Nordea Eiendomskreditt AS
Annual Report 2024
54
6.10 Information Security Management
The objective of Information and Communication
Technology
Risk Management is to ensure that information
and communication technology and data management
risks are appropriately identified, assessed and managed.
The Nordea Group maintains an Information Security
Management System for implementation of the principles
and requirements for information security, with the overall
objective to preserve the confidentiality, integrity and
availability of Nordea’s information and information
entrusted to Nordea and Nordea Eiendomskreditt, by
applying a risk-based methodology.
6.11 Cyber security
Introducing new technologies, exploring new ways of doing
business and connecting with customers widen bank’s
attack surface. At the same time, entities that pose cyber
threats are becoming more organised, resourceful and
experienced. Nordea focuses not only on maintaining
effective basic information security controls but also on
enhancing its cyber defence with new tools and functions
for security, detection and response. Nordea develops
innovative security practices to meet new business
demands, such as robust mobile applications and proactive
customer support for fraud detection and prevention.
6.12 Significant/Key Operating Processes (SiOPs)
The objective of the SiOPs framework is to identify and
document SiOPs to ensure risks and controls in the most
important processes are assessed and managed, for these
processes to operate as intended, which includes ensuring
Nordea Eiendomskreditt’s customers are offered products
and services in a compliant, safe and timely way.
The objective of Reputational Risk Management is to
protect the Nordea Group’s and Nordea Eiendomskreditt’s
reputation. Reputational risk is defined as the risk of
damage to the trust in the Nordea brand from our
customers, employees, authorities, investors, partners and
the general public with the potential for adverse financial
impact. Reputational risk is often an impact from, or a
cause of, other types of risks, e.g. credit, liquidity, market,
operational, compliance and legal risks inherent in the
business. A reputational risk framework with guiding
principles for managing reputational risk has been
developed. The framework is strongly linked with the risk
management framework and related processes for
identifying, assessing and mitigating risk. It includes
considering stakeholders’ perceptions in the decision-
making processes.
6.14 Minimum own funds requirement for operational
risk
Nordea Eiendomskreditt’s own funds requirements for
operational risk are calculated according to the
standardised approach. In this approach, the institution’s
activities are divided into eight standardised business lines
and the gross income-based indicator for each business
line is multiplied by a predefined beta coefficient. The
consolidated own funds requirement for operational risk is
calculated as the average of the last three years’ own funds
requirement.
7. Compliance risk
Nordea defines compliance risk as the risk of failure to
comply with applicable regulations and related internal
rules. Management of compliance risk is governed by
Nordea’s Compliance Risk Appetite Statement which also
sets out the requirements for the mitigation of compliance
risk. Employees throughout Nordea are accountable for the
compliance risks related to their mandate and for managing
these risks in accordance with the Compliance Risk
Management Framework. The key governance principle for
management of risks at Nordea is the three Lines of
Defence (“LoD”) model.
1LoD is represented by the staff in Nordea Eiendomskreditt
performing business activities as well as staff in the Nordea
Group operating under intra-group agreement on account
of Nordea Eiendomskreditt. All employees in the 1LoD
have a role of understanding and adhering to prudent risk
management and are accountable for managing
compliance risks as part of performing their tasks. All
managers are fully responsible for the risks they assume
and are accountable for ensuring compliance with
applicable regulations within their respective area of
responsibility. Hence, they are responsible for ensuring that
the appropriate organisation, governance, controls,
procedures and support systems are implemented to
ensure a sufficient system of internal controls.
Group Risk (GR) and Group Compliance (GC) represent
Nordea’s independent second line of defence (2LoD)
control function. GR & GC oversee the implementation of
the financial and the non-financial risk policies and
according to a risk-based approach, monitor and control
the Risk Management Framework including the
Compliance Risk Management Framework and oversee
that all risks that Nordea is or could be exposed to, are
identified, assessed, monitored, managed and reported on.
GR is organized in divisions with individual risk type
responsibility. The following divisions are part of GR; Group
Credit Risk Control, Model Risk & Validation, Group
Financial Risk Management & Control, Group Operational
Risk, Risk Models, Chief Security Office, Enterprise-wide
Risk Management and Recovery & Resolution Planning,
CRO Office and Country CROs.
Group Compliance (GC) constitutes the compliance
function for Nordea Eiendomskreditt according to intra-
group agreement and is responsible for developing and
maintaining the risk management framework for managing
compliance risks in cooperation with other functions in GR
and for guiding the business in their implementation of the
framework to ensure continuous adherence to the
framework. GC is responsible for regular reporting on
annual compliance plan to NE Board and NE CEO at least
quarterly. GC reports on the status and development of
Nordea Eiendomskreditt’s compliance risks including
information on major deficiencies along with consequence
analyses and emerging risks and trends; status and key
observations from monitoring activities and investigations;
general updates on Financial Supervisory Authority
interactions and impact; and preparations on regulatory
changes. The reports shall also contain recommendations
on actions to be undertaken to mitigate compliance risk.
Group Internal Audit (GIA) represents the 3LoD according
to intra-group agreement. GIA conducts risk based and
general audits and shall assess whether the internal control
framework is both effective and efficient, including
assessing whether existing policies and procedures and
Group internal Rules remain adequate and comply with
legal and regulatory requirements, and with the risk
appetite and strategy of Nordea. GIA is also in charge of
the independent review of 1LoD and 2LoD including
ensuring that the segregation of duties is