PNC Bank 2015 Annual Report Download - page 88

committee membership includes representatives from business
and risk stakeholder groups that are responsible for helping
ensure risk issues are proactively identified, decisioned,
monitored, communicated and managed appropriately within
the risk management framework.
Risk Organization and Governance
PNC employs a comprehensive risk management governance
framework to help ensure that risks are identified, balanced
decisions are made that consider risk and return, and risks are
adequately monitored and managed. Risk committees
established within this governance framework provide oversight
for risk management activities at the Board, corporate, and
business levels. Committee composition is designed to provide
effective oversight balanced across the three lines of defense in
accordance with the OCC’s heightened risk management and
governance expectations and guidelines. See further discussion
in the Supervision and Regulation section in Item 1 of this
Report.
Risk is managed across three lines of defense:
Business Front Line Units (BFLU) – As the first line of
defense, business front line units are accountable for
identifying, owning and managing risks to within
acceptable levels while adhering to the risk management
framework established by Independent Risk Management.
Our businesses strive to enhance risk management and
internal control processes. Integrated and comprehensive
processes are designed to adequately identify, measure,
manage, monitor and report risks which may significantly
impact each business.
Independent Risk Management (IRM) – As the second
line of defense, IRM oversees risk management and
establishes standards at the enterprise level to support
business management in meeting their responsibilities for
managing risk. IRM is independent from BFLUs and is
responsible for identifying, measuring, monitoring and
controlling aggregate risks.
Internal Audit – As the third line of defense, Internal Audit
is independent from BFLUs and IRM and develops a risk
based audit program to provide assurance on the
management of risk throughout the organization. This
includes auditing business processes across the
organization and reporting on the effectiveness of controls,
as well as auditing the risk management policy and
infrastructure implemented by IRM.
Within the three lines of defense, the risk organization has
sufficient authority to influence material decisions. The Board
oversees enterprise risk management of PNC for any material
changes to the risk profile and periodically reviews core
elements of enterprise risk including the Risk Appetite
Statement, Risk Capacity, Appetite and Strategy, and Risk
Controls and Limits.
We use our governance structure to assess the effectiveness of
our risk management practices on an ongoing basis, based on
how we manage our day-to-day business activities and on our
development and execution of more specific strategies to
mitigate risks. Specific responsibilities include:
Board of Directors – The Board oversees enterprise risk
management. The Risk Committee of the Board of
Directors evaluates PNC’s risk appetite, management’s
assessment of the enterprise risk profile, and the
enterprise-wide risk structure and processes established by
management to identify, measure, monitor, and manage
risk. The Audit Committee of the Board also has
responsibility for select areas of risk (e.g., Financial
Reporting, Ethics and Internal Controls over Financial
Reporting).
Corporate Committees – The corporate committees are
responsible for overseeing risk standards and strategies,
recommending risk limits, policies and metrics,
monitoring risk exposures, reviewing risk profiles and
key risk issues, and approving significant transactions
and initiatives. At the management level, PNC has
established several senior management-level committees
to facilitate the review, evaluation, and management of
risk. The management-level Executive Committee (EC)
is the corporate committee that is responsible for
developing enterprise-wide strategy and achieving PNC’s
strategic objectives. The EC evaluates risk management,
in part, by monitoring risk reporting from the other
corporate committees, which are the supporting
committees for EC.
Working Committees – The working committees are
generally subcommittees of the corporate committees and
include risk management committees for each of PNC’s
major businesses or functions. Working committees are
intended to define, design and develop the risk
management framework, including risk appetite, at the
business or function level. The working committees help
to implement key enterprise-level activities within a
business or function. These committees recommend risk
management policies for the business or function that are
consistent with the enterprise-wide risk management
objectives and policies. The business level committees
are also responsible for approving significant initiatives
under a certain threshold.
Policies and Procedures – PNC has established risk
management policies and procedures to provide
direction, guidance, and clarity on roles and
responsibilities to management and the Board of
Directors. These policies and procedures are organized in
a multi-tiered framework and require periodic review and
approval by relevant committees within the governance
structure.
70 The PNC Financial Services Group, Inc. – Form 10-K