UBI Banca Group

The organisational model
The organisational model for the management of operational risks is based on a combination of
components based on the responsibilities assigned and the specific position occupied in the
organisation chart, both centralised and decentralised, consistent with the federal, multi-functional
and integrated structure of the Group. In this context the Parent performs the functions of
management, co-ordination and control, and the supervision of business functions, which includes
supporting the activities of network banks and product companies in their core businesses, and it
supplies common support services either directly or through subsidiaries.
The design of the organisational structure is differentiated and based on the size and operational
complexity of each entity in the Group: Parent, service company, commercial banks, product
companies. Centralised responsibilities, each within the scope of their functions, are assigned to the
following:
– the Operational Risks Committee is the policy making and governance body which
oversees the general process of operational risk management. Its composition,
functional rules, duties and powers are governed by the General Corporate Regulations;
– Operational Risks Service: as the unit responsible for the general system of
operational risk management, it plans, develops and maintains methods for the
detection, measurement and monitoring of operational risk and it verifies the
effectiveness of measures to mitigate operational risk and of the relative reporting
systems. It is also responsible for policy setting, co-ordination and control of the overall
system at Group level;
– the Methods and Models Service is the unit responsible for calculating capital
requirements for the legal entities of the Group which intend to adopt advanced
approaches on the basis of validation instructions received from the Models and
Processes Validation Service and other internal and external bodies according to the
case. This service forms part of the Operational Risk Service;
– the Models and Processes Validation Service: as a function that is independent of
persons or units involved in the development of risk management and measurement
systems, it is responsible for the continuous assessment of the quality of the operational
risk management system and its compliance over time with legislation and regulations,
operational requirements and market demands. Its activities include verification of the
reliability of capital requirement calculations and tests of the use of the measurement
system in decision making processes and in the management of operational risks (use
tests);
– the Risk Policies Service is the unit responsible for formulating and revising the
“Operational Risk Policy of the UBI Banca Group”. It is also involved in assessing and
taking out insurance policies to mitigate operational risk following procedures contained
in the Insurance Risk Management Regulations.
The organisational model is structured with four levels of responsibility for the individual legal
entities of the Group as follows:
– Operational Risk Officer (ORO): these are responsible within their legal entities (Parent
– network banks – product companies) for implementing the overall framework for the
management of operational risks as defined by Group policies and the respective
regulations to implement it;
443