Prospectus - Notowania

Organizational structure
Senior Management is responsible for approving all aspects relating to the Group operational risk framework and verifying the
adequacy of the measurement and control system, and is regularly updated on changes to the risk profile and operational risk
exposure, with support from the appropriate risk committees if required.
At Parent company level is set up the Group Operational Risk Committee - chaired by Group Chief Risk Officer.
The permanent members are functions of Parent company: Operational and Reputational Risks Portfolio Management,
Transactional Risk Managers and other functions involved in controlling and managing operational risk as for example
Compliance, Legal, Tax Affairs, Human Resources, Security and Internal Audit. Other functions of Parent company,
representing the areas and Operational Risk Management (ORM) functions of relevant entities, are called to attend to the
Committee when required.
The Committee is responsible for monitoring operational risks at Group level, evaluating incidents significantly affecting the
overall operational risk profile, submitting to the “Group Risk Committee”, for either approval or information operational risk
strategies and policies, methodologies and limits as well as regular reporting on operational risk portfolio.
The Group Operational Risk Committee meets with consulting and suggestion functions for submission to the Group Risk
Committee for the following topics:
� Group risk appetite
� definition of operational risk limits
� Internal models for operational risk measurement for regulatory and economic capital purposes
� operational risk strategies
The Group Operational Risk Committee meets with approval function for the following topics:
� guidelines and policies on operational risk topics
� mitigation actions
� strategies for insurance hedging
Parent company Operational and Reputational Risks Portfolio department oversees and manages the overall operational and
reputational risks profile of the Group by defining all the relevant strategies, methodologies and limits.
In the department there are two organizational units devoted to operational risk management.
Operational Risk Methodologies and Control unit is responsible for developing operational risk management methodologies,
for the Group capital at risk measurement and defining Group guidelines for operational risk control, supporting and
controlling the legal entities’ ORM functions, in order to verify that Group standards are met in the implementation of control
processes and methodologies.
Operational Risk Strategies and Mitigation unit is responsible for defining and monitoring operational risk limits, defining
strategies, planning mitigation actions and monitoring their implementations.
The ORM functions of the controlled entities provide specific operational risk training to staff, who can also use intranet
training programs, and are responsible for the correct implementation of the Group framework elements. Parent company's
Operational Risk Management function prepares regular updates on regulatory and managerial aspects of operational risk,
which are sent to the functions responsible for operational risk control and management.
In compliance with regulations, an internal validation process (self-assessment) for the operational risk control and
measurement system has been set up at Parent company and in the Group entities in order to verify the conformity with
regulations and Group standards.
CONSOLIDATED INTERIM REPORT
AS AT SEPTEMBER 30, 2009
204