PNC Bank 2013 Annual Report Download - page 104

continuity management (BCM) program. BCM manages the
organization’s capabilities to provide services in the case of an
event resulting in material disruption of business activities
affecting our people, facilities, technology, or suppliers. The
BCM program leads the efforts to identify and mitigate internal
and external business disruptive threats to PNC through
effective resiliency as well as recovery planning and testing.
Prioritization of investments in people, processes, technology
and facilities is based on business process criticality, likelihood
of events, and business risk. A testing program validates our
resiliency and recovery capabilities on an ongoing basis, and an
integrated governance model is designed to help assure
appropriate management reporting. The BCR function serves as
a second line of defense conducting various activities to
challenge the policies, processes, and elements of the business
continuity program. These activities include performing policy
gap analysis as well as conducting quality control risk
assessments which provide an independent review of the
viability, correctness, and effectiveness of various areas and
elements of the BCM program.
Enterprise Compliance is responsible for coordinating the
compliance risk component of PNC’s Operational Risk
framework. Compliance issues are identified and tracked
through enterprise-wide monitoring and tracking programs.
Key compliance risk issues are escalated through a
comprehensive risk reporting process at both a business and
enterprise level and incorporated, as appropriate, into the
development and assessment of the firm’s operational risk
profile. The Compliance, Conflicts & Ethics Policy
Committee, chaired by the Chief Compliance Officer,
provides oversight for compliance, conflicts and ethics
programs and strategies across PNC. This committee also
oversees the compliance processes related to fiduciary and
investment risk. In order to help understand, and where
appropriate, proactively address emerging regulatory issues,
Enterprise Compliance communicates regularly with various
regulators with supervisory or regulatory responsibilities with
respect to PNC, its subsidiaries or businesses and participates
in forums focused on regulatory and compliance matters in the
financial services industry.
PNC monitors and manages insurable risks through a
combination of risk mitigation, retention and transfer
consistent with the organization’s risk philosophy. PNC uses
insurance where appropriate to mitigate the effects of
operational risk events. PNC self-insures select risks through
its wholly-owned captive insurance company Alpine
Indemnity Limited.
Insurance decisions and activities are led by PNC’s Corporate
Insurance Group. The alignment of Corporate Insurance
within the enterprise risk management governance structure
facilitates increased cross-functional integration and
engagement, and is a primary governance strategy.
Management holds regular meetings with the lines of business
regarding risk evaluation and the utilization of insurance as a
risk transfer technique. Furthermore, Corporate Insurance
management and the Insurance Risk Committee have primary
oversight of reporting insurance related activities through a
governance structure that allows management to fully vet risk
information.
PNC, through a subsidiary company, Alpine Indemnity
Limited, provides insurance coverage for select corporate
programs. PNC’s risks associated with its participation as an
insurer for these programs are mitigated through policy limits
and annual aggregate limits. Decisions surrounding PNC’s
retention of its operating risks through deductibles or captive
participation are made in conjunction with the Insurance Risk
Committee.
On a quarterly basis, an enterprise operational risk report is
developed to report key operational risks to senior
management and the Board of Directors. The report
encompasses key operational risk management conclusions,
including the overall operational risk level, risk management
effectiveness and outlook, grounded in quantitative measures
and qualitative factors. Key enterprise operational risks are
also included in the enterprise risk report. In addition,
operational risk is an integrated part of the quarterly business-
specific risk reports.
M
ODEL R ISK M ANAGEMENT
PNC relies on quantitative models to measure risks and to
estimate certain financial values. Models may be used in such
processes as determining the pricing of various products,
grading and granting loans, measuring interest rate risks and
other market risks, predicting losses, and assessing capital
adequacy, as well as to estimate the value of financial
instruments and balance sheet items. There are risks involved
in the use of models as they have the potential to provide
inaccurate output or results, could be used for purposes other
than those for which they have been designed, or may be
operated in an uncontrolled environment where unauthorized
changes can take place and where other control risks exist.
The Model Risk Management Group is responsible for
policies and procedures describing how model risk is
evaluated and managed, and the application of the governance
process to implement these practices throughout the
enterprise. The Model Risk Management Committee, a
subcommittee of the Enterprise Risk Management Committee,
oversees all aspects of model risk, including PNC’s
compliance with regulatory requirements, and approves
exceptions to policy when appropriate.
To better manage our business, our practices around the use of
models, and to comply with regulatory guidance and
requirements, we have policies and procedures in place that
define our governance processes for assessing and controlling
model risk. These processes focus on identifying, reporting
86 The PNC Financial Services Group, Inc. – Form 10-K