JP Morgan Chase 2015 Annual Report Download - page 154

Management’s discussion and analysis
144 JPMorgan Chase & Co./2015 Annual Report
OPERATIONAL RISK MANAGEMENT
Operational risk is the risk of loss resulting from inadequate
or failed processes or systems, human factors or due to
external events that are neither market- nor credit-related.
Operational risk is inherent in the Firm’s activities and can
manifest itself in various ways, including fraudulent acts,
business interruptions, inappropriate behavior of
employees, failure to comply with applicable laws and
regulations or failure of vendors to perform in accordance
with their arrangements. These events could result in
financial losses, litigation and regulatory fines, as well as
other damage to the Firm. The goal is to keep operational
risk at appropriate levels, in light of the Firm’s financial
strength, the characteristics of its businesses, the markets
in which it operates, and the competitive and regulatory
environment to which it is subject.
Overview
To monitor and control operational risk, the Firm maintains
an Operational Risk Management Framework (“ORMF”)
designed to enable the Firm to maintain a sound and well-
controlled operational environment. The four main
components of the ORMF include: governance, risk
identification and assessment, monitoring and reporting,
and measurement.
Risk Management is responsible for prescribing the ORMF to
the lines of business and corporate functions and for
providing independent oversight of its implementation. The
lines of business and corporate functions are responsible
for implementing the ORMF. The Firmwide Oversight and
Control Group (“O&C”), which consists of dedicated control
officers within each of the lines of business and corporate
functional areas, as well as a central oversight team, is
responsible for day to day execution of the ORMF.
Operational risk management framework
The components of the Operational Risk Management
Framework are:
Governance
The Firm’s operational risk governance function reports to
the Firm’s CRO and is responsible for defining the ORMF and
establishing the firmwide operational risk management
governance structure, policies and standards. The Firmwide
Risk Executive for Operational Risk Governance, a direct
report of the CRO, works with the line of business CROs to
provide independent oversight of the implementation of the
ORMF across the Firm. Operational Risk Officers (“OROs”),
who report to the LOB Chief Risk Officers or to the Firmwide
Risk Executive for Operational Risk Governance, are
independent of the lines of business and corporate
functions, and O&C. The OROs provide oversight of the
implementation of the ORMF within in each line of business
and corporate function.
Line of business, corporate function and regional control
committees oversee the operational risk and control
environments of their respective businesses, functions or
regions. These committees escalate operational risk issues
to the FCC, as appropriate. For additional information on
the Firmwide Control Committee, see Enterprise Risk
Management on pages 107–111.
Risk Identification and Self-Assessment
In order to evaluate and monitor operational risk, the lines
of business and corporate functions utilize several
processes to identify, assess, mitigate and manage
operational risk. Firmwide standards are in place for each of
these processes and set the minimum requirements for how
they must be applied.
The Firm’s risk and control self-assessment (“RCSA”)
process and supporting architecture requires management
to identify material inherent operational risks, assess the
design and operating effectiveness of relevant controls in
place to mitigate such risks, and evaluate residual risk.
Action plans are developed for control issues that are
identified, and businesses are held accountable for tracking
and resolving issues on a timely basis. Risk Management
performs an independent challenge of the RCSA program
including residual risk results.
The Firm also tracks and monitors operational risk events
which are analyzed by the responsible businesses and
corporate functions. This enables identification of the root
causes of the operational risk events and evaluation of the
associated controls.
Furthermore, lines of business and corporate functions
establish key risk indicators to manage and monitor
operational risk and the control environment. These assist
in the early detection and timely escalation of issues or
events.
Risk monitoring and reporting
Operational risk management and control reports provide
information, including actual operational loss levels, self-
assessment results and the status of issue resolution to the
lines of business and senior management. In addition, key
control indicators and operating metrics are monitored
against targets and thresholds. The purpose of these
reports is to enable management to maintain operational
risk at appropriate levels within each line of business, to
escalate issues and to provide consistent data aggregation
across the Firm’s businesses and functions.