Letno poročilo 2009.pdf - UniCredit Banka Slovenija dd

Risk ReportRisk Report• Achieve a deeper understanding of the embedded risk in the business process.Internal Loss Data are collected and processed in close coordination and cooperation with other departments and units. The minimumthreshold at which an event is recorded is 100 euros of actual loss or 10.000 euros of potential loss. Any losses below these thresholds arenot collected. The operational risk events are allocated in line with operational risk standards to the following seven categories:• Internal fraud;• External fraud;• Employment practices and workplace safety;• Clients, products and business practices;• Damage to physical assets;• Business disruption and system failures;• Execution, delivery and process.Operational risk losses get regularly reconciled with the Bank’s profit and loss statement in order to ensure completeness of the collectedoperational risk losses.We have to consider the fact that we always take numerous measures to manage and reduce operational risk. Implementation of mitigationmeasures is constantly monitored and new measures are proposed.Self-AssessmentRisk identification is the recognition of the operational risk events that management believes may give rise to operational losses. We utilizeself-assessment process and supporting architecture as a dynamic risk management tool. The goal of the self-assessment process is toidentify the key operational risks specific to our environment and assess the degree to which it maintains appropriate controls. Action plansare developed for control issues identified, and business units are held accountable for tracking and resolving these issues on a timely basis.Key Risk Indicators (KRI)Risk indicators are numerical variables whose trend is linked to the processes’ operational risk exposure. Risk indicators are ratios or datareflecting the operational risk profile: the value of an indicator should be correlated to changes in risk levels. Monitoring operational risk usingindicators will give the Operational Risk Team, process owners and persons directly in charge of the risk management early warning signals.The selection process of indicators involves the Operational Risk Management function and process owners and is based on internal loss data,external events, scenario analysis, experts’ suggestion of processes and internal audit, business environment and internal control factors andrisk mapping activity.Scenario AnalysisThe goal of scenario analysis is to assess the Bank’s operational risk exposure to high impact and low probability events. The scenariosare defined by analyzing internal losses, external events deemed relevant, key operational risk indicators' trend, processes, products andevent types. The experience of process managers and operational risk managers as well as suggestions from internal audit and the seniormanagement is taken into consideration. Results, in terms of worst case scenarios, critical processes, mitigation proposals or impacts oncapital at risk are described in specific scenario reports.General Ledger ReconciliationTo guarantee completeness and correctness of the loss data collection process, we carry out quarterly a general ledger analysis. The generalledger analysis is performed by operational risk team in cooperation with the Accounting department on P&L accounts of the general ledger.Although the general ledger analysis requires substantial effort of the Accounting department and the Operational Risk team, it is deemedas adequate and effective to identify all operational risk related accounts and data completeness. Since 2008, we have established also atransitory/suspense accounts analysis which is performed by the Accounting department in cooperation with the account owners.Risk Modeling and capital RequirementsTo support advanced capital modelling and management, the businesses are required to capture relevant operational risk capital information.An enhanced version of the risk capital model for operational risk has been developed on a Group level and implemented also in our Bank.The risk capital calculation is designed to qualify as an “Advanced Measurement Approach” (AMA) under Basel II. It uses a combination ofinternal and external loss data to support statistical modelling of capital requirement estimates, which are then adjusted to reflect qualitativedata regarding the operational risk and control environment.224 2009 Annual Report · UniCredit Bank