Capital One 2008 Annual Report Download - page 25

7
Control Activities are the day-to-day backbone of our Enterprise Risk Management Program. Controls provide reasonable assurance
that legal, regulatory, and business requirements are met, and identified risks are being mitigated, avoided, or accepted according to
our risk appetite. We have practices in place to ensure key controls are established, evaluated, and effective in preventing a
breakdown. Control activities include the monitoring of adherence to current requirements, regular reporting to management, and
regular reviews and sign-offs. They also include the resolution of regulatory and audit findings and issues and the procedures that
trigger objective setting and risk assessments when new business opportunities are evaluated or business hierarchy changes occur.
Communication and Information must provide a solid infrastructure to support the objective setting, risk assessment, and control
activities described above. We have established policies for each risk category which define the specific reports to be used and the
communication infrastructure. Robust risk management requires well-functioning communication channels to inform associates of
their responsibilities, alert them to issues or changes that might affect their activities, and to enable an open flow of information up,
down, and across the company.
Program Monitoring is critical to the Enterprise Risk Management Program itself because it assesses the accuracy, sufficiency, and
effectiveness of current objectives, risk assessments, controls, ownership, communication, and management support. Where
deficiencies are discovered, the Enterprise Risk Management Program must be updated to resolve the deficiencies in a timely manner.
Clear accountability must also be defined when resolving deficiencies to ensure the desired outcome is achieved. Risk management
programs are monitored at every level; from the overall Enterprise Risk Management Program to the individual risk management
activities in each business area.
Our Organization and Culture promote risk management as a key factor in making important business decisions. An effective risk
management culture starts with a well-defined risk management philosophy. It requires established risk management objectives that
align to business objectives and make targeted risk management activities part of ongoing business management activities.
We have a corporate Code of Business Conduct and Ethics (the Code) (available on the Corporate Governance page of our website
at www.capitalone.com/about) under which each associate is obligated to behave with integrity in dealing with customers and
business partners and to comply with applicable laws and regulations. We disclose any waivers to the Code on our website. Currently,
there are no waivers. We also have an associate performance management process that emphasizes achieving business results while
ensuring integrity, compliance, and sound business management. Our risk management culture is also encouraged through frequent
direction and communications from the Board of Directors, senior leadership, corporate and departmental risk management policies,
risk management and compliance training programs and on-going risk assessment activities in the business areas.
Risk Appetite
Capital One organizes its Enterprise Risk Management Program around eight risk categories. The risk categories enable us to
efficiently aggregate risks, provide a mechanism to discuss risk appetite, and facilitate the assignment of expert risk resources to
support our business activities. While we customize specific risk objectives and control methodologies to each risk category, they
share, at the highest level, a common approach to describing and measuring risk appetite.
Risk appetites are approved by the Board of Directors and are used both to monitor the companys evolving risk position and to guide
strategic and tactical decision making. The risk appetite framework assesses each risk category across the following three dimensions:
1. Net Risk: Assessment of the level of risk given internal and external factors;
2. Quality of Governance and Controls: Evidence demonstrating the strength (or weakness) of our risk governance structure
and/or controls associated with the risk category and our ability to address issues; and
3. Mitigation Plan Status: When needed, the status of key mitigation activity needed to reduce risk.
Risk Categories
Capital Ones risk management program is organized around eight risk categories. They are:
1. Liquidity
2. Credit
3. Reputation
4. Market
5. Strategic
6. Operational
7. Compliance
8. Legal