The board has overall responsibility for the group’s risk management framework, regulatory compliance and internal control and for ensuring that they work effectively. The risk management framework and associated governance arrangements are designed to ensure that there is a clear organisational structure with well defined, transparent and consistent lines of responsibility and effective processes to identify, manage, monitor and report the risks to which the group is, or might become, exposed.
Identification, measurement and management of risk are strategic priorities for the group. Governance has been strengthened by the establishment of the Risk Committee to lead the management of risk across the group. This is supported by risk and compliance committees at group level and in the divisions with responsibility for risk management, internal control and regulatory compliance.
A key priority of the risk and control framework is to allow business opportunities to be captured while maintaining an appropriate balance of risk and reward. The group’s risk management framework is designed to ensure that the risks to which the group is or may become exposed are identified and that those which the group chooses to take are managed, controlled and, where appropriate, mitigated so that the group is not subject to unexpected loss.
The group reviews and revises its risk appetite as part of the strategy setting process and identifies its material risks through this process. This aligns risk taking with the achievement of strategic objectives.
The key principles underlying risk management in the group are:
- Business management own all the risks assumed throughout the group and are responsible for ensuring that these are managed on a day-to-day basis to ensure that risk and return are balanced;
- The board and business management promote a culture in which risks are identified, assessed and reported in an open, transparent and objective manner;
- The overriding priority is to protect the group’s long-term viability and produce sustainable medium to long-term revenue streams, not simply to maximise short-term profits;
- Risk functions are independent of the businesses but partner closely with and provide support and challenge to the businesses;
- Risk management across the group is proportionate to the scale and complexity of the group’s individual businesses;
- Risk mitigation and control activities are commensurate with the degree of risk; and
- Risk management and control supports decision making.
The risk management framework is based on the concept of “three lines of defence”. Business management are responsible for ensuring that all key risks have been identified, assessed and evaluated and that, where necessary, appropriate controls have been put in place to manage them within their defined risk appetites. Risk functions provide oversight of this and group internal audit ensures that the first and second lines of defence are working effectively.
The Risk Committee’s primary responsibilities are to:
- Develop, review and recommend risk appetite in the context of both the group’s strategy and the economic, market and regulatory environment;
- Monitor the risk profile in relation to current and future strategy and ensure that it is consistent with the risk appetite;
- Consider, evaluate, monitor and challenge the appropriateness and effectiveness of the risk management framework and the oversight arrangements in relation to the business undertaken and risk profile;
- Review and challenge reports and recommendations regarding current risk exposures and overall risk strategy and discuss mitigation, providing advice as appropriate;
- Consider and assess the implications of proposed regulatory and legal changes that are material to the risk profile, risk appetite and management of risk;
- Oversee and challenge the design and execution of stress and scenario testing;
- Provide the advice, oversight and challenge necessary to embed and maintain a supportive risk culture; and
- Agree recommended actions, as appropriate, and ensure that these are owned and followed through to completion.
In addition the committee:
- Provides input and advice to the Remuneration Committee on the alignment of reward structures to the group’s risk appetite; and
- Considers and approves the appointment and dismissal of the group Chief Risk Officer.
The full terms of reference of the Risk Committee are attached here.
