Citigroup (C)

Framework

        To monitor, mitigate and control operational risk, Citigroup maintains a system of comprehensive policies and has established a consistent, value-added framework for assessing and communicating operational risk and the overall effectiveness of the internal control environment across Citigroup. An Operational Risk Council has been established to provide oversight for operational risk across Citigroup. The Council's membership includes senior members of the Chief Risk Officer's organization covering multiple dimensions of risk management with representatives of the Business and Regional Chief Risk Officers' organizations and the Business Management Group. The Council's focus is on further advancing operational risk management at Citigroup with focus on proactive identification and mitigation of operational risk and related incidents. The Council works with the business segments and the control functions to help ensure a transparent, consistent and comprehensive framework for managing operational risk globally.

        Each major business segment must implement an operational risk process consistent with the requirements of this framework. The process for operational risk management includes the following steps:

•

identify and assess key operational risks;



•

establish key risk indicators;



•

produce a comprehensive operational risk report; and



•

prioritize and assure adequate resources to actively improve the operational risk environment and mitigate emerging risks.

        The operational risk standards facilitate the effective communication and mitigation of operational risk both within and across businesses. As new products and business activities are developed, processes are designed, modified or sourced through alternative means and operational risks are considered. Information about the businesses' operational risk, historical losses, and the control environment is reported by each major business segment and functional area, and summarized for senior management and the Citigroup Board of Directors.

Framework

        To monitor, mitigate and control operational risk, Citigroup maintains a system of comprehensive policies and has established a consistent, value-added framework for assessing and communicating operational risk and the overall effectiveness of the internal control environment across Citigroup. An Operational Risk Council has been established to provide oversight for operational risk across Citigroup. The Council's membership includes senior members of the Chief Risk Officer's organization covering multiple dimensions of risk management with representatives of the Business and Regional Chief Risk Officers' organizations and the Business Management Group. The Council's focus is on further advancing operational risk management at Citigroup with focus on proactive identification and mitigation of operational risk and related incidents. The Council works with the business segments and the control functions to help ensure a transparent, consistent and comprehensive framework for managing operational risk globally.

        Each major business segment must implement an operational risk process consistent with the requirements of this framework. The process for operational risk management includes the following steps:

•

identify and assess key operational risks;



•

establish key risk indicators;



•

produce a comprehensive operational risk report; and



•

prioritize and assure adequate resources to actively improve the operational risk environment and mitigate emerging risks.

        The operational risk standards facilitate the effective communication and mitigation of operational risk both within and across businesses. As new products and business activities are developed, processes are designed, modified or sourced through alternative means and operational risks are considered. Information about the businesses' operational risk, historical losses, and the control environment is reported by each major business segment and functional area, and summarized for senior management and the Citigroup Board of Directors.

51

Table of Contents

Framework

        To monitor, mitigate and control operational risk, Citigroup maintains a system of comprehensive policies and has established a consistent, value-added framework for assessing and communicating operational risk and the overall effectiveness of the internal control environment across Citigroup. An Operational Risk Council has been established to provide oversight for operational risk across Citigroup. The Council's membership includes senior members of the Chief Risk Officer's organization covering multiple dimensions of risk management with representatives of the Business and Regional Chief Risk Officers' organizations and the Business Management Group. The Council's focus is on further advancing operational risk management at Citigroup with focus on proactive identification and mitigation of operational risk and related incidents. The Council works with the business segments and the control functions to help ensure a transparent, consistent and comprehensive framework for managing operational risk globally.

        Each major business segment must implement an operational risk process consistent with the requirements of this framework. The process for operational risk management includes the following steps:

•

identify and assess key operational risks;



•

establish key risk indicators;



•

produce a comprehensive operational risk report; and



•

prioritize and assure adequate resources to actively improve the operational risk environment and mitigate emerging risks.

        The operational risk standards facilitate the effective communication and mitigation of operational risk both within and across businesses. As new products and business activities are developed, processes are designed, modified or sourced through alternative means and operational risks are considered. Information about the businesses' operational risk, historical losses, and the control environment is reported by each major business segment and functional area, and summarized for Senior Management and the Citigroup Board of Directors.

Framework

To monitor, mitigate and control operational risk, Citigroup maintains a system of comprehensive policies and has established a consistent, value-added framework for assessing and communicating operational risk and the overall effectiveness of the internal control environment across Citigroup. An Operational Risk Council has been established to provide oversight for operational risk across Citigroup. The Council’s membership includes senior members of the Chief Risk Officer’s organization covering multiple dimensions of risk management with representatives of the Business and Regional Chief Risk Officers’ organizations and the Business Management Group. The Council’s focus is on further advancing operational risk management at Citigroup with focus on proactive identification and mitigation of operational risk and related incidents. The Council works with the business segments and the control functions to help ensure a transparent, consistent and comprehensive framework for managing operational risk globally.

Each major business segment must implement an operational risk process consistent with the requirements of this framework. The process for operational risk management includes the following steps:

The operational risk standards facilitate the effective communication and mitigation of operational risk both within and across businesses. As new products and business activities are developed, processes are designed, modified or sourced through alternative means and operational risks are considered. Information about the businesses’ operational risk, historical losses, and the control environment is reported by each major business segment and functional area, and summarized for Senior Management and the Citigroup Board of Directors.

Framework

To monitor, mitigate and control operational risk, Citigroup maintains a system of comprehensive policies and has established a consistent, value-added framework for assessing and communicating operational risk and the overall effectiveness of the internal control environment across Citigroup. An Operational Risk Council has been established to provide oversight for operational risk across Citigroup. The Council’s membership includes senior members of the Chief Risk Officer’s organization covering multiple dimensions of risk management with representatives of the Business and Regional Chief Risk Officers’ organizations and the Business Management Group. The Council’s focus is on further advancing operational risk management at Citigroup with focus on proactive identification and mitigation of operational risk and related incidents. The Council works with the business segments and the control functions to help ensure a transparent, consistent and comprehensive framework for managing operational risk globally.

Each major business segment must implement an operational risk process consistent with the requirements of this framework. The process for operational risk management includes the following steps:

The operational risk standards facilitate the effective communication and mitigation of operational risk both within and across businesses. As new products and business activities are developed, processes are designed, modified or sourced through alternative means and operational risks are considered. Information about the businesses’ operational risk, historical losses, and the control environment is reported by each major business segment and functional area, and summarized for Senior Management and the Citigroup Board of Directors.

Framework

        Citigroup's approach to operational risk is defined in the Citigroup Risk and Control Self-Assessment (RCSA)/Operational Risk Policy.

        The objective of the Policy is to establish a consistent, value-added framework for assessing and communicating operational risk and the overall effectiveness of the internal control environment across Citigroup. Each major business segment must implement an operational risk process consistent with the requirements of this Policy.

        The RCSA standards establish a formal governance structure to provide direction, oversight, and monitoring of Citigroup's RCSA programs. The RCSA standards for risk and control assessment are applicable to all businesses and staff functions. They establish RCSA as the process whereby important risks inherent in the activities of a business are identified and the effectiveness of the key controls over those risks are evaluated and monitored. RCSA processes facilitate Citigroup's adherence to internal control over financial reporting, regulatory requirements (including Sarbanes-Oxley and FDICIA) the International Convergence of Capital Measurement and Capital Standards (Basel II), and other corporate initiatives, including Operational Risk Management and alignment of capital assessments with risk management objectives. The entire process is subject to audit by Citigroup's ARR, and the results of RCSA are included in periodic management reporting, including reporting to senior management and the Audit and Risk Management Committee.

        The operational risk standards facilitate the effective communication of operational risk both within and across businesses. Information about the businesses' operational risk, historical losses, and the control environment is reported by each major business segment and functional area, and summarized for senior management and the Citigroup Board of Directors.

46

Framework

        Citigroup's approach to operational risk is defined in the Citigroup Risk and Control Self-Assessment (RCSA)/Operational Risk Policy.

        The objective of the Policy is to establish a consistent, value-added framework for assessing and communicating operational risk and the overall effectiveness of the internal control environment across Citigroup. Each major business segment must implement an operational risk process consistent with the requirements of this Policy.

        The RCSA standards establish a formal governance structure to provide direction, oversight, and monitoring of Citigroup's RCSA programs. The RCSA standards for risk and control assessment are applicable to all businesses and staff functions. They establish RCSA as the process whereby important risks inherent in the activities of a business are identified and the effectiveness of the key controls over those

37

risks are evaluated and monitored. RCSA processes facilitate Citigroup's adherence to internal control over financial reporting, regulatory requirements (including Sarbanes-Oxley) FDICIA, the International Convergence of Capital Measurement and Capital Standards (Basel II), and other corporate initiatives, including Operational Risk Management and alignment of capital assessments with risk management objectives. The entire process is subject to audit by Citigroup's ARR, and the results of RCSA are included in periodic management reporting, including reporting to senior management and the Audit and Risk Management Committee.

        The operational risk standards facilitate the effective communication of operational risk both within and across businesses. Information about the businesses' operational risk, historical losses, and the control environment is reported by each major business segment and functional area, and summarized for senior management and the Citigroup Board of Directors.

Framework

        Citigroup's approach to operational risk is defined in the Citigroup Risk and Control Self-Assessment (RCSA)/Operational Risk Policy.

        The objective of the Policy is to establish a consistent, value-added framework for assessing and communicating operational risk and the overall effectiveness of the internal control environment across Citigroup. Each major business segment must implement an operational risk process consistent with the requirements of this Policy.

        The RCSA standards establish a formal governance structure to provide direction, oversight, and monitoring of Citigroup's RCSA programs. The RCSA standards for risk and control assessment are applicable to all businesses and staff functions. They establish RCSA as the process whereby important risks inherent in the activities of a business are identified and the effectiveness of the key controls over those risks are evaluated and monitored. RCSA processes facilitate Citigroup's adherence to internal control over financial reporting, regulatory requirements (including Sarbanes-Oxley) FDICIA, the International Convergence of Capital Measurement and Capital Standards (Basel II), and other corporate initiatives, including Operational Risk Management and alignment of capital assessments with risk management objectives. The entire process is subject to audit by Citigroup's Audit and Risk Review, and the results of RCSA are included in periodic management reporting, including reporting to senior management and the Audit and Risk Management Committee.

        The operational risk standards facilitate the effective communication of operational risk both within and across businesses. Information about the businesses' operational risk, historical losses, and the control environment is reported by each major business segment and functional area, and summarized for senior management and the Citigroup Board of Directors.

Framework

Citigroup’s approach to operational risk is defined in the Citigroup Risk and Control Self-Assessment (RCSA)/Operational Risk Policy.

The objective of the Policy is to establish a consistent, value-added framework for assessing and communicating operational risk and the overall effectiveness of the internal control environment across Citigroup.

Framework

        Citigroup's approach to operational risk is defined in the Citigroup Risk and Control Self-Assessment (RCSA)/ Operational Risk Policy.

        The objective of the Policy is to establish a consistent, value-added framework for assessing and communicating operational risk and the overall effectiveness of the internal control environment across Citigroup. Each major business segment must implement an operational risk process consistent with the requirements of this Policy. The process for operational risk includes the following steps:

•

Identify and assess Key Operational Risks;



•

Establish Key Risk Indicators; and



•

Produce a comprehensive operational risk report.

        The Operational Risk standards facilitate the effective communication of operational risk both within and across businesses. Information about the businesses' operational risk, historical losses, and the control environment is reported by each major business segment and functional area, and summarized for Senior Management and the Citigroup Board of Directors.

        The RCSA standards establish a formal governance structure to provide direction, oversight, and monitoring of Citigroup's RCSA programs. The RCSA standards for risk and control assessment are applicable to all businesses and staff functions. They establish RCSA as the process whereby important risks inherent in a business' activities are identified and the effectiveness of the key controls over those risks are evaluated and monitored. RCSA processes facilitate Citigroup's adherence to regulatory requirements, including Sarbanes-Oxley, FDICIA, the International Convergence of Capital Measurement and Capital Standards (Basel II), and other corporate initiatives, including Operational Risk Management and alignment of capital assessments with risk management objectives. The entire process is subject to audit by Citigroup's ARR, and the results of RCSA are included in periodic management reporting, including reporting to Senior Management and the Audit and Risk Management Committee.

Framework

Citigroup’s approach to operational risk is defined in the Citigroup Risk and Control Self-Assessment (RCSA)/ Operational Risk Policy.

The objective of the Policy is to establish a consistent, value-added framework for assessing and communicating operational risk and the overall effectiveness of the internal control environment across Citigroup. Each major business segment must implement an operational risk process consistent with the requirements of this Policy. The process for operational risk includes the following steps:

The Operational Risk standards facilitate the effective communication of operational risk both within and across businesses. Information about the businesses’ operational risk, historical losses, and the control environment is reported by each major business segment and functional area, and summarized for Senior Management and the Citigroup Board of Directors.

The RCSA standards establish a formal governance structure to provide direction, oversight, and monitoring of Citigroup’s RCSA programs. The RCSA standards for risk and control assessment are applicable to all businesses and staff functions. They establish RCSA as the process whereby important risks inherent in a business’ activities are identified and the effectiveness of the key controls over those risks are evaluated and monitored. RCSA processes facilitate Citigroup’s adherence to regulatory requirements, including Sarbanes-Oxley, FDICIA, the International Convergence of Capital Measurement and Capital Standards (Basel II), and other corporate initiatives, including Operational Risk Management and alignment of capital assessments with risk management objectives. The entire process is subject to audit by Citigroup’s ARR, and the results of RCSA are included in periodic management reporting, including reporting to Senior Management and the Audit and Risk Management Committee.

Framework

        Citigroup's approach to operational risk is defined in the Citigroup Risk and Control Self-Assessment (RCSA)/ Operational Risk Policy.

        The Operational Risk portion codifies the core governing principles and provides a consistent framework for managing operational risks across the Company. Each major business segment must establish its own operational risk procedures, consistent with the corporate policy, and an approved governance structure. The policy requires each business to identify its key operational risks as well as the controls established to mitigate those risks and to ensure compliance with laws, regulations, regulatory administrative actions, and Citigroup policies. It also requires that all businesses collect and report their operational risk loss data.

        The Operational Risk standards facilitate the effective communication of operational risk both within and across businesses. Information about the businesses' operational risk, historical losses, and the control environment is reported by each major business segment and functional area, and summarized for Senior Management and the Citigroup Board of Directors.

        The RCSA portion establishes a formal governance structure to provide direction, oversight, and monitoring of Citigroup's RCSA programs. The RCSA standards for risk and control assessment are applicable to all businesses and staff functions. It also establishes RCSA as the process whereby risks inherent in a business' activities are identified and the effectiveness of the key controls over those risks are evaluated and monitored. RCSA processes facilitate Citigroup's adherence to regulatory requirements, including Sarbanes-Oxley, FDICIA, the International Convergence of Capital Measurement and Capital Standards (Basel II), and other corporate initiatives, including Operational Risk Management and alignment of capital assessments with risk management objectives. The entire process is subject to audit by Citigroup's ARR, and the results of RCSA are included in periodic management reporting, including reporting to Senior Management and the Audit and Risk Management Committee.

Framework

        Citigroup's approach to operational risk is defined in two key policies:

•

The Citigroup Operational Risk Policy and;



•

The Citigroup Risk and Control Self-Assessment (RCSA) Policy

        The Citigroup Operational Risk Policy codifies the core governing principles and provides a consistent framework for managing operational risks across the Company. Each major business segment must establish its own operational risk procedures, consistent with the corporate policy, and an approved governance structure. The policy requires each business to identify its key operational risks as well as the controls established to mitigate those risks and to ensure compliance with laws, regulations, regulatory administrative actions, and Citigroup policies. It also requires that all businesses collect and report their operational risk loss data.

        The Operational Risk Policy and its requirements facilitate the effective communication of operational risk both within and across businesses. Information about the businesses' operational risk, historical losses, and the control environment is reported by each major business segments and functional area, and summarized for Senior Management and the Citigroup Board of Directors.

        The Citigroup RCSA Policy establishes a formal governance structure to provide direction, oversight, and monitoring of Citigroup's RCSA programs. The RCSA Policy incorporates standards for risk and control assessment that are applicable to all businesses and staff functions. It also establishes RCSA as the process whereby risks inherent in a business' activities are identified and the effectiveness of the key controls over those risks are evaluated and monitored. RCSA processes facilitate Citigroup's adherence to regulatory requirements, including Sarbanes-Oxley, FDICIA, the International Convergence of Capital Measurement and Capital Standards (Basel II), and other corporate initiatives, including Operational Risk Management and alignment of capital assessments with risk management objectives. The entire process is subject to audit by Citigroup's ARR, and the results of RCSA are included in periodic management reporting, including reporting to Senior Management and the Audit and Risk Management Committee.