Capital One 2010 Annual Report Download - page 89

69
Communication and Information infrastructures must be solid and are necessary to support the objective setting, risk assessment, and
control activities described above. Specific reports and communication infrastructure are defined within our individual risk category
policies. Our risk governance structure is designed to support solid and ongoing communication. Robust risk management requires
well-functioning communication channels to inform associates of their responsibilities, alert them to issues or changes that might
affect their activities, and to enable an open flow of information up, down, and across our company. Robust risk management also
requires management information to enable controls to work effectively and to support the analysis needed to set objectives and assess
risk accurately.
Program Monitoring is critical to our risk management program overall. Program monitoring assesses the accuracy, sufficiency, and
effectiveness of current objectives, risk assessments, controls, ownership, communication, and management support. The assessment
of a risk program or activity can be qualitative or quantitative. We encourage the use of measurement and metrics, where it is possible
and recognizing that some risks or programs cannot be measured quantitatively. Where deficiencies are discovered, we seek to update
the risk management program to resolve the deficiencies in a timely manner. Significant deficiencies are escalated to the appropriate
risk executive or risk committee. Clear accountability is defined when resolving deficiencies to ensure the desired outcome is
achieved. Risk management programs are monitored at every level; from the overall Enterprise Risk Management Program to the
individual risk management activities in each business area.
Organization and Culture is intended to create and maintain an effective risk management organization and culture. A strong
organization and culture promotes risk management as a key factor in making important business decisions and helps drive risk
management activities deeper into the company. An effective risk management culture starts with a well-defined risk management
philosophy. It requires established risk management objectives that align to business objectives and make targeted risk management
activities part of ongoing business management activities. We believe we staff risk functions at the appropriate levels with qualified
associates and effective tools that support risk management practices and activities. Senior management and the Board of Directors are
ultimately accountable for promoting adherence to sound risk principles and tolerances. We seek to incent associates at all levels to
perform according to corporate policies and risk tolerance and in conformity with applicable laws and regulations. Additionally,
management tries to ensure that performance goals, plans, and incentives are designed to promote financial performance within the
confines of a sound risk management program and within defined risk tolerances.
We have a corporate Code of Business Conduct and Ethics (the “Code”) (available on the Corporate Governance page of our website
at www.capitalone.com/about) under which each associate is obligated to behave with integrity in dealing with customers and
business partners and to comply with applicable laws and regulations. We disclose any waivers to the Code on our website. We also
have an associate performance management process that emphasizes achieving business results while ensuring integrity, compliance,
and sound business management.
Risk Appetite
We have a defined risk appetite for each of our eight risk categories that is approved by the Board of Directors. Each risk category has
its own risk appetite statement. Stated risk appetites, and the assessment framework that support them, define the guardrails for taking
and accepting risks and are used by senior management and the Board to make business decisions.
The risk appetite framework assesses each risk category across three dimensions, using consistent, comprehensive, and understandable
measures. The three dimensions are:
• Net Risk: Assessment of the level of risk given internal and external factors
• Quality of Governance and Controls: Evidence demonstrating the strength (or weakness) of our risk governance structure
and/or controls associated with the risk category and our ability to address issues
• Mitigation Plan Status: When needed, the status of our key mitigation activity needed to reduce risk
All three framework dimensions are assessed and measured using a five-point scale. The assessment language in each scale is
customized by each risk steward to reflect the tolerance levels of each of the eight risk categories.
Risk Categories
Our risk management program is organized around eight risk categories. They are: