Operational risk is defined as the one that could potentially cause losses due to human error, inadequate or faulty internal processes, system failures or external events. This definition includes legal risk, but excludes strategic, business and reputational risk.
Operational risk is inherent to all banking activities, products, systems and processes. Its origins are diverse (processes, internal and external fraud, technology, human resources, suppliers, commercial practices, disasters). Operational risk management is integrated into BBVA Group’s global risk management structure.
39 Characteristics of BBVA’s operational risk management model
In 2012 an integrated internal control and operational risk methodology was implemented across the Group as a development of the self-assessment Ev-Ro tool, which in 2012 has been updated in the same time. The methodology identifies risks in organizational units, generates exercises which prioritize the risks according to their estimated residual risk (after including the effect of the controls), links the risks to the Bank’s processes, and establishes a target level for each risk to identify and manage gaps by comparing it with the residual risk level. In order to provide the required support for this methodology, the Group has developed a new corporate IT system: STORM (Support Tool for Operational Risk Management), which includes indicators and scenarios modules.