Wells Fargo 2014 Annual Report Download - page 56

Risk Management
Financial institutions must manage a variety of business risks
that can significantly affect their financial performance. Among
the key risks that we must manage are operational risks, credit
risks, and asset/liability management risks, which include
interest rate, market, and liquidity and funding risks. Our risk
culture is strongly rooted in our Vision and Values, and in
order to succeed in our mission of satisfying all our customers’
financial needs and helping them succeed financially, our
business practices and operating model must support prudent
risk management practices.
Risk Management Framework and Culture
The key elements of our risk management framework and
culture include the following:
• We strongly believe in managing risk as close to
the source as possible. We manage risk through three
lines of defense, and the first line of defense is our team
members in our lines of business who are responsible for
identifying, assessing, monitoring, managing, mitigating,
and owning the risks in their businesses. All of our team
members have accountability for risk management.
• We recognize the importance of strong oversight.
Our Corporate Risk group, led by our Chief Risk Officer
who reports to the Board’s Risk Committee, as well as
other corporate functions such as the Law Department,
Corporate Controllers, and the Human Resources
Department serve as the second line of defense and
provide company-wide leadership, oversight, an enterprise
view, and appropriate challenge to help ensure effective
and consistent understanding and management of all risks
by our lines of business. Wells Fargo Audit Services, led by
our Chief Auditor who reports to the Board’s Audit and
Examination Committee, serves as the third line of defense
and through its audit, assurance, and advisory work
evaluates and helps improve the effectiveness of the
governance, risk management, and control processes
across the enterprise.
• We have a significant bias for conservatism. We
strive to maintain a conservative financial position
measured by satisfactory asset quality, capital levels,
funding sources, and diversity of revenues. Our risk is
distributed by geography, product type, industry segment,
and asset class, and while we want to grow the Company,
we will attempt to do so in a way that supports our long-
term goals and does not compromise our ability to manage
risk.
• We have a long-term customer focus. Our focus is
on knowing our customers and meeting our customers’
long-term financial needs by offering products and value-
added services that are appropriate for their needs and
circumstances. In addition, our team members are
committed to operational excellence, and we recognize
that our infrastructure, systems, processes, and
compliance programs must support the financial success
of our customers through a superior customer service
experience.
• We must understand and follow our risk appetite.
Our risk management framework is based on
understanding and following our overall enterprise
statement of risk appetite, which describes the nature and
level of risks that we are willing to take to achieve our
strategic and business objectives. This statement provides
the philosophical underpinnings that guide business and
risk leaders as they manage risk on a day-to-day basis. Our
CEO and Operating Committee, which consists of our
Chief Risk Officer and other senior executives, develop our
enterprise statement of risk appetite in the context of our
risk management framework and culture described above.
The Board approves our statement of risk appetite
annually, and the Board’s Risk Committee reviews and
approves any proposed changes to the statement to help
ensure that it remains consistent with our risk profile.
As part of our review of our risk appetite, we maintain
metrics along with associated objectives to measure and
monitor the amount of risk that the Company is prepared to
take. Actual results of these metrics are reported to the
Enterprise Risk Management Committee on a quarterly basis
as well as to the Risk Committee of the Board. Our operating
segments also have business-specific risk appetite statements
based on the enterprise statement of risk appetite. The metrics
included in the operating segment statements are harmonized
with the enterprise level metrics to ensure consistency where
appropriate. Business lines also maintain metrics and
qualitative statements that are unique to their line of business.
This allows for monitoring of risk and definition of risk
appetite deeper within the organization.
Our risk culture seeks to promote proactive risk
management and puts the customer first by implementing an
ongoing program of training, performance management, and
regular communication. Our risk culture also depends on the
“tone at the top” set by our Board, CEO, and Operating
Committee members. The Board and the Operating Committee
are the starting point for establishing and reinforcing our risk
culture and have overall and ultimate responsibility to provide
oversight for the three lines of defense and the risks we take.
The Board and the Operating Committee carry out their
oversight through governance committees with specific risk
management responsibilities described below.
Board Oversight of Risk
The Board allocates its oversight responsibilities across its
seven standing committees, all of which report to the full
Board. Each Board committee has defined authorities and
responsibilities for considering a specific set of risk issues, as
outlined in each of their charters and as summarized on the
following chart, and works closely with management to
understand and oversee the Company’s key risk exposures.
Allocating risk responsibilities among each Board level
committee increases the overall amount of attention devoted to
risk management. The Risk Committee serves as a focal point
for enterprise-wide risk issues, overseeing all key risks facing
the Company, and supports and assists the other six Board
level committees as they consider their specific risk issues. To
ensure that the Risk Committee does not duplicate the risk
oversight efforts of other Board committees, the Risk
Committee includes the Chairs of each of the Board’s other
standing committees to provide a comprehensive perspective
on risk across the Company and across all individual risk types.
In addition to providing a forum for risk issues at the Board
level, the Risk Committee plays an active role in approving and
overseeing the Company’s enterprise-wide risk management
framework established by management to manage risk, and the
functional framework and oversight policies established by
54