PNC Bank 2012 Annual Report Download - page 103

management-level Executive Committee (EC) is the corporate
committee that is responsible for developing enterprise-wide
strategy and achieving PNC’s strategic objectives. The EC
evaluates risk management, in part, by monitoring risk
reporting from the other corporate committees, which are the
supporting committees for EC. The corporate committees are
responsible for overseeing risk standards and strategies,
recommending risk limits, policies, and metrics, monitoring
risk exposures, reviewing risk profiles and key risk issues, and
approving significant transactions and initiatives.
Working Committees – The working committees are generally
subcommittees of the corporate committees and include risk
management committees for each of PNC’s major businesses
or functions. Working committees are intended to define,
design and develop the risk management framework at the
business or function level. The working committees help to
implement key enterprise-level activities within a business or
function. These committees recommend risk management
policies for the business or function that are consistent with
the enterprise-wide risk management objectives and policies.
The business level committees are also responsible for
approving significant initiatives under a certain threshold.
Working Groups – Where appropriate, management will also
form ad hoc groups (working groups) to address specific risk
topics and report to a working committee or corporate
committee. These working groups generally have a narrower
scope and may be limited in their duration.
Policies and Procedures – PNC uses various risk management
policies and procedures to provide direction and guidance to
management and the Board of Directors. These policies and
procedures are organized in a framework of different levels
requiring review and approval at varying committees within
the governance structure.
Business Activities – Our businesses strive to enhance risk
management and internal control processes. Integrated and
comprehensive processes are designed to adequately identify,
measure, manage, monitor, and report risks which may
significantly impact each business.
Risk Identification and Quantification
Risk identification takes place across a variety of different risk
types throughout the organization. These risk types consist of,
but are not limited to, Credit Risk, Market Risk, Operational
Risk, Model Risk and Liquidity Risk. Risks are identified
based on a balanced use of analytical tools and management
judgment for both on- and off-balance sheet exposures. Our
governance structure supports risk identification by
facilitating that issues of the risk types, both existing and
emerging, are assessed and mitigation strategies implemented.
These risks are prioritized based on quantitative and
qualitative analysis and assessed against the risk appetite.
Multiple tools and approaches are used to help identify and
prioritize risks, including Key Risk Indicators (KRIs), Key
Performance Indicators (KPIs), Risk Control and Self
Assessments (RCSAs), scenario analysis, stress testing, and
special investigations.
Risks are aggregated and assessed within and across risk
functions or businesses. The aggregated risk information is
reviewed and reported at an enterprise level for adherence to
the risk appetite and tolerances as established through the
policy framework and approved by the Board of Directors or
by appropriate managing committees. This enterprise
aggregation and reporting approach promotes the
identification and appropriate escalation of material risks
across the organization and supports an understanding of the
cumulative impact of risk in relation to our risk appetite.
Risk Control and Limits
PNC uses a multi-tiered risk policy, procedure, and committee
charter framework to provide direction and guidance for
identifying, decisioning, and managing risk, including
appropriate processes to escalate control parameter exceptions
when applicable.
Risk limits, defined quantitatively and qualitatively, are
established within policy across risk categories. When setting
risk limits, PNC considers major risks, aligns with established
risk appetite, balances risk-reward, leverages analytics, and
adjusts limits timely in response to changes in external and
internal environments.
Quantitative and qualitative operating guidelines support risk
limits and serve as an early warning system for potential
violations of the limits. These operating guidelines trigger
mitigation strategies and management escalation protocols if
limits are breached.
Risk Monitoring and Reporting
PNC uses similar tools to monitor and report risk as to perform
Risk Identification. These tools include KRIs, KPIs, RCSAs,
scenario analysis, stress testing, and special investigations.
The risk identification and quantification processes, the risk
control and limits reviews, and the tools used for risk
monitoring provide the basis for risk reporting. The objective
of risk reporting is comprehensive risk aggregation and
transparent communication of aggregated risks. Risk reports
are produced at the line of business level, the functional level
(credit, market, operational) and the enterprise level. The
enterprise level report aggregates the risks identified in the
functional and business reports. The enterprise level report is
provided through the governance structure to the Board of
Directors.
84 The PNC Financial Services Group, Inc. – Form 10-K