Capital One 2012 Annual Report Download - page 109

•Market Risk: Market risk is the risk that an institution’s earnings or the economic value of equity could be
adversely impacted by changes in interest rates, foreign exchange rates, or prices of other financial
instruments.
•Compliance Risk: Compliance risk is the risk of financial loss due to regulatory fines or penalties, restriction
or suspension of business activities or costs of mandatory corrective action incurred by not adhering to
applicable laws, regulations, principles and supervisory guidance, as well as our own internal standards
intended to adhere to these laws and regulations.
•Operational Risk: Operational risk is the risk of loss, capital impairment, adverse customer experience, or
reputation impact resulting from inadequate or failed internal process, people, and systems, or from external
events.
•Legal Risk: Legal risk represents the risk of material adverse impact due to new or changes in laws and
regulations; new interpretations of law; the drafting, interpretation and enforceability of contracts; adverse
decisions or consequences arising from litigation or regulatory scrutiny; the establishment, management and
governance of our legal entity structure; or the failure to seek or follow appropriate legal counsel when
needed.
•Reputation Risk: Reputation Risk is the risk to market value, recruitment and retention of talented associates
and maintenance of a loyal customer base due to the negative perceptions of our internal and external
stakeholders regarding our business strategies and activities.
•Strategic Risk: Strategic risk is the risk that results from adverse business decisions, ineffective or
inappropriate business plans, or failure to respond to changes in the competitive environment, business
cycles, customer preferences, product obsolescence, regulatory environment, business strategy execution,
and/or other inherent risks of the business.
We discuss below our overall risk management principles, roles and responsibilities, framework and risk
appetite. Following this section, we address in more detail the specific procedures, measures and analysis of the
major categories of risks that we manage.
Risk Management Principles
Our risk management framework is intended to identify, assess and mitigate risks that affect or have the potential
to affect our business. We target financial returns that compensate us for the amount of risk that we take and
avoid excessive risk-taking. Our risk management framework incorporates the “Three Lines of Defense” risk
management model to demonstrate and structure the roles, responsibilities and accountabilities in the
organization for taking and managing risk. Using the “Three Lines of Defense” model, we follow these central
guiding principles:
• The “First Line of Defense” is comprised of the business areas and staff groups that through their day-to-day
business activities take risk on our behalf. As the business owner, the first line is responsible for identifying,
assessing, managing and controlling that risk, and for mitigating our overall risk exposure.
• The “Second Line of Defense” provides oversight of first line risk taking and management, and is comprised
of our Risk Management organization and other staff control functions. The second line assists in
determining risk capacity, risk appetite, and the strategies, policies and structure for managing risks.
• The “Third Line of Defense” is comprised of our Internal Audit and Credit Review functions. The third line
provides independent and objective assurance to senior management and to the Board of Directors that first
and second line risk management and internal control systems and its governance processes are well-
designed and working as intended.
Our approach is reflected in six critical risk management practices of particular importance in the financial
services industry due to changing regulatory environments and ongoing economic uncertainty.
90