PNC Bank 2015 Annual Report Download - page 99

professionals also challenge Business Units’ design and
implementation of mitigation strategies to address risks and
issues identified through ongoing assessment and monitoring
activities.
PNC’s Technology Risk Management (TRM) program is
aligned with the operational risk framework. Technology risk
represents the risk associated with the use, ownership,
operation, involvement, influence and adoption of technology
within an enterprise.
Management of technology risk is embedded into the culture
and decision-making processes of PNC through an
information and technology risk management framework
designed to help ensure secure, sound, and compliant IT
systems and infrastructure in support of business strategies
and goals. The management of technology risk is a core
business skill and an integral part of day-to-day activity.
Cybersecurity is a principal concern for financial institutions
and is a very high priority for PNC. The ever changing and
complex threat landscape is closely monitored and PNC
participates in proactive information sharing with intelligence
sources, law enforcement, and the private sector. The cyber
security program is based on a continuous improvement
strategy by assessing current and emerging threats to protect
our critical business functions, as well as the integrity,
privacy, and confidentiality of data. We continue to strengthen
our controls, processes and systems to help protect our
networks, computers, software, and data from attack, damage
or unauthorized access. See Item 1A Risk Factors in this
Report for additional information regarding the risk of a
material adverse impact from interruptions in the effective
operation of, or security breaches affecting, those systems.
Managers and staff at all levels are responsible for applying
risk management policies, procedures, and strategies in their
areas of responsibility. PNC’s TRM function supports
enterprise management of technology risk by independently
assessing technology and information security risks, and by
serving in an oversight role by measuring, monitoring, and
challenging enterprise technology capabilities. Specifically,
Technology Risk Management has the following objectives:
• A sound control infrastructure is in place to
effectively manage technology risks to help drive
informed business decisions,
• Technology risks related to ongoing business and
operational activities are identified, assessed, and
monitored,
• Technology risks related to new key initiatives are
assessed and appropriately managed, and
• Emerging technology risks are monitored and
assessed to verify their potential impact to PNC’s
overall risk profile.
To support PNC’s overall risk profile within risk appetite and
the Enterprise Risk Appetite Statement, Technology Risk
Management has established governance, operating structures,
metrics, and guiding principles designed to ensure that
technology risk is distinctly considered in business activities
and strategic decision making processes.
PNC has defined an enterprise-wide business continuity
program that provides structure and guidelines to ensure
resiliency and recovery of PNC’s facilities, employees,
suppliers and technology should there be a business
disruption. It is a comprehensive program based upon a life
cycle containing repeatable activities to identify and mitigate
internal and external business disruptive threats. It is the
responsibility of PNC’s business units to execute and comply
with the business continuity program. The program is
administered by a separate group, with governance and
oversight being provided by additional resources in the
Independent Risk Management function.
PNC’s Corporate Insurance Group is responsible for
managing insurance risk across the organization, and is
aligned within the enterprise risk management governance
framework. PNC retains select corporate risks through its
wholly-owned captive insurance company Alpine Indemnity
Limited, and transfers excess risk through the purchase of
insurance where appropriate, to mitigate the effects of
operational loss events. PNC’s risks associated with its
participation as an insurer for these programs are mitigated
through policy and annual aggregate limits. Decisions
surrounding PNC’s retention of its operating risks through
deductibles or captive participation are made in conjunction
with the enterprise risk management governance framework.
The Corporate Insurance Group monitors and manages
insurable risks through a combination of risk mitigation,
retention and transfer consistent with the organization’s risk
appetite and philosophy. To ensure the lines of business have
a clear understanding of insurance risk and the ability to retain
or transfer risk, management holds regular meetings with the
lines of business regarding risk evaluation and the utilization
of insurance as a risk transfer technique. Furthermore,
Corporate Insurance management and the Insurance Risk
Committee have primary oversight of reporting insurance
related activities through the governance structure that allows
management to fully vet risk information.
Quarterly, an enterprise operational risk report is developed to
report key operational risks to senior management and the
Board of Directors. The report encompasses key operational
risk management conclusions, including the overall
operational risk level, risk management effectiveness and
outlook, grounded in quantitative measures and qualitative
factors. Key enterprise operational risks are also included in
the enterprise risk report. In addition, operational risk is an
integrated part of the quarterly business-specific risk reports.
The PNC Financial Services Group, Inc. – Form 10-K 81