PNC Bank 2014 Annual Report Download - page 101

is a standard process for business units to document
and assess operational risks, evaluate key control
design and operating effectiveness, and determine if
control enhancements are required,
• A Scenario Analysis program that is leveraged to
proactively evaluate operational risks with the
potential for severe business, financial, operational or
regulatory impact on the company or a major
business unit. This methodology leverages standard
processes and tools to evaluate a wide range of
business and operational risks encompassing both
external and internal events relevant to the company.
Based upon scenario analysis conclusions,
management may implement additional controls or
risk management activities to reduce exposure to an
acceptable level,
• A Metrics and Key Risk Indicator framework that
allows management to proactively monitor and assess
shifts in operational risk exposure or key control
effectiveness compared to expectations and
thresholds. Enterprise-level Operational Risk
Appetite metrics support PNC’s Operational Risk
Management framework and guiding principles with
the objective of maintaining a risk profile within risk
appetite. A broad set of operational risk indicators are
in place to monitor and report exposures across the
different inherent operational risk types. Lastly,
business-specific risk indicators are established to
monitor the most significant risks and controls
identified in the individual risk and control self
assessments, and
• Operational loss events as well as technology and
operational breakdowns that do not result in direct loss
(near miss events) across the enterprise are
continuously captured and maintained in a central
repository. This information is analyzed and used to
help determine the root causes of these events and to
identify trends that could indicate changes in the
company’s risk exposure or control effectiveness.
PNC’s External Loss Event program utilizes a number
of sources to monitor and identify external loss events
occurring across the financial services industry.
Relevant external events are evaluated by appropriate
business and risk management personnel to determine
whether PNC is exposed to similar events, and if so,
whether appropriate controls are in place.
We continue to refine our methodology to estimate capital
requirements for operational risk using a proprietary version
of an Advanced Measurement Approach (AMA) as prescribed
in Basel II. Under the AMA, the results of the program
elements described above are key inputs directly incorporated
into the capital calculation methodology.
Risk professionals from Operational Risk, Technology Risk
Management, Compliance and Legal work closely with
business areas to evaluate risks and challenge that appropriate
key controls are established prior to the introduction of new or
enhanced products, services and technologies. These risk
professionals also challenge Business Units’ design and
implementation of mitigation strategies to address risks and
issues identified through ongoing assessment and monitoring
activities.
PNC’s Technology Risk Management (TRM) program is
aligned with the operational risk framework. Technology risk
represents the risk associated with the use, ownership,
operation, involvement, influence and adoption of technology
within an enterprise.
Management of technology risk is embedded into the culture
and decision-making processes of PNC through an
information and technology risk management framework
designed to help ensure secure, sound, and compliant IT
systems and infrastructure in support of business strategies
and goals. The management of technology risk is a core
business skill and an integral part of day-to-day activity.
Cybersecurity is a principal concern for financial institutions
and is a very high priority for PNC. The ever changing and
complex threat landscape is closely monitored and PNC
participates in proactive information sharing with intelligence
sources, law enforcement, and the private sector. The cyber
security program is based on a continuous improvement
strategy by assessing current and emerging threats to protect
our critical business functions, as well as the integrity,
privacy, and confidentiality of data. We continue to strengthen
our controls, processes and systems to help protect our
networks, computers, software, and data from attack, damage
or unauthorized access. See Item 1A Risk Factors in this
Report for additional information regarding the risk of a
material adverse impact from interruptions in the effective
operation of, or security breaches affecting, those systems.
Managers and staff at all levels are responsible for applying
risk management policies, procedures, and strategies in their
areas of responsibility. PNC’s TRM function supports
enterprise management of technology risk by independently
assessing technology and information security risks, and by
serving in an oversight role by measuring, monitoring, and
challenging enterprise technology capabilities. Specifically,
Technology Risk Management has the following objectives:
• A sound control infrastructure is in place to
effectively manage technology risks to help drive
informed business decisions,
• Technology risks related to ongoing business and
operational activities are identified, assessed, and
monitored,
• Technology risks related to new key initiatives are
assessed and appropriately managed, and
• Emerging technology risks are monitored and
assessed to verify their potential impact to PNC’s
overall risk profile.
The PNC Financial Services Group, Inc. – Form 10-K 83