Capital One 2014 Annual Report Download - page 105

Our risk framework, which is built around governance, processes and people, consists of the following eight key
elements:
Establish Governance Processes, Accountabilities and Risk Appetites
The “starting point” of our risk framework is the establishment of governance processes, accountabilities and risk
appetites. Our Board of Directors and senior management establish the tone at the top regarding the importance of
internal control, including standards of conduct and the integrity and ethical values of the Company. Management
reinforces the expectations at the various levels of the organization. This portion of the framework sets the foundation
for the methods that govern risk taking, the interactions within and among the lines of defense and the risk appetites
and tolerances.
Identify and Assess Risks and Ownership
Identifying and assessing risks and ownership is the beginning of the more detailed day-to-day process of managing
risk. This portion of the framework clarifies the importance of strong first-line management and accountability for
identifying and assessing risk while specifying the roles of the second line to identify and assess risk, particularly
when taking on new initiatives.
Develop and Operate Controls, Monitoring and Mitigation Plans
We develop, operate and monitor controls to manage risk within tolerance levels. The first line develops controls to
oversee and manage identified risks. Controls may prevent risks from occurring (e.g., ensuring compliance with a
law or regulation), discover when a risk has been realized, or measure the amount of risk being taken so that the
amount may be proactively managed. Whenever possible, plans are implemented to mitigate risks or reduce them
to lower levels to reduce exposure. The first line leads mitigation, control and monitoring actions. The second line
is a consultant on control design when needed.
Test and Detect Control Gaps and Perform Corrective Action
While the first line is principally accountable for taking, controlling and monitoring risk, the second line oversees
and monitors first line risk taking, including the effectiveness of first line controls, and the third line independently
tests first and second line controls. These activities provide the second and third lines of defense with the ability to
reduce the likelihood of unauthorized or unplanned risk taking within the organization. Identified control gaps are
closed by first line corrective action.
Escalate Key Risks and Gaps to Executive Management and, when Appropriate, the Board of Directors
Escalation is an important component of our overall risk framework. Use of escalation is encouraged and doesn’t
necessarily indicate a failure on the part of first, second or third line risk management. Through escalation in the
first line, decisions requiring judgment can be raised to executives who have the broadest possible context and
experience to make challenging choices. Escalation in the second and third lines of defense can also demonstrate
part of their core responsibilities of effective challenge. Risks are escalated to the Board of Directors to ensure their
alignment with material risk decisions and/or transparency to the largest risks facing the organization and to enable
Board of Directors engagement when needed.
Calculate and Allocate Capital in Alignment with Risk Management and Measurement Processes (including
Stress Testing)
Capital is held to protect the Company from unforeseen risks or unexpected risk severity. As such, it is important
that capital planning processes be well linked with risk management practices to ensure the appropriate capital
83 Capital One Financial Corporation (COF)