PNC Bank 2012 Annual Report Download - page 118

We continue to enhance our methodology to estimate capital
requirements for Operational Risk using a proprietary version
of an Advanced Measurement Approach (AMA). Under the
AMA approach, the results of the program elements described
above are key inputs directly incorporated into the capital
calculation methodology.
Risk professionals from Operational Risk Management,
Technology Risk Management, Business Resiliency,
Compliance, and Legal work closely with business areas to
evaluate risks and help ensure that appropriate controls are
established prior to the introduction of new or enhanced
products, services, and technologies. These risk professionals
also consult with business areas in the design and
implementation of mitigation strategies to address risks and
issues identified through ongoing assessment and monitoring
activities.
PNC’s technology risk management program is aligned with
the operational risk framework. Management of technology
risk is embedded into the culture and decision making
processes of PNC through an information and technology risk
management framework designed to help ensure secure,
sound, and compliant IT systems and infrastructure in support
of business strategies and goals. PNC’s Technology Risk
Management (TRM) function supports enterprise management
of technology risk by independently assessing technology and
information security risks, and by serving in an oversight role
by measuring, monitoring, and challenging enterprise
technology capabilities.
Our business resiliency program manages the organization’s
capabilities to provide services in the case of an event that
results in material disruption of business activities.
Prioritization of investments in people, processes, technology
and facilities is based on different types of events, business
risk and criticality. A testing program validates our resiliency
capabilities on an ongoing basis, and an integrated governance
model is designed to help assure appropriate management
reporting.
Enterprise Compliance is responsible for coordinating the
compliance risk component of PNC’s Operational Risk
framework. Compliance issues are identified and tracked
through enterprise-wide monitoring and tracking programs.
Key compliance risk issues are escalated through a
comprehensive risk reporting process at both a business and
enterprise level and incorporated, as appropriate, into the
development and assessment of the firm’s operational risk
profile. The Compliance, Conflicts & Ethics Policy
Committee, chaired by the Chief Compliance Officer,
provides oversight for compliance, conflicts and ethics
programs and strategies across PNC. This committee also
oversees the compliance processes related to fiduciary and
investment risk. In order to help understand and where
appropriate proactively address emerging regulatory issues,
Enterprise Compliance communicates regularly with various
regulators with supervisory or regulatory responsibilities with
respect to PNC, its subsidiaries or businesses and participates
in forums focused on regulatory and compliance matters in the
financial services industry.
PNC uses insurance where appropriate to help mitigate the
effects of operational risk events. In 2012, PNC implemented
a Network Security & Privacy Liability program to address
associated risks. The purchase of insurance protects against
accidental losses, which, in the aggregate, may affect
personnel, financial objectives, or our ability to meet
responsibilities to various stakeholder groups. While certain
corporate risks are retained through a subsidiary, various
insurers provide the balance of coverage. Uncertainty, related
to insurer coverage determinations, may result in reduced
benefit received from insurance mitigation. Oversight of
insurance purchased is provided by Risk committees within
the governance structure.
On a quarterly basis, an enterprise operational risk report is
developed to report key operational risks to senior
management and the Board of Directors. The report
encompasses key operational risk management conclusions,
including the overall operational risk level, risk management
effectiveness and outlook, grounded in quantitative measures
and qualitative factors. Key enterprise operational risks are
also included in the enterprise risk report. In addition,
operational risk is an integrated part of the quarterly business-
specific risk reports.
Model Risk Management
PNC relies on quantitative models to measure risks and to
estimate certain financial values. Models may be used in such
processes as determining the pricing of various products,
grading and granting loans, measuring interest rate risks and
other market risks, predicting losses, and assessing capital
adequacy, as well as to estimate the value of financial
instruments and balance sheet items. There are risks involved
in the use of models as they have the potential to provide
inaccurate output or results, could be used for purposes other
than those for which they have been designed, or may be
operated in an uncontrolled environment where unauthorized
changes can take place and where other control risks exist.
Model Risk Management is responsible for policies and
procedures describing how model risk is evaluated and
managed, and the application of the governance process to
implement these practices throughout the enterprise. The
Model Risk Management Committee, a subcommittee of the
Enterprise Risk Management Committee, oversees all aspects
of model risk, including PNC’s compliance with regulatory
requirements, and approves exceptions to policy when
appropriate.
To better manage our business, our practices around the use of
models, and to comply with regulatory guidance and
requirements, we have in place policies and procedures that
define our governance processes for assessing and controlling
The PNC Financial Services Group, Inc. – Form 10-K 99