Capital One 2009 Annual Report Download - page 18

5
Risk Management and Control Framework
Capital One uses a consistent framework to manage risk. The framework applies at all levels, from the development of the Enterprise
Risk Management Program itself to the tactical operations of the front-line business team. The framework has six key elements:
1. Objective Setting;
2. Risk Assessment;
3. Control Activities;
4. Communication and Information;
5. Program Monitoring; and
6. Organization and Culture.
Objective Setting is at the beginning of our risk management approach. We set strategic, financial, operational, and other objectives
during our strategic and annual planning processes and throughout the year. These objectives cascade through the organization to
individual teams of associates.
Risk Assessment is the process of identifying risks to our objectives, evaluating the impact of those risks and choosing a response.
Responses include avoidance, mitigation, or acceptance. Risk responses are guided by our established risk appetite. In certain risk
categories, risk assessment is largely conducted by central risk groups or jointly between business areas and central groups (market,
liquidity, legal, credit, compliance). In other risk categories, risk assessment is primarily the responsibility of business areas with more
limited central support (strategic, operational, reputation).
Control Activities are the day-to-day backbone of our Enterprise Risk Management Program. Controls provide reasonable assurance
that financial accounting and reporting, legal, regulatory, and business requirements are met, and identified risks are being mitigated,
avoided, or accepted according to our risk appetite. We have practices in place to ensure key controls are established, evaluated, and
effective in preventing a breakdown. Control activities include the monitoring of adherence to current requirements, regular reporting
to management, and regular reviews and sign-offs. They also include the resolution of regulatory and audit findings and issues and the
procedures that trigger objective setting and risk assessments when new business opportunities are evaluated or business hierarchy
changes occur.
Communication and Information must provide a solid infrastructure to support the objective setting, risk assessment, and control
activities described above. We have established policies for each risk category which define the specific reports to be used and the
communication infrastructure. Robust risk management requires well-functioning communication channels to inform associates of
their responsibilities, alert them to issues or changes that might affect their activities, and to enable an open flow of information up,
down, and across the company.
Program Monitoring is critical to the Enterprise Risk Management Program itself because it assesses the accuracy, sufficiency, and
effectiveness of current objectives, risk assessments, controls, ownership, communication, and management support. Where
deficiencies are discovered, the Enterprise Risk Management Program must be updated to resolve the deficiencies in a timely manner.
Clear accountability must also be defined when resolving deficiencies to ensure the desired outcome is achieved. Risk management
programs are monitored at every level; from the overall Enterprise Risk Management Program to the individual risk management
activities in each business area.
Our Organization and Culture promote risk management as a key factor in making important business decisions. An effective risk
management culture starts with a well-defined risk management philosophy. It requires established risk management objectives that
align to business objectives and make targeted risk management activities part of ongoing business management activities.
We have a corporate Code of Business Conduct and Ethics (the “Code”) (available on the Corporate Governance page of our website
at www.capitalone.com/about) under which each associate is obligated to behave with integrity in dealing with customers and
business partners and to comply with applicable laws and regulations. We disclose any waivers to the Code on our website. We also
have an associate performance management process that emphasizes achieving business results while ensuring integrity, compliance,
and sound business management. Our risk management culture is also encouraged through frequent direction and communications
from the Board of Directors, senior leadership, corporate and departmental risk management policies, risk management and
compliance training programs and on-going risk assessment activities in the business areas.