JP Morgan Chase 2012 Annual Report Download - page 166

Management’s discussion and analysis
176 JPMorgan Chase & Co./2012 Annual Report
capital model uses actual losses, a comprehensive inventory
of forward looking potential loss scenarios with adjustments
to reflect changes in the quality of the control environment
in determining Firmwide operational risk capital. This
methodology is designed to comply with the advanced
measurement rules under the Basel II Framework.
Operational risk management system
The Firm’s operational risk framework is supported by
Phoenix, an internally designed operational risk system,
which integrates the individual components of the
operational risk management framework into a unified,
web-based tool. Phoenix enhances the capture, reporting
and analysis of operational risk data by enabling risk
identification, measurement, monitoring, reporting and
analysis to be done in an integrated manner across the
Firm.
Audit alignment
Internal Audit utilizes a risk-based program of audit
coverage to provide an independent assessment of the
design and effectiveness of key controls over the Firm’s
operations, regulatory compliance and reporting. This
includes reviewing the operational risk framework, the
effectiveness of the business self-assessment process, and
the loss data-collection and reporting activities.
Insurance
One of the ways operational loss is mitigated is through
insurance maintained by the Firm. The Firm purchases
insurance to be in compliance with local laws and
regulations, as well as to serve other needs. Insurance may
also be required by third parties with whom the Firm does
business. The insurance purchased is reviewed and
approved by senior management.
Cybersecurity
The Firm devotes significant resources to maintain and
regularly update its systems and processes that are
designed to protect the security of the Firm’s computer
systems, software, networks and other technology assets
against attempts by third parties to obtain unauthorized
access to confidential information, destroy data, disrupt or
degrade service, sabotage systems or cause other damage.
The Firm and several other U.S. financial institutions
continue to experience significant distributed denial-of-
service attacks from technically sophisticated and well-
resourced third parties which are intended to disrupt
consumer online banking services. The Firm has also
experienced other attempts to breach the security of the
Firm’s systems and data. These cyberattacks have not, to
date, resulted in any material disruption of the Firm’s
operations, material harm to the Firm’s customers, and
have not had a material adverse effect on the Firm’s results
of operations.
Business resiliency
JPMorgan Chase’s global resiliency and crisis management
program is intended to ensure that the Firm has the ability
to recover its critical business functions and supporting
assets (i.e., staff, technology and facilities) in the event of a
business interruption, and to remain in compliance with
global laws and regulations as they relate to resiliency risk.
The program includes corporate governance, awareness and
training, as well as strategic and tactical initiatives to
ensure that risks are properly identified, assessed, and
managed.
The Firm’s Global Resiliency team has established
comprehensive and qualitative tracking and reporting of
resiliency plans in order to proactively anticipate and
manage various potential disruptive circumstances such as
severe weather, technology and communications outages,
flooding, mass transit shutdowns and terrorist threats,
among others. The resiliency measures utilized by the Firm
include backup infrastructure for data centers, a
geographically distributed workforce, dedicated recovery
facilities, ensuring technological capabilities to support
remote work capacity for displaced staff and
accommodation of employees at alternate locations.
JPMorgan Chase continues to coordinate its global
resiliency program across the Firm and mitigate business
continuity risks by reviewing and testing recovery
procedures. The strength and proficiency of the Firm’s
global resiliency program has played an integral role in
maintaining the Firm’s business operations during and
quickly after various events that have resulted in business
interruptions, such as Superstorm Sandy and Hurricane
Isaac in the U.S., monsoon rains in the Philippines, tsunamis
in Asia, and earthquakes in Latin America.