Capital One 2013 Annual Report Download - page 109

RISK MANAGEMENT
Risk Framework
We use a risk framework to manage risk. We execute against our risk management framework with the “Three
Lines of Defense” risk management model to demonstrate and structure the roles, responsibilities and
accountabilities in the organization for taking and managing risk. The “First Line of Defense” is comprised of the
business areas that through their day-to-day business activities take risk on our behalf. As the business owner, the
first line is responsible for identifying, assessing, managing and controlling that risk, and for mitigating our
overall risk exposure. The “Second Line of Defense” provides oversight of first line risk taking and management,
and is comprised of our Risk Management organization and other staff control functions. The second line assists
in determining risk capacity, risk appetite, and the strategies, policies and structure for managing risks. The
second line is both an ‘expert advisor’ to the first line and an ‘effective challenger’ of first line risk activities. The
“Third Line of Defense” is comprised of our Internal Audit and Credit Review functions. The third line provides
independent and objective assurance to senior management and to the Board of Directors that first and second
line risk management and internal control systems and its governance processes are well-designed and working
as intended. Our risk framework, which is built around governance, processes and people, consists of the
following eight key elements:
Establish governance processes, accountabilities, and risk appetites
The “starting point” of our risk framework is the establishment of governance processes, accountabilities and
appetites. Our Board of Directors and senior management establish the tone at the top regarding the importance
of internal control, including standards of conduct and the integrity and ethical values of the company.
Management reinforces the expectations at the various levels of the organization. This portion of the framework
sets the foundation for the methods that govern risk taking, the interactions within and among the lines of defense
and the risk appetites and tolerances.
Identify and assess risks and ownership
Identifying and assessing risks and ownership is the beginning of the more detailed day-to-day process of
managing risk. This portion of the framework clarifies the importance of strong first-line management and
accountability for identifying and assessing risk while specifying the roles of the second line to identify and
assess risk, particularly when taking on new initiatives.
Develop and operate controls, monitoring and mitigation plans
We develop, operate and monitor controls to manage risk within tolerance levels. The first line develops controls
to oversee and manage identified risks. Controls may prevent risks from occurring (e.g., ensuring compliance
with a law or regulation), discover when a risk has been realized, or measure the amount of risk being taken so
that the amount may be proactively managed. Whenever possible, plans are implemented to mitigate risks or
reduce them to lower levels to reduce exposure. The first line leads mitigation, control and monitoring actions.
The second line is a consultant on control design when needed.
Test and detect control gaps and perform corrective action
While the first line is principally accountable for taking, controlling and monitoring risk, the second line oversees
and monitors first line risk taking, including the effectiveness of first line controls, and the third line
independently tests first and second line controls. These activities provide the second and third lines of defense
with the ability to reduce the likelihood of unauthorized or unplanned risk taking within the organization.
Identified control gaps are closed by first line corrective action.
89