PNC Bank 2015 Annual Report Download - page 89

Risk Identification and Quantification
Risk identification takes place across a variety of risk types
throughout the organization. These risk types consist of, but
are not limited to, credit, operational, compliance, market,
liquidity and model. Risks are identified based on a balanced
use of analytical tools and management judgment for both on-
and off-balance sheet exposures. Our governance structure
supports risk identification by facilitating assessment of key
risk issues, emerging risks, and idiosyncratic risks and
implementation of mitigation strategies as appropriate. These
risks are prioritized based on quantitative and qualitative
analysis and assessed against the risk appetite. Multiple tools
and approaches are used to help identify and prioritize risks,
including Risk Appetite Metrics, Key Risk Indicators (KRIs),
Key Performance Indicators (KPIs), Risk Control and Self-
Assessments (RCSAs), scenario analysis, stress testing and
special investigations.
Risks are aggregated and assessed within and across risk
functions or businesses. The aggregated risk information is
reviewed and reported at an enterprise level for adherence to
the risk appetite framework as established through the policy
framework and approved by the Board of Directors or by
appropriate managing committees. This enterprise aggregation
and reporting approach promotes the identification and
appropriate escalation of material risks across the organization
and supports an understanding of the cumulative impact of
risk in relation to our risk appetite.
Risk Control and Limits
Risk controls and limits provide the linkage from PNC’s Risk
Appetite Statement and associated guiding principles to the
risk taking activities of our businesses. Risk limits are
quantitative measures, including forward looking assumptions,
which allocate the firm’s aggregate risk appetite statement to
lines of business and functional risk areas. They are
established within policy across risk categories and are
embedded within each risk appetite description.
When setting risk limits, PNC considers major risks, aligns
with the established risk appetite, balances risk-reward,
leverages analytics including stressed scenarios along with
historical data, and adjusts limits in a timely manner in
response to changes in internal and external environments.
Quantitative and qualitative operating guidelines support risk
limits and serve as an early warning system for potential
violations of the limits. These operating guidelines trigger
mitigation strategies and management escalation protocols if
limits are breached.
PNC’s control structure is balanced in terms of efficiency and
effectiveness with the risks that we are willing to take, as
defined by our risk appetite. Controls are in place across the
risk taxonomy to monitor established risk limits.
PNC uses a multi-tiered risk policy, procedure, and committee
charter framework to provide direction and guidance for
identifying, decisioning, monitoring, communicating and
managing risk, including appropriate processes to escalate
control parameter exceptions when applicable.
Risk Monitoring and Reporting
PNC uses similar tools to monitor and report risk when
performing Risk Identification. These tools include Risk
Appetite Metrics, KRIs, KPIs, RCSAs, scenario analysis,
stress testing and special investigations.
The risk identification and quantification processes, the risk
control and limits reviews, and the tools used for risk
monitoring provide the basis for risk reporting. The objective
of risk reporting is comprehensive risk aggregation and
transparent communication of aggregated risks, issues, risk
level compared to appetite, outlook as well as mitigation
strategies where appropriate, to the Risk Committee of the
Board of Directors, Corporate Committees, Working
Committees and other designated parties for effective decision
making.
Risk reports are produced at the line of business, functional
risk and the enterprise levels. The enterprise level risk report
aggregates risks identified in the functional and business
reports to define the enterprise risk profile. The enterprise risk
profile is a point-in-time assessment of enterprise risk. The
risk profile represents PNC’s overall risk position in relation
to the desired enterprise risk appetite and overall risk capacity.
The determination of the enterprise risk profile is based on
analysis of quantitative reporting of risk limits and other
measures along with qualitative assessments. Quarterly
aggregation of our risk profile enables a clear view of our risk
level relative to our quantitative risk appetite and overall risk
capacity. The enterprise level report is provided through the
governance structure to the Board of Directors.
Credit Risk Management
Credit risk represents the possibility that a customer,
counterparty or issuer may not perform in accordance with
contractual terms. Credit risk is inherent in the financial
services business and results from extending credit to
customers, purchasing securities, and entering into financial
derivative transactions and certain guarantee contracts. Credit
risk is one of our most significant risks. Our processes for
managing credit risk are embedded in PNC’s risk culture and
in our decision-making processes using a systematic approach
whereby credit risks and related exposures are identified and
assessed, managed through specific policies and processes,
measured and evaluated against our risk appetite and credit
concentration limits, and reported, along with specific
mitigation activities, to management and the Board through
our governance structure.
The PNC Financial Services Group, Inc. – Form 10-K 71