32
| 2022 ANNUAL REPORT AND ACCOUNTS
The Committee, which is made up of relevant senior managers and is
chaired by the Chief Risk Officer & General Counsel, oversees the
management of risks related to models to ensure that models are included
within the Society’s governance framework and are robustly designed,
developed, documented and reviewed.
The Committee provides oversight ensuring that models and EUC
applications are managed in line with the Model Governance Risk Policy,
both on an ongoing basis and during model development. It ensures that
models and EUC applications are compliant with applicable regulation and
remain fit for purpose.
Legal, Regulatory & Conduct Risk Committee
The Society, being a provider of mortgage, savings and insurance products,
is regulated by both the FCA and the PRA.
The Legal, Regulatory & Conduct Risk Committee (LRC) is responsible for
overseeing how The Nottingham conducts its business, ensuring that all
customer-impacting activities are conducted in a clear, transparent and fair
manner, delivering fair outcomes for customers.
The Committee is chaired by the Head of Compliance & DPO, supported by
relevant senior managers.
Each business area is responsible for ensuring that all regulatory and
statutory requirements are complied with on a day-to-day basis. Formal
oversight is provided by the Compliance Function through a programme of
compliance monitoring.
The Nottingham has a very low appetite for breaches of regulation or for
any activity that may lead to an unfair outcome for our customers.
Accordingly, The Nottingham carefully chooses the products and services it is
willing to offer to its customers and ensures the appropriate level of
expertise exists in the organisation to ensure good customer outcomes,
compliant sales processes and clear oversight of third party providers.
Operational Risk and Resilience Committee
The Operational Risk and Resilience Committee (ORRC) is responsible for
actively overseeing the management of operational risk across The
Nottingham. It is also responsible for ensuring that the Society maintains
sufficient operational resilience to ensure the ongoing delivery of key
services to customers.
The Committee is chaired by the Chief Customer Officer supported by
relevant senior managers.
In order to allow the Committee to focus on the key elements of
operational risk (which includes ‘people risk’ in respect of our own
colleagues and ‘third party risk’ in respect of reliance on third parties and
partners to deliver key elements of our proposition and our operational
resilience framework), the Committee meets eight times a year with
agendas alternating between the following:
• A formal quarterly ORRC meeting, covering the full range of operational
risks including review and approval of the operational risk dashboard and
oversight of operational resilience.
• An information risk focused meeting, largely focused on matters relating to
the management of information security, information management and
technology risks, as well as providing specialist oversight of the Society’s
defences against cyber-attack.
The Nottingham defines operational risk as the risk of loss resulting from
human factors, inadequate or failed internal processes and systems, or from
external events. Operational risk exists in every aspect of The Nottingham’s
business activities. Proactive management of operational risk is essential in
helping The Nottingham achieve both short-term operational objectives and
longer-term strategic goals.
To ensure that The Nottingham’s services are operationally resilient, the
Committee is also responsible for ensuring that processes are in place to
prevent, adapt, respond to, recover and learn from operational disruptions.
The Committee oversees the process by which the Society identifies its
important business services, understands and remediates any potential
weaknesses in the supporting processes, ensures that appropriate business
continuity plans are in place and verifies that third party suppliers are able
to meet our customers’ needs at all times.
One of the key processes that support the effective identification and
management of operational risk is the risk event process, which provides a
mechanism for operational incidents to be reported, their impacts assessed,
remediation to be performed and root cause analysis to be undertaken,
thereby reducing the risk of recurrence.
The Committee also continues to work on embedding the Society’s approach to
operational resilience, in response to the Regulator’s increased focus in this area.
Change Management Committee
The Change Management Committee is responsible for the oversight and
management of the Transformation and Change risk category; for which it
reports to Executive Risk Committee. It is also responsible for ensuring that
transformation and change activity supports the effective delivery of the
Society’s strategy. In this second role, the Committee reports to Executive
Committee. The Change Management Committee acts on behalf of the
Executive Committee and Executive Risk Committee monitoring delivery
execution and operational tolerance impact of transformational, large and
small business change for the Society through the effective control of a
portfolio of change activity. The Change Management Committee is informed
by the Group corporate plan and specifically owns the change execution plan
on behalf of the Executive Committee, ensuring effective delivery, balancing
risk and benefit in the achievement of the Society’s strategy.
The Nottingham’s change activity is underpinned by the project risk
management framework, which champions clear responsibilities, regular and
transparent status reporting and a high level of oversight and scrutiny by
members of the Executive team and the Board. All significant projects must be
approved by the Executive Committee and the Board.
Risk Oversight
The risk management framework is supported by a series of control documents
and risk reporting and is overseen by both the second and third lines of defence
working through the Committee structure detailed above and undertaking
independent oversight and assurance activity on key areas of risk for the Society.
This framework enables the Board and senior management to maintain
effective supervision of the level of risk within The Nottingham and to
ensure that appropriate controls and mitigating activities are in place.
On behalf of the Board,
Simon Baum
Chair of the Board Risk Committee
2 March 2023
RISK MANAGEMENT REPORT (CONTINUED)
GOVERNANCE