JP Morgan Chase 2008 Annual Report Download - page 119

JPMorgan Chase & Co./ 2008 Annual Report 117
Risk management
The Firm makes direct principal investments in private equity. The
illiquid nature and long-term holding period associated with these
investments differentiates private equity risk from the risk of posi-
tions held in the trading portfolios. The Firm’s approach to managing
private equity risk is consistent with the Firm’s general risk gover-
nance structure. Controls are in place establishing expected levels for
total and annual investment in order to control the overall size of the
portfolio. Industry and geographic concentration limits are in place
and intended to ensure diversification of the portfolio. All invest-
ments are approved by an investment committee that includes exec-
utives who are not part of the investing businesses. An independent
valuation function is responsible for reviewing the appropriateness of
the carrying values of private equity investments in accordance with
relevant accounting policies. At December 31, 2008 and 2007, the
carrying value of the private equity businesses was $6.9 billion and
$7.2 billion, respectively, of which $483 million and $390 million,
respectively, represented publicly traded positions. For further infor-
mation on the Private equity portfolio, see page 75 of this Annual
Report.
PRIVATE EQUITY RISK MANAGEMENT
OPERATIONAL RISK MANAGEMENT
Operational risk is the risk of loss resulting from inadequate or failed
processes or systems, human factors or external events.
Overview
Operational risk is inherent in each of the Firm’s businesses and sup-
port activities. Operational risk can manifest itself in various ways,
including errors, fraudulent acts, business interruptions, inappropriate
behavior of employees, or vendors that do not perform in accordance
with their arrangements. These events could result in financial losses
and other damage to the Firm, including reputational harm.
To monitor and control operational risk, the Firm maintains a system
of comprehensive policies and a control framework designed to pro-
vide a sound and well-controlled operational environment. The goal
is to keep operational risk at appropriate levels, in light of the Firm’s
financial strength, the characteristics of its businesses, the markets in
which it operates, and the competitive and regulatory environment to
which it is subject. Notwithstanding these control measures, the Firm
incurs operational losses.
The Firm’s approach to operational risk management is intended to
mitigate such losses by supplementing traditional control-based
approaches to operational risk with risk measures, tools and disci-
plines that are risk-specific, consistently applied and utilized
firmwide. Key themes are transparency of information, escalation of
key issues and accountability for issue resolution.
The Firm’s operational risk framework is supported by Phoenix, an
internally designed operational risk software tool. Phoenix integrates
the individual components of the operational risk management
framework into a unified, web-based tool. Phoenix enhances the
capture, reporting and analysis of operational risk data by enabling
risk identification, measurement, monitoring, reporting and analysis
to be done in an integrated manner, thereby enabling efficiencies in
the Firm’s monitoring and management of its operational risk.
For purposes of identification, monitoring, reporting and analysis, the
Firm categorizes operational risk events as follows:
• Client service and selection
• Business practices
• Fraud, theft and malice
• Execution, delivery and process management
• Employee disputes
• Disasters and public safety
• Technology and infrastructure failures
Risk identification and measurement
Risk identification is the recognition of the operational risk events
that management believes may give rise to operational losses. All
businesses utilize the Firm’s standard self-assessment process and
supporting architecture as a dynamic risk management tool. The goal
of the self-assessment process is for each business to identify the key
operational risks specific to its environment and assess the degree to
which it maintains appropriate controls. Action plans are developed
for control issues identified, and businesses are held accountable for
tracking and resolving these issues on a timely basis.
Risk monitoring
The Firm has a process for monitoring operational risk-event data,
permitting analysis of errors and losses as well as trends. Such analy-
sis, performed both at a line-of-business level and by risk-event type,
enables identification of the causes associated with risk events faced
by the businesses. Where available, the internal data can be supple-
mented with external data for comparative analysis with industry
patterns. The data reported enables the Firm to back-test against
self-assessment results. The Firm is a founding member of the
Operational Riskdata eXchange Association, a not-for-profit industry
association formed for the purpose of collecting operational loss
data, sharing data in an anonymous form and benchmarking results
back to members. Such information supplements the Firm’s ongoing
operational risk measurement and analysis.