Charles Schwab 2013 Annual Report Download - page 48

THE CHARLES SCHWAB CORPORATION
Management’s Discussion and Analysis of Financial Condition and Results of Operations
(Tabular Amounts in Millions, Except Ratios, or as Noted)
- 37 -
RISK MANAGEMENT
The Company’s business activities expose it to a variety of risks, including operational, credit, market, liquidity, compliance
and legal risk. The Company has a comprehensive risk management program to identify and manage these risks and their
associated potential for financial and reputational impact. Despite the Company’s efforts to identify areas of risk and
implement risk management policies and procedures, there can be no assurance that the Company will not suffer unexpected
losses due to these risks.
The Company’s risk management process is comprised of risk identification and assessment, risk measurement, risk
monitoring and reporting and risk mitigation. The activities and organizations that comprise the risk management process are
described below.
Risk Culture
The Company’s Board of Directors sets the tone for effective risk management and has approved an Enterprise Risk
Management (ERM) Framework commensurate with the size, risk profile, complexity, and continuing growth of the
Company. The ERM Framework and governance structure constitute a comprehensive approach to managing risks
encountered by the Company in its business activities. Risk appetite, which is defined as the amount of risk the Company is
willing to accept in pursuit of its corporate strategy, is set by executive management and approved by the Board of Directors.
The Company has established risk metrics and reporting that enable the measurement of the impact of strategy execution
against risk appetite. The risk metrics, with risk limits and tolerance levels, are established for key risk categories by the
Global Risk Committee and its functional risk sub-committees.
Risk Governance
Senior management takes an active role in the risk management process and has developed policies and procedures under
which specific business and control units are responsible for identifying, measuring and controlling risks.
The Global Risk Committee, which is comprised of senior executives from each major business and control function, is
responsible for the oversight of risk management. This includes identifying emerging risks, assessing risk management
practices and the control environment, reinforcing business accountability for risk management, supervisory controls and
regulatory compliance, supporting resource prioritization across the Company, and escalating significant issues to the Board
of Directors.
The Global Risk Committee reports regularly to the Risk Committee of the Board of Directors. The Risk Committee assists
the Board of Directors in fulfilling its oversight responsibilities with respect to the Company’s risk management program,
including approving risk appetite statements and reviewing reports relating to risk issues from functional areas of risk
management, legal, compliance, and internal audit.
Functional risk sub-committees focusing on specific areas of risk report into the Global Risk Committee. These sub-
committees include the:
 Asset-Liability Management and Pricing Committee, which establishes strategies and policies for the management
of corporate capital, liquidity, interest rate risk, and investments;
 Credit and Market Risk Oversight Committee, which provides oversight of and approves credit and market risk
policies, limits, and exposures in loan, investment, and positioning portfolios;
 New Products and Services Risk Oversight Committee, which provides oversight of, and approves corporate policy
and procedures relating to the risk governance of new products and services; and the
 Operational Risk Oversight Committee, which provides oversight of and approves operational risk management
policies, risk tolerance levels, and operational risk governance processes, and includes the following sub-
committees:
o Information Security and Privacy Sub-Committee, which provides oversight of the information security and
privacy programs and policies;