Enterprise Risk Management at BNP Paribas

<< Previous

Excerpts

Five principles defined the scope of BNP's Global Risk Management Department (GRM)

A. Active Control GRM was responsible for ensuring that the risks taken by the bank were compatible with its profitability and credit rating objectives. GRM regularly reported to the Internal Control and Risk Management Committee of the Board on its main findings concerning risks, and how they were measured and consolidate them on a Group-wide basis... B. Strong Independence GRM reported directly to Executive Management and was outside any business line or territory authority. GRM had cross-functional teams in the main territories...

C. Wide Range of Competence
GRM had responsibility for all risks arising in the course of the Group's business. There were five main categories of risk: Credit risk, Market & Liquidity risk, Operational risk, Insurance risk (risk due to the specific risk arising from unexpected changes in claims experience) and New risks (risks generated by changes in the banking business)...

D. Intervention at All Levels of The Risk-Taking and Monitoring Chain
As part of risk decision-making, GRM performed the following core functions:

Policy: GRM made recommendations to Executive Management concerning risk acceptance policies and was responsible for approving new businesses and products that exposed the Group to new types of risk...

E. Global Organisation
GRM teams were based in the various territories. These teams were placed under the direct authority of GRM and had a clear functional reporting relationship with GRM. In some cases, where the risks involved were of a different nature as in Retail Banking, the business line concerned had its own risk management function...

Market and Liquidity Risks
Overall responsibility for managing market and liquidity risks lay with the Market Risk Committee headed by one of the Chief Operating Officers and backed by GRM. The Committee met once a month to approve risk management methods and procedures, define exposure limits and check compliance with these limits...

Operational Risk
Operational risk correspondents had been appointed in each business line and each corporate department, to ensure that Group operational risk management guidelines were implemented. They were backed by numerous risk officers within their units. Various initiatives had been launched to produce detailed measurements of operational risk, to comply with future regulatory requirements. An Incident Management Policy and an Incident Management System ("IMS") had been established in order to collect detailed historical loss data, for the entire Group...

BNP's information systems security policy was monitored by Group Management. Systems security considerations were factored into all IT projects from the outset. Periodic monitoring was used to ensure that the level of systems security was maintained. This was backed up by a technical intelligence service to ensure that the latest advances in systems security were implemented...