Risk management

Sound risk management plays a critical role in positioning us to prepare for, and respond to, opportunities and challenges in our operating environment.

Our progress

This year we have continued to strengthen our risk management capabilities, focusing on:

Culture and conduct

• We have initiated a programme of work to build out how we will measure, monitor and manage conduct risk to allow us to better understand and respond to the drivers of poor conduct. This has included introducing new accountability and consequence principles for employees found accountable for material failure and non-compliance as well as recognising positive risk behaviours in our annual performance and remuneration reviews.
• We have raised employee awareness about our whistleblower processes and made it easier for them to ‘speak up’– including through initiatives such as the inaugural Whistleblower Awareness Week this year.

Simplification

• Investment has been made in our risk systems, including enhancing our data analytics to improve our ability to identify issues, and more swiftly understand the root causes.
• Standardisation and simplification of our wholesale risk practices and policies has helped significantly improve time responsiveness thereby delivering a better banker and customer experience.

Non-financial risk

• We have redesigned our non-financial risk framework in response to feedback that it was too complex. Significant work has been undertaken to simplify our language around operational risk, consolidate our framework documentation, and clarify the requirements and roles and responsibilities of our staff.
• We have established a Royal Commission and Self-Assessment Oversight Group to provide oversight of the integrated approach and plans to address the Self-Assessment focus areas and Royal Commission ‘lessons’. This includes for example, commissioning and reviewing reports on progress in addressing the Self- Assessment focus areas, our 16 Royal Commission commitments and actions by government to respond to the Royal Commission.

“Strong risk management is a necessity if we are to anticipate and navigate ANZ through a changing environment.” Kevin Corbally – Group Chief Risk Officer

Our Risk Management Framework

The Board is responsible for establishing and overseeing the Group’s risk management framework. The Board has delegated authority
to the Board Risk Committee (BRC) to develop and monitor compliance with the Group’s risk management policies.
The Committee reports regularly to the Board on its activities.

The key pillars of the Group’s risk management framework include:

• the Risk Appetite Statement (RAS), which sets out the Board’s expectations regarding the degree of risk that the Group is prepared to accept in pursuing its strategic objectives and its operating plan; and
• the Risk Management Statement (RMS), which describes the Group’s strategy for managing risks and a summary of the key elements of the Risk Management Framework (RMF) that give effect to that strategy. The RMS includes: a description of each material risk; and an overview of how the RMF addresses each risk, with reference to the relevant policies, standards and procedures. It also includes information on how the Group identifies, measures, evaluates, monitors, reports and then either controls or mitigates material risks.

The Group operates a Three Lines-of-Defence Model in regard to risk management that helps embed a culture where risk is everyone’s responsibility. The business – as the first line of defence – has day to day ownership of risks and controls and is accountable for identifying and managing its own risks. The Risk Function is the second line of defence, providing a strong and independent oversight of the work undertaken to manage the risk, as well as developing and maintaining the Risk Management Framework.

The final line of defence is Internal Audit and includes independent assurance that evaluates the adequacy and effectiveness of both first and second line risk management approaches.