Organisation of risk management

The Management Board bears overall responsibility for the RMS. It is informed about the risk situation on a regular and ad-hoc basis.

The Management Board informs the Supervisory Board about the risk situation in the regular meetings of the Supervisory Board. It informs the Supervisory Board about material risk-relevant events on an ad-hoc basis.

The Supervisory Board has formed various committees to deal with specific issues. The Management Board reports on the risk situation in the meetings of the Risk Committee. Besides discussing the risk situation, the Risk Committee deals with material risk-relevant issues. The Audit Committee particularly deals with the auditor’s report and the annual financial statements. Both committees and the competent regulatory authorities receive the risk report on a quarterly basis.

Rentenbank has established various committees to manage the Bank’s business and risks. The Risk Committee, which convenes at least once every quarter, is the central committee bearing responsibility for risk management. It discusses central issues and topics of risk management and advises the Management Board on this subject. Besides the members of the Management Board, the committee members include the Head of the Risk Controlling Department and the Heads of the Credit, Finance, Treasury, and Promotional Activity Departments. The Finance Committee deals with the Bank’s financial situation and the Market Committee deals with promotional topics and treasury topics. The Sustainability Board deals with sustainability-related requirements and the operational and strategic implications of these requirements for Rentenbank.

To ensure a robust RMS, Rentenbank has organised its internal control system (ICS) in a clear three-lines-of-defence structure. The first line of defence is formed by primary and key controls in the operating units. The second line of defence is composed of the Regulatory Issues Work Group (ART), the special MaRisk functions of Risk Controlling and Compliance pursuant to the German Minimum Requirements for Risk Management (Mindestanforderungen an das Risikomanagement, MaRisk), the officers in charge of information security, money laundering and other criminal acts, and data protection. The Internal Audit Department forms the third line of defence.

The CRO serves as the Head of the Risk Controlling Department pursuant to the MaRisk. The Risk Controlling Department performs essential tasks of the Risk Controlling function, which include supporting the Management in all risk policy matters, particularly in the development and implementation of the risk strategy, the regular monitoring of the limits defined to ensure the Bank’s risk-bearing capacity, risk reporting, the daily valuation of financial instruments and market conformity checks, and risk assessment in the “New Products Process” (NPP).

In accordance with the MaRisk requirements, risks are monitored and reported independently of the front office functions Promotional Activity and Treasury.

The back office function is performed by the Credit Department, which casts the market-independent vote on credit decisions. This department also monitors compliance with credit default risk-specific limits for purposes of loan portfolio management.

Rentenbank’s Compliance function is directly subordinated to the Management Board organisationally and reports directly to it. In addition, Rentenbank has established a central office for the prevention of money laundering, terrorist financing, and other criminal acts. The Money Laundering Officer is directly subordinated to the Management Board organisationally and reports to it directly.

The Information Security Department (ISD) bears responsibility for all information security concerns. The head of this department performs the function of Information Security Officer (ISO) prescribed by the Regulatory Requirements for IT in Financial Institutions (Bankaufsichtliche Anforderungen an die IT, BAIT).

Internal Audit audits and evaluates the legal compliance of activities and processes and the appropriateness and effectiveness of the RMS and the ICS on a risk-oriented and process-independent basis. It reports directly to the Management Board and performs its duties in an autonomous and independent manner.