PNC Bank 2012 Annual Report Download - page 117

Operational Risk Management
Operational risk is the risk of loss resulting from inadequate or
failed internal processes or systems, human factors, or
external events. This includes losses that may arise as a result
of non-compliance with laws or regulations, failure to fulfill
fiduciary responsibilities, as well as litigation or other legal
actions. Operational risk may occur in any of our business
activities and manifests itself in various ways, including but
not limited to:
• Transaction processing errors,
• Unauthorized transactions and fraud by employees or
third parties,
• Material disruption in business activities,
• System breaches and misuse of sensitive information,
• Regulatory or governmental actions, fines or
penalties, and
• Significant legal expenses, judgments or settlements.
PNC’s Operational Risk Management is inclusive of
Technology Risk Management, Compliance, and Business
Resiliency. Operational Risk Management focuses on
balancing business needs, regulatory expectations and risk
management priorities through an adaptive and proactive
program that is designed to provide a strong governance
model, sound and consistent risk management processes and
transparent operational risk reporting across the enterprise.
The PNC Board determines the strategic approach to
operational risk via establishment of the operational risk
appetite and appropriate risk management structure. This
includes establishment of risk metrics and limits and a
reporting structure to identify, understand and manage
operational risks.
Executive Management has responsibility for operational risk
management. The executive management team is responsible
for monitoring risk issues through management reporting and
a governance structure of risk committees and sub-
committees.
Within Risk Management, Operational Risk Management
functions are responsible for developing and maintaining the
policies, methodologies, tools, and technology utilized across
the enterprise to identify, assess, monitor, and report
operational risks, including compliance risk. A key function of
Operational Risk Management is to help ensure business
units’ alignment with the Operational Risk Management
framework and to validate results and overall program
effectiveness.
Business Unit management is responsible for the day-to-day
management of operational risks inherent in the products,
services, and activities for which they are responsible.
Business Unit management is also responsible for adhering to
PNC’s enterprise-wide operational risk management policies
and procedures; including regularly identifying, measuring,
and monitoring operational risks in their respective area, as
well as capturing, analyzing and reporting operational loss
events.
Management of operational risk is based upon a
comprehensive framework designed to enable the company to
determine the enterprise and individual business unit’s
operational risk profile in comparison to the established risk
appetite and identify operational risks that may require further
mitigation. This framework is established around a set of
enterprise-wide policies and a system of internal controls that
are designed to manage risk and to provide management with
timely and accurate information about the operations of PNC.
This framework employs a number of techniques to manage
operational risk, including:
• Risk and Control Self-Assessments (RCSAs) are
performed at least annually across PNC’s businesses,
processes, systems and products. RCSA methodology
is a standard process for management to self assess
operational risks, evaluate control effectiveness, and
determine if risk exposure is within established
tolerances,
• Scenario Analysis is leveraged to proactively
evaluate operational loss events with the potential for
severe business, financial, operational or regulatory
impact on the company or a major business unit. This
methodology leverages standard processes and tools
to evaluate a wide range of business and operational
risks encompassing both external and internal events
relevant to the company. Based upon scenario
analysis conclusions, management may implement
additional controls or risk management activities to
reduce exposure to an acceptable level,
• A Key Risk Indicator (KRI) framework allows
management to assess actual operational risk results
compared to expectations and thresholds, as well as
proactively identify unexpected shifts in operational
risk exposure or control effectiveness. Enterprise-
level KRIs are designed to monitor exposure across
the different inherent operational risk types,
including compliance risk. Business-specific KRIs
are established in support of the individual risk and
control self assessments, and
• Operational loss events across the enterprise are
continuously captured and maintained in a central
repository. This information is analyzed and used to
help determine the root causes of these events and to
identify trends that could indicate changes in the
company’s risk exposure or control effectiveness.
PNC utilizes a number of sources to identify external
loss events occurring across the financial services
industry. These events are evaluated to determine
whether PNC is exposed to similar events, and if so,
whether appropriate controls are in place.
98 The PNC Financial Services Group, Inc. – Form 10-K