Citigroup (C)

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, systems or human factors, or from external events. It includes the reputation and franchise risk associated with business practices or market conduct in which the Company is involved. Operational risk is inherent in Citigroup's global business activities and, as with other risk types, is managed through an overall framework designed to balance strong corporate oversight with well-defined independent risk management. This framework includes:

•

recognized ownership of the risk by the businesses;



•

oversight by independent risk management; and



•

independent review by Audit and Risk Review (ARR).

        The goal is to keep operational risk at appropriate levels relative to the characteristics of our businesses, the markets in which we operate, our capital and liquidity, and the competitive, economic and regulatory environment. Notwithstanding these controls, Citigroup incurs operational losses.

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, systems or human factors, or from external events. It includes the reputation and franchise risk associated with business practices or market conduct in which the Company is involved. Operational risk is inherent in Citigroup's global business activities and, as with other risk types, is managed through an overall framework designed to balance strong corporate oversight with well-defined independent risk management. This framework includes:

•

recognized ownership of the risk by the businesses;



•

oversight by independent risk management; and



•

independent review by Audit and Risk Review (ARR).

        The goal is to keep operational risk at appropriate levels relative to the characteristics of our businesses, the markets in which we operate, our capital and liquidity, and the competitive, economic and regulatory environment. Notwithstanding these controls, Citigroup incurs operational losses.

OPERATIONAL RISK MANAGEMENT PROCESS

Operational risk is the risk of loss resulting from inadequate or failed internal processes, systems or human factors, or from external events. It includes the reputation and franchise risk associated with business practices or market conduct in which the Company is involved. Operational risk is inherent in Citigroup’s global business activities and, as with other risk types, is managed through an overall framework designed to balance strong corporate oversight with well-defined independent risk management. This framework includes:

The goal is to keep operational risk at appropriate levels relative to the characteristics of our businesses, the markets in which we operate, our capital and liquidity, and the competitive, economic and regulatory environment. Notwithstanding these controls, Citigroup incurs operational losses.

OPERATIONAL RISK MANAGEMENT PROCESS

Operational risk is the risk of loss resulting from inadequate or failed internal processes, systems or human factors, or from external events. It includes the reputation and franchise risk associated with business practices or market conduct in which the Company is involved. Operational risk is inherent in Citigroup’s global business activities and, as with other risk types, is managed through an overall framework designed to balance strong corporate oversight with well-defined independent risk management. This framework includes:

The goal is to keep operational risk at appropriate levels relative to the characteristics of our businesses, the markets in which we operate, our capital and liquidity, and the competitive, economic and regulatory environment. Notwithstanding these controls, Citigroup incurs operational losses.

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It includes the reputation and franchise risk associated with business practices or market conduct that the Company undertakes. Operational risk is inherent in Citigroup's global business activities and, as with other risk types, is managed through an overall framework with checks and balances that include:

•

Recognized ownership of the risk by the businesses;



•

Oversight by independent risk management; and



•

Independent review by Audit and Risk Review (ARR).

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It includes the reputation and franchise risk associated with business practices or market conduct that the Company undertakes. Operational risk is inherent in Citigroup's global business activities and, as with other risk types, is managed through an overall framework with checks and balances that include:

•

Recognized ownership of the risk by the businesses;



•

Oversight by independent risk management; and



•

Independent review by Audit and Risk Review (ARR).

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It includes the reputation and franchise risk associated with business practices or market conduct that the Company undertakes. Operational risk is inherent in Citigroup's global business activities and, as with other risk types, is managed through an overall framework with checks and balances that include:

•

Recognized ownership of the risk by the businesses;



•

Oversight by independent risk management; and



•

Independent review by Audit and Risk Review (ARR).

OPERATIONAL RISK MANAGEMENT PROCESS

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It includes the reputation and franchise risk associated with business practices or market conduct that the Company undertakes. Operational risk is inherent in Citigroup’s global business activities and, as with other risk types, is managed through an overall framework with checks and balances that include:

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It includes the reputation and franchise risk associated with business practices or market conduct that the Company undertakes. Operational risk is inherent in Citigroup's global business activities and, as with other risk types, is managed through an overall framework with checks and balances that include:

•

Recognized ownership of the risk by the businesses;



•

Oversight by independent risk management; and



•

Independent review by Audit and Risk Review (ARR).

OPERATIONAL RISK MANAGEMENT PROCESS

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It includes the reputation and franchise risk associated with business practices or market conduct that the Company undertakes. Operational risk is inherent in Citigroup’s global business activities and, as with other risk types, is managed through an overall framework with checks and balances that include:

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or external events. It includes the reputation and franchise risk associated with business practices or market conduct that the Company undertakes. Operational risk is inherent in Citigroup's global business activities and, as with other risk types, is managed through an overall framework with checks and balances that include:

•

Recognized ownership of the risk by the businesses;



•

Oversight by independent risk management; and



•

Independent review by Audit and Risk Review (ARR).

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or external events. It includes the reputation and franchise risk associated with business practices or market conduct that the Company undertakes. Operational risk is inherent in Citigroup's global business activities and, as with other risk types, is managed through an overall framework with checks and balances that include:

•

Recognized ownership of the risk by the businesses;



•

Oversight by independent risk management; and



•

Independent review by Audit and Risk Review (ARR).

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It includes reputation and franchise risk associated with business practices or market conduct that the Company may undertake. Operational risk is inherent in Citigroup's global business activities and, as with other risk types, is managed through an overall framework with checks and balances that include recognized ownership of the risk by the businesses, independent risk management oversight, and independent review by Audit Risk and Review (ARR).

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It includes reputation and franchise risks associated with business practices or market conduct that the Company may undertake with respect to activities in a fiduciary role, as principal, as well as agent, or through a special-purpose vehicle.

        The Citigroup Operational Risk Policy codifies the core governing principles for operational risk management and provides the framework to identify, control, monitor, measure, and report operational risks in a consistent manner across the Company.

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It includes reputation and franchise risks associated with business practices or market conduct that the Company may undertake with respect to activities in a fiduciary role, as principal, as well as agent, or through a special-purpose vehicle.

        The Citigroup Operational Risk Policy codifies the core governing principles for operational risk management and provides the framework to identify, control, monitor, measure, and report operational risks in a consistent manner across the Company.

OPERATIONAL RISK MANAGEMENT PROCESS

        Operational risk is the risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. It includes reputation and franchise risks associated with business practices or market conduct that the Company may undertake with respect to activities in a fiduciary role, as principal, as well as agent, or through a special-purpose vehicle.

        The management of operational risk is continuing to evolve into a distinct discipline with its own risk management structure, tools, and process, much like credit and market risk. The Citigroup Self-Assessment and Operational Risk Framework (the Framework) includes the Citigroup Risk and Control Self-Assessment Policy and the Citigroup Operational Risk Policy, which define Citigroup's approach to operational risk management. The Citigroup Operational Risk Policy (the Policy) codifies the core governing principles for operational risk management and provides the framework to identify, evaluate, control, measure, monitor, and report operational risks in a consistent manner across the Company. The Framework requires each business to identify its operational risks as well as the controls established to mitigate those risks and to ensure compliance with laws, regulations, regulatory administrative actions, and Citigroup policies. It also requires that all businesses report their operational risk losses in accordance with Policy definitions into a standardized database.

        Citigroup's Framework includes the following core operational risk principles, which apply to all of Citigroup's businesses (certain newly acquired businesses are granted temporary exemptions to this policy):

•

Senior Business Managers are accountable for managing Operational Risk.



•

Citigroup has a system of checks and balances in place for operational risk management including:



•

an independent operational risk oversight function, reporting to the Citigroup Senior Risk Officer;



•

a formal governance structure established by the Citigroup Controller and Chief Accounting Officer, to provide direction, oversight, and monitoring of Citigroup's Risk and Control Self-Assessment (RCSA) programs;



•

an independent Audit and Risk Review function.



•

Each major Citigroup business segment must have approved business-specific procedures for managing operational risk including risk identification, evaluation, control, measurement, monitoring, and reporting, as well as processes for ensuring compliance with corporate policies and applicable laws and regulations.

57

        The Policy and its requirements facilitate the aggregation of operational risks across products and businesses and promote effective communication of those risks to management. Information about the businesses' operational risks and losses is reported regularly to Senior Management and to the Citigroup Board of Directors. This includes information about the allocation of risk capital for operational risk to each business. Risk capital is calculated based on an estimate of the operational loss potential for each major line of business adjusted for the quality of its control environment. Citigroup's methodologies for calculating capital continue to evolve to accommodate use of the increasing amounts of data that are becoming available as a product of the Framework. Citigroup's Framework facilitates the Company's response to the requirements of emerging regulatory guidance on operational risk, including those related to Basel 2 capital calculations.