Page 30 - CCB_Full-Annual-Report-2021

30
The Enterprise Risk Management Governance of Risk Management
Framework describes the risks the Bank is Risk management is governed by the
willing to take in pursuit of, and the risks corporate governance framework and
inherent within, its strategy, its governance committee structure described in the
of risk management, and the methodologies Bank’s corporate governance statement on
used to measure and monitor these within pages 42 - 75, with ultimate ownership by
its ‘Risk Management Cycle’:
the Board.
Three lines of defence model
The Bank manages risk using the ‘three lines
of defence’ model, via clear responsibilities
Identify Measure established for all colleagues in relation to
risk management, including executive and
non-executive responsibilities documented
Risk as applicable under the Senior Managers
Management and Certification Regime. The model
operates as follows:
Cycle
First line of defence
Monitor/ Manage/
Report Mitigate The Chief Executive Officer, executives
and their teams are responsible for
managing risk on a day-to-day basis,
including identification of risks as they
emerge, evaluating and reporting them
and ensuring that the Bank operates within
risk appetite. This includes producing
A Risk Register is maintained to record and Key Risk Indicators and other metrics,
monitor the full list of risks to which the Committee and Board reporting, making
Bank is exposed. The Register is regularly sure that all colleagues are adequately
refreshed, primarily as part of the Risk and trained, and that the executives and senior
Control Self-Assessment programme, management provide leadership of the
to ensure that it provides an up-to-date governance of risk as members of the
record of the Bank’s overall risk profile. relevant committees. In support of this, a
A forward-looking approach is ensured dedicated first line risk function is in place
using quarterly stress testing and scenario to provide risk management expertise
analysis, feeding into the annual Internal within an operational setting. The first line
Capital and Liquidity Adequacy Assessment risk function undertakes an active role in
processes (ICAAP and ILAAP) through maintaining and improving internal control
which the Bank ensures that it has sufficient frameworks, remediating weaknesses in
capital and liquidity in place to cover the operational processes, and supporting
risks the Bank faces. business areas in the implementation of the
Bank’s key risk management processes.
31
Contents
Contents
The Bank's capital ratios exceeded its
regulatory requirements throughout Strategic Report
the year.
Second line of defence Key Risk Indicators). The regular review of Corporate Governance Statement
The Chief Risk Officer and team operate as the Bank’s appetite for risk is facilitated and
the second line of defence, working closely challenged by the second line of defence,
with executive management and their driven by the recommendations of the
respective teams. The Chief Risk Officer is appropriate executives and subject matter
independently responsible for managing, experts. This process includes ensuring that
the key risks identified remain appropriate
designing, and continually updating the against the strategic plan, current business,
Enterprise Risk Management Framework macroeconomic, geopolitical, regulatory,
and risk assessment and evaluation tools and legal environment, and experience
and systems, providing training, review,
and challenge to the first line, and ensuring of risk throughout the preceding year.
that the Bank operates within all applicable On at least an annual basis, the second
regulatory guidelines and in line with line of defence provides a review and
challenge before presenting to the relevant
emerging industry good practices in
executive committee (Risk Management Independent Auditor’s Report
relation to risk management. A key role of
second line is to provide an independent Committee, Credit Committee or Asset &
view to management and the Board of the Liabilities Committee) for further review
and challenge and recommendation to the
risks within the Bank. Board Risk & Compliance Committee for
approval. The Risk Appetite Statement is
Third line of defence refreshed and updated annually.
The third line of defence is comprised of
Internal Audit, outsourced to Deloitte under The Bank’s performance against Risk
the administrative supervision of the Chief Appetite is monitored via reporting to
Risk Officer and Chief Financial Officer, the executive risk committees. This is
reporting to the Bank’s Audit Committee. summarised within the Chief Risk Officer
Financial Statements
Internal Audit is responsible for providing Risk Management Report, which is
independent assurance that the Enterprise presented to Risk Management Committee
Risk Management Framework, including its and appropriate Board committees
operation by the first and second lines, is monthly. The periodic reporting shows
operating effectively. status against each Key Risk Indicator (KRI)
and overall rating, based on parameters
Risk Appetite set within the Enterprise Risk Management
Framework, using a Red/Amber/Yellow/
The Risk Appetite is the amount and type of Green scale and the expert judgement of
risks the Board is willing to take in pursuit the first and second lines. These KRI’s detail
of its strategy and objectives. The overall the Bank’s Risk Appetite and are reviewed
objective is to protect the Bank from at least annually or in the event of a major
unacceptable levels of risk while supporting change to strategy and/or environment Notes to the Financial Statements
and enabling overall business strategy within which the Bank operates.
(including the assessment of new business
opportunities). The Bank’s Risk Appetite
Statement outlines a mixture of qualitative
and quantitative measures (Statements and