Bank of America 2010 Annual Report Download - page 67

enterprise and line of business levels for their respective control functions.
Enterprise control functions consist of the Chief Financial Officer group, Global
Technology and Operations, Global Human Resources, Global Marketing and
Corporate Affairs, and Legal.
The Corporate Audit function and the Corporate General Auditor maintain
independence from the lines of business and governance and control func-
tions by reporting directly to the Audit Committee of the Board. Corporate
Audit provides independent assessment and validation through testing of key
processes and controls across the Corporation. Corporate Audit provides an
independent assessment of the Corporation’s management and internal
control systems. Corporate Audit activities are designed to provide reason-
able assurance that resources are adequately protected; significant financial,
managerial and operating information is materially complete, accurate and
reliable; and employees’ actions are in compliance with the Corporation’s
policies, standards, procedures, and applicable laws and regulations.
To ensure that the Corporation’s goals and objectives, risk appetite, and
business and risk strategies are achieved, we utilize a risk management
process that is applied across the execution of all business activities. This risk
management process, which is an integral part of our Risk Framework,
enables the Corporation to review risk in an integrated and comprehensive
manner across all risk categories and make strategic and business decisions
based on that comprehensive view. Corporate goals and objectives and our
risk appetite are established by management, approved by the Board, and are
key drivers to setting business and risk strategy.
One of the key tools of the risk management process is the use of Risk and
Control Self Assessments (RCSAs). RCSAs are the primary method for facili-
tating the management of Business Environment and Internal Control Factor
(BEICF) data. The end-to-end RCSA process incorporates risk identification and
assessment of the control environment; monitoring, reporting and escalating
risk; quality assurance and data validation; and integration with the risk appe-
tite. The RCSA process also incorporates documentation by either the line of
business or enterprise control function of the business environment, risks,
controls, and monitoring and reporting. This results in a comprehensive risk
management view that enables understanding of and action on operational
risks and controls for all of our processes, products, activities and systems.
The formal processes used to manage risk represent a part of our overall
risk management process. Corporate culture and the actions of our associates
are also critical to effective risk management. Through our Code of Ethics, we
set a high standard for our associates. The Code of Ethics provides a framework
for all of our associates to conduct themselves with the highest integrity in the
delivery of our products or services to our customers. We instill a strong and
comprehensive risk management culture through communications, training,
policies, procedures, and organizational roles and responsibilities. Additionally,
we continue to strengthen the link between the associate performance man-
agement process and individual compensation to encourage associates to work
toward enterprise-wide risk goals.
Board Oversight of Risk
We maintain a governance structure that delineates the responsibilities for
risk management activities, as well as governance and oversight of those
activities, by management and the Board. The majority of our directors,
including the Chairman of the Board, are considered independent and meet
the requirements of our Director Independence Categorical Standards and the
criteria for independence in the listing standards of the New York Stock
Exchange. Also, all members of the Audit and Enterprise Risk Committees
are independent and all members of the Credit Committee are non-manage-
ment directors.
The Board is responsible for the oversight of the management of the
Corporation. As part of its oversight, the Board oversees the management of
the various types of risk faced by the Corporation. Our corporate risk man-
agement governance structure is designed to align the interests of the Board
and management with those of our stockholders and to foster integrity
throughout the Corporation.
The Board, under the leadership of its independent Chairman, oversees
the management of the Corporation through the governance structure, which
includes Board committees and management committees. The Board main-
tains standing committees to oversee risk. The committees with the majority
of risk oversight responsibilities include the Credit, Enterprise Risk and Audit
Committees.
Bank of America 2010 65