PNC Bank 2011 Annual Report Download - page 93

PNC utilizes a number of sources to identify external
loss events occurring across the financial services
industry. These events are evaluated to determine
whether PNC is exposed to similar events, and if so,
whether the appropriate controls are in place.
Operational Risk Management, Compliance and Legal
professionals work closely with business areas to evaluate
risks and help ensure the appropriate controls are established
prior to the introduction of new or enhanced products,
services, and technologies. These risk professionals also
consult with business areas in the design and implementation
of mitigation strategies to address risks and issues identified
through ongoing assessment and monitoring activities.
We are in the process of implementing a methodology to
estimate capital requirements for Operational Risk using a
proprietary version of an Advanced Measurement Approach
(AMA). Under the AMA approach, the results of the program
elements described above are key inputs directly incorporated
into the capital calculation methodology.
PNC’s technology risk management and business resiliency
programs are aligned with the operational risk framework. Our
integrated security and technology risk management
framework is designed to help ensure a secure, sound, and
compliant infrastructure for information and system
management. The technology risk management process is
aligned with the strategic direction of the businesses and is
integrated into the technology management culture, structure
and practices.
Our business resiliency program manages the organization’s
capabilities to provide services in the case of an event that
results in material disruption of business activities.
Prioritization of investments in people, processes, technology
and facilities is based on different types of events, business
risk and criticality. Detailed testing validates our resiliency
capabilities on an ongoing basis, and an integrated governance
model is designed to help assure appropriate management
reporting.
PNC uses insurance where appropriate to mitigate the effects
of operational risk events. PNC purchases direct coverage
provided by various insurers, and retains certain corporate
risks via one of its two wholly owned captive insurance
companies, Alpine Indemnity Limited. PNC’s retention of
corporate risks associated with its participation as an insurer is
mitigated through policy limits. Insurance purchased in the
external market is governed by PNC’s Financial Stability
Carrier guidelines.
As a component of PNC’s risk management practices, we
purchase insurance designed to protect us against accidental
loss or losses, which, in the aggregate, may significantly affect
personnel, property, financial objectives, or our ability to
continue to meet our responsibilities to our various
stakeholder groups.
On a quarterly basis, an enterprise operational risk report is
made reporting key operational risks to senior management
and the Board of Directors. The report encompasses key
operational risk management conclusions, including the
overall operational risk level, risk management effectiveness
and outlook, grounded in quantitative measures and
qualitative factors. Key enterprise operational risks are also
included in the enterprise risk report. In addition, operational
risk is an integrated part of the quarterly business-specific risk
reports.
M
ODEL R ISK M ANAGEMENT
PNC relies on quantitative models to measure risks and to
estimate certain financial values. Models may be used in such
processes as determining the pricing of various products,
grading and granting loans, measuring interest rate risks and
other market risks, predicting losses, and assessing capital
adequacy, as well as to estimate the value of financial
instruments and balance sheet items. There are risks involved
in the use of models as they have the potential to provide
inaccurate output or results, could be used for purposes other
than those for which they have been designed, or may be
operated in an uncontrolled environment where unauthorized
changes can take place and where other control risks exist.
Model Risk Management is responsible for policies and
procedures describing how model risk is evaluated and
managed, and the application of the governance process to
implement these practices throughout the enterprise.
To better manage our business, our practices around the use of
models, and to comply with regulatory guidance and
requirements, we have in place policies and procedures that
define our governance processes for assessing and controlling
model risk. These processes focus on identifying, reporting,
and remediating any problems with the soundness, accuracy,
improper use, or operating environment of our models. We
recognize that models must be monitored over time to ensure
their continued accuracy and functioning, and our policies also
address the type and frequency of monitoring that is
appropriate according to the importance of each model.
There are a number of practices we undertake to identify and
control model risk. A primary consideration is that models be
well understood by those who use them as well as by other
parties. Our policies require detailed written model
documentation for significant models to assist in making their
use transparent and understood by users, independent
reviewers, and regulatory and auditing bodies. The
documentation must include details on the data and methods
used to develop each model, assumptions utilized within the
model, and a description of model limitations and
circumstances in which a model should not be relied upon.
84 The PNC Financial Services Group, Inc. – Form 10-K