PNC Bank 2014 Annual Report Download - page 102

To support PNC’s overall risk profile within risk appetite and
the Enterprise Risk Appetite Statement, Technology Risk
Management has established governance, operating structures,
metrics, and guiding principles designed to ensure that
technology risk is distinctly considered in business activities
and strategic decision making processes.
PNC has defined an enterprise-wide business continuity
program that provides structure and guidelines to ensure
resiliency and recovery of PNC’s facilities, employees,
suppliers and technology should there be a business
disruption. It is a comprehensive program based upon a life
cycle containing repeatable activities to identify and mitigate
internal and external business disruptive threats. It is the
responsibility of PNC’s business units to execute and comply
with the business continuity program. The program is
administered by a separate group, with governance and
oversight being provided by additional resources in the
Independent Risk Management function.
PNC’s Corporate Insurance Group is responsible for
managing insurance risk across the organization, and is
aligned within the enterprise risk management governance
framework. PNC retains select corporate risks through its
wholly-owned captive insurance company Alpine Indemnity
Limited, and transfers excess risk through the purchase of
insurance where appropriate, to mitigate the effects of
operational loss events. PNC’s risks associated with its
participation as an insurer for these programs are mitigated
through policy and annual aggregate limits. Decisions
surrounding PNC’s retention of its operating risks through
deductibles or captive participation are made in conjunction
with the enterprise risk management governance framework.
The Corporate Insurance Group monitors and manages
insurable risks through a combination of risk mitigation,
retention and transfer consistent with the organization’s risk
appetite and philosophy. To ensure the lines of business have
a clear understanding of insurance risk and the ability to retain
or transfer risk, management holds regular meetings with the
lines of business regarding risk evaluation and the utilization
of insurance as a risk transfer technique. Furthermore,
Corporate Insurance management and the Insurance Risk
Committee have primary oversight of reporting insurance
related activities through the governance structure that allows
management to fully vet risk information.
Quarterly, an enterprise operational risk report is developed to
report key operational risks to senior management and the
Board of Directors. The report encompasses key operational
risk management conclusions, including the overall
operational risk level, risk management effectiveness and
outlook, grounded in quantitative measures and qualitative
factors. Key enterprise operational risks are also included in
the enterprise risk report. In addition, operational risk is an
integrated part of the quarterly business-specific risk reports.
Compliance Risk
Enterprise Compliance is responsible for coordinating the
compliance risk component of PNC’s Operational Risk
framework. Compliance issues are identified and tracked
through enterprise-wide monitoring and tracking programs.
Key compliance risk issues are escalated through a
comprehensive risk reporting process at both a business and
enterprise level and incorporated, as appropriate, into the
development and assessment of the firm’s operational risk
profile. The Compliance, Conflicts & Ethics Policy
Committee, chaired by the Chief Compliance Officer,
provides oversight for compliance, conflicts and ethics
programs and strategies across PNC. This committee also
oversees the compliance processes related to fiduciary and
investment risk. In order to help understand, and where
appropriate, proactively address emerging regulatory issues,
Enterprise Compliance communicates regularly with various
regulators with supervisory or regulatory responsibilities with
respect to PNC, its subsidiaries or businesses and participates
in forums focused on regulatory and compliance matters in the
financial services industry.
Risk professionals from Operational Risk, Technology Risk
Management, Compliance and Legal work closely with
business areas to evaluate risks and challenge that appropriate
key controls are established prior to the introduction of new or
enhanced products, services and technologies. These risk
professionals also challenge Business Units’ design and
implementation of mitigation strategies to address risks and
issues identified through ongoing assessment and monitoring
activities.
84 The PNC Financial Services Group, Inc. – Form 10-K