The Group has in place an integrated internal control and operational risk methodology.
This methodology identifies risks in organizational areas, generates analyses that prioritize risks according to the estimated residual risk (after incorporating control effects), links risks to processes and establishes an objective risk level for each risk type to identify and manage gaps by comparing it with the residual risk level. The Group has developed a corporate application to provide the required support for this methodology: STORM (Support Tool for Operational Risk Management), which includes modules of indicators and scenarios.
The Corporate Risk Area, through its Corporate Operational Risk Management (CORM) unit, will establish the criteria to apply for determining the BBVA Group companies in which the OR monitoring and management/mitigation tools described in section 3.3 should be implemented. These criteria will be based on both quantitative and qualitative aspects.
The scope of application of the OR management model revolves around the following elements:
- Company
- Process: in general, OR originates in the different activities/processes carried out in the Group.
- Business line: because the type of the different operational risks to which the Group is exposed, and their impact, is substantially different for each line of business, considering this element is fundamental for effective management of OR. Each line has a characteristic risk profile: for example, the risk profile of retail banking is different in terms of type, impact and frequency than that of corporate banking, or the market activity.