PNC Bank 2013 Annual Report Download - page 103

policies, methodologies, tools, and technology utilized across the
enterprise to identify, assess, monitor, and report operational
risks, including compliance risk. A key function of Operational
Risk Management is to ensure business units’ alignment with the
Operational Risk Management framework and to independently
challenge results and overall program effectiveness.
Business Unit management is responsible for the day-to-day
management of operational risks inherent in the products,
services, and activities for which they are responsible. Business
Unit management is also responsible for adhering to PNC’s
enterprise-wide operational risk management policies and
procedures including regularly identifying, measuring, and
monitoring operational risks in their respective areas, as well as
capturing, analyzing and reporting operational risk events.
Management of operational risk is based upon a
comprehensive framework designed to enable the company to
determine the enterprise and individual business unit’s
operational risk profile in comparison to the established risk
appetite and identify operational risks that may require further
mitigation. This framework is established around a set of
enterprise-wide policies and a system of internal controls that
are designed to manage risk and to provide management with
timely and accurate information about the operations of PNC.
This framework employs a number of techniques to manage
operational risk, including:
• RCSAs that are performed at least annually across
PNC’s businesses, processes, systems and products.
RCSA methodology is a standard process for
management to document and assess operational
risks, evaluate key control design and operating
effectiveness, and determine if control enhancements
are required,
• A Scenario Analysis program that is leveraged to
proactively evaluate operational risks with the
potential for severe business, financial, operational or
regulatory impact on the company or a major
business unit. This methodology leverages standard
processes and tools to evaluate a wide range of
business and operational risks encompassing both
external and internal events relevant to the company.
Based upon scenario analysis conclusions,
management may implement additional controls or
risk management activities to reduce exposure to an
acceptable level,
• A KRI framework that allows management to
proactively monitor and assess shifts in operational
risk exposure or key control effectiveness compared
to expectations and thresholds. Enterprise-level KRIs
are in place to monitor exposure across the different
inherent operational risk types, including compliance
risk. Business-specific KRIs are established in
support of the individual risk and control self
assessments, and
• Operational loss events as well as technology and
operational breakdowns that do not result in direct
loss (near miss events) across the enterprise are
continuously captured and maintained in a central
repository. This information is analyzed and used to
help determine the root causes of these events and to
identify trends that could indicate changes in the
company’s risk exposure or control effectiveness.
PNC utilizes a number of sources to identify external
loss events occurring across the financial services
industry. These events are evaluated to determine
whether PNC is exposed to similar events, and if so,
whether appropriate controls are in place.
We continue to refine our methodology to estimate capital
requirements for operational risk using a proprietary version
of an Advanced Measurement Approach (AMA). Under the
AMA approach, the results of the program elements described
above are key inputs directly incorporated into the capital
calculation methodology.
Risk professionals from Operational Risk, Technology Risk
Management, Compliance and Legal work closely with business
areas to evaluate risks and challenge that appropriate key controls
are established prior to the introduction of new or enhanced
products, services and technologies. These risk professionals also
challenge Business Units’ design and implementation of
mitigation strategies to address risks and issues identified through
ongoing assessment and monitoring activities.
PNC’s Technology Risk Management (TRM) program is
aligned with the operational risk framework. Technology risk
represents the risk associated with the use, ownership,
operation, involvement, influence and adoption of technology
within an enterprise. Management of technology risk is
embedded into the culture and decision making processes of
PNC through an information and technology risk management
framework designed to help ensure secure, sound, and
compliant IT systems and infrastructure in support of business
strategies and goals. The management of technology risk is a
core business skill and an integral part of day-to-day activity.
Managers and staff at all levels are responsible for applying
risk management policies, procedures, and strategies in their
areas of responsibility. PNC’s TRM function supports
enterprise management of technology risk by independently
assessing technology and information security risks, and by
serving in an oversight role by measuring, monitoring, and
challenging enterprise technology capabilities. Specifically,
Technology Risk Management has the following objectives:
• A sound control infrastructure is in place to
effectively manage technology risks to help drive
informed business decisions,
• Technology risks related to ongoing business and
operational activities are identified, assessed, and
monitored,
• Technology risks related to new key initiatives are
assessed and appropriately managed, and
• Emerging technology risks are monitored and
assessed to verify their potential impact to PNC’s
overall risk profile.
Our business continuity risk (BCR) program provides
governance and oversight of PNC’s enterprise wide business
The PNC Financial Services Group, Inc. – Form 10-K 85