Risk Management

Overview

A fundamental element of the Group's strategy is the effective management of risk in order to protect the Group's depositors, borrowers and shareholders, and to ensure that the Group maintains sufficient capital, liquidity and operational control at all times, and acts in a reputable way. This is reflected in the Group's strategy and values, in particular the 'Sustain' strategy and 'Risk Aware' value, which demonstrate the Group's commitment to protect the reputation, integrity and sustainability of the Group for all of its customers and stakeholders through prudent balance sheet management, investment for growth and robust risk and operational control.

The Group's Chief Risk Officer is responsible for leading the Group's Risk Function, which is independent from the Group's operational and commercial functions. The Risk Function is responsible for ensuring that appropriate risk management processes and controls are in place, and that they are sufficiently robust, so as to ensure that key risks are identified, assessed, monitored and mitigated. The Chief Risk Officer is responsible for providing assurance to the Board that the Group's principal risks are appropriately managed and that it is operating within its risk appetite.

The Group's Operational Risk Management Framework, policies and procedures are regularly reviewed and updated to ensure that they accurately identify the risks that the Group faces in its business activities and are appropriate for the nature, scale and complexity of the Group's business.

Group Risk Appetite Statement

The Group risk appetite statement confirms the risk parameters within which the strategic aims and vision of the Group are to be achieved. The Board has identified risk themes, risk drivers and major risk categories relevant to the business to enable it to produce the following risk appetite statements which underpin the strategy of the Group:

The Group risk appetite statement is subject to regular monitoring and review.

Operational Risk Management Framework

The Group's operational risk management framework supports decision-making across the Group and is designed to ensure that each risk is managed, monitored and overseen through a dedicated risk-specific committee. The Group operates a 'Three Lines of Defence' model for the management of its risks in which each risk has a defined risk appetite which is controlled and managed through documented policies and frequent reporting, and is overseen by one or more committees as part of the Group's governance process.

The Group's governance structure in respect of risk is summarised in the table below, which sets out for each risk the relevant policy governing the risk, the method of reporting and the responsible committee(s).

Risk governance

The Three Lines of Defence, when taken together, control and manage risks in line with the Group's risk appetite. The three lines are:

• First Line: the Business Line Managers who own and manage risk;
• Second Line: functions that oversee or specialise in risk management or compliance (Information Security, Operational Risk, Credit Risk, Financial Crime Risk and Compliance Teams); and
• Third Line: Internal Audit.

Each line of defence effectively ensures a robust operational risk framework within the Group. The Group ensures that each line understands its respective responsibilities and those of the other lines, and has the appropriate resource and expertise in order to fulfil its responsibilities.

First Line of Defence - Business Line Managers

As the First Line of Defence, the management and staff of each business unit are responsible and accountable for identifying, assessing, controlling and mitigating risks. They are the owners of the risks and controls that operate within their business.

Each business unit or subsidiary is responsible for the recording and maintenance of its own risks, within the statements of risk appetite, limits, tolerances and thresholds articulated within the risk management framework.

Second Line of Defence - Risk Management function

The role of the Second Line Risk Management function, led by the Chief Risk Officer and including the Credit Risk, Information Security, Operational Risk, Financial Crime Risk and Compliance teams is to support and guide the Group in order to operate within the Statements of Risk Appetite, by assisting the business in assessing and controlling operational risks, and by reporting to the Board and Group Risk Committees on the effectiveness of the controls.

The Second Line of Defence enables the business to adopt a common strategy and approach to operational risk management. It sets bank-wide policies and designs an Operational Risk Management Framework that helps businesses to control risks and that provides consistent insight into the risk profile.

Third Line of Defence - Group Internal Audit

Internal Audit provides the Audit Committee and senior management with comprehensive, independent and objective assurance on the effectiveness of risk governance, risk management, and internal controls in the first and second lines of defence. It reports significant risk exposures and control issues to the Audit Committee.

The scope of this assurance covers a broad range of objectives, including:

• efficiency and effectiveness of operations
• safeguarding of assets
• reliability and integrity of reporting processes
• compliance with laws, regulations, policies, procedures, and contracts.

The remit extends to a number of areas: Group-wide processes; subsidiaries; business units; business processes including customer lifecycle, sales, marketing and operations; and enabling functions such as Finance, HR, Operational Risk, Compliance and IT.

The monitoring and control of risk is a fundamental part of the management process within the Group. The responsibilities of the Board, Board Risk Committee and Audit Committee in this respect are described in the Corporate Governance Report within the Annual Report and Accounts. The following committees also form a key part of the Group's risk management governance structure:

Assets and Liabilities Committee ('ALCO')

The ALCO is a sub-committee of the Risk Committee and is responsible for implementing and controlling the liquidity and asset and liability management risk appetite of the Group, ensuring high level control over the Group's balance sheet and associated risks. The committee sets and controls capital deployment, treasury strategy guidelines and limits and focuses on the effects of future plans and strategy on the Group's assets and liabilities.

Consumer Credit Risk Committee

This committee reviews the control of credit and lending decisions and related risks in respect of the Consumer Finance businesses. Retail Finance and Motor Finance are reviewed in alternate months to ensure a detailed analysis is undertaken of the entire portfolio. This committee determines whether the credit strategies and risk polices are working and will make recommendations on any changes required.

SME Credit Committees

These committees are responsible for making decisions on existing and new-to-bank transactions.

Group Operational Risk Committee

This committee reviews and monitors the adequacy, the implementation and the level of embeddedness of the operational risk management framework across the Group. It recommends and undertakes improvements where required. The committee reviews the operational risks across the Group and recommends, initiates and monitors any further mitigating action that is required.

Group Compliance and Regulatory Risk Committee

This committee reviews and monitors regulatory change with which the Group is required to comply and it provides oversight that appropriate co-ordinated and controlled action is taken to deliver the required changes to an acceptable standard, which achieves compliance in a timely manner. This committee also reviews and approves the compliance risk management framework, the compliance universe and annual monitoring plan. It reviews the Compliance function and offers support to the first line of defence in understanding regulatory requirements and delivery of required outcomes.

Group Financial Crime Committee

This committee ensures that AML and other financial crime related regulatory responsibilities are complied with. The committee is the escalation point and oversight to ensure that key risks are being seen and managed within the Group.

Customer Focus Committee

This committee reviews and challenges the customer experience delivered by the Group, ensuring that treating customers fairly principles, conduct risk, and customer service excellence requirements are met and good customer outcomes are achieved.

Information Security Management Committee

This committee provides direction, oversight and management of the Information Security governance framework and Information Security Management System, including safeguarding the personal information of its customers.

IT Governance and Risk Committee

This committee reviews and monitors the adequacy and implementation of the Group's IT Strategy and Policies. It reviews, challenges and assesses the key IT risks across the Group and recommends, initiates and monitors where further mitigating action may be required.

Assumptions Committee

This committee is responsible for reviewing and challenging assumptions used in a number of areas including the Group's forecasting, ICAAP and ILAAP, ECL calculations, Funds Transfer Pricing, Liquidity Risk Management and Interest Rate Risk Management.

Model Governance Committee

This committee is responsible for understanding, challenging and assessing risks, weakness and appropriateness of statistical and financial models.