Balance Sheet at 31 December 2010 of BBVA

processes. SIRO: operational risk events tend to have a negative impact on the income statement. To
keep exhaustive control over them, they are recorded to a data base called SIRO. For this to be
trustworthy, it is fed directly from the accounts department. The internal SIRO data are supplemented
with information from an external data base that come from the ORX consortium (Operational Risk
Exchange, orx@org.com. BBVA was a founding member of this non-profit association, which now has
50 first-line banks from 18 countries as members.
The operational risk events are classified into the risk categories established under Basel 2:
processes, fraud (internal and external); technology, human resources, trading practices, disasters
and suppliers. The Group also has its internal control model that informs the best practices contained
in the documents Enterprise Risk Management – Integrated COSO Framework and the BIS
Framework for Internal Control Systems in Banking Organisations. The Internal Control Model fits into
the Integral Risk Management Framework, which is a process within the organisation that involves its
board of directors, its senior management and all its staff. It is designed to identify potential risks facing
the institution, to ensure these are managed within the limits established, such that the business
objectives can be guaranteed, insofar as this is reasonable. This Integrated Risks Management
Fraework includes specialist units, the Internal Control and Operational Risk function and Internal
Audit.
The Internal Control Model is based on the following principles:
1. The axis for articulating the Internal Control Model is the process.
2. 2. The activity of identifying, evaluating and mitigating risks must be unique for each
process.
3. The responsibility for internal control falls to the units within the Group.
4. The systems, tools and information flows supporting the activities of internal control
and operational risk must be unique or, in all cases, administered in an integrated
fashion by one sole unit.
5. The specialist units promote policies and draw up internal standards whose secondlevel
development and application is done by the Corporate Internal Control and
Operational Risk Unit. One of the essential elements in the model is the Entity-Level
Controls, a high level layer of controls aimed to reduce the severity of the risks
inherent to the business. The Internal Control and Operational Risk deparment in
each unit is responsible for implementing the control model within its scope of
powers and to manage existing risk by proposing improvements to processes. Given
that the scope of responsibility of some units is global, there are transversal control
functions to supplement the aforementioned control mechanisms. Finally, the Internal
Control & Operational Risk Committee in each unit is responsible for approving the
suitable plans for mitigating each of the risks and issues detected. This structure of
committees culminates in the Group Global Internal Control & Operational Risk
Committee.
The use of all the tools, and the implementation of the risk control systems and correct
performance of the risk function has meant that there is a low level of risk
materialisation, the levels of NPA levels are controlled and the BBVA Group has high
levels of capital adequacy.
D.2. Indicate whether any of the various types of risks (operational, technological, financial, legal,
reputational, tax-related, etc.) affecting the Company and/or its Group materialized during the fiscal
year.
YES
If so, indicate the circumstances giving rise to them and whether the established control systems have
worked:
WARNING: The English version is only a translation of the original in Spanish for information purposes. In case of a discrepancy,
the Spanish original prevails.