AmazonScience/document-haystack

1Non-Financial Risk2Non-financial risk is comprised of operational risk and reputational risk.3Operational risk means the risk of loss resulting from inadequate or failed internal processes, 4people, and systems or from external events, including legal risk. Operational risk excludes 5business and reputational risk. 6Reputational risk means the risk of possible damage to our brand and reputation, and the 7associated risk to earnings, capital, or liquidity, arising from any association, action or 8inaction which could be perceived by stakeholders to be inappropriate or unethical or 9inconsistent with our Code of Conduct.10Key Drivers for Non-Financial Risk11Non-financial risk is inherent to our business activities. We have embedded internal risk 12management and control processes and the use of risk management tools and concepts. Our 13integrated approach along the risk management lifecycle is designed to enable sound risk 14identification, evaluation, remediation, and monitoring of the key non-financial risks. Any 15failures related to key non-financial risks, caused by external or internal influences, could lead 16to material financial, regulatory, and/or reputational impacts.17Our business profile is exposed primarily to the following non-financial risks: 18– Fiduciary obligations: As an asset manager, we face the risk that we do not comply with 19our fiduciary obligations to put the interests of our clients first. This requires us to balance 20between various interests of our clients and the economic interests of our firm to avoid 21undue conflicts, taking into consideration regulatory requirements, principles, contractual 22agreements, and specific disclosure requirements.23– Information security: We face the risk that our business is not sufficiently protected 24against information security failures, i. e., targeted cyber security attacks. The financial 25industry is subject to continuous elevated threat levels of cyber-attacks in the context of 26geo-political developments and technology advancements. Direct or indirect attacks may 27undermine our ability to act in a fiduciary capacity to serve our clients in a resilient way.28– Transformation: As our firm continues to mature as a standalone asset manager, we have 29elected to develop and implement a more standalone corporate infrastructure separate 30from our majority shareholder Deutsche Bank AG. Such decision poses both 31transformational risks as well as decreased time and resources for business-as-usual 32operations. Deviations in expected system and process functionality or inadequate 33integration of associated controls may expose the firm to incremental non-financial risks.34– Regulatory developments: The development of new and evolving regulatory requirements 35for the asset management industry, for instance on ESG requirements, IT disclosures or 36record retention, imposes a challenge for us for timely identification, interpretation and 37implementation. Non-compliance with laws and regulations may expose us to material non-38financial risks. 39– Service providers: Third parties support us to successfully deliver our business operations 40and fiduciary obligations. The use of and dependency on our vendors has increased in 41recent years. Inadequate vendor oversight may adversely impact our business resiliency.42Management of Non-Financial Risk43The management of non-financial risks follows the three lines of defence approach with the 44aim of protecting the Group, our clients, and shareholders against risk of material financial, 45regulatory, or reputational damages. It seeks to ensure that all our key non-financial risks are 46identified and addressed, that responsibilities regarding the management of non-financial 47risks are clearly assigned and risks are consciously taken and managed in the most 48appropriate and long-term interest of our franchise, clients and stakeholders. The three lines 49of defence approach and its underlying standards apply to all levels of the organization.50To manage our non-financial risks, the operational risk management framework defines 51interrelated concepts and processes aligned to the Deutsche Bank Group framework. The 52operational risk management framework provides a comprehensive approach across all three 53lines of defence for managing the key non-financial risks across the risk management 54lifecycle. The approach enables us to determine our non-financial risk profile in comparison to 55our risk appetite, to systematically identify non-financial risk themes and concentrations, and 56to define risk mitigating measures and priorities. The approach to identification and impact 57assessment aims to ensure that we mitigate the impact of these risks on our financial results, 58long-term strategic goals, and our reputation. Key concepts and processes for managing non-59financial risks are loss data collection, lessons learned, scenario analysis, sustainable risk 60remediation tracking, transformation risk assessments and risk and control assessments. In 61addition, consideration of ESG driven inherent risk exposure, assessment of mitigating 62controls, and ESG driven residual risk has been integrated in the risk and control assessment 63tool implementation.64The most material risks we seek to remediate qualify as top risks and are regularly analysed, 65monitored and reported to senior management. Top risks are rated in terms of both the 66likelihood of their occurrence and the potential impact (severity) on the Group. The concept 67provides a forward-looking perspective on the prioritization and anticipated impact of planned 68        69To our Shareholders Summarised 70Management Report71Consolidated 72Financial Statements Compensation Report Corporate Govern-73ance Statement74Supplementary 75Information DWS 2023 Annual Report76 77Risk Report7850 Non-Financial Risk