Capital One 2011 Annual Report Download - page 110

comply with applicable laws, regulations, principles or other supervisory guidance requirements, or our own
internal code of conduct and policies intended to ensure compliance with applicable laws and regulations.
•Operational Risk: Operational risk is the risk of loss, adverse customer experience, or negative regulatory or
reputation impact resulting from inadequate or failed internal process, human factors, systems, or from
external events.
•Legal Risk: Legal risk represents the risk of material adverse impact due to new or changes in laws and
regulations; new interpretations of law; the drafting, interpretation and enforceability of contracts; adverse
decisions or consequences arising from litigation or regulatory scrutiny; the establishment, management and
governance of our legal entity structure; or the failure to seek or follow appropriate legal counsel when
needed.
•Reputational Risk: Reputational risk is the risk that negative publicity, whether true or not, could adversely
affect our market value, profitability, customer base, funding sources or operations or result in costly
litigation.
•Strategic Risk: Strategic risk is the risk that results from adverse business decisions, ineffective or
inappropriate business plans, or failure to respond to changes in the competitive environment, business
cycles, customer preferences, product obsolescence, regulatory environment, business strategy execution,
and/or other inherent risks of the business.
We discuss below our overall risk management principles, roles and responsibilities, framework and risk
appetite. Following this section, we address in more detail the specific procedures, measures and analysis of the
major categories of risks that we manage.
Risk Management Principles
Our risk management framework is intended to identify, assess and mitigate risks that affect or have the potential
to affect our business. We target financial returns that compensate us for the amount of risk that we take and
avoid excessive risk-taking. Our risk management framework consists of five key risk management principles:
(1) Individual businesses take and manage risk within established tolerance levels in pursuit of strategic,
financial and other business objectives.
(2) Independent risk management organizations support individual businesses by providing risk management
tools and policies and by aggregating risks; in some cases, risks are managed centrally.
(3) The Board of Directors and senior management review our aggregate risk position, establish the risk
appetite and work with management to ensure conformance to policy and adherence to our adopted
mitigation strategy.
(4) We employ a top risk identification system to maintain the appropriate focus on the risks and issues that
may have the most impact and to identify emerging risks of consequence.
(5) Independent assurance functions, such as our Internal Audit and Credit Review teams, assess the
governance framework and test transactions, business processes and procedures to provide assurance as to
whether our risk programs are operating as intended.
Our approach is reflected in five critical risk management practices of particular importance in the financial
services industry due to changing regulatory environments and ongoing economic uncertainty.
First, we seek to mitigate liquidity risk strategically and tactically. From a strategic perspective, we have
acquired and built deposit gathering businesses and significantly reduced our loan to deposit ratio. From a
tactical perspective, we have accumulated a very large liquidity reserve comprising cash, high-quality,
unencumbered securities, and committed collateralized credit lines and conduit facilities.
Second, we recognize that we are exposed to cyclical changes in credit quality. Consequently, we try to ensure
our credit portfolio is resilient to economic downturns. Our most important tool in this endeavor is sound
90