Capital One 2011 Annual Report Download - page 112

• Objective Setting
• Risk Assessment
• Control Activities
• Communication and Information
• Program Monitoring
• Organization and Culture
Objective Setting
Our risk management approach begins with objective setting. We establish strategic, financial, operational and
other objectives during our strategic and annual planning processes and throughout the year. These objectives
cascade through the organization to individual teams of associates. The risk management approach helps identify
and manage risks that have the potential to interfere with the achievement of our stated objectives.
Risk Assessment
Risk assessment is the process of identifying risks to our objectives, evaluating the impact of those risks and
choosing and executing on a response. Our risk responses include risk avoidance, mitigation or acceptance.
Generally, our risk responses are guided by our established risk appetite. For certain risk categories (legal,
compliance, liquidity, credit and market risks), risk assessment is largely conducted by central risk groups or
jointly between business areas and central groups. For other risk categories (strategic, reputational and
operational risks), risk assessment is primarily the responsibility of business areas with less central support.
Control Activities
We consider our control activities to be the day-to-day backbone of our risk management. Controls provide
reasonable assurance that legal, regulatory, and business requirements are being met, and identified risks are
being mitigated, avoided, or accepted according to our risk response choices and risk appetite. We have practices
in place designed to establish key controls and assess their effective in preventing a breakdown. Control activities
include the monitoring of adherence to current policy and procedure requirements, sign-offs, and regular
reporting to management. They also include the resolution of regulatory and audit findings and issues and the
procedures that trigger objective setting and risk assessments when new business opportunities are evaluated or
business hierarchy changes occur.
Communication and Information
Communication and information infrastructures must be solid and are necessary to support the objective setting,
risk assessment, and control activities described above. Robust risk management requires well-functioning
communication channels to inform associates of their responsibilities, alert them to issues or changes that might
affect their activities, and to enable an open flow of information up, down, and across our company. Robust risk
management also requires management information to enable controls to work effectively and to support the
analysis needed to set objectives and assess risk accurately. Our risk governance structure is designed to support
solid and ongoing communication. Specific reports and communication infrastructure are defined within our
individual risk category policies.
Program Monitoring
Program monitoring is critical to our overall risk management program. Program monitoring involves assessing
the accuracy, sufficiency, and effectiveness of current objectives, risk assessments, controls, ownership,
communication, and management support. The assessment of a risk program or activity can be qualitative or
quantitative. We encourage the use of measurements and metrics where it is possible, recognizing that some risks
92