Controls over financial reporting

A framework of disclosure controls and procedures is in place to support the approval of the Group’s financial statements. Specific governance committees are responsible for examining the Groups’ financial reports and disclosures to ensure that they have been subject to adequate verification and comply with applicable standards and legislation. These committees report their conclusions to the BAC which debates its conclusions and provides further challenge. Finally, the Board scrutinises and approves results announcements and the Annual Report, and ensures that appropriate disclosures have been made. This governance process ensures that both management and the Board are given sufficient opportunity to debate and challenge the Groups’ financial statements and other significant disclosures before they are made public.

Management’s report on internal control over financial reporting

Management is responsible for establishing and maintaining adequate internal control over financial reporting. Internal control over financial reporting is a process designed under the supervision of the principal executive and principal financial officers to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external reporting purposes in accordance with International Financial Reporting Standards (IFRS) as adopted by the European Union and issued by the International Accounting Standards Board (IASB). Internal control over financial reporting includes policies and procedures that pertain to the maintenance of records that, in reasonable detail, accurately and fairly reflect transactions and dispositions of assets; provide reasonable assurances that transactions are recorded as necessary to permit preparation of financial statements in accordance with IFRS and that receipts and expenditures are being made only in accordance with authorisations of management and the respective Directors; and provide reasonable assurance regarding prevention or timely detection of unauthorised acquisition, use or disposition of assets that could have a material effect on the financial statements.

 

Internal control systems, no matter how well designed, have inherent limitations and may not prevent or detect misstatements. Also, projections of any evaluation of effectiveness to future periods are subject to the risk that internal controls may become inadequate because of changes in conditions, or that the degree of compliance with the policies or procedures may deteriorate.

Management has assessed the internal control over financial reporting of Barclays PLC Group’s and Barclays Bank PLC Group’s as of 31 December 2017. In making its assessment, management utilised the criteria set out in the 2013 COSO framework and concluded that, based on its assessment, the internal control over financial reporting was effective as of 31 December 2017. Our independent registered public accounting firm has issued a report on the Barclays PLC Group internal control over financial reporting, which is set out on page 186.

The system of internal financial and operational controls is also subject to regulatory oversight in the UK and overseas. Further information on supervision by the financial services regulators is provided under Supervision and Regulation in the Risk review section on pages 155 to 162 .

Changes in internal control over financial reporting

There have been no changes in the Groups’ internal control over financial reporting that occurred during the period covered by this report which have materially affected or are reasonably likely to materially affect the Groups’ internal control over financial reporting.

 

 

Credit risk (audited)

The risk of loss to the firm from the failure of clients, customers or counterparties, including sovereigns, to fully honour their obligations to the firm, including the whole and timely payment of principal, interest, collateral and other receivables.

 

 

Overview

The credit risk that the Group faces arises mainly from wholesale and retail loans and advances together with the counterparty credit risk arising from derivative contracts with clients. Other sources of credit risk arise from trading activities, including: debt securities, settlement balances with market counterparties, available for sale assets and reverse repurchase loans.

Credit risk management objectives are to:

 

◾

maintain a framework of controls to enable credit risk taking to be based on sound credit risk management principles;

 

◾

identify, assess and measure credit risk clearly and accurately across the Group and within each separate business, from the level of individual facilities up to the total portfolio;

 

◾

control and plan credit risk-taking in line with external stakeholder expectations and avoiding undesirable concentrations;

 

◾

monitor credit risk and adherence to agreed controls;

 

◾

enable risk-reward objectives to be met.

More information covering the reporting of credit risk can be found in Barclays PLC Pillar 3 Report 2017.

Organisation and structure

Wholesale and retail portfolios are managed separately to reflect the differing nature of the assets; wholesale balances tend to be larger and are managed on an individual basis, while retail balances are larger in number but smaller in value and are, therefore, managed on a homogeneous portfolio basis.

Credit risk management responsibilities have been structured so that decisions are taken as close as possible to the business, while enforcing robust review and challenge of performance, risk infrastructure and strategic plans. The credit risk management teams in each business are accountable to the relevant Business CRO who, in turn, reports to the Group CRO.

Roles and responsibilities

The responsibilities of the credit risk management teams in the businesses, the sanctioning team and other shared services include: sanctioning new credit agreements (principally wholesale); setting policies for approval of transactions (principally retail); setting risk appetite; monitoring risk against limits and other parameters; maintaining robust processes, data gathering, quality, storage and reporting methods for effective credit risk management; performing effective turnaround and workout scenarios for wholesale portfolios via dedicated restructuring and recoveries teams; maintaining robust collections and recovery processes/units for retail portfolios; and review and validation of credit risk measurement models.

For wholesale portfolios, credit risk approval is undertaken by experienced credit risk professionals operating within a clearly defined delegated authority framework, with only the most senior credit officers entrusted with the higher levels of delegated authority. The largest credit exposures, which are outside the Risk Sanctioning Unit or Risk Distribution Committee authority require the support of the Group Senior Credit Officers (GSCOs), the Group’s most senior credit risk sanctioners. For exposures in excess of the GSCOs’ authority, approval from the Group CRO is required. In the wholesale portfolios, credit risk managers are organised in sanctioning teams by geography, industry and/or product.

The role of the Central Risk function is to provide Group-wide direction, oversight and challenge of credit risk-taking. Central Risk sets the Credit Risk Control Framework, which provides the structure within which credit risk is managed, together with supporting credit risk policies.

 

Credit risk mitigation

The Group employs a range of techniques and strategies to actively mitigate credit risks. These can broadly be divided into three types:

 

◾

netting and set-off

 

◾

collateral

 

◾

risk transfer

Netting and set-off

In most jurisdictions in which the Group operates, credit risk exposures can be reduced by applying netting and set-off. In exposure terms, this credit risk mitigation technique has the largest overall impact on net exposure to derivative transactions, compared with other risk mitigation techniques.

For derivative transactions, the Group’s normal practice is to enter into standard master agreements with counterparties (e.g. ISDAs). These master agreements typically allow for netting of credit risk exposure to a counterparty resulting from derivative transactions against the obligations to the counterparty in the event of default, and so produce a lower net credit exposure. These agreements may also reduce settlement exposure (e.g. for foreign exchange transactions) by allowing payments on the same day in the same currency to be set-off against one another.

Collateral

The Group has the ability to call on collateral in the event of default of the counterparty, comprising:

 

◾

home loans: a fixed charge over residential property in the form of houses, flats and other dwellings. The value of collateral is impacted by property market conditions which drive demand and therefore value of the property. Other regulatory interventions on ability to repossess, longer period to repossession and granting of forbearance may also affect the collateral value.

 

◾

wholesale lending: a fixed charge over commercial property and other physical assets, in various forms.

◾

other retail lending: includes charges over motor vehicle and other physical assets; second lien charges over residential property, which are subordinate to first charges held either by the Group or by another party; and finance lease receivables, for which typically the Group retains legal title to the leased asset and has the right to repossess the asset on the default of the borrower.

 

◾

derivatives: the Group also often seeks to enter into a margin agreement (e.g. Credit Support Annex) with counterparties with which the Group has master netting agreements in place. These annexes to master agreements provide a mechanism for further reducing credit risk, whereby collateral (margin) is posted on a regular basis (typically daily) to collateralise the mark to market exposure of a derivative portfolio measured on a net basis. The Group may additionally negotiate the receipt of an independent amount further mitigating risk by collateralising potential mark to market exposure moves.

 

◾

reverse repurchase agreements: collateral typically comprises highly liquid securities which have been legally transferred to the Group subject to an agreement to return them for a fixed price.

 

◾

financial guarantees and similar off- balance sheet commitments: cash collateral may be held against these arrangements.

Risk transfer

A range of instruments including guarantees, credit insurance, credit derivatives and securitisation can be used to transfer credit risk from one counterparty to another. These mitigate credit risk in two main ways:

 

◾

if the risk is transferred to a counterparty which is more creditworthy than the original counterparty, then overall credit risk is reduced

 

◾

where recourse to the first counterparty remains, both counterparties must default before a loss materialises. This is less likely than the default of either counterparty individually so credit risk is reduced.

Detailed policies are in place to appropriately recognise and record credit risk mitigation and more information can be found in the Barclays PLC Pillar 3 Report 2017.

 

Market risk (audited)

The risk of loss arising from potential adverse changes in the value of the firm’s assets and liabilities from fluctuation in market variables including, but not limited to, interest rates, foreign exchange, equity prices, commodity prices, credit spreads, implied volatilities and asset correlations.

 

 

Overview

Market risk arises primarily as a result of client facilitation in wholesale markets, involving market making activities, risk management solutions and execution of syndications. Upon execution of a trade with a client, the Group will look to hedge against the risk of the trade moving in an adverse direction. Mismatches between client transactions and hedges result in market risk due to changes in asset prices.

Organisation and structure

Market risk in the businesses resides primarily in Barclays International and Group Treasury. These businesses have the mandate to incur market risk. Market risk oversight and challenge is provided by business Committees and Group Committees, including the Market Risk Committee.

Roles and responsibilities

The objectives of market risk management are to:

 

◾

understand and control market risk by robust measurement, limit setting, reporting and oversight

 

◾

facilitate business growth within a controlled and transparent risk management framework

 

◾

control market risk in the businesses according to the allocated appetite

To meet the above objectives, a well established governance structure is in place to manage these risks consistent with the ERMF. See page 77 on risk management strategy, governance and risk culture.

The BRC recommends market risk appetite to the Board for their approval. The Market Risk Principal Risk Lead (PR Lead) is responsible for the Market Risk Control Framework and, under delegated authority from the Group CRO, agrees with the Business CROs a limit framework within the context of the approved market risk appetite.

The Market Risk Committee approves and makes recommendations concerning the Group-wide market risk profile. This includes overseeing the operation of the Market Risk Framework and associated standards and policies; reviewing arising market or regulatory issues, limits and utilisation; and risk appetite levels to the Board. The Committee is chaired by the PR Lead and attendees include the business heads of market risk, business aligned market risk managers and Internal Audit.

The head of each business is accountable for all market risks associated with its activities, while the head of the market risk team covering each business is responsible for implementing the risk control framework for market risk.

More information on market risk management can be found in Barclays PLC Pillar 3 Report 2017.

Management Value at Risk

 

◾

estimates the potential loss arising from unfavourable market movements, over one day for a given confidence level

 

◾

differs from the Regulatory value at risk (VaR) used for capital purposes in scope, confidence level and horizon

 

◾

backtesting is performed to test the model is fit for purpose.

VaR is an estimate of the potential loss arising from unfavourable market movements if the current positions were to be held unchanged for one business day. For internal market risk management purposes, a historical simulation methodology with a two-year equally weighted historical period, at the 95% confidence level is used for all trading books and some banking books.

The Management VaR model in some instances may not appropriately measure some market risk exposures, especially for market moves that are not directly observable via prices. Market risk managers are required to identify risks which are not adequately captured in VaR (‘risks not in VaR’ or ‘RNIVs’).

When reviewing VaR estimates, the following considerations are taken into account:

 

◾

the historical simulation uses the most recent two years of past data to generate possible future market moves, but the past may not be a good indicator of the future;

 

◾

the one-day time horizon may not fully capture the market risk of positions that cannot be closed out or hedged within one day;

 

◾

VaR is based on positions as at close of business and consequently, it is not an appropriate measure for intra-day risk arising from a position bought and sold on the same day;

 

◾

VaR does not indicate the potential loss beyond the VaR confidence level.

Limits are applied at the total level as well as by risk factor type, which are then cascaded down to particular trading desks and businesses by the market risk management function.

See page 120 for a review of management VaR in 2017.

 

Treasury and capital risk

Liquidity risk : The risk that the firm is unable to meet its contractual or contingent obligations or that it does not have the appropriate amount, tenor and composition of funding and liquidity to support its assets

Capital risk : The risk that the firm has an insufficient level or composition of capital to support its normal business activities and to meet its regulatory capital requirements under normal operating environments or stressed conditions (both actual and as defined for internal planning or regulatory testing purposes). This includes the risk from the firm’s pension plans

Interest rate risk in the banking book : The risk that the firm is exposed to capital or income volatility because of a mismatch between the interest rate exposures of its (non-traded) assets and liabilities.

 

Overview

Barclays Treasury manages treasury and capital risk on a day-to-day basis with the Treasury Committee acting as the principal management body. To enforce effective oversight and segregation of duties and in line with the ERMF, the Treasury and capital Risk function is responsible for oversight of key capital, liquidity, interest rate risk in the banking book (IRRBB) and pension risk management activities. The following describes the structure and governance associated with the risk types within the Treasury and capital Risk function.

Liquidity risk management (audited)

Overview

The efficient management of liquidity is essential to the Group in retaining the confidence of the financial markets and maintaining that the business is sustainable. There is a control framework in place for managing liquidity risk and this is designed to meet the following objectives:

 

◾

To maintain liquidity resources that are sufficient in amount and quality and a funding profile that is appropriate to meet the liquidity risk appetite as expressed by the Board

◾

To maintain market confidence in the Group’s name.

This is achieved via a combination of policy formation, review and governance, analysis, stress testing, limit setting and monitoring. Together, these meet internal and regulatory requirements.

Roles and responsibilities

The Treasury and Capital Risk function is responsible for the management and governance of the liquidity risk mandate defined by the Board and the production of ILAAPs. Treasury has the primary responsibility for managing liquidity risk within the set risk appetite. The CRO for treasury and capital risk reports to the Group CRO.

Barclays’ comprehensive control framework for managing the Group’s liquidity risk is designed to deliver the appropriate term and structure of funding consistent with the Liquidity Risk Appetite (LRA) set by the Board.

The Board sets the LRA based on the internal liquidity risk model and external regulatory requirements namely the Liquidity Coverage Ratio (LCR). The LRA is represented as the level of risk the Group chooses to take in pursuit of its business objectives and in meeting its regulatory obligations. The approved LRA is implemented in line with the control framework and policy for liquidity risk.

The control framework incorporates a range of ongoing business management tools to monitor, limit and stress test the Group’s balance sheet and contingent liabilities and the Recovery Plan. Limit setting and transfer pricing are tools that are designed to control the level of liquidity risk taken and drive the appropriate mix of funds. Together, these tools reduce the likelihood that a liquidity stress event could lead to an inability to meet the Group’s obligations as they fall due. The control framework is subject to internal conformance testing and internal audit review.

The liquidity stress tests assess the potential contractual and contingent stress outflows under a range of scenarios, which are then used to determine the size of the liquidity pool that is immediately available to meet anticipated outflows if a stress occurs.

The Group maintains a range of management actions for use in a liquidity stress, these are documented in the Group Recovery Plan. Since the precise nature of any stress event cannot be known in advance, the actions are designed to be flexible to the nature and severity of the stress event and provide a menu of options that can be drawn upon as required. The Barclays Group Recovery Plan also contains more severe recovery options to generate additional liquidity in order to facilitate recovery in a severe stress. Any stress event would be regularly monitored and reviewed using key management information by key Treasury, Risk and business representatives.

 

management strategy, outlined in the Group and legal entity capital plans, is developed in alignment with the control framework and policy for capital risk, and is implemented consistently in order to deliver on the Group’s objectives.

The Board approves the Group capital plan, internal stress tests and results of regulatory stress tests, and the Group recovery plan. The Treasury Committee is responsible for monitoring and managing capital risk in line with the Group’s capital management objectives, capital plan and risk frameworks. The Treasury and Capital Risk Committee monitors and reviews the capital risk profile and control environment, providing Second Line oversight of the management of capital risk. The BRC reviews the risk profile, and annually reviews risk appetite and the impact of stress scenarios on the Group capital plan/forecast in order to agree the Group’s projected capital adequacy.

Local management assures compliance with an entity’s minimum regulatory capital requirements by reporting to local Asset and Liability Committees with oversight by the Group’s Treasury Committee, as required.

Treasury has the primary responsibility for managing and monitoring capital and reports to the Group Finance Director. The Treasury and Capital Risk function contains a Capital Risk Oversight team, and is an independent risk function that reports to the Group CRO and is responsible for oversight of capital risk and production of ICAAPs.

Pension risk

The Group maintains a number of defined benefit pension schemes for past and current employees. The ability of the pension fund to meet the projected pension payments is maintained principally through investments.

Pension risk arises because the estimated market value of the pension fund assets might decline; investment returns might reduce; or the estimated value of the pension liabilities might increase. The Group monitors the pension risks arising from its defined benefit pension schemes and works with Trustees to address shortfalls. In these circumstances the Group could be required or might choose to make extra contributions to the pension fund. The Group’s main defined benefit scheme was closed to new entrants in 2012.

Interest Rate Risk in the Banking Book

Overview

Banking book operations generate non-traded market risk, primarily through the mismatch between the duration of assets and liabilities and where interest rates on products reset at different dates. As per the Group’s policy to remain within the defined risk appetite, interest rate and FX risks residing in the banking books of the businesses are transferred to Treasury where they are centrally managed. Currently, these risks are transferred to Treasury via funding arrangements, interest rate or FX swaps. However, the businesses remain susceptible to market risk from seven key sources:

 

◾

Repricing/Residual risk: the impact from the mismatch between the run-off of product balances and the associated interest rate hedges or from unhedged liquidity buffer investments;

 

◾

Structural risk : the change to the net interest income on hedge replenishment due to adverse movements in interest rates, assuming that the balance sheet is held static;

 

◾

Prepayment risk: the potential loss in value if actual prepayment or early withdrawal behaviour from customers deviates from the expected or contractually agreed behaviour, which may result in a hedge or funding adjustment at a cost to the bank. Exposures are typically considered (where appropriate) net of any applicable offsetting early repayment charges. This risk principally relates to early repayment of fixed rate loans or withdrawal from fixed rate savings products;

 

◾

Recruitment risk: the potential loss in value if the actual completion or drawdown behaviour from customers deviates from the expected behaviour, which may result in a hedge or funding adjustment at a cost to the bank. This risk principally relates to the completion timing around the Bank’s fixed rate mortgage pipeline process;

 

◾

Margin compression risk: the effect of internal or market forces on a bank’s net margin where, for example, in a low rate environment any fall in rates will further decrease interest income earned on the assets whereas funding cost cannot be reduced as it is already at the minimum level.

◾

Lag risk: arises from the delay in re-pricing customer rates for certain variable/ managed rate products, following an underlying change to market interest rates. This is typically driven by either regulatory constraint around customer notification on pricing changes, processing time for the Group’s notification systems or contractual agreements within a product’s terms and conditions.

 

◾

Asset swap spread risk : the spread between Libor and sovereign bond yields that arises from the management of the liquidity buffer investments and its associated hedges.

Furthermore, liquidity buffer investments are generally subject to Available for Sale (AFS) accounting rules, whereby changes in the value of these assets impact capital via Other Comprehensive Income, creating volatility in capital directly.

Roles and responsibilities

The Non-traded Market Risk team provides risk management oversight and monitoring of all traded and non-traded market risk in Treasury and customer banking books, which specifically includes:

 

◾

interest rate risk assessment in the customer banking books,

 

◾

review and challenge the behavioural assumptions used in hedging and transfer pricing,

 

◾

risk management of the liquidity buffer investments and funding activities,

 

◾

oversight of balance sheet hedging,

 

◾

review of residual risk in the hedge accounting solution and hedging of net investments,

 

◾

proposes and monitors risk limits to manage traded and non-traded market risk within the agreed risk appetite.

 

Operational risk

The risk of loss to the firm from inadequate or failed processes, systems, human factors or due to external events (for example, fraud) where the root cause is not due to credit or market risks.

 

Overview

The management of operational risk has three key objectives:

 

◾

Deliver an operational risk capability owned and used by business leaders which is pragmatic, relevant, and enables business leaders to make sound risk decisions over the long term.

 

◾

Provide the frameworks, policies and tools to enable management to meet their risk management responsibilities while the Second line of defence provides robust, independent, and effective oversight and challenge.

 

◾

Deliver a consistent and aggregated measurement of operational risk that will provide clear and relevant insights, so that the right management actions can be taken to keep the operational risk profile consistent with the Group’s strategy, the stated risk appetite, the client franchise, and other stakeholder needs.

The Group is committed to the management and measurement of operational risk and was granted a waiver by the FSA (now the PRA) to operate an advanced management approach (AMA) for operational risk, which commenced in January 2008. The majority of the Group calculates regulatory capital requirements using AMA (94% of capital requirements), except for small parts of the organisation acquired since the original permission (6% of

capital requirements) using the Basic Indicator Approach (BIA). The Group works to benchmark its internal operational risk management and measurement practices with peer banks.

The Group is committed to operating within a strong system of internal controls that enables business to be transacted and risk taken without exposing the Group to unacceptable potential losses or reputational damages. The Group has an overarching ERMF that sets out the approach to internal governance. The ERMF establishes the mechanisms and processes by which the Board directs the organisation, through setting the tone and expectations from the top, delegating authority and monitoring compliance.

Organisation and structure

Operational risk comprises a number of specific risks defined as follow:

 

◾

Data Management and Information Risk: The risk that Barclays information is not captured, retained, used or protected in accordance with its value and legal and regulatory requirements.

 

◾

Financial Reporting Risk: The risk of a material misstatement or omission within the Group’s external financial, regulatory reporting or internal management reporting.

 

◾

Fraud Risk: The risk of financial loss when an internal or external party acts dishonestly with the intent to obtain an undue benefit, cause a loss to, or to expose either the Group or its customers and clients to a risk of loss.

 

◾

Payments Process Risk: The risk of payments being processed inaccurately, with delays, without appropriate authentication and authorisation.

 

◾

People Risk: The risk that Barclays is exposed to by virtue of being an employer (excluding Health and Safety related risk).

 

◾

Premises and Security Risk: The risk of interruption to Barclays’ business due to the unavailability of premises and infrastructure as a result of intentional or accidental damage to premises and moveable assets, physical security breaches and safety and security incidents.

 

◾

Supplier Risk: The risk that is introduced to the firm or entity as a consequence of obtaining services or goods from another legal entity as a result of inadequate selection, inadequate exit and supplier management, resulting in operational, financial, or reputational risk to the bank, failure of services and/or negative customer impact.

 

◾

Tax Risk: The risk of unexpected tax cost in relation to any tax for which Barclays is liable, or of reputational damage on tax matters with key stakeholders such as tax authorities, regulators, shareholders or the public. Tax cost includes tax, interest or penalties levied by a taxing authority.

 

◾

Technology Risk: The risk that comes about due to dependency on technological solutions and is defined as failure to develop, deploy and maintain technology solutions that are stable, reliable and deliver what the business needs.

 

◾

Transaction Operations Risk: The risk of Customer/Client or Bank detriment due to unintentional error and/or failure in the end-to-end process of initiation, processing and fulfilment of an interaction between a Customer/Client and the Bank with an underlying financial instrument (e.g. mortgage, derivative product, trade product etc.).

These risks may result in financial and/or non-financial impacts including legal/regulatory breaches or reputational damages.

Roles and responsibilities

The prime responsibility for the management of operational risk and compliance with control requirements rests with the business and functional units where the risk arises. The operational risk profile and control environment is reviewed by business management through specific meetings which cover governance, risk and control. Businesses are required to report their operational risks on both a regular and an event-driven basis. The reports include a profile of the material risks that may threaten the achievement of their objectives and the effectiveness of key controls, operational risk events and a review of scenarios.

The Group Head of Operational Risk is responsible for establishing, owning and maintaining an appropriate Group-wide Operational Risk Management Framework and for overseeing the portfolio of operational risk across the Group.

Operational Risk Management (ORM) acts in a second line of defence capacity, and is responsible for defining and overseeing the implementation of the framework and monitoring Barclays operational risk profile. ORM alerts management when risk levels exceed acceptable ranges or risk appetite in order to drive timely decision making and actions by the first line of defence. Through attendance at Business Risk Committee meetings, ORM provide specific risk input into the issues highlighted and the overall risk profile of the business. Operational risk issues escalated from these meetings are considered through the second line of defence review meetings. Depending on their nature, the outputs of these meetings are presented to the BRC or the BAC.

For further information on operational risk management, Risk and Control Self-assessments and risk scenarios, please refer to the operational risk management section on pages 350 to 353.

 

Model risk

The risk of the potential adverse consequences from financial assessments or decisions based on incorrect or misused model outputs and reports.

 

 

Overview

Barclays uses models to support a broad range of activities, including informing business decisions and strategies, measuring and limiting risk, valuing exposures, conducting stress testing, assessing capital adequacy, managing client assets, and meeting reporting requirements.

Since models are imperfect and incomplete representations of reality, they may be subject to errors affecting the accuracy of their output. Model errors can result in inappropriate business decisions being made, financial loss, regulatory risk, reputational risk and/or inadequate capital reporting. Models may also be misused, for instance applied to products that they were not intended for, or not adjusted, where fundamental changes to their environment would justify re-evaluating their core assumptions. Errors and misuse are the primary sources of model risk.

Robust model risk management is crucial to assessing and managing model risk within a defined risk appetite. Strong model risk culture, appropriate technology environment, and adequate focus on understanding and resolving model limitations are crucial components.

Organisation and structure

Barclays allocates substantial resources to identify and record models and their usage, document and monitor the performance of models, validate models and adequately address model limitations. Barclays manages model risk as an enterprise level risk similar to other Principal Risks.

Barclays has a dedicated Model Risk Management (MRM) function that consists of

two main units: the Independent Validation Unit (IVU), responsible for model validation and approval, and Model Governance and Controls (MGC), covering model risk governance, controls and reporting, including ownership of model risk policy and the model inventory.

The model risk management framework consists of the model risk policy and standards. The policy prescribes group-wide, end-to-end requirements for the identification, measurement and management of model risk, covering model documentation, development, implementation, monitoring, annual review, independent validation and approval, change and reporting processes. The policy is supported by global standards covering model inventory, documentation, validation, complexity and materiality, testing and monitoring, overlays, risk appetite, as well as vendor models and stress testing challenger models.

Barclays is continuously enhancing model risk management. The function reports to the Group CRO and operates a global framework. Implementation of best practice standards is a central objective of the Group. Model risk reporting flows to senior management as depicted below:

Roles and responsibilities

The key model risk management activities include:

 

◾

Correctly identifying models across all relevant areas of the firm, and recording models in the Group Models Database (GMD), the Group-wide model inventory. The heads of the relevant model ownership areas (typically, the Business Chief Risk Officers, Business Chief Executive Officers,

the Treasurer, the Chief Financial Officer, etc.) annually attest to the completeness and accuracy of the model inventory. MGC undertakes regular conformance reviews on the model inventory.

 

◾

Enforcing that every model has a model owner who is accountable for the model. The model owner must sign off models prior to submission to IVU for validation. The model owner works with the relevant technical teams (model developers, implementation, monitoring, data services, regulatory) to maintain that the model presented to IVU is and remains fit for purpose.

 

◾

Overseeing that every model is subject to validation and approval by IVU, prior to being implemented and on a continual basis. While all models are reviewed and re-approved for continued use each year, the validation frequency and the level of review and challenge applied by IVU is tailored to the materiality and complexity of each model. Validation includes a review of the model assumptions, conceptual soundness, data, design, performance testing, compliance with external requirements if applicable, as well as any limitations, proposed remediation and overlays with supporting rationale. Material model changes are subject to prioritised validation and approval.

 

◾

Defining model risk appetite in terms of risk tolerance, and qualitative metrics which are used to track and report model risk.

 

◾

Maintaining specific standards that cover model risk management activities relating to stress testing challenger models, model overlays, vendor models, and model complexity and materiality.

 

Conduct risk

The risk of detriment to customers, clients, market integrity, competition or Barclays from the inappropriate supply of financial services, including instances of wilful or negligent misconduct.

 

 

Overview

The Group defines, manages and mitigates conduct risk with the goal of providing positive customer and client outcomes, protecting market integrity and promoting effective competition. This includes taking reasonable steps to assure the Group’s culture and strategy are appropriately aligned to these goals, products and services are reasonably designed and delivered to meet the needs of customers and clients, as well as promoting the fair and orderly operation of the markets in which the Group does business and that the Group does not commit or facilitate money laundering, terrorist financing, bribery and corruption or breaches of economic sanctions.

Product Lifecycle, Culture and Strategy and Financial Crime are the risk categories under conduct risk.

Organisation and structure

The governance of conduct risk within Barclays is fulfilled through management Committees and forums operated by the First and Second Lines of Defence with clear escalation and reporting lines to the Board.

The GRC is the most senior executive body responsible for reviewing and monitoring the effectiveness of Barclays’ management of conduct risk.

Roles and responsibilities

The Conduct Risk Management Framework (CRMF) comprises a number of elements that allow the Group to manage and measure its conduct risk profile.

Senior Managers have ownership within their areas for managing conduct risk. These individuals have a Statement of Responsibilities identifying the activities and areas for which they are accountable. The primary responsibility for managing conduct risk and compliance with control requirements sits with the business where the risk arises. The First Line Business Control Committees provide oversight of controls relating to conduct risk.

The Group Chief Compliance Officer is responsible for owning and maintaining an appropriate Group-wide CRMF for overseeing Group-wide conduct risk management. This includes defining and owning the relevant conduct risk policies and oversight of the implementation of controls to manage the risk.

Businesses are required to report their conduct risks on both a quarterly and an event-driven basis. The quarterly reports detail conduct risks inherent within the business strategy and include forward looking horizon scanning analysis as well as backward looking evidence-based indicators from both internal and external sources.

The Business Unit Risk Committees and the Financial Crime Business Oversight Committees are the primary Second Line governance forums for oversight of conduct risk profile and implementation of the CRMF. The responsibilities of the Business Unit Risk Committees include approval of the conduct risk tolerance and the business defined key indicators. Additional responsibilities include the identification and discussion of any emerging conduct risks exposures which have been identified.

 

Reputation risk

The risk that an action, transaction, investment or event will reduce trust in the firm’s integrity and competence by clients, counterparties, investors, regulators, employees or the public.

 

 

Overview

A reduction of trust in Barclays’ integrity and competence may reduce the attractiveness of Barclays to stakeholders and could lead to negative publicity, loss of revenue, regulatory or legislative action, loss of existing and potential client business, reduced workforce morale and difficulties in recruiting talent. Ultimately it may destroy shareholder value.

Organisation and structure

The GRC is the most senior executive body responsible for reviewing and monitoring the effectiveness of Barclays’ management of reputation risk.

Roles and responsibilities

The Chief Compliance Officer is accountable for developing a reputation risk framework and policies including limits against which data is monitored, reported on and escalated, as required.

Reputation risk is by nature pervasive and can be difficult to quantify, requiring more subjective judgement than many other risks. The Reputation Risk Framework sets out what is required to manage reputation risk effectively and consistently across the bank.

The primary responsibility for identifying and managing reputation risk and adherence to the control requirements sits with the business and support functions where the risk arises.

Barclays International and Barclays UK are required to operate within established reputation risk appetite and their component businesses submit quarterly reports to the Group Reputation Management team, highlighting their most significant current and potential reputation risks and issues and how they are being managed. These reports are a key internal source of information for the quarterly reputation risk reports which are prepared for the GRC and RepCo.

 

Legal risk

The risk of loss or imposition of penalties, damages or fines from the failure of the firm to meet its legal obligations including regulatory or contractual requirements.

 

 

Overview

The Legal Risk Management Framework (LRMF) prescribes Group-wide requirements for the identification, escalation, measurement and management of legal risk, covering assessment, risk tolerance, key indicators and governance. The LRMF is supported by Group-wide legal risk policies and associated standards aligned to the following legal risks:

 

◾

Contractual Arrangements – the Group’s rights and remedies in its relationships with other parties not being enforceable as intended due to the absence of appropriate contractual documentation or defects therein.

 

◾

Litigation Management – failure to adequately manage litigation involving the Group.

 

◾

Intellectual Property (IP) – failure to protect the Group’s IP assets or the Group infringing valid IP rights of third parties.

 

◾

Competition/Anti-trust – failure to adequately manage competition/anti-trust issues or failure to manage relationships with competition/anti-trust authorities.

 

◾

Use of Law Firms – failure to control instruction of external law firms.

 

◾

Contact with Regulators – failure to manage interactions with regulators or failure to manage the receipt and handling of regulatory information from a regulatory or government agency appropriately.

The LRMF requires businesses and functions to integrate the management of legal risk within their strategic planning and business decision making, including adopting processes to identify legal risk exposures and managing adherence to the minimum control requirements.

In addition to legal risk detailed above, legal outcomes, including losses or the imposition of penalties, damages, fines and sanctions, may arise because of past and future actions, behaviours and business decisions aligned to the Principal Risk which gave rise to the outcome, including but not limited to conduct and operational risk. Details of current contentious legal matters in relation to the Group are set out in Note 29.

Organisation and structure

Business/function risk forums have oversight of their legal risk profile and implementation of the LRMF. The Legal Executive Committee oversees, challenges and monitors legal risk across the Group. The GRC is the most senior executive body responsible for reviewing and monitoring the effectiveness of Barclays’ management of risk. Escalation paths from this forum exist to the BRC.

 

Roles and responsibilities

The primary responsibility for identifying and managing legal risk and adherence to the minimum control requirements sits with the businesses/functions where the risk resides.

On behalf of the businesses/functions, the aligned General Counsel or members of Legal senior management provide oversight and challenge of the legal risk profile, for example by undertaking legal risk tolerance assessments, and providing advice on legal risk management. Legal risk tolerance assessments include both quantitative and qualitative criteria such as:

 

◾

Risk and control self-assessment, lessons learned, testing and monitoring processes.

 

◾

Analysis of legal risk material control issues or weaknesses.

 

◾

Potential legal risks resulting from upcoming changes in the control environment, systems, or internal organisational structures.

 

◾

Potential implications on the Group of forthcoming changes in the external legal and regulatory environment and/or prevailing decisions from courts and enforcing authorities as they relate to defined legal risks.

The Group General Counsel supported by the Global Head of Legal Risk, Governance and Control is responsible for maintaining an appropriate LRMF and for overseeing Group-wide legal risk management.

 

Overview

Credit risk represents a significant risk to the Group and mainly arises from exposure to wholesale and retail loans and advances together with the counterparty credit risk arising from derivative contracts entered into with clients. A summary of performance may be found below.

This section provides an analysis of areas of particular interest or potentially of higher risk, including: i) balance sheet, including the maximum exposure, collateral, credit quality and loans and advances; ii) areas of concentrations; iii) exposure to and performance metrics for specific portfolios and assets types, including home loans and credit cards; iv) problem loans, including credit risk loans (CRLs) and forbearance; and v) impairment, including impairment allowances and management adjustments to model outputs.

Please see the credit risk management section on pages 85 to 86 for details of governance, policies and procedures.

Summary of performance in the period

Loan impairment charges decreased £19m to £2,333m. Total loans and advances net of impairment decreased by £34.1bn to £415.4bn net £12.7bn decrease in cash collateral and settlement balances and a £21.4bn decrease in other lending, primarily in Corporate and Investment bank. Overall, this resulted in a 4bps increase in the LLR to 57bps.

Credit risk loans (CRLs) decreased to £6.0bn (December 2016: £6.5bn) and the CRL coverage ratio increased to 78% (December 2016: 71%) mainly within retail portfolios.

Analysis of the Balance Sheet

 

 

Group’s maximum exposure and collateral and other credit enhancements held

 

 

Basis of preparation

The following tables present a reconciliation between the Group’s maximum exposure and its net exposure to credit risk; reflecting the financial effects of collateral, credit enhancements and other actions taken to mitigate the Group’s exposure.

For financial assets recognised on the balance sheet, maximum exposure to credit risk represents the balance sheet carrying value after allowance for impairment. For off-balance sheet guarantees, the maximum exposure is the maximum amount that the Group would have to pay if the guarantees were to be called upon. For loan commitments and other credit related commitments that are irrevocable over the life of the respective facilities, the maximum exposure is the full amount of the committed facilities.

 

This and subsequent analyses of credit risk include only financial assets subject to credit risk. They exclude other financial assets not subject to credit risk, mainly equity securities held for trading, as available for sale or designated at fair value, and traded commodities. Assets designated at fair value in respect of linked liabilities to customers under investment contracts have also not been included as the Group is not exposed to credit risk on these assets. Credit losses in these portfolios, if any, would lead to a reduction in the linked liabilities and not result in a loss to the Group. For off-balance sheet exposures certain contingent liabilities not subject to credit risk such as performance guarantees are excluded.

The Group mitigates the credit risk to which it is exposed through netting and set-off, collateral and risk transfer. Further detail on the Group’s policies to each of these forms of credit enhancement is presented in the Barclays PLC Pillar 3 Report 2017.

Overview

As at 31 December 2017, the Group’s net exposure to credit risk after taking into account netting and set-off, collateral and risk transfer increased 7% to £790.5bn. Overall, the extent to which the Group holds mitigation against its total exposure decreased to 43% (2016: 47%).

Of the remaining exposure left unmitigated, a significant portion relates to cash held at central banks, financial investment debt securities issued by governments and cash collateral and settlement balances, all of which are considered to be lower risk. Increases in cash held at central banks and financial investment debt securities in the period have driven the increase in the Group’s net exposure to credit risk. Trading portfolio liability positions, which to a significant extent economically hedge trading portfolio assets but which are not held specifically for risk management purposes, are excluded from the analysis. The credit quality of counterparties to derivatives, financial investments and wholesale loan assets are predominantly investment grade. Further analysis on the credit quality of assets is presented on pages 100 to 101.

Where collateral has been obtained in the event of default, the Group does not, as a rule, use such assets for its own operations and they are usually sold on a timely basis. The carrying value of assets held by the Group as at 31 December 2017, as a result of the enforcement of collateral, was £nil (2016: £16m).