THE GOLDMAN SACHS GROUP, INC. AND SUBSIDIARIES
Management’s Discussion and Analysis
Risk Management
Risks are inherent in our businesses and include liquidity, market, credit, operational, model, legal, compliance, conduct, regulatory and reputational risks. For further information about our risk management processes, see “Overview and Structure of Risk Management” below. Our risks include the risks across our risk categories, regions or global businesses, as well as those which have uncertain outcomes and have the potential to materially impact our financial results, our liquidity and our reputation. For further information about our areas of risk, see “Liquidity Risk Management,” “Market Risk Management,” “Credit Risk Management,” “Operational Risk Management” and “Model Risk Management” below and “Risk Factors” in Part I, Item 1A of the 2017Form 10-K.
Overview and Structure of Risk Management
Overview
We believe that effective risk management is critical to our success. Accordingly, we have established an enterprise risk management framework that employs a comprehensive, integrated approach to risk management, and is designed to enable comprehensive risk management processes through which we identify, assess, monitor and manage the risks we assume in conducting our activities. These risks include liquidity, market, credit, operational, model, legal, compliance, conduct, regulatory and reputational risk exposures. Our risk management structure is built around three core components: governance, processes and people.
Governance.Risk management governance starts with the Board, which both directly and through its committees, including its Risk Committee, oversees our risk management policies and practices implemented through the enterprise risk management framework. The Board is also responsible for the annual review and approval of our risk appetite statement. The risk appetite statement describes the levels and types of risk we are willing to accept or to avoid, in order to achieve our strategic business objectives, while remaining in compliance with regulatory requirements.
The Board receives regular briefings on firmwide risks, including liquidity risk, market risk, credit risk, operational risk and model risk from our independent risk oversight and control functions, including the chief risk officer, and on compliance risk and conduct risk from the head of Compliance, on legal and regulatory matters from the general counsel, and on other matters impacting our reputation from the chair of our Firmwide Client and Business Standards Committee. The chief risk officer reports to our chief executive officer and to the Risk Committee of the Board. As part of the review of the firmwide risk portfolio, the chief risk officer regularly advises the Risk Committee of the Board of relevant risk metrics and material exposures, including risk limits and thresholds established in our risk appetite statement.
The Enterprise Risk Management department, which reports to our chief risk officer, oversees the implementation of our risk governance structure and core risk management processes and is responsible for ensuring that our enterprise risk management framework provides the Board, our risk committees and senior management with a consistent and integrated approach to managing our various risks in a manner consistent with our risk appetite.
Our revenue-producing units, as well as Treasury, Operations and Technology, are our first line of defense and are accountable for the outcomes of our risk-generating activities, as well as for assessing and managing those risks.
Our independent risk oversight and control functions are considered our second line of defense and provide independent assessment, oversight and challenge of the risks taken by our first line of defense, as well as lead and participate in risk-oriented committees. Independent risk oversight and control functions include Compliance, Conflicts Resolution, Controllers, Credit Risk Management, Enterprise Risk Management, Human Capital Management, Legal, Liquidity Risk Management, Market Risk Management and Analysis (Market Risk Management), Model Risk Management, Operational Risk Management and Analysis (Operational Risk Management) and Tax.
Internal Audit is considered our third line of defense and reports to the Audit Committee of the Board. Internal Audit includes professionals with a broad range of audit and industry experience, including risk management expertise. Internal Audit is responsible for independently assessing and validating the effectiveness of key controls, including those within the risk management framework, and providing timely reporting to the Audit Committee of the Board, senior management and regulators.
| | |
Goldman Sachs June 2018 Form 10-Q | | 122 |