Capital One 2015 Annual Report Download - page 90

71 Capital One Financial Corporation (COF)
functions. The third line provides independent and objective assurance to senior management and to the Board of Directors that
first and second line risk management and internal control systems and its governance processes are well-designed and working
as intended.
Our risk framework, which is built around governance, processes and people, consists of the following eight key elements:
Establish Governance Processes, Accountabilities, and Risk Appetites
The starting point of our risk framework is the establishment of governance processes, accountabilities, and risk appetites. Our
Board of Directors and senior management establish the tone at the top regarding the importance of internal control, including
standards of conduct and the integrity and ethical values of the Company. Management reinforces expectations at the various levels
of the organization. This portion of the framework sets the foundation for the methods for governing risk taking, the interactions
within and among the lines of defense, and the risk appetites and tolerances.
Identify and Assess Risks and Ownership
Identifying and assessing risks and ownership is the beginning of the more detailed day-to-day process of managing risk. This
portion of the framework clarifies the importance of strong first-line management and accountability for identifying and assessing
risk while specifying the role of the second line to identify and assess risk, particularly when taking on new initiatives.
Develop and Operate Controls, Monitoring and Mitigation Plans
We develop, operate, and monitor controls to manage risk within tolerance levels. The first line develops controls to oversee and
manage identified risks. Controls may prevent risks from occurring (e.g., ensuring compliance with a law or regulation) or measure
the amount of risk being taken so that the amount may be proactively managed. Whenever possible, plans are implemented to
mitigate risks or reduce them in order to reduce exposure. The first line leads mitigation, control, and monitoring actions. The
second line is a consultant on control design when needed.
Test and Detect Control Gaps and Perform Corrective Action
While the first line is principally accountable for taking, controlling, and monitoring risk, the second line oversees and monitors
first line risk taking, including the effectiveness of first line controls, and the third line independently tests and oversees first and
second line risk taking. These activities provide the second and third lines of defense with the ability to reduce the likelihood of
unauthorized or unplanned risk taking within the organization. Control gaps are closed by first line corrective action.
Escalate Key Risks and Gaps to Executive Management and when appropriate, the Board of Directors
Escalation is an important component of our risk framework. Use of escalation is encouraged and does not necessarily indicate a
failure on the part of first, second, or third line risk management. Through escalation in the first line, decisions requiring judgment
can be raised to executives who have the broadest possible context and experience to make challenging decisions. Escalation in
the second and third lines of defense can also demonstrate part of their core responsibilities of effective challenge. If appropriate,
risks are escalated to the Board of Directors to ensure their alignment with material risk decisions and/or transparency to the largest
risks facing the organization.
Calculate and Allocate Capital in Alignment with Risk Management and Measurement Processes (including Stress Testing)
Capital is held to protect the company from unforeseen risks or unexpected risk severity. As such, it is important that capital
planning processes be well linked with risk management practices to ensure the appropriate capital protections are in place for the
safety and soundness of the company. Stress testing and economic capital measurement, both of which incorporate inputs from
across the risk spectrum, are key tools for evaluating our capital position and risk adjusted returns.
Support with the Right Culture, Talent, and Skills
The right culture, talent, and skills are critical to effective risk management. Our risk framework is supported with the right culture
that promotes the foundation and values of the risk management organization. Skills necessary to effectively manage risk are
reinforced through performance management systems. When needed, risk talent is augmented through recruitment of industry
experts as well as training and development of internal associates.