BBVA in 2012

40 Operational risk management framework: Three lines of defense• In general, it verifies compliance with theoperational risk management model throughindependent review and tests of the Group’scontrols, processes and systems.• Coordinated by GRO funcions in the areas and bythe owners of processes and controls.Internal auditGCRO, Country GROand specialized unitsBusinessunits• The Corporate Operational Risk Management(GCRO) and Country Operational RiskManagement (GRO) functions design, maintainand update the Group’s operational riskframework and verifies its correct applicationwithin the business and support areas.• They define procedures, systems and tools.• Reporting to senior management.Operational risk management in BBVA is designed and coordinated from the Corporate OperationalRisk Management (GCRO) function, belonging to the GRM area, and from the Operational RiskManagement (GRO) units, located in the Risk departments of the different countries and business areas.In turn, business or support areas have operational risk managers who report to the aforementionedunits, and who are responsible for implementing the model in the areas on a daily basis. This givesthe Group a view of risks at the process level, where risks are identified and prioritized and mitigationdecisions are made. Following a bottom-up approach, this system provides an overall view at each level.Each business and support unit has one or more GRO committees that meet on a quarterlybasis. These committees analyze the information provided by the Group’s risk tools and makethe appropriate mitigation decisions. Above these GRO committees is the country-level GROCommittee, which deals with the most significant risks and their corresponding mitigation plans, aswell as risks that cut across different areas. The Global Corporate Assurance Committee (CGCA) isthe highest-level body in the parent company, and undertakes a general monitoring of the Group’smain operational risks. The Board of Directors is responsible for establishing the risk control andmanagement policy and for periodically monitoring the internal reporting and control systems.41Operational risk management framework: Organizational structureCGCAGRO CountryBusiness area and support GROBBVA is working to improve the operational risk management model along two lines:• Incorporating specialist control units to obtain a more independent and expert overview and tounify governance of the Group’s control functions.• Bolstering the operational risk scenarios with a scenario database that can be updated eachyear. Exhaustive quantification reports are constructed for them under different environments,with the help of independent experts and specialists.122 Risk management