Capital One 2013 Annual Report Download - page 110

Escalate key risks and gaps to executive management, and when appropriate the Board of Directors
Escalation is an important component of our overall Risk Framework. Use of escalation is encouraged and
doesn’t necessarily indicate a failure on the part of first, second or third line risk management. Through
escalation in the first line, decisions requiring judgment can be raised to executives who have the broadest
possible context and experience to make challenging choices. Escalation in the second and third lines of defense
can also demonstrate part of their core responsibilities of effective challenge. Risks are escalated to the Board of
Directors to ensure alignment with high risk decisions and/or transparency to the largest risks facing the
organization and to enable Board of Directors engagement when needed.
Calculate and allocate capital in alignment with risk management and measurement processes (including
stress testing)
Capital is held to protect the company from unforeseen risks or unexpected risk severity. As such, it is important
that capital planning processes be well linked with risk management practices to ensure the appropriate capital
protections are in place for the safety and soundness of the company. Stress testing and economic capital
measurement, both of which incorporate inputs from across the risk spectrum, are key tools for evaluating our
capital position and risk adjusted returns.
Support with the right culture, talent and skills
The right culture, talent and skills are critical to effective risk management. The activities and actions specified in
our Risk Framework are supported with the right culture to ensure that both the spirit and the letter of the risk
management action are pursued. Skills necessary to effectively manage risk are reinforced through performance
management systems. When needed, risk talent is augmented through recruitment of industry experts as well as
training and development of internal associates.
Enabled by the right data, infrastructure and systems
Data, infrastructure and programs are key enablers of our overall risk management processes and practices.
These core requirements enable effective risk modeling, efficient first, second and third line risk activity
performance and cross-line interaction. In addition, effective program design of each risk category is regularly
assessed to ensure risk practices continue to evolve with leading industry practice and continue to interact across
categories as desired for a strong overall risk management program.
Risk Appetite
Risk appetite refers to the level of risk our business is willing to take in pursuit of our corporate business
objectives.The Board of Directors approves our risk appetite including specific risk limits where applicable.
While first line executives manage risk on a day-to-day basis, the Chief Risk Officer provides effective challenge
and independent oversight to ensure that risks are within the appetite and specific limits established by the Board
of Directors. The Chief Risk Officer reports to the Board of Directors regularly on the nature and level of risk
across all eight risk categories. In addition to his broader management responsibilities, our Chief Executive
Officer is responsible for developing the strategy and mission of our organization, determining and leading our
culture, and reviewing and providing input into our risk appetite.
We have a defined Enterprise Risk Appetite Statement, which governs and embraces the overall tenets of our risk
management culture. The Enterprise Risk Appetite Statement sets the tone for how our Board of Directors and
our company approach risk, supports our mission, values, and strategic imperatives
We have a defined risk appetite for each of our eight risk categories that is approved by our Board of Directors.
Stated risk appetites define the parameters for taking and accepting risks and are used by management and our
90