The Bank’s Operational Risk Management Policy is set by the Board of Directors. The Policy is complemented by an Operational Risk Management Framework comprising the guiding principles for the identification, assessment, monitoring and control of operational risks the Bank faces or may face. In day-to-day operations, the three-lines-of-defence model ensures accountability and defines the roles and responsibilities for operational risk management for all processes across the organisation. Process owners must manage the operational risks associated with their process. Emphasis is put on increasing risk awareness of the Bank’s personnel.
Risks are identified and their impact assessed by the various functions for their respective fields of expertise in risk assessments, such as the risk and control self-assessment process. Focus is placed on identifying key risks and assessing the quality of risk detection and risk mitigation in order to ensure compliance with the Bank’s policies and guidelines. Operational risks are also identified through analysis of results obtained from the Bank’s event reporting system. No material financial losses were incurred as a result of operational risks during the year.
Priority areas for operational risk management include increased focus on risks in the Bank’s core processes and further development of reporting on material operational risks and trends.
In 2020 an Information Classification Policy and Guidelines were introduced. In addition, the risk identification and approval process for new products and developments was updated to better meet current requirements. Following the organisational changes that took place during 2020 the Bank’s Business continuity & Security function was merged with the Operational risk & Information security function forming the Operational risk and Security control unit.
Due to the COVID-19 situation in 2020 emphasis has been on securing the Bank’s operations.
COMPLIANCE RISK
The Bank defines integrity risk as the risk of legal or regulatory sanctions, material financial loss, or loss to reputation that NIB may suffer as a result of its failure to comply with those laws, regulations, rules, self-regulatory organisation standards and codes of conduct concerning market conduct and transparency standards, managing conflicts of interest and the prevention of money laundering, terrorist financing, market abuse, corruption and fraud.
The Bank is committed to following international best practices and market standards in the areas of accountability, governance, corporate social responsibility, transparency and business ethics. Consequently, the Bank’s policies draw upon relevant market standards; in particular the International Financial Institutions’ Uniform Framework for Preventing and Combating Fraud and Corruption, which the Bank has endorsed.
The integrity of its own activities and of its staff is governed through the Bank’s Code of Conduct, which sets the values and ethical standards expected from staff. The Code covers topics such as conflicts of interests, gifts, hospitality, trading limitations and perquisite positions.
Further, NIB places particular emphasis on mitigating the risk of engaging with parties and projects that are, or potentially could be, associated with corruption, fraud, money laundering or the financing of terrorism. This is achieved through investing significant efforts in the Integrity Due Diligence (IDD) applicable to customers and counterparties. The IDD aims at identifying any integrity or reputational risk indicators of entities that have a reputation of engaging in illegal or unethical behaviour.
Allegations of fraud, corruption, collusion or any other Prohibited Practices related to the Bank’s projects are investigated following a preliminary assessment of the allegation. The investigations are conducted by the Integrity and Compliance Office (ICO), which issues a findings report that is presented for decision to the President (for cases related to staff) or to the Sanctions Panel (for cases related to counterparties).
ICO oversees and coordinates matters relating to integrity and reputational risks and provides independent expert advice to staff, management and the Board of Directors in integrity matters.
The Chief Compliance Officer (CCO) reports to the Chief Risk Officer with a dotted reporting line to the President as well as unrestricted access to the chairpersons of the Board of Directors and the Control Committee. The CCO regularly reports to the Board of Directors and the Control Committee.
Once a year, ICO publishes its Integrity Report, which is available on the Bank’s website.