Capital One 2011 Annual Report Download - page 115

We ensure compliance by maintaining an effective Compliance Management Program consisting of sound
policies, systems, processes, and reports. The Compliance Management Program provides management with
guidance, training, and monitoring to provide reasonable assurance of our compliance with internal and external
compliance requirements. Additionally, management and the Corporate Compliance department jointly and
separately conduct on-going monitoring and assess the state of compliance. The assessment provides the basis for
performance reporting to management and the Board, allows business areas to determine if their compliance
performance is acceptable, and confirms effective compliance controls are in place. Business areas embed
compliance requirements and controls into their business policies, standards, processes and procedures. They
regularly monitor and report on the efficacy of their compliance controls. Corporate Compliance, working jointly
with the business, defines and validates a standard compliance monitoring and reporting methodology.
Compliance results and trends are reported to management’s Risk Management Committee and the Audit and
Risk Committee of the Board.
Operational Risk Management
The Chief Operational Risk Officer is responsible for the establishment of risk management standards and for
governance and monitoring of operational risk at a corporate level. Division Presidents are responsible for
managing operational risk within their business areas.
While most operational risks are managed and controlled by business areas, the Operational Risk Management
Program establishes requirements and control processes that assure certain consistent practices in the
management of operational risk and provides transparency to the corporate operational risk profile. Our
Operational Risk Management Program also includes two primary additional functions. Operational Risk
Reporting involves independent assessments of the control and sustainability of key business processes at a
corporate and business area level, and such assessments are provided to the Chief Risk Officer, management’s
Risk Management Committee and the Audit and Risk Committee of the Board.
Operational risk results and trends are reported to the Risk Management Committee and the Audit and Risk
Committee of the Board.
Legal Risk Management
The General Counsel is responsible for managing legal risk by providing legal evaluation and guidance to the
enterprise and business areas. This evaluation and guidance is based on an assessment of the type and degree of
legal risk associated with the internal business area practices and activities and of the controls the business has in
place to mitigate legal risks. Legal risk is governed by and defined in our Legal Risk Policy.
Reputational Risk Management
The General Counsel is responsible for managing our overall reputational risk. Reputational risks associated with
daily interactions are managed by our business areas. Business area activities are controlled by the frameworks
set forth in the Reputational Risk Management Policy and other risk management policies. Each business area
determines how much risk it is willing to accept and when it is prudent to execute mitigation activities. From
time to time, senior management conducts detailed assessments of our business practices and evaluates them in
terms of their potential impact on Capital One’s reputation. The Reputational Risk Management Policy sets forth
the obligation of each business area, with direction and guidance from the Reputational Risk Steward and his or
her designee to identify, assess and determine whether and how best to mitigate its reputation risk. The
Reputational Risk Steward is responsible for reporting on the assessments of our aggregate reputation risk, as
well as the state of our reputation with specific stakeholder groups, to the Chief Risk Officer, the Chief Executive
Officer, the Risk Management Committee and the Audit and Risk Committee of the Board of Directors, as
appropriate.
95