Risk management and control

Business risks are the risks associated with a chosen business strategy, including business cycles, industry cycles, and technological change. They are the sole responsibility of the relevant business, and are not subject to an independent control process. They are, however, factored into the firm's planning and budgeting process and the assessment of our risk capacity and overall risk exposure.

The primary and operational risks inherent in our business activities are subject to independent risk control. Primary risks are exposures deliberately entered into for business reasons, which are actively traded and managed. Operational risks arise as a consequence of business undertaken and as a consequence of internal control gaps.

Primary risks are credit risk, market risk and liquidity and funding risk:

– credit risk is the risk of loss resulting from client or counterparty default and arises on credit exposure in all forms, including settlement risk

– market risk is exposure to market variables including general market risk factors such as interest rates, exchange rates, equity market indices and commodity prices, and factors specific to individual names affecting the values of securities and other obligations in tradable form, and derivatives referenced to those names

– liquidity and funding risk is the risk that we are unable to meet our payment obligations when due, or that we are unable, on an ongoing basis, to borrow funds in the market on an unsecured, or even secured basis at an acceptable price to fund actual or proposed commitments.

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external causes, whether deliberate, accidental or natural. It can arise in many ways, for example:

– from errors, failures or shortcomings at any point in the transaction process, from deal execution and capture to final settlement

– by not complying with rules, regulations, laws, accounting standards, local or international best practice, or our own internal standards, which can result in regulatory fines or penalties, restriction or suspension of business, or mandatory corrective action

– if we are unable to enforce our actual or anticipated rights under law, a contract or other arrangement

– if we, or someone acting on our behalf, fail to fulfill the obligations, responsibilities or duties imposed by law or assumed under a contract, which can lead to claims against us

– through loss of confidentiality, integrity or availability of our information or other assets

– by taking technically incorrect positions on tax matters, or failing to comply with tax withholding or reporting requirements on behalf of clients or employees, or as a result of our involvement in tax-sensitive products or transactions.

Failure to identify, manage or control any of these risks, including business risks, may result not only in financial loss but also in loss of reputation, and repeated or widespread failure compounds the impact. Reputational risk is not directly quantifiable and cannot be managed and controlled independently of other risks.