BANCO BILBAO VIZCAYA ARGENTARIA, S.A. AND ... - BBVA

- PRINCIPLES AND POLICIES
The general guiding principles followed by the BBVA Group to define and monitor its risk profile are set
out below:
• The risk management function is unique, independent and global.
• The assumed risks must be compatible with the target capital adequacy and must be identified,
measured and assessed. Monitoring and management procedures and sound control and
mitigation systems must likewise be in place.
• All risks must be managed integrally during their life cycle, being treated differently depending on
their type and with active portfolio management based on a common measurement (economic
capital).
• It is each business area’s responsibility to propose and maintain its own risk profile, within their
independence in the corporate action framework (defined as the set of risk policies and
procedures), using a proper risk infrastructure.
• The risk infrastructure must be suitable in terms of people, tools, databases, information systems
and procedures so that there is a clear definition of roles and responsibilities, ensuring efficient
assignment of resources among the corporate area and the risk units in business areas.
Building on these principles, the Group has developed an integrated risk management system that is
structured around three main components: a corporate risk governance regime, with adequate
segregation of duties and responsibilities a set of tools, circuits and procedures that constitute the
various different risk management regimes, and an internal risk control system.
- CORPORATE GOVERNANCE SYSTEM
The Group has a corporate governance system which is in keeping with international
recommendations and trends, adapted to requirements set by regulators in each country and to the
most advanced practices in the markets in which it pursues its business.
In the field of risk management, it is the board of directors that is responsible for approving the risk
control and management policy, as well as periodically monitoring internal reporting and control
systems.
To perform this function correctly the board is supported by the Executive Committee and a Risk
Committee, the main mission of the latter being to assist the board in undertaking its functions
associated with risk control and management.
Under Article 36 of the Board Regulations, the Risk Committee is assigned the following functions for
these purposes:
• To analyze and evaluate proposals related to the Group’s risk management and oversight
policies and strategies.
• To monitor the match between risks accepted and the profile established.
• To assess and approve, where applicable, any risks whose size could compromise the Group’s
capital adequacy or recurrent earnings, or that present significant potential operational or
reputational risks.
• To check that the Group possesses the means, systems, structures and resources in
accordance with best practices to allow the implementation of its risk management strategy.
The risk management function is distributed into the Risk Units of the business areas and the
Corporate Area, which defines the policy, strategies, methodologies and global infrastructure. The
Risk Units in the business areas propose and maintain the risk profile of each client independently,
but within the corporate framework for action.
The Corporate Risk Area combines the view by risk type with a global view. It is made up of the
Corporate Risk Management unit, which covers the different types of risk, the Technical Secretary
responsible for technical comparison, which works alongside the transversal units: such as Structural
47