Wells Fargo 2014 Annual Report Download - page 59

Operational Risk Management
Operational risk is the risk of loss resulting from inadequate or
failed internal controls and processes, people and systems, or
resulting from external events. These losses may be caused by
events such as fraud, breaches of customer privacy, business
disruptions, inappropriate employee behavior, vendors that do
not perform their responsibilities and regulatory fines and
penalties.
To address these risks, Wells Fargo maintains an
operational risk management framework that includes the
following objectives:
• Provide a structured approach for identifying, measuring,
managing, reporting, and monitoring operational risks
across all areas of Wells Fargo;
• Understand operational risk across the Company by
establishing and maintaining an effective operational risk
management program;
• Adequately control operational risk-related losses;
• Establish and hold an appropriate level of capital for such
losses in accordance with regulatory guidance; and
• Support the Board as it carries out its oversight duties and
responsibilities relating to management’s establishment of
an effective operational risk management program.
Wells Fargo’s operational risk management program seeks
to accomplish these objectives by managing operational risk
across the Company in a comprehensive, interconnected, and
consistent manner, in line with the enterprise statement of risk
appetite and relevant regulatory requirements.
The Audit & Examination Committee of the Board (A&E
Committee) has primary responsibility for oversight of
operational risk. In this capacity it reviews and approves the
operational risk management framework and significant
supporting risk policies and programs, including the
Company’s business continuity, information security, and third
party risk management policies and programs. The A&E
Committee periodically reviews updates from management on
the state of operational risk and the general condition of
operational risk management in the Company.
At the management level, the Operational Risk
Management Committee oversees operational risk
management across the Company and informs and advises the
Chief Operational Risk Officer on matters that affect the
Company's operational risk profile.
Information security is a significant operational risk for
financial institutions such as Wells Fargo, and includes the risk
of losses resulting from cyber attacks. Wells Fargo and other
financial institutions continue to be the target of various
evolving and adaptive cyber attacks, including malware and
denial-of-service, as part of an effort to disrupt the operations
of financial institutions, potentially test their cybersecurity
capabilities, or obtain confidential, proprietary or other
information. Wells Fargo has not experienced any material
losses relating to these or other cyber attacks. Addressing
cybersecurity risks is a priority for Wells Fargo, and we
continue to develop and enhance our controls, processes and
systems in order to protect our networks, computers, software
and data from attack, damage or unauthorized access. We are
also proactively involved in industry cybersecurity efforts and
working with other parties, including our third-party service
providers and governmental agencies, to continue to enhance
defenses and improve resiliency to cybersecurity threats. See
the “Risk Factors” section in this Report for additional
information regarding the risks associated with a failure or
breach of our operational or security systems or infrastructure,
including as a result of cyber attacks.
57