Becoming a New Force in Regulatory Risk Management Paul Moore Head of Group Regulatory Risk HBOS plc

Agenda Preliminary remarks, the problem, the opportunity and some stories Our objective, vision and strategy Our accountabilities Key aspects of our business plan for 2004 Next steps Concluding remarks

The business Reg. risk managers Real regulatory risks This paradigm is our problem

But it’s also our opportunity… “Each problem has hidden within it an opportunity so powerful that it literally dwarfs the problem. The greatest success stories were created by people who recognised a problem and turned it into an opportunity”. Joseph Sugarman

Our objective To enhance shareholder value by providing business focused regulatory risk management oversight, advice and other services.

Our vision is threefold To build relationships with our stakeholders which inspire trust and confidence in our advice and oversight To become “A New Force In Regulatory Risk Management” To become an employer of choice for the best regulatory risk management professionals

Our strategy Developing the right people with the right skills Providing outstanding regulatory advice, oversight and other services Striving for simplicity in everything we do Inspiring a culture of openness and excellence Helping management to drive down the costs of managing or failing to manage regulatory risk

A bit more about people matters People matters matter most

IID Risk IID Risk A New Force in Risk Management Internal customer focus Being passionately client focused in dealings with stakeholders Technical excellence Demonstrates technical excellence at all times Outstanding judgement Using a fine-tuned balance of all aspects of knowledge, experience and understanding to solve problems Creativity Exploring all options… thinking ‘out-of-the-box’; breaking new ground in exercising judgement Integrity Demonstrating personal courage, independence and honesty in exercising judgement and giving advice – leading a culture of openness Understanding the business Developing a deep understanding of our clients’ businesses, the risks they face and the needs of their stakeholders Managing relationships Establishing and maintaining relationships with clients so as to become their ‘trusted adviser’ Giving advice and assurance Providing clients with confident and understandable advice and assurance which demonstrates a passionate dedication to technical excellence Functional ProfileFunctional DNA Regulatory Risk Manager’s Competence Framework

A bit more about oversight To enable us provide an independent formal opinion Watchwords of great oversight are:- Deep business understanding and deep relationships Confident advice which protects and adds value Technical excellence & outstanding judgement Personal courage, independence and honesty…..

Striving for simplicity “Bureaucrats write memoranda both because they appear to be busy when they are writing and because the memos, once written, immediately become proof that they were busy.” Charles Peters

Risk management made child’s play! A tree climbing policy by Jennifer Moore Risk management made child’s play!

Our accountabilities Setting the standards, policy and framework Oversight of regulatory risk management Providing functional leadership Fulfilling the accountabilities of the GMLRO Processing suspicion reports to go to NCIS. Coordinating communications with the FSA

Key challenges for 2004 Increased FSA scrutiny Continued focus on fighting financial crime Major regulatory change in UK and EU Ambitious business plans around HBOS New Divisional and Group Risk Organisation Our own change programme

Key priorities for GRR in 2004 Delivering results Business focused oversight and advice – see later for more Arrow RMPs AML, Peps and Sanctions Regulatory Risk Management framework and environment FSA Principles, AP Regime, Treating customers fairly Implementation of group policies (e.g. record keeping) Operating division specific matters IPSB implementation – advice and oversight Suspicion reporting and SearchSpace Setting new standards through “Technical and Policy Services” function

Key priorities for GRR in 2004 Building capability “People matters matter most” Launching a new functional competence framework for GRR and a supporting Skills Development Programme. Introducing an aligned performance management system. Continued focus on MORI survey results Developing a simple and cohesive approach to leadership and management Review GRR operations and processes and supporting organisational structure in line with agreed vision and strategy to ensure high quality service.

Key priorities for GRR in 2004 Shaping strategy – “Good ideas need wings” Communicating our new vision, strategy and structure through a simple programme of meetings, events and other methods. But note….. actions speak louder than words! “Good ideas need wings…but they also need an undercarriage”

Key performance indicators Delivering results Oversight plans and other projects / initiatives completed to relevant standards Stakeholder satisfaction with our work. Appropriate reporting to Group Audit Committee and other relevant governance committees. Suspicion reporting to NCIS to requisite time and quality measures Technical quality of work Financial management on expected work plans.

KPI’s (2) Building capability Key personnel trained in new Leadership and Competence Framework and high quality personal development coaching of colleagues Documented, understood and implemented management procedures ensuring effective “systems and controls”. Positive colleague morale.

KPI’s (3) Shaping strategy Awareness, visibility and buy-in from Divisional CEOs/ Management Teams / Regulatory Risk Management Teams of our vision and strategy.

Next steps Get on with BAU! Complete business plans esp. oversight plans Agree with divisional CEOs Finalise resource requirements in each part of the new structure and communicate Advertise and recruit to new structure Finalise key management and communication systems Design and launch new leadership and skills development courses

Concluding remarks In [??] case I can say that, without her input, it is difficult to see how the fledgling risk function in ?? could have put down the foundations that now exist. I have found her unfailingly helpful and supportive, hard working (sometimes well beyond the call of duty) and uncomplaining. Overall then I would say a very strong client focused performance and one that exceeded my expectations, as I had certainly underestimated her ability in my previous more limited dealings with her. Terrific.

Compliance is not “rocket science”!