|
The risk of loss or other
non-financial impact, resulting from inadequate or failed internal
processes, people and systems, or from external events.
|
·
The Group is exposed to operational risk in
executing its core business activities and seeks to manage this
exposure in a cost-effective manner.
·
The Group is alert to the fact that operational
risk has a broad remit, covering processes, people, systems and
external events. It therefore has a risk appetite set at Level 2
risk types. The top level 2 risks at this level are:
-
Data management
risk: The Group uses data (including
personally identifiable data) in its activities to drive business
outcomes. There is a risk of poor data quality and the requirements
of UK General Data Protection Regulation and the Data Protection
Act not being adhered to.
-
Execution,
transaction processing and delivery risk:
The Group relies on a combination of manual and
automated processing to fulfil its obligations to its clients.
Specific clients have bespoke processes that are performed by a
select few. The Company as a listed entity needs to comply with the
Listing Rules of the UK Listing Authority (the Listing Rules) for
the first time.
-
Technology,
information security and cyber risk: The Group relies extensively on the use of technology,
including the inter-relationship between multiple third-party
services, which is central to the processing and operating
environment that services its clients. It is therefore imperative
that the Group protects its clients, counterparty and employee data
from theft, damage or destruction from cyber-attacks. The Group is
acutely aware of the growing sophistication of cyber-attack threats
across the industry.
-
Outsourcing,
vendor management and third party risk: The Group is reliant on material vendors to support its
technology infrastructure, architecture and certain applications.
It is fully aware of the risks this reliance creates in delivering
its products and services. The Group works closely with these
suppliers to ensure the services they provide remain resilient.
-
People
risk: Resource capacity and
capability impact all risk-types, these are monitored frequently to
ensure staffing levels reflect the size and complexity of the
Group.
-
Operational
resilience: The Group has identified
its important business services and impact tolerance limits that
form part of the Group's risk materiality assessment. This is in
line with the PRA supervisory requirements (SS1/21).
-
Clients, products
and business practices: The Group
considers transformation and change risk within this Level 2 risk
type. The Group offers three key products (see page 22) and there
has been little change to them, or the underlying business
practices. However, as the Group grows, the risks associated with
transformation and change are becoming a priority.
|
·
The Group has an established Group Operational
Risk Management Policy that details various tools that support the
identification, assessment, management and reporting of operational
risk, linked to the Group ERMF.
·
The RCSAs are performed at a business unit level.
All risks and controls are stored centrally within the Group's
approved GRC system. The system has links to risks, controls,
issues, assurance actions, Board metrics and other similar
information, thus providing a holistic operational risk
profile.
·
Data management risk: The Group continues to
monitor and mitigate data risk through governance structures. Data
risk is assessed through the RCSA process at least once per
calendar year.
·
Execution, transaction processing and delivery
risk: Processes are being documented, and automation considered, to
ensure consistency and reduction of manual/bespoke processing. To
comply with the Listing Rules, the Finance team has been
strengthened with external subject matter experts, as
required.
·
Technology, information security and cyber risk:
Protecting the Group's clients, counterparties, suppliers and
employees remains a top priority. The Group is working on obtaining
ISO 27001 and Cyber Essentials accreditation. The Group has
recently completed a disaster recovery exercise and cyber
simulation to continue to strengthen its operational resiliency
efforts.
·
Outsourcing, vendor management and third-party
risk: The Group has enhanced its procurement and outsourcing
framework and associated policies to align with the requirements of
the outsourcing and third-party risk management supervisory
statement (SS2/21).
·
People risk: The Group deploys a number of
attraction and retention strategies throughout the employee
lifecycle, including hybrid-working and competitive employee
benefits.
·
Operational resilience: The Group continues to
embed a robust operational resilience framework and enhance
contingency plans for the failure of key systems, processes and
services to ensure a timely recovery.
·
Clients, products and business practices: The
Group has developed a New Product and Significant Change Policy
that brings together the Group's transformation and change agenda.
Key transformation projects are discussed at the Operational Risk
Committee and the Executive Risk Committee as required.
|
|
The risk of financial loss arising
from a borrower's or counterparty's failure or inability to meet
their financial obligations in accordance with contractual
terms
|
·
Credit risk is inherently generated through the
Group's banking and financing activities; i.e. for example, through
trade finance products, working capital overdrafts, Nostro balances
etc.
·
Counterparty credit risk arises due to FX/Payment
related trading and derivatives activities where counterparties may
be unable or unwilling to meet their financial obligations,
including collateral obligations, as they fall due.
·
Treasury related activities also generate an
element of credit risk through its day-to-day placement of funds
i.e. money market funds, HQLA portfolio etc.
|
·
Credit Risk remains a key focus for the Group
given the current macroeconomic environment.
·
Risk appetite thresholds are constructed with
regard to regulatory requirements and internal assessments included
within the ICAAP.
·
An established credit policy is in place with
portfolio levels exposure limits and a maximum individual
counterparty exposure limit framework. The Credit Risk Committee
provides individual counterparty approvals and portfolio level
oversight.
·
Robust individual credit assessment and monitoring
frameworks ensure that credit risk is managed and mitigated in line
with credit management objectives and risk frameworks.
·
Counterparty FX and derivatives transaction risk
is mitigated via an ISDA master agreements and credit support
annexes, where suitable.
|