Capital One 2010 Annual Report Download - page 88

68
Finally, we recognize that maintaining a strong capital position is essential to our business strategy and competitive position. While
capital is not a risk unto itself, understanding and managing risks to our capital position is an underlying objective of all our risk
programs. Stress testing and economic capital measurement, both of which incorporate inputs from across the risk spectrum, are key
tools for evaluating our capital position and risk adjusted returns. We also consider risks to our reputation and to our ability to access
capital markets as part of our process for evaluating our capital plans. See “MD&A—Liquidity and Capital Management” for
additional information on our capital adequacy and strength.
Risk Management Roles and Responsibilities
The Board of Directors is responsible for establishing our overall risk framework; approving and overseeing execution of the
Enterprise Risk Management Policy and key risk category policies; establishing our risk appetite; and regularly reviewing our risk
profile.
The Chief Risk Officer, who reports to the CEO, is responsible for overseeing our risk management program and driving appropriate
action to resolve any weaknesses. The risk management program begins with a set of policies and risk appetites approved by the
Board that are implemented through a system of risk committees and senior executive risk stewards. We have established risk
committees at both the corporate and divisional level to identify and manage risk. In addition, we have assigned a senior executive
expert to each of eight risk categories (the risk stewards). These executive risk stewards work with the Chief Risk Officer and the risk
committees to ensure that risks are identified and given appropriate priority and attention. The Chief Risk Officer aggregates the
results of these processes to assemble a view of our risk profile. Both management and the Board regularly review the risk profile.
Risk Management and Control Framework
We use a consistent framework to manage risk. The framework applies at all levels, from the development of the Enterprise Risk
Management Program itself to the tactical operations of the front-line business team. The framework has six key elements:
• Objective Setting;
• Risk Assessment;
• Control Activities;
• Communication and Information;
• Program Monitoring; and
• Organization and Culture.
Objective Setting is at the beginning of our risk management approach. We set strategic, financial, operational, and other objectives
during our strategic and annual planning processes and throughout the year. These objectives cascade through the organization to
individual teams of associates. The risk management approach helps identify and manage risks that have the potential to interfere with
the achievement of our stated objectives.
Risk Assessment is the process of identifying risks to our objectives, evaluating the impact of those risks and choosing and executing
on a response. Responses include avoidance, mitigation, or acceptance. Generally, risk responses are guided by our established risk
appetite. For certain risk categories, risk assessment is largely conducted by central risk groups or jointly between business areas and
central groups (market, liquidity, legal, credit, compliance). In other risk categories, risk assessment is primarily the responsibility of
business areas with more limited central support (strategic, operational, reputation).
Control Activities are the day-to-day backbone of risk management. Controls provide reasonable assurance that legal, regulatory, and
business requirements are being met, and identified risks are being mitigated, avoided, or accepted according to our risk response
choices and risk appetite. We have practices in place designed to ensure key controls are established, evaluated, and effective in
preventing a breakdown. Control activities include the monitoring of adherence to current policy and procedure requirements, sign-
offs, and regular reporting to management. They also include the resolution of regulatory and audit findings and issues and the
procedures that trigger objective setting and risk assessments when new business opportunities are evaluated or business hierarchy
changes occur.