1. Head of Operational Risk
Institute of
Operational Risk
Robert Galway
Head of Operational Risk
Friday 1st November 2013

2. Agenda Contents About Worldpay Enterprise Risk Framework;
High Level Strategy and Approach;
Governance Model;
Risk Themes Across the Industry;
My first 90 days – key challenges and achievements.

3. Leading independent global payment services business
WorldPay Overview
Leading independent global payment services business
Top 5 acquirer globally • 400k + merchants • 8bn transactions / £300bn
Streamline is #1 player in UK and Europe across large corporates and SMEs
Led UK Chip & Pin implementation
First contactless transaction in UK
Process 1 of every 2 face- to-face transactions in UK
Streamline
Online point of sale gateway and processing solution
Global presence with vertical expertise
Process in 120 currencies; settle in 14 currencies
Widest range of alternative payment methods
eCommerce
Top 10 acquirer in the US and fastest growing
Focused on SME and Mid- Market
Largest off-premise ATM network
First acquirer with end-to-end hardware encryption US

4. WorldPay Overview

5. Enterprise Risk Framework
Risk Universe
Risk Strategy & Appetite
Risk Policies MI
Risk Assessment
Projects and Outsourcing
Issue Management
Systems to support risk assessment and reporting against the risk exposures, incidents and KRIs and effectiveness of the framework.
Open culture whereby accountability is taken and rewarded for managing risks and incidents – “no blame” culture.
Systems
Culture
Assurance
Governance
Risk based assurance model in place to ensure focus given is applied in the right areas of the business – both embedding the risk framework and exposures.
3LOD governance model operating effectively with clear roles and responsibilities defined. Risk Committee structure articulated and embedded.

6. What is Operational Risk?
Operational Risk is defined as the risk of loss resulting from inadequate or failed processes, systems, human factors or external events. In practice this covers the following…

7. Strategy and Approach 2013 H1 - 2014 H2 2014 Onwards
The risk framework will mature and embed over time given the right focus....
Understanding the risks..
Key Risks identified and assessed across the business;
Control environment defined and assessed;
Actions defined to reduce risk exposures in line with appetite;
Issue Management process rolled out;
Raise awareness of risk management across the business; and
Risk Governance structure in place and basic Risk MI produced (functional and BU).
Embedding and reducing risk exposures….
Risks and issues regularly discussed at Risk Committee and Functional team meetings;
Actions progressing to improve control environment tracked to ensure risk managed down in line with appetite;
Risk MI developing – improved KRIs and KCIs; and
Risk based decision making.
Managing Risk is BAU….
Maturing risk culture, part of day to day management and decision making;
Actions progressing to improve control environment and reduce risk exposures; and
Risk profile reflects the underlying reality and limits issues that materialise.

8. (Ecom, Streamline, Technology, Central Functions)
Risk Assessment
Risks are identified , assessed and managed at three levels across the organisation to ensure that the right risks are managed at the right level….. WP
Business Unit
(Ecom, Streamline, Technology, Central Functions)
Functional
Key Risks for WP are discussed regularly at the Exec and ShipMidco Risk Committees
Strategic risks for each Business Unit are discussed regularly at the relevant SLT meetings
Risk Registers for each functional area, discussed regularly at Management meetings.

9. Governance Model
ShipMidco meets quarterly to ensure that risk framework is embedding appropriately and key risks are managed in line with appetite. This is supported by the Exec Risk Committee and Functional “Risk Committees”
“Board”
Risk Committee
Streamline Exec meeting
eCom
CATS
Central Functions SLT (Finance, Legal, Risk, HR)
WP Exec Risk Committee

10. Key Risk Areas for the Industry
The following risks are a key focus for the Industry
Systems Stability;
Data Security;
Regulatory Change and Scheme Rules;
Financial Crime;
Credit Risk;

11. It’s early days……………….