The Pillar 3 Disclosure is prepared on a consolidated basis and comprises information on The Royal Bank of Scotland Berhad and its subsidiaries and associated company. Information on subsidiaries and associated company of the Group is available in Notes 12 and 13 to the financial statements respectively. The basis of consolidation for financial accounting purposes is described in Note 3 to the financial statements.

The capital adequacy ratios of the bank are computed in accordance with Bank Negara Malaysia's revised Risk-weighted Capital Adequacy Framework (RWCAF-Basel II). The Bank has adopted the Standardised Approach for Credit Risk and Market Risk, and Basic Indicator Approach for Operational Risk. The minimum regulatory capital adequacy requirement is 8% for the risk-weighted capital ratio.

The Royal Bank of Scotland Berhad has a high proportion of its liabilities funded via equity and long-term debt. The Bank closely monitors the capital structure and has comfortable capital margins allowing it to support a substantial buffer over minimum capital adequacy requirements.

The components of the Bank's capital structure are as shown in the table below:

Credit risk considers the ability of a borrower or counterparty to honor commitments under an agreement as any such failure has an adverse impact on the Bank’s financial performance. The Bank is exposed to credit risk through its various lending activities such as funded facilities, non-funded facilities as well as hedging facilities.

The Bank’s credit risk management process is independent of the business so as to protect integrity of the risk assessment process and decision making. The global as well as local policies guide the credit risk team to make informed decisions.

Credit risk in respect of exposures on corporate as well as small and medium enterprises (SME) is measured and managed at both individual counterparty levels as well as at a portfolio level. Credit rating tools are an integral part of risk-assessment of the corporate borrowers and different rating models are used for each segment that has distinct risk characteristics such as large corporate, financial companies and project finance.

The credit rating tools use a combination of quantitative inputs and qualitative inputs to arrive at a “point-in-time” view of the rating of counterparty. Each internal rating grade corresponds to a distinct probability of default. Model validation is carried out periodically at a global level by objectively assessing the accuracy and stability of ratings.

All credit exposures, once approved, are monitored and reviewed periodically against the approved limits. Borrowers with lower credit rating are subject to more frequent reviews. Besides this there are monthly risk migration analysis and monthly watch list meeting.

Risk review involves independent review of credit risk assessment, compliance with internal policies of the Bank and with the regulatory framework, compliance of sanction terms and conditions and effectiveness of loan administration.

Customers with emerging credit problems are identified early and classified accordingly. Remedial action is initiated promptly to minimize the potential loss to the Bank.

The Bank controls and limits concentration risk by means of appropriate structural limits and borrower limits based on creditworthiness. The exposures to individual clients or group are based on the internal rating of the borrower as well as group-wise borrowing limits and capped by the regulatory ceiling.

Industry analysis plays an important part in assessing the concentration risk within the loan
portfolio. Particular attention is given to industry sectors where the Bank believes there is a high degree of risk or potential for volatility in the future. The Bank has fixed internal limits for aggregate commitments to different sectors so that the exposures are evenly spread over various sectors.

Market risk exposures are monitored daily by independent market risk management team using relevant systems. Daily reports measuring utilisation of currency and holding limit together with price value basis points limits are generated and circulated to the relevant parties for information and action. The Bank has no significant exposure to equity and commodity price risk.

VaR and limits, independent stress testing of portfolios, factor sensitivity measures and derivatives are used as additional risk management tools to manage and hedge market risk exposures.

Operational risk is the potential for financial loss, damage to reputation, or impact upon customers resulting from fraud, human error, ineffective or inadequately designed processes or systems, improper behavior, or external events. Operational risk is an integral and unavoidable part of the Bank’s business as it is inherent in the processes it operates to provide services to customers and generate profit for shareholders.

To ensure appropriate responsibility is allocated for the management, reporting and escalation of operational risk, the Bank operates a three lines of defense model which outlines principles for the roles, responsibilities and accountabilities for operational risk management.

An objective of operational risk management is not to remove operational risk altogether, but to manage the risk to an acceptable level, taking into account the cost of minimising the risk with the resultant reduction in exposure. Strategies to manage operational risk include avoidance, transfer, acceptance and mitigation by controls.

Each business unit must manage its operational risk exposure within an acceptable level, testing the adequacy and effectiveness of controls and other risk mitigants regularly and documenting the results. Where unacceptable control weaknesses are identified, action plans are produced and tracked to completion.

Operational risk – three lines of defense model

First line of defense
The Business: Accountable for the ownership and day-to-day management and control of operational risk. Responsible for implementing processes in compliance with the Bank’s policies and for testing key controls and monitoring compliance with Bank policies.

Second line of defense
Operational Risk: Responsible for the implementation and maintenance of the operational risk framework, tools and methodologies. Responsible for oversight and challenge on the adequacy of the risk and control processes operating in the business.

Third line of defense
Group Internal Audit: Responsible for providing independent assurance on the design, adequacy and effectiveness of the Bank’s system of internal controls.

The Operational Risk Policy Standards provide the direction for delivering effective operational risk management. They comprise principles and processes that enable the consistent identification, assessment, management, monitoring and reporting of operational risk across the Bank. The objectives of the standards are to protect the Bank from financial loss or damage to its reputation, its customers or staff and to ensure that it meets all necessary regulatory and legal requirements.

The standards are supported by several key operational risk management techniques of which the Bank applies the following techniques:

• Risk and control assessments: business units identify and assess operational risks to ensure that they are effectively managed, prioritised, documented and aligned to risk appetite;
• Loss data management: each business unit’s internal loss data management process captures all operational risk loss events above certain minimum thresholds. The data is used to enhance the adequacy and effectiveness of controls, identify emerging themes, enable formal loss event reporting and inform risk and control assessments and scenario analysis.

Escalation of individual event to senior management is determined by the seriousness of the event.

Operational loss events are categorised under the following headings:
– Clients, products and business practices;
– Technology and infrastructure failures;
– Employment practices and workplace safety;
– Internal fraud;
– External fraud;
– Execution, delivery and process management;
– Malicious damage; and
– Disaster and public safety

• Key risk indicators: business units monitor key risk indicators (usually operational) against their material risks. These indicators are used to monitor the operational risk profile and exposure to losses against thresholds which trigger risk management actions;
  
  
• New products approval process: this process ensures that all new products or significant variations to existing products are subject to a comprehensive risk assessment. Products are evaluated and approved by specialist areas and are subject to executive approval prior to launch; and
  
  
• Self certification process: this requires management to monitor and report regularly on the internal control framework for which they are responsible, confirming its adequacy and effectiveness. This includes certifying compliance with the requirements of Bank's policies.

Interest Rate Risk Sensitivity Analysis

Stress testing is performed to provide early warnings of potential losses to facilitate the proactive management of interest rate risk. Section 35(d) to the financial statements provides further information about stress testing. Based on data as at 31 December 2010, the Bank’s projected sensitivity to a 100 basis point parallel shock to interest rates across all maturities is approximately RM850,000.