Discover 2015 Annual Report Download - page 29

-13-
compliance with risk management policies, procedures and standards across the Company. It also periodically reviews
the design and operating effectiveness of our risk management program and processes, including the independence
and effectiveness of our CRM function, and reports the results to our Audit Committee of the Board of the Directors
("Audit Committee") and, where appropriate, the Risk Oversight Committee of the Board of Directors ("Risk Oversight
Committee").
Defined Risk Appetite
We operate within a risk appetite framework approved by our Board of Directors, which guides an acceptable
level of risk-taking, considering desired financial returns and other objectives. To that end, limits and escalation
thresholds are set consistent with the risk appetite approved by our Board of Directors.
Transparency
We seek to provide transparency of exposures and outcomes, which is core to our risk culture and operating
style. We provide this risk transparency through our risk committee structure and standardized processes for escalating
issues and reporting. This is accomplished at several levels within the organization, including quarterly meetings held by
our Risk Committee and quarterly reports to the Risk Oversight Committee, as well as regular reporting to our Risk
subcommittees commensurate with the needs of our businesses. Further, our CRO is a member of the Company's senior
management team.
Enterprise Risk Management Governance Structure
Our governance structure is based on the principle that each line of business is responsible for managing risks
inherent in its business with appropriate oversight from our senior management and Board of Directors. Various
committees are in place to oversee the management of risks across our Company. We seek to apply operating
principles consistently to each committee. These operating principles are detailed in committee charters which are
approved by the Risk Committee. Our banking subsidiaries have their own risk governance, compliance, auditing and
other requirements. Our risk governance framework is implemented such that bank-level risk governance requirements
are satisfied as well.
Board of Directors
Our Board of Directors (i) approves certain risk management policies, (ii) approves our capital targets and goals,
(iii) approves our risk appetite framework, (iv) monitors our strategic plan, (v) appoints our CRO, and other risk
governance function leaders, as appropriate, (vi) receives reports on any exceptions to the Enterprise Risk Management
policy, (vii) receives and reviews regulatory examination reports and (viii) receives reports from the Audit Committee
and Risk Oversight Committee on risk management matters.
Risk Oversight Committee of our Board of Directors
Our Risk Oversight Committee is responsible for overseeing our risk management policies and the operations of
our enterprise-wide risk management framework. The Committee is responsible for (i) approving and periodically
reviewing our risk management policies, (ii) overseeing the operation of our policies and procedures establishing our
risk management governance, risk management procedures, and our risk-control infrastructure, (iii) overseeing the
operation of processes and systems for implementing and monitoring compliance with such policies and procedures, (iv)
reviewing and making recommendations to the Board of Directors, as appropriate, regarding the Company's risk
management framework, key risk management policies and the Company's risk appetite and tolerance, (v) receiving
and reviewing regular reports from our CRO on risk management deficiencies and emerging risks, the status of and
changes to risk exposures, policies, procedures and practices, and the steps management has taken to monitor and
control risk exposures, (vi) receiving reports on compliance with our risk appetite and limit structure and risk
management policies, procedures and controls, (vii) overseeing Capital Planning, Liquidity Risk Management and
Resolution Planning related activities, and (viii) sharing information and liaising with the Audit Committee (which it may
do through the Chair of the Committee) as necessary or desirable to help ensure that the committees have received the
information necessary to permit them to fulfill their duties and responsibilities with respect to oversight of risk
management matters.