;
� Group strategies, including strategies for insurance hedging after joint proposals from the Global
Insurance Management function and the Operational & Reputational Risks Portfolio Management
department;
� the internal model for operational risk measuring, both for economic capital purposes and for
stress testing activities.
In the Holding company, the Operational & Reputational Risks Portfolio Management department, part of
the Strategic Risk Management & Control department, supervises and manages the overall profile of the
operational and reputational risks in the Group by defining the strategies, methodologies and limits.
Regarding the operational risk management function, the department has two organizational units. The
Operational Risk Methodologies and Control unit is responsible for the methodologies, the calculation
model for the Group operational capital at risk and the guidelines for operational risk control activities; it is
also supporting and controlling the legal entities’ Operational Risk Management functions, in order to
verify that Group standards are met in the implementation of control processes and methodologies.
The Operational Risk Strategies and Mitigation unit is responsible for the definition and monitoring of the
risk limits and for the identification of strategies and mitigation actions and the monitoring of their
implementation.
The Operational Risk Management functions of the controlled entities provide specific operational risk
training to staff, also with the use of intranet training programs, and are responsible for the correct
implementation of the Group framework elements. The Holding company's Operational & Reputational
Risks Portfolio Management department prepares regular updates on regulatory and managerial aspects
of operational risk, which are sent to the functions responsible for operational risk control and
management.
In compliance with regulations, an internal validation process (self-assessment) for the operational risk
control and measurement system has been set up at the Holding company and in the relevant Group
entities in order to verify the conformity with regulations and Group standards.
The Operational Risk Management functions of the entities provide a summary of the activities carried out
and assess whether they comply with regulations and Group standards. Where areas for improvement
are identified, the proposed actions must be indicated, along with, where possible, the predicted
timeframe for their implementation. The entities meeting the advanced (AMA) requirements and those of
the Italian entities using the standard (TSA) method must compile the validation document and send it to
the Holding company.
2009 CONSOLIDATED REPORTS AND ACCOUNTS
452