Capital One 2012 Annual Report Download - page 112

communication channels to inform associates of their responsibilities, alert them to issues or changes that might
affect their activities, and to enable an open flow of information up, down, and across our company. Robust risk
management also requires management information to enable controls to work effectively and to support the
analysis needed to set objectives and assess risk accurately. Our risk governance structure is designed to support
solid and ongoing communication. Specific reports and communication infrastructure are defined within our
individual risk category policies.
Program Monitoring
Program monitoring is critical to our overall risk management program. Program monitoring involves assessing
the accuracy, sufficiency, and effectiveness of current objectives, risk assessments, controls, ownership,
communication, and management support. The assessment of a risk program or activity can be qualitative or
quantitative. We encourage the use of measurements and metrics where it is possible, recognizing that some risks
or programs cannot be measured quantitatively. Where deficiencies are discovered, we seek to update the risk
management program to resolve the deficiencies in a timely manner. Significant deficiencies are escalated to the
appropriate risk executive or risk committee. Clear accountability is defined when resolving deficiencies so that
the desired outcome is achieved. Risk management programs are monitored at every level from the overall
Enterprise Risk Management Program to the individual risk management activities in each business area.
Organization and Culture
Our intent is to create and maintain an effective risk management organization and culture. A strong organization
and culture promotes risk management as a key factor in making important business decisions and helps drive
risk management activities deeper into the company. An effective risk management culture starts with a well-
defined risk management philosophy. It requires established risk management objectives that align to business
objectives and make targeted risk management activities part of ongoing business management activities. We
believe we staff risk functions at the appropriate levels with qualified associates and effective tools that support
risk management practices and activities. Senior management and the Board of Directors are ultimately
accountable for promoting adherence to sound risk principles and tolerances. We seek to incent associates at all
levels to perform according to corporate policies and risk tolerance and in conformity with applicable laws and
regulations. Additionally, management establishes performance goals, plans, and incentives that are designed to
promote financial performance within the confines of a sound risk management program and within defined risk
tolerances.
We have a corporate Code of Business Conduct and Ethics (the “Code”) (available on the Corporate Governance
page of our Web site at www.capitalone.com/about) under which each associate is obligated to behave with
integrity in dealing with customers and business partners and to comply with applicable laws and regulations. We
disclose any waivers to the Code on our Web site. We also have an associate performance management process
that emphasizes achieving business results while ensuring integrity, compliance, and sound business
management.
Risk Appetite
We have a defined risk appetite for each of our eight risk categories that is approved by the Board of Directors.
Stated risk appetites define the parameters for taking and accepting risks and are used by management and the
Board of Directors to make business decisions.
For some risk categories (credit, liquidity, market), our risk appetite statements are translated into largely
quantitative limits and guidelines. For other risk categories, our risk appetite is defined more qualitatively and is
supported by indicative metrics where appropriate. We communicate risk appetite statements, metrics and limits
to the appropriate levels in the organization and monitor adherence.
93