US Bank 2015 Annual Report Download - page 60

Residual Value Risk Management The Company manages
its risk to changes in the residual value of leased assets
through disciplined residual valuation setting at the inception of
a lease, diversification of its leased assets, regular residual
asset valuation reviews and monitoring of residual value gains
or losses upon the disposition of assets. Commercial lease
originations are subject to the same well-defined underwriting
standards referred to in the “Credit Risk Management” section
which includes an evaluation of the residual value risk. Retail
lease residual value risk is mitigated further by originating
longer-term vehicle leases and effective end-of-term marketing
of off-lease vehicles.
Included in the retail leasing portfolio was approximately
$4.4 billion of retail leasing residuals at December 31, 2015,
compared with $4.8 billion at December 31, 2014. The
Company monitors concentrations of leases by manufacturer
and vehicle “make and model.” As of December 31, 2015,
vehicle lease residuals related to sport utility vehicles were 36.4
percent of the portfolio, while auto and crossover vehicle
classes represented approximately 32.7 percent and 20.0
percent of the portfolio, respectively. At year-end 2015, the
largest vehicle-type concentration represented 7.4 percent of
the aggregate residual value of the vehicles in the portfolio. At
December 31, 2015, the weighted-average origination term of
the portfolio was 40 months, compared with 39 months at
December 31, 2014. At December 31, 2015, the commercial
leasing portfolio had $511 million of residuals, compared with
$543 million at December 31, 2014. At year-end 2015, lease
residuals related to trucks and other transportation equipment
were 30.7 percent of the total residual portfolio. Business and
office equipment represented 30.3 percent of the aggregate
portfolio, and railcars represented 12.7 percent. No other
concentrations of more than 10 percent existed at December
31, 2015.
Operational Risk Management Operational risk is the risk of
loss resulting from inadequate or failed internal processes,
people,orsystems,orfromexternal events, including the risk of
loss resulting from fraud, litigation and breaches in data security.
The Company operates in many different businesses in diverse
markets and relies on the ability of its employees and systems to
process a high number of transactions. Operational risk is
inherent in all business activities, and the management of this
risk is important to the achievement of the Company’s
objectives. Business lines have direct and primary responsibility
and accountability for identifying, controlling, and monitoring
operational risks embedded in their business activities. The
Company maintains a system of controls with the objective of
providing proper transaction authorization and execution, proper
system operations, proper oversight of third parties with whom it
does business, safeguarding of assets from misuse or theft, and
ensuring the reliability and security of financial and other data.
Business continuation and disaster recovery planning is
also critical to effectively managing operational risks. Each
business unit of the Company is required to develop, maintain
and test these plans at least annually to ensure that recovery
activities, if needed, can support mission critical functions,
including technology, networks and data centers supporting
customer applications and business operations.
While the Company believes it has designed effective
processes to minimize operational risks, there is no absolute
assurance that business disruption or operational losses
would not occur from an external event or internal control
breakdown. On an ongoing basis, management makes
process changes and investments to enhance its systems of
internal controls and business continuity and disaster recovery
plans.
In the past, the Company has experienced attack attempts
on its computer systems including various denial-of-service
attacks on customer-facing websites. The Company has not
experienced any material losses relating to these attempts, as
a result of its controls, processes and systems to protect its
networks, computers, software and data from attack, damage
or unauthorized access. However, attack attempts on the
Company’s computer systems are increasing and the
Company continues to develop and enhance its controls and
processes to protect against these attempts.
Compliance Risk Management The Company may suffer
legal or regulatory sanctions, material financial loss, or damage
to reputation through failure to comply with laws, regulations,
rules, standards of good practice, and codes of conduct,
including those related to compliance with Bank Secrecy Act/
anti-money laundering requirements, sanctions compliance
requirements as administered by the Office of Foreign Assets
Control, and other requirements. The Company has controls
and processes in place for the assessment, identification,
monitoring, management and reporting of compliance risks
and issues.
The significant increase in regulation and regulatory
oversight initiatives over the past several years has
substantially increased the importance of the Company’s
compliance risk management personnel and activities. For
example, the Consumer Financial Protection Bureau (“CFPB”)
has authority to prescribe rules, or issue orders or guidelines
pursuant to any federal consumer financial law. The CFPB
regulates and examines the Company, its bank and other
subsidiaries with respect to matters that relate to these laws
and consumer financial services and products. The CFPB’s
rulemaking, examination and enforcement authority increases
enforcement risk in this area including the potential for fines
and penalties. Refer to “Supervision and Regulation” in the
Company’s Annual Report on Form 10-K for further
discussion of the regulatory framework applicable to bank
—58 —