Capital One 2012 Annual Report Download - page 114

to the Finance and Trust Oversight Committee of the Board no less than quarterly. Management is authorized to
utilize financial instruments as outlined in our policy to actively manage market risk exposure. Detailed
processes, requirements and controls are contained in our policies and supporting procedures.
Compliance Risk Management
The Chief Compliance Officer is responsible for establishing the compliance management program, for
determining specific compliance requirements, and for monitoring performance. Division Presidents are
responsible for building and maintaining business processes and controls that meet the requirements of the
compliance program.
We ensure compliance by maintaining an effective Compliance Management Program consisting of sound
policies, systems, processes, and reports. The Compliance Management Program provides management with
guidance, training, and monitoring to provide reasonable assurance of our compliance with internal and external
compliance requirements. Additionally, management and the Corporate Compliance department jointly and
separately conduct on-going monitoring and assess the state of compliance. The assessment provides the basis for
performance reporting to management and the Board, allows business areas to determine if their compliance
performance is acceptable, and confirms effective compliance controls are in place. Business areas embed
compliance requirements and controls into their business policies, standards, processes and procedures. They
regularly monitor and report on the efficacy of their compliance controls. Corporate Compliance, working jointly
with the business, defines and validates a standard compliance monitoring and reporting methodology.
Compliance results and trends are reported to management’s Risk Management Committee and the Audit and
Risk Committee of the Board.
Operational Risk Management
The Chief Operational Risk Officer is responsible for the establishment of operational risk management policies
and standards and for governance and monitoring of operational risk at a corporate level. Division Presidents are
responsible for managing operational risk within their business areas.
Business areas are accountable for the management of operational risk controls and mitigation of risk. The
Operational Risk Management Program establishes requirements and control processes that assure certain
consistent practices in the management of operational risk and provides transparency to the corporate operational
risk profile. Operational risk practices are currently being aligned with Basel II AMA (“Advanced Measurement
Approach”) requirements.
The Operational Risk Management (“ORM”) function plays an active role in monitoring adherence to our
operational risk policies and standards as well as in the validation of our operational risk levels, as expressed
against our appetite. Key activities performed by ORM include the collection of operational breakdowns; the
identification, analysis and escalation of risks and/or issues, and the regular reporting of risk levels to senior
management and the Board.
Legal Risk Management
The General Counsel is responsible for managing legal risk by providing legal evaluation and guidance to the
enterprise and business areas and by partnering with other risk-related functions such as Compliance and Audit.
This evaluation and guidance is based on an assessment of the type and degree of legal risk associated with the
internal business area practices and activities and of the controls the business has in place to mitigate legal risks.
Legal risk is governed by and defined in our Legal Risk Policy.
95