Health and safety and premises
The Group strives to ensure compliance with legal and regulatory
requirements, embedding compliant and appropriate colleague
behaviours in line with its policies, values and people risk priorities.
The Group continues to monitor horizon scanning, risk assessments
and any incident information to continually improve its health, safety
and premises risk management. Colleagues also regularly complete
health and safety training to ensure that policies, standards,
procedures, processes and practices are understood and implemented
effectively.
Information, cyber and physical security
The Group adopts a risk-based approach to mitigate cyber threats it
faces. Specifically, the Group continues to enhance access controls
across certain business applications and associated IT infrastructure.
The effective operation of the Group’s estate is supported by an IT
and Cyber Security Governance framework, guided by a threat-based
strategy which underpins investment decisions. The ongoing
protection of the estate and confidentiality of material information is
ensured through adherence to the Group Security Policy which has
been aligned to industry good practice including the NIST Cyber
Security Framework; and material laws and regulations. The Group
engages a specialist third-party consultancy on a periodic basis, to
assess the maturity of its cyber security programme, in assessing,
identifying and managing material risks from cyber security threats.
The Lloyds Banking Group and Ring-Fenced Banks Risk Committee is
responsible for ensuring that management has processes in place
designed to identify and evaluate information, cyber and security risks
that the Group is exposed to, implementing processes and
programmes to manage these risks and mitigate related incidents
within appetite. The Board Risk Committee (BRC) continues to be
supported by the IT and Cyber Advisory Forum (ITCAF), which is
attended by the BRC chair and other Board members. ITCAF
dedicates time and attention to reviewing and challenging risks
associated with IT infrastructure, IT strategy, IT resilience and cyber
risks. Senior management is responsible for identifying, considering
and assessing material IT systems and security risks on an ongoing
basis, establishing processes to ensure that such potential risk
exposures are monitored, putting in place appropriate mitigation
measures and maintaining control improvement programmes.
Internal and external supplier
The threat landscape associated with third party suppliers and the
critical services they provide continues to receive a significant amount
of attention. The Group acknowledges the importance of control and
responsibility for critical business services and processes, which could
cause significant harm to the Group’s customers
The Group segments its suppliers by criticality and has processes in
place to support ongoing supplier management, including:
• Policy expectations are underpinned by standards, notably the
sourcing and supply chain management framework
• All material arrangements are set out in written agreements and
based on Group standard terms, which comply with regulations,
including the expectation that all sub-outsourcing is managed in
line with the supplier’s contractual obligations to the Group
• A risk-proportionate process exists for onboarding and managing
third-party arrangements through the life cycle
• Pre-outsourcing and ongoing risk assessments to identify key
operational and financial risks, including on-site or virtual
assurance for suppliers with a higher criticality assessment
• Assessments drive the level of ongoing supplier governance,
assurance and monitoring. For example, the Group provides
training and other resources to its suppliers to support IT systems
and information security resilience in its supply chain
IT systems
The Group continues its journey to simplify its technology estate, in
line with its strategy, through the targeted simplification of legacy
applications, infrastructure platforms and on-premise data centres.
The Group has controls in place to manage legacy technology, IT
change and monitoring, incident management and recovery. IT
disaster recovery is a key capability to recover from multiple
scenarios, ranging from likely and medium impact (such as
infrastructure failure for a single application), to low likelihood with
severe or material impact scenarios, such as the loss of a data centre
or cloud region.
People
The Group takes many mitigating actions with respect to people risk.
Key areas of focus include:
• Focusing on leadership and colleague engagement, through
delivery of strategies to attract, retain and develop high calibre
people together with a focus on creating a strong and resilient
talent pipeline
• Continued focus on the Group’s culture and inclusivity strategy by
developing and delivering initiatives that reinforce the appropriate
behaviours which generate the best possible long- term outcomes
for customers and colleagues
• Managing organisational capability and capacity through divisional
people strategies to ensure there are the right skills and resources
to meet customers’ needs and deliver the Group’s strategic plan
• Ensuring colleague wellbeing strategies and support are in place to
meet colleague needs, alongside skills and capability growth
required to maximise the potential of our people
• Ensuring compliance with legal and regulatory requirements,
embedding compliant and appropriate colleague behaviours in line
with Group policies, values and its people risk priorities
• Reviewing and enhancing people processes to ensure they are fit
for purpose and operationally resilient
Payments and transaction execution
The Group adopts a robust approach to minimising risks associated
with payments or transaction execution, which may have an impact
on customers, clients, or internal operations. This includes processing
and execution failures relating to clients and products, such as errors
in payment processing or management of payments and claims,
including those where a third party is operating on the Group’s behalf.
Monitoring
Events and their associated impacts are identified, escalated and
recorded to ensure that losses are managed in line with risk appetite,
with some events requiring immediate notification to the regulator.
Effective root cause analysis is undertaken to identify issues that need
to be resolved and where action is necessary to strengthen the control
environment, including resilience. Events data is also used to inform
the amount of capital required to cover unexpected severe
operational risk losses.
Changes to the internal and external environment are regularly
monitored to ensure there is an accurate and up-to-date view of the
operational risk profile. This includes but is not limited to:
• Utilising outputs from horizon scanning to determine changes in
regulatory obligations or the external environment
• Using key risk, control and performance indicators (as relevant) to
monitor the risk profile
• Monitoring risk appetite metrics and management measures
against agreed thresholds, including the escalation of breaches
• Understanding the impact of change and/or transformation
activity on the risk and control environment
• Ensuring strategic changes or new product offerings are monitored
and impacts understood
Reporting
Operational risk reporting ensures senior management has full
visibility of the Group’s operational risk exposure to enable informed
decision making.
