BBVA in 2012

Operational riskOperational risk is defined as the one that could potentially cause losses due to human error,inadequate or faulty internal processes, system failures or external events. This definition includeslegal risk, but excludes strategic, business and reputational risk.Operational risk is inherent to all banking activities, products, systems and processes. Its originsare diverse (processes, internal and external fraud, technology, human resources, suppliers,commercial practices, disasters). Operational risk management is integrated into BBVA Group’sglobal risk management structure.39Characteristics of BBVA's operational risk management modelSoundnessBoard - Holding - Country – UnitDepthModel created in 1999 using a database since 2002Integrated into managementCapital, budgets, incentives, internal benchmark, cultureForward lookingUses future variables for analysis, calculation and mitigationProactive focusIdentifies and prioritizes relevant risks in order to mitigate themContinuos improvementBest practices function and continuous updatingIn 2012 an integrated internal control and operational risk methodology was implemented acrossthe Group as a development of the self-assessment Ev-Ro tool, which in 2012 has been updatedin the same time. The methodology identifies risks in organizational units, generates exerciseswhich prioritize the risks according to their estimated residual risk (after including the effect ofthe controls), links the risks to the Bank’s processes, and establishes a target level for each riskto identify and manage gaps by comparing it with the residual risk level. In order to provide therequired support for this methodology, the Group has developed a new corporate IT system:STORM (Support Tool for Operational Risk Management), which includes indicators and scenariosmodules.Operational risk management frameworkBBVA Group’s operational risk management model includes a governance structure based onthree lines of defense, with clear specification of responsibilities: a) policies and procedures thatare common to the whole Group; b) systems prepared to identify, measure, monitor, control andmitigate operational risks and losses; and c) tools and methodologies that quantify operational riskin terms of capital.Operational risk121