US Bank 2014 Annual Report Download - page 42

Operational risk is the risk of loss resulting from inadequate
or failed internal processes, people, or systems, or from
external events, including the risk of loss resulting from
breaches in data security. Operational risk can also include
failures by third parties with which the Company does
business. Compliance risk is the risk of loss arising from
violations of, or nonconformance with, laws, rules,
regulations, prescribed practices, internal policies, and
procedures, or ethical standards, potentially exposing the
Company to fines, civil money penalties, payment of
damages, and the voiding of contracts. Compliance risk also
arises in situations where the laws or rules governing certain
Company products or activities of the Company’s customers
may be ambiguous or untested. Strategic risk is the risk to
earnings or capital arising from adverse business decisions
or improper implementation of those decisions. Reputational
risk is the potential that negative publicity or press regarding
the Company’s operations, business practices or products,
whether true or not, will cause a decline in the customer
base, costly litigation, or revenue reductions. In addition to
the risks identified above, other risk factors exist that may
impact the Company. Refer to “Risk Factors” beginning on
page 155, for a detailed discussion of these factors.
The Company’s Board and management-level
governance committees are supported by a “three lines of
defense” model for establishing effective checks and
balances. The first line of defense, the business lines,
manages risks in conformity with established limits and
policy requirements. In turn, business leaders and their risk
officers establish programs to ensure conformity with these
limits and policy requirements. The second line of defense,
which includes the Chief Risk Officer’s organization as well
as policy and oversight activities of corporate support
functions, translates risk appetite and strategy into
actionable risk limits and policies. The second line of defense
monitors first line of defense conformity with limits and
policies, and provides reporting and escalation of emerging
risks and other concerns to senior management and the Risk
Management Committee of the Board of Directors. The third
line of defense, internal audit, is responsible for providing the
Audit Committee of the Board of Directors and senior
management with independent assessment and assurance
regarding the effectiveness of the Company’s governance,
risk management, and control processes.
Management provides various risk reports to the Risk
Management Committee of the Board of Directors. The Risk
Management Committee discusses with management the
Company’s risk management performance, and provides a
summary of key risks to the entire Board of Directors,
covering the status of existing matters, areas of potential
future concern, and specific information on certain types of
loss events. The discussion also covers quarterly reports by
management assessing the Company’s performance relative
to the risk appetite statements and the associated risk limits,
including:
– Qualitative considerations, such as the macroeconomic
environment, regulatory and compliance changes,
litigation developments, and technology and cybersecurity;
– Capital ratios and projections, including regulatory
measures and stressed scenarios;
– Credit measures, including adversely rated and
nonperforming loans, leveraged transactions, credit
concentrations and lending limits;
– Interest rate and market risk, including market value and
net income simulation, and trading-related Value at Risk;
– Liquidity risk, including funding projections under various
stressed scenarios;
– Operational, compliance and strategic risk, including
losses stemming from events such as fraud, processing
errors, control breaches, breaches in data security, or
adverse business decisions, as well as reporting on
technology performance, and various legal and regulatory
compliance measures; and
– Reputational risk considerations, impacts and responses.
Credit Risk Management The Company’s strategy for credit
risk management includes well-defined, centralized credit
policies, uniform underwriting criteria, and ongoing risk
monitoring and review processes for all commercial and
consumer credit exposures. The strategy also emphasizes
diversification on a geographic, industry and customer level,
regular credit examinations and management reviews of
loans exhibiting deterioration of credit quality. The Risk
Management Committee oversees the Company’s credit risk
management process.
In addition, credit quality ratings as defined by the
Company, are an important part of the Company’s overall
credit risk management and evaluation of its allowance for
credit losses. Loans with a pass rating represent those loans
not classified on the Company’s rating scale for problem
credits, as minimal risk has been identified. Loans with a
special mention or classified rating, including loans that are
90 days or more past due and still accruing, nonaccrual
loans, those considered troubled debt restructurings
(“TDRs”), and loans in a junior lien position that are current
but are behind a modified or delinquent loan in a first lien
position, encompass all loans held by the Company that it
considers to have a potential or well-defined weakness that
40