BANCO BILBAO VIZCAYA ARGENTARIA, S.A. AND ... - BBVA

The Internal Control Model therefore comes within the Integral Risk Management Framework.Said
framework is understood as the process within an organization involving its Board of Directors, its
management and all its staff, which is designed to identify potential risks facing the institution and which
enables them to be managed within the limits defined, in such a way as to reasonably assure that the
organization meets its business targets.
This Integral Risk Management Framework is made up of Specialized Units (Risks, Compliance,
Accounting and Consolidation, Legal Services), the Internal Control Function and Internal Audit.
The Internal Control Model is underpinned by, amongst others, the following principles:
1. The “process” is the articulating axis of the Internal Control Model.
2. Risk identification, assessment and mitigation activities must be unique for each process.
3. The Group’s units are responsible for internal control.
4. The systems, tools and information flows that support internal control and operational risk
activities must be unique or, in any event, they must be wholly administered by a single unit.
5. The specialized units promote policies and draw up internal regulations, the second-level
development and application of which is the responsibility of the Corporate Internal Control Unit.
One of the essential elements in the model is the Institution-Level Controls, a top-level control layer,
whose aim is to reduce the overall risk inherent in its business activities.
Each unit’s Internal Control Management is responsible for implementing the control model within its
scope of responsibility and managing the existing risk by proposing improvements to processes.
Given that some units have a global scope of responsibility, there are transversal control functions which
supplement the previously mentioned control mechanisms.
Lastly, the Internal Control and Operational Risk Committee in each unit is responsible for approving
suitable mitigation plans for each existing risk or shortfall. This committee structure culminates at the
Group’s Global Internal Control and Operational Risk Committee.
RISK CONCENTRATION
In the trading area, limits are approved each year by the Board’s Risk Committee on exposures to trading,
structural interest rate, structural currency, equity and liquidity risk at the banking entities and in the asset
management, pension and insurance businesses. These limits factor in many variables, including economic
capital and earnings volatility criteria, and are reinforced with alert triggers and a stop-loss scheme.
In relation to credit risk, maximum exposure limits are set by customer and country; generic limits are also
set for maximum exposure to specific deals and products. Upper limits are allocated based on iso-risk
curves, determined as the sum of expected losses and economic capital, and its ratings-based equivalence
in terms of gross nominal exposure.
There is also an additional guideline in terms of oversight of maximum risk concentration up to and at the
level of 10% of equity: stringent requirements in terms of in-depth knowledge of the counterparty, its
operating markets and sectors.
For retail portfolios, potential concentrations of risk are analyzed by geographical area or by certain specific
risk profiles in relation to overall risk and earnings volatility; where appropriate, the opportune measures are
taken, imposing cut-offs using scoring tools, via recovery management and mitigating exposure using pricing
strategy, among other approaches.
7.1 CREDIT RISK
Credit risk is defined as the risk that one party to a financial instrument will cause a financial loss for the
other party by failing to discharge a contractual obligation due to the insolvency or incapacity of the natural or
legal persons involved.
49