The Pillar 3 Disclosure is prepared on a consolidated basis and comprises information on The Royal Bank of Scotland Berhad and its subsidiaries and associated company. Information on subsidiaries and associated company of the Group is available in Notes 13 and 14 to the 2011 annual financial statements respectively. The basis of consolidation for financial accounting purposes is described in Note 3 to the financial statements.

The capital adequacy ratios of the Group are computed in accordance with Bank Negara Malaysia's revised Risk-weighted Capital Adequacy Framework (RWCAF-Basel II). The minimum regulatory capital adequacy requirement is 8% for the risk-weighted capital ratio.

The Group has a high proportion of its assets funded via equity and long-term debt. The Group closely monitors the capital structure and has comfortable capital margins allowing it to support a buffer over minimum capital adequacy requirements.

Included in the Group’s capital base is a RM200 million subordinated debt capital. The main features of the subordinated debt capital are disclosed in Note 21 to the financial statements.

Credit risk considers the ability of a borrower or counterparty to honor commitments under an agreement as any such failure has an adverse impact on the Group’s financial performance. The Group is exposed to credit risk through its various lending activities such as funded facilities, non-funded facilities as well as hedging facilities.

The Group’s credit risk management process is independent of the business so as to protect integrity of the risk assessment process and decision making. The global as well as local policies guide the credit risk team to make informed decisions.

Credit risk in respect of exposures on corporate as well as small and medium enterprises (SME) is measured and managed at both individual counterparty levels as well as at a portfolio level. Credit rating tools are an integral part of risk-assessment of the corporate borrowers and different rating models are used for each segment that has distinct risk characteristics such as large corporate, financial companies and project finance.

The credit rating tools use a combination of quantitative inputs and qualitative inputs to arrive at a “point-in-time” view of the rating of counterparty. Each internal rating grade corresponds to a distinct probability of default. Model validation is carried out periodically at a global level by objectively assessing the accuracy and stability of ratings.

All credit exposures, once approved, are monitored and reviewed periodically against the approved limits. Borrowers with lower credit rating are subject to more frequent reviews. Besides this there are monthly risk migration analysis and monthly watch list meeting.

Risk review involves independent review of credit risk assessment, compliance with internal policies of the Group and with the regulatory framework, compliance of sanction terms and conditions and effectiveness of loan administration.

Customers with emerging credit problems are identified early and classified accordingly. Remedial action is initiated promptly to minimize the potential loss to the Group.

The Group controls and limits concentration risk by means of appropriate structural limits and borrower limits based on creditworthiness. The exposures to individual clients or group are based on the internal rating of the borrower as well as group-wide borrowing limits and capped by the regulatory ceiling.

Industry analysis plays an important part in assessing the concentration risk within the loan portfolio. Particular attention is given to industry sectors where the Group believes there is a high degree of risk or potential for volatility in the future. The Group is subject to global fixed internal limits for aggregate commitments to different sectors so that the exposures are evenly spread over various sectors.

Market risk exposures are monitored daily by independent market risk management team using relevant systems. Daily reports measuring utilisation of currency and holding limit together with price value basis points limits are generated and circulated to the relevant parties for information and action. The Group has no significant exposure to equity and commodity price risk.

VaR and limits, independent stress testing of portfolios, factor sensitivity measures and derivatives are used as additional risk management tools to manage and hedge market risk exposures.

Operational risk is the potential for financial loss, damage to reputation, or impact upon customers resulting from fraud, human error, ineffective or inadequately designed processes or systems, improper behavior, or external events. Operational risk is an integral and unavoidable part of the Group’s business as it is inherent in the processes it operates to provide services to customers and generate profit for shareholders.

To ensure appropriate responsibility is allocated for the management, reporting and escalation of operational risk, the Group operates a three lines of defense model which outlines principles for the roles, responsibilities and accountabilities for operational risk management.

An objective of operational risk management is not to remove operational risk altogether, but to manage the risk to an acceptable level, taking into account the cost of minimising the risk with the resultant reduction in exposure. Strategies to manage operational risk include avoidance, transfer, acceptance and mitigation by controls.

Each business unit must manage its operational risk exposure within an acceptable level, testing the adequacy and effectiveness of controls and other risk mitigants regularly and documenting the results. Where unacceptable control weaknesses are identified, action plans are produced and tracked to completion.

Operational risk – three lines of defense model

First line of defense
The Business: Accountable for the ownership and day-to-day management and control of operational risk. Responsible for implementing processes in compliance with the Group’s policies and for testing key controls and monitoring compliance with its policies.

Second line of defense
Operational Risk: Responsible for the implementation and maintenance of the operational risk framework, tools and methodologies. Responsible for oversight and challenge on the adequacy of the risk and control processes operating in the business.

Third line of defense
Group Internal Audit: Responsible for providing independent assurance on the design, adequacy and effectiveness of the Group’s system of internal controls.

The Group’s Operational Risk Policy/Procedures provide the direction for delivering effective operational risk management. They comprise principles and processes that enable the consistent identification, assessment, management, monitoring and reporting of operational risk across the Group. The objectives of the standards are to protect the Group from financial loss or damage to its reputation, its customers or staff and to ensure that it meets all necessary regulatory and legal requirements.

The standards are supported by several key operational risk management techniques of which the Group applies the following techniques:

• Risk and control assessments: business units identify and assess operational risks to ensure that they are effectively managed, prioritised, documented and aligned to risk appetite;
• Loss data management: each business unit’s internal loss data management process captures all operational risk loss events above certain minimum thresholds. The data is used to enhance the adequacy and effectiveness of controls, identify emerging themes, enable formal loss event reporting and inform risk and control assessments and scenario analysis.

Escalation of individual event to senior management is determined by the seriousness of the event.

Operational loss events are categorised under the following headings:
– Clients, products and business practices;
– Technology and infrastructure failures;
– Employment practices and workplace safety;
– Internal fraud;
– External fraud;
– Execution, delivery and process management;
– Malicious damage; and
– Disaster and public safety

• Key risk indicators: business units monitor key risk indicators (usually operational) against their material risks. These indicators are used to monitor the operational risk profile and exposure to losses against thresholds which trigger risk management actions;
  
  
• New products approval process: this process ensures that all new products or significant variations to existing products are subject to a comprehensive risk assessment. Products are evaluated and approved by specialist areas and are subject to executive approval prior to launch; and
  
  
• Self certification process: this requires management to monitor and report regularly on the internal control framework for which they are responsible, confirming its adequacy and effectiveness. This includes certifying compliance with the requirements of Group's policies.

Interest Rate Risk Sensitivity Analysis

Stress testing is performed to provide early warnings of potential losses to facilitate the proactive management of interest rate risk. Based on data as at 31 December 2011, the Group’s projected sensitivity to a 100 basis point parallel shock to interest rates across all maturities is approximately RM6.35 million.