Prospectus - Notowania

205
>> Condensed Consolidated Financial Statements
Part E) – Information on risks and related risk management policies
The entities provide a summary of the activities carried out and assess whether they comply with regulations and Group
standards. Where areas for improvement are identified, the proposed actions must be defined, along with, where possible,
the predicted timeframe for their implementation.
The entities applying the advanced model (Advanced Measurement Approach) and those of the Italian entities using the
standard approach (Traditional Standardized Approach) must compile the validation document and submit it to Parent
company. The validation document, together with Parent company’s opinion and the Internal Audit report, are submitted to
the entity's Board of Directors for approval.
Parent company’s Risk management function is responsible for drawing up the Group validation document and submitting it
to the UniCredit Board of Directors for approval, together with the Internal Audit report.
Reporting
A reporting system has been developed by Parent company to inform senior management and internal control bodies about
the Group's operational risk exposure and the risk mitigation actions.
In particular, quarterly updates are provided on operating losses, capital-at-risk estimates, relevant external events and the
main initiatives undertaken to mitigate operational risk in the various business areas. A summary of the most important risk
indicators is drawn up each month.
The results of the main scenario analyses carried out at Group level and the relevant mitigation actions undertaken are also
submitted to the attention of the Group's Operational Risk Committee.
Operational risk management and mitigation
Operational risk management consists of process reengineering to reduce risk exposure, including outsourcing
considerations, and insurance policies management, defining proper deductibles and policies’ limits.
Regularly tested business continuity plans will also assure operational risk management in case of interruption of main
business services.
The Risk Committee (or other bodies in accordance with local regulations) reviews risks tracked by the Operational Risk
functions of the Legal entities, with the support of functions involved in daily operational risk control and monitors the risk
mitigation initiatives.
Risk capital measurement and allocation mechanism
UniCredit developed a proprietary model for measuring capital requirements. The system for measuring operational risk is
based on internal loss data, external loss data (consortium and public data), scenario generated loss data and risk indicators.
Capital requirements are calculated per operational event type class. For each risk class, severity and frequency of loss data
are separately estimated to obtain the annual loss distribution through simulation, considering also insurance coverage. The
severity distribution is estimated on internal, external and scenario generated data, while the frequency distribution is
determined using only the internal data. An adjustment for key operational risk indicators is applied to each risk class. Annual
loss distributions of each risk class are aggregated through a copula based method. Capital at risk is calculated at a
confidence level of 99.9% on the overall loss distribution for regulatory purposes and at a confidence level 99.97% for
economic capital purposes.
By the allocation mechanism, the individual legal entities’ capital requirements are identified, reflecting the Legal Entities’ risk
exposure and risk management effectiveness.
The internal model (AMA) has been formally approved by the Supervisory Authority and is expected to be rolled out to all the
relevant Group entities before the end of 2012. The entities not yet authorised to use the advanced methods contribute to the
consolidated capital requirement on the basis of the standard (TSA) or basic (BIA) method.