Operational risk

Operational risk is the risk of a loss resulting from the inadequacy or failure of the Bank's internal processes, employees and systems or from external events not controlled by the Bank (primarily, natural disasters).

To implement the Bank's internal operational risk management strategy, VTB carries out regular procedures for risk identification, assessment, control and limitation. In its operational risk management practices, VTB follows the principles set by the Bank of Russia regulations (including the Letter of May 24, 2006 No. 76-T On Managing Operational Risks Lending Institutions) as well as recommendations of the Basel Committee on Banking Supervision.

The Bank employs a system of collecting and submitting information on identified operational losses by head office and branch structural units with the use of a centralized analytic losses database. The unified nature and level of detail of the information contained in the database ensure:

• possibility to carry out quantitative assessment of operational risk indicators (including by separate risk categories and business lines);
• risk source identification;
• risk limitation measures; and
• creation of management reporting.

The principal measures used in VTB bank to minimize operational risk are:

• regulating the procedure of carrying out all main operations in accordance with internal regulations and guidelines;
• accounting and documentation of bank operations and transactions, regular document and account reconciliation by operations;
• applying the principle of: division and limitation of functions, authorities and responsibilities of employees, use of double control mechanism, taking collegial decisions, setting limits for terms and volumes of operations;
• implementing procedures for administrative and financial internal control (prior, current and follow-up) over business process organization, activities of structural units and carrying out operations by individual employees, observation of legal and internal regulatory requirements by employees, control over observation of limits set for operations, procedure of access to information and the Bank's tangible assets;
• automating bank operations, using bank's internal information systems;
• ensuring information security, information access control, multilevel data protection;
• ensuring physical security of the Bank's premises and valuables and access control;
• insurance of operational risks covering any losses that may arise by insurance indemnity;
• creating necessary organizational and technical conditions to ensure continuity of economic activity related to banking operations (in case of fire, terrorist attacks and other emergencies);
• mitigating the Bank's operational risks related to separate business processes by attracting third parties (outsourcing); and
• mitigating personnel-related risks by establishing selection criteria and conducting preliminary checks, implementation of education, training and further training of personnel.