Discover 2009 Annual Report Download - page 25

Law and Compliance Department. Our Law and Compliance Department is responsible for establishing and
maintaining a compliance program that includes our compliance risk identification, assessment, policy development,
monitoring, testing, training and reporting activities. Through collaboration with business units, our Law and Compliance
Department incorporates a commitment to compliance in our day-to-day activities. The head of Compliance reports to the
General Counsel.
Internal Audit Department. Our Internal Audit Department is responsible for performing periodic, independent reviews
and testing of compliance with our risk management policies and standards, performing assessments of the design and
operating effectiveness of these policies and standards, and validating that all risk management controls are functioning
as intended. The head of Internal Audit reports to the Audit and Risk Committee of our board of directors.
Risk Appetite and Strategic Limit Structure
Our risk appetite and strategic limit structure establish the amount of risk, on a broad level, that we are willing to
accept in pursuit of shareholder value. It reflects our risk management philosophy, and, in turn influences our culture and
operating style. Our determination of risk appetite and strategic limits is directly linked to the strategic planning process
and is consistent with our aspirations and mission statement. Risk appetite expressions and strategic limits are categorized
by risk type and cascade through our committees and business units and are incorporated into business decisions,
reporting and day-to-day business discussions.
Management and the Corporate Risk Management function monitor approved limits and escalation triggers to ensure
that the business is operating within the expressed risk appetite and strategic limits. Risk limits are monitored and
reported on to various risk committees and our board of directors, as appropriate. Through ongoing monitoring of risk
exposures, management is able to identify appropriate risk response and mitigation strategies in order to react
dynamically to changing conditions.
The expressions of risk appetite and strategic limits also serve as tools to preclude business activities that are
inconsistent with our long-term goals. Our risk appetite and strategic limit structure is approved by our board of directors.
Risk Management Review of Compensation
In compliance with requirements of the CPP, our Corporate Risk Officer reviewed and discussed compensation
arrangements with the Compensation Committee of our board of directors to ensure that these arrangements would not
incent employees to take unnecessary or excessive risks that would threaten the value of the company or encourage the
manipulation of reported earnings of the company to enhance the compensation of any employee.
Risk Categories
Our risk management program is organized around six major risk categories: credit risk, market risk, liquidity risk,
operational risk, legal and compliance risk and strategic risk. We evaluate the potential impact of a risk event on the
company by assessing financial impact, impact to our reputation, legal and regulatory impact and client/customer
impact.
Credit Risk. Credit risk arises from the potential that a borrower or counterparty will fail to perform on an obligation.
Our credit risk includes consumer credit risk and counterparty credit risk. Consumer credit risk is primarily incurred by
issuing credit cards and granting student loans and personal loans to consumers. Counterparty credit risk is incurred
through a number of activities including settlement, certain marketing programs, treasury and asset/liability management,
network incentive programs, vendor relationships and insurers.
Management of consumer credit risk is the primary responsibility of the Discover Bank Credit Committee. The
responsibilities of the Discover Bank Credit Committee include (i) establishing consumer credit risk philosophy and
tolerance; (ii) establishing procedures for implementing and ensuring compliance with risk identification, measurement,
monitoring and management policies and procedures for consumer credit risk management; and (iii) reviewing, on a
periodic basis, aggregate risk exposures and efficacy of risk measurement, monitoring and management policies and
procedures within the Credit Risk Management Department.
-13-