Capital One 2012 Annual Report Download - page 111

lines of business, the Chief Risk Officer and the risk committees to identify, aggregate and report risks, develop
mitigation plans and controls and remediate issues. The Chief Risk Officer combines the results of these
processes to assemble a view of our risk profile. Both management and the Board of Directors regularly review
the risk profile.
Risk Management Framework
We use a consistent risk management framework to manage risk. This framework applies at all levels, from the
development of the Enterprise Risk Management Program itself to the tactical operations of the front-line
business team. We are continuing to make changes to our risk management framework as we enhance our
enterprise-wide compliance risk management programs, including further expanding the “Three Lines of
Defense” model referenced under the “Risk Management Principles” set forth above. Our risk management
framework, which is built around governance, processes and people, currently consists of the following six key
elements:
• Objective Setting
• Risk Assessment
• Control Activities
• Communication and Information
• Program Monitoring
• Organization and Culture
Objective Setting
Our risk management approach begins with objective setting. We establish strategic, financial, operational and
other objectives during our strategic and annual planning processes and throughout the year. These objectives
cascade through the organization to individual teams of associates. The risk management approach helps identify
and manage risks that have the potential to interfere with the achievement of our stated objectives.
Risk Assessment
Risk results from our strategic business choices and our day-to-day business activities. Risk assessment is the
process of identifying our risks (including emerging and potential risks), evaluating the impact of those risks and
choosing and executing a response that is guided by our risk appetite. Risk assessment also includes the
correlation of risks and the assessment of their cumulative effect on the overall risk profile of a line of business
or of the enterprise.
Control Activities
We consider our control activities to be the day-to-day backbone of our risk management. Controls provide
reasonable assurance that legal, regulatory, and business requirements are being met, and identified risks are
being mitigated or accepted according to our risk response choices and risk appetite. We have practices in place
designed to establish key controls and assess their effectiveness in preventing a breakdown. Control activities
include the monitoring of adherence to current policy, process and procedure requirements, sign-offs, and regular
reporting to management. They also include the resolution of regulatory and audit findings and issues and the
procedures that trigger objective setting and risk assessments when new business opportunities are evaluated or
business hierarchy changes occur.
Communication and Information
Communication and information infrastructures must be solid and are necessary to support the objective setting,
risk assessment, and control activities described above. Robust risk management requires well-functioning
92