Risk Management
The information in Section 3.1, 3.2 and 3.3 on pages 46 to 59 in Risk Management identified as audited (with the exception of the boxed parts of these sections clearly identified as unaudited), forms an integral part of the audited financial statements as described in the basis of preparation on page 295. All other information in Risk Management is additional information and does not form part of the audited financial statements.
1. Risk Management and Governance
The nature of risk taking is fundamental to a financial institution’s business profile. It follows that prudent risk management forms an integral part of the Bank’s governance structure.
Within the boundaries of the Board-approved Risk Appetite Statement (RAS), the Bank follows an integrated approach to Risk Management, to ensure that all key risks faced by the Group are appropriately identified, assessed and managed. This approach ensures that robust mechanisms are in place to protect and direct the Bank in recognising the economic substance of its risk exposure.
The Bank implements a Risk Management process, which consists of the following key aspects:
- Risk Identification;
- Risk Assessment and Measurement;
- Risk Mitigation and Control;
- Risk Monitoring and Testing; and
- Risk Reporting and Escalation.
Enterprise Risk Management Framework
Within the Internal Control Framework (‘ICF’), the Enterprise Risk Management Framework (‘ERMF’) is the Group’s overarching risk management framework articulating the management process governing risks within the following key risk categories: Capital Adequacy Risk; Liquidity and Funding Risk; Market Risk; Credit Risk; Business Risk; Operational Risk; Information and Communication Technology (‘ICT’) Risk; Model Risk; Compliance Risk (including ‘AML’); Conduct & Reputational Risk, Climate-Related and Environmental Risk (‘CRE’).
The ERMF outlines the Group-wide approach to the identification; assessment and measurement; mitigation and control; monitoring and testing; and, reporting and escalation of breaches across the outlined risk categories. The Group manages, mitigates, monitors and reports its risk exposure through a set of risk management processes, activities and tools.
The Board Risk and Compliance Committee (‘BRCC’) provides oversight and advice to the Board on risk governance and supports the Board in carrying out its responsibilities for ensuring that risks are properly identified, assessed, mitigated, monitored and reported and that the Group’s strategy is consistent with the Group’s Risk Appetite.
Risk Appetite and Strategy
The Bank’s Risk Appetite Statement (‘RAS’) documents are owned by the Board, supported by the Chief Risk Officer (‘CRO’), and describe the Bank’s risk appetite at the enterprise level. The RAS serves as a boundary to business, support, and control function leaders; enables a consistent approach to risk management; endorses risk discipline; and integrates risk management into decision-making at all levels of the organisation. The RAS further ensures the Bank’s risk is communicated clearly and well understood by both Senior Management and Bank employees so that risk management is continually embedded into the Bank’s culture.
The structure of the RAS enables the Bank to maintain robust discussions of risk taking and risk management and provides a commonly understood baseline against which management recommendations and decisions can be debated and effectively and credibly challenged.
The RAS is an articulation of how the Bank’s appetite for and tolerance of risk will be expressed. This comes in the form of qualitative statements about the nature and type of risk that the Bank will take on, and quantitative limits and thresholds that define the range of acceptable risk.
The RAS includes component risk appetite statements for each of the distinct key risk categories defined, including qualitative expressions of risk appetite as well as quantitative measures i.e., key risk indicators (‘KRIs’) supporting qualitative expression. KRIs are monitored and reported to ensure prompt and proactive assessment of their impact on adherence with the Board-approved risk appetite.
The Bank has a straight-forward business model, to deliver a full-service Retail and SME Bank with a medium risk appetite exclusively focused on the Republic of Ireland.
Risk Governance
The Bank’s risk governance structure establishes the authority, responsibility, and accountability for risk management across the Bank and enables effective and efficient monitoring, escalation, decision-making, and oversight with respect to risks by appropriate Board and management-level governing bodies.
The responsibilities set out below relate to risk management activities. Further roles and responsibilities are documented in the Internal Control Framework (“ICF”), the Board Manual and the Group Risk committees’ Terms of Reference.
The design of the Bank’s risk governance structure is informed by a set of risk governance principles that are based on relevant regulatory guidelines. These principles include:
