RCSAs Georgia Simmons Barclays Director RCSAs Overview of

RCSAs Georgia Simmons – Barclays Director – RCSAs

Overview of an RCSA – How are you going to do it? Triggers Initiate Assessments Annual Assessment Risk Assessments could be broken out into sub units including: • Business Units Risk • Legal Entities • Processes Single annual assessment Unit of Assessment sub-unit 2 | RCSA Restricted - External sub-unit

Assessing your Risk – Financial vs Non-financial Risk Financial Risk Credit Risk Conduct Risk Market Risk Legal Risk Model Risk Operational Risk Treasury and Capital Risk Reputation Risk 3 | RCSA Restricted - External

Creating a Scale of measure • Always use an even number for your rating scale • Set financial bandings of loss for each rating band • Consider any Non-financial factors including: staff / customers / media / regulators… Board Tolerance Impact v Frequency Business Unit / Entity Tolerance 10 8 6 4 2 Business / Branch / Regional Tolerance 0 Very Frequent Quite Frequent Infrequent Series 1 4 | RCSA Restricted - External Tail

Exploring the Causes vs Impacts Hazard Cause / Threat Detective Control Reductive Control Impact Risk Event Cause / Threat Detective Control 5 | RCSA Restricted - External

Control Assessment – are these rigid or fluid? Structured / Waterfall Approach Inherent Risk Assessment Control Assessment Residual Risk Assessment Continuous Approach Control Assessment Time Continuously assessed throughout the year Consider also reviewing for appropriate design, both individually and collectively, to mitigate Risk to within appetite in the current and the known future business environment. 6 | RCSA Restricted - External

Links to Risk Events / Issues and other data sources Governance Risk Compliance Integrated Risk Management 7 | RCSA Restricted - External

Outputs and Reporting and Tools to use within Risk Assessments 8 | RCSA Restricted - External