2007 REGISTRATION DOCUMENT

3 RiskRISK MANAGEMENTmanagement frameworkOPTIMUM ORGANISATIONAL STRUCTUREIn 2007 the units responsible for setting the operational risk framework,conducting permanent controls and coordinating business continuityplans were merged in an attempt to streamline and optimise internalcontrol procedures. The new unit will be responsible for both measuringand managing operational risk. It will define, coordinate and monitorthe Group’s operational risk, permanent controls and business continuityframeworks, and produce the appropriate risk measures and managementdata.The unit will work in line with a unified, five-tier approach based on:■ analysing risks;■ implementing preventive and/or mitigating tools including procedures,controls, business continuity plans and insurance;■ producing risk measures and calculating the capital charge foroperational risk (used to determine tolerance levels and consolidatedexposure);■ reporting and analysing information (used in validating controls andmanaging risk);■ formulating action plans to prevent and/or remedy risks, togetherwith follow-up procedures.This approach involves a two-way vertical information flow (bottom upand top down) which ensures that data is provided to the competent levelof the organisation for review, validation and decision-making purposes.It also functions as a loop, ensuring that due account has been takenof changes in the environment and that control procedures have beenadjusted accordingly.KEY PLAYERS AND GOVERNANCEAt all levels of the Group (core businesses, functions, business lines,subsidiaries and territories), the risk management framework relies onteams of operational risk analysts and coordinators of permanent controlsand business continuity plans. These teams head up the operational riskmanagement process falling within their particular remit, and ensurethat the standard operational risk policy and related methodologies andtools are properly implemented. They have a particularly important rolein risk analysis and risk reporting.The entire system requires significant involvement of operational staff.Issues that arise in relation to operational risk, permanent controls andbusiness continuity are discussed with the Group’s Executive Committeethree times a year, and with the Internal Control Coordination Committeeevery month. This committee is chaired by the Internal Control Coordinatorand brings together key players in the internal control process. Groupcompanies are encouraged to adopt this governance structure in theirown organisations.Executive Committees at the level of the Group and the core businessesare tasked with ensuring that operational risk is effectively managedand controlled in the areas falling within their remit, in accordance withthe Group’s operational risk framework. The committees are responsiblefor validating the quality and consistency of reporting data and forexamining the risk profile adopted in light of the tolerance levels setby either the committees themselves or the Group. They also assess thequality of risk control procedures in light of their objectives and therisks they incur.RISK ANALYSISA large number of people are involved in the risk analysis process, fromstaff heading up the operational risk management framework throughto their business line operating managers. Operational risk is analysedon the basis of historical data and prospective scenarios.Historical data: operational risk data has been systematically compiledsince the beginning of 2002, with the process subsequently rolled outto all of the Group’s business lines and territories and enhanced by dataquality reviews and certification procedures. The analysis and followupof operational risk data are key to identifying the actions needed toprevent incidents from recurring in the future.Prospective scenarios: the Group adopts an integrated approach tomodelling risks and analysing potential incidents, based on an analysis ofits internal processes. A qualitative analysis of the causes, correspondingcontrols and impact of operational risk incidents is carried out foreach process, with the results quantified and input into the internalcapital calculation model. The analysis highlights the Group’s mainrisk exposures and enables the organisation to identify the necessaryremedial actions.The analysis of actual and potential operational risks is therefore a keycomponent of the risk management process. It helps identify factorsthat may prevent or mitigate such risks, particularly the need for new oradjusted control procedures and business continuity plans. In turn, therisk analysis process is enhanced by the review of control procedures andbusiness continuity plans. The analysis of the “risk – controls – businesscontinuity plan” chain is therefore designed as a loop in order to optimisethe Group’s operational risk management framework.LEGAL, TAX AND INFORMATION TECHNOLOGYRISKS RELATING TO OPERATIONAL RISKLegal risk< Contents >In each country where it operates , BNP Paribas is bound by specific localregulations applicable to companies engaged in banking, insurance andfinancial services. The Group is notably required to respect the integrityof the markets and the primacy of clients’ interests.For many years, the Group Legal Department function has had an internalcontrol system designed to anticipate, detect, measure and managelegal risks.The system is organised around:■ Specific committees:■ the Legal Affairs Committee,■ the Global Legal Committee, which coordinates the activities ofthe legal function throughout the Group in all countries that havetheir own legal staff, and ensures that the Group’s legal policiesare consistent and applied in a uniform manner,■ the Legislation Tracking Committee, which analyses, interpretsand distributes throughout the Group the texts of new laws andregulations, and details of changes in French and European caselaw,■ the Legal Internal Control Committee, whose focuses includeoperational risk,■ the Litigation Committee, which deals with major litigationproceedings in which the Group is the plaintiff or defendant,■ the Legal function is a permanent member of the ComplianceCommittee and the Internal Control Coordination Committee;1234567891011762007 Registration document - BNP PARIBAS