the
clients
and
communication
with
them.
The
bank
continuously
alerts
clients
to
new
threats,
in
particular
affecting online banking, as well as new methods of internet fraud.
In
2022,
in
the
area
of
counteracting
fraud,
we
have
focused
our
activity
on
protecting
customers
and
the
bank
against
fraudulent
extortion
techniques,
including
through
social
engineering.
Thanks
to
effective
mitigants in the field of Anti-Fraud Policy and tools, extortion patterns have been limited to a great extent.
Outsourcing risk
Outsourcing
risk
is
understood
as
the
risk
of
adverse
influence
of
a
third
party
conducting
a
process,
providing
a
service
or
performing
a
task
under
an
agreement,
which
would
otherwise
be
conducted,
provided
or
performed
by
the
bank
(the
bank
is
also
understood
as
an
investment
company
in
accordance
with the EBA Guidelines and Delegated Regulation (EU) 2017/565).
Outsourcing
poses
risk,
in
particular
operational,
business,
legal,
compliance
and
reputational
risk.
The
Management
Board
of
the
bank
is
responsible
for
the
regulatory
compliance
of
outsourcing
agreements
and
oversees
their
implementation.
In
particular,
the
Management
Board
is
responsible
for
the
process
of
making decisions to outsource critical functions.
The
Management
Board
has
appointed
the
Compliance
Department
to
manage
and
coordinate
the
outsourcing process across the bank, including the foreign branches.
We manage outsourcing risk based on the model of three lines of defence:
■
the
first
line
of
defence
includes
organisational
units
which
are
owners
or
administrators
of
outsourcing
agreements, outsource functions, and remain responsible for operational relations with third parties,
■
the second line of defence is composed of:
□
the
Compliance
Department,
in
particular
the
outsourcing
coordinator,
who
supervises
the
outsourcing process and reports to the bank's authorities, and
□
other
units
from
the
risk
management
and
security
areas
that
participate
in
the
process
of
concluding
and
implementing
outsourcing
agreements
and
have
their
roles
defined
in
the
Internal
Instruction on Outsourcing,
■
the
third
line
of
defence
is
the
Internal
Audit
Department
(DAW),
which
performs
the
independent
internal
audit
function.
DAW
carries
out
regular
audits
of
outsourcing
in
order
to
assess
the
effectiveness
and
adequacy
of
the
risk
management
system
in
outsourcing
and
to
evaluate
outsourcing
risk management.
Organisational
units
of
the
bank
which
are
owners
or
administrators
of
outsourcing
agreements
are
responsible for the management of risks generated by such agreements, among other things, by:
■
performing analyses of the purpose of outsourcing agreements,
■
performing analyses of the effectiveness of contractors,
■
performing analyses of function risk, including assessment of function criticality,
■
performing analyses of counterparty risk (due diligence, conflicts of interest),
■
preparing
drafts
of
outsourcing
agreements
(or,
if
needed,
a
draft
of
a
notification
or
application
to
the
Polish Financial Supervision Authority),
■
consulting drafts of outsourcing agreements with the competent organisational units of the bank,
■
if needed, agreeing on the template of an outsourcing agreement or of an amending annex to such an
agreement with the outsourcing coordinator,
■
archiving outsourcing agreements,
■
monitoring and controlling the quality and timeliness of activities performed under agreements,
■
regular (at least once per year) monitoring of the effectiveness of active outsourcing agreements.
We
follow
the
principle
of
maximum
mitigation
of
outsourcing
risk,
which
is
why
we
regularly
evaluate
the
standing of outsourcers and monitor the implementation of outsourcing agreements.
We continued to implement the EBA guidelines on outsourcing in 2022.
HR and organisational risk
HR
and
organisational
risk
is
understood
as
the
risk
that
the
organisation
would
be
unable
to
operate
efficiently
due
to
unavailability
or
a
shortage
of
employees
with
the
necessary
professional
profile,
or
due
to
instability,
changes
or
deficiencies
in
the
organisation’s
structure
and
way
it
is
established.
The
risk
includes:
