Bank of America 2011 Annual Report Download - page 66

64 Bank of America 2011
established by management, and management reflects these
goals and objectives in our risk appetite which is approved by the
Board and serves as a key driver for setting business and risk
strategy.
One of the key tools of the risk management process is the
use of Risk and Control Self Assessments (RCSAs). RCSAs are
the primary method for facilitating the management of Business
Environment and Internal Control Factor data. The end-to-end RCSA
process incorporates risk identification and assessment of the
control environment; monitoring, reporting and escalating risk;
quality assurance and data validation; and integration with the risk
appetite. The RCSA process also incorporates documentation by
either the business or governance and control functions of the
business environment, risks, controls, and monitoring and
reporting. This results in a comprehensive risk management view
that enables understanding of and action on operational risks and
controls for all of our processes, products, activities and systems.
The formal processes used to manage risk represent a part of
our overall risk management process. Corporate culture and the
actions of our employees are also critical to effective risk
management. Through our Code of Ethics, we set a high standard
for our employees. The Code of Ethics provides a framework for
all of our employees to conduct themselves with the highest
integrity. We instill a strong and comprehensive risk management
culture through communications, training, policies, procedures,
and organizational roles and responsibilities. Additionally, we
continue to strengthen the link between the employee performance
management process and individual compensation to encourage
employees to work toward enterprise-wide risk goals.
Board Oversight of Risk
The Board, comprised of a majority of independent directors,
including an independent Chairman of the Board, oversees the
management of the Corporation through a governance structure
that includes Board committees and management committees.
The Board’s standing committees that oversee the management
of the majority of the risks faced by the Corporation include the
Audit and Enterprise Risk Committees, comprised of independent
directors, and the Credit Committee, comprised of non-
management directors. This governance structure is designed to
align the interests of the Board and management with those of
our stockholders and to foster integrity throughout the Corporation.
The chart below illustrates the inter-relationship between the
Board, Board committees and management committees with the
majority of risk oversight responsibilities for the Corporation.
(1) Compliance Risk activities, including Ethics Oversight, are required to be reviewed by the Audit Committee and Operational Risk activities are required to be reviewed by the Enterprise Risk Committee.
(2) The Disclosure Committee assists the CEO and CFO in fulfilling their responsibility for the accuracy and timeliness of the Corporation’s disclosures and reports the results of the process to the Audit
Committee.
Board of Directors
Board Level
Committees
Management
Level
Committees
Credit
Committee
Enterprise
Risk
Committee
Audit
Committee
Corporate
Governance
Committee
Compensation
and Benefits
Committee
Credit Risk
Committee
Asset Liability
and Market
Risk
Committee
Compensation
Committee
Benefits
Committee
Executive
Committee
Enterprise
Credit Risk
Policy
Committee
Allowance for
Credit Losses
Committee
Enterprise
Portfolio
Strategies
Steering Co.
International
Governance
and Control
Committee
Ethics
Oversight
Committee
Operational &
Compliance
Risk
Committee
CFO Risk
Committee
Enterprise
Model Risk
Control
Committee
Operational
Risk
Committee (1)
Disclosure
Committee (2)
Regional Risk
Committee
Risk Rating
Executive
Oversight
Committee
Enterprise
Mortgage Risk
Committee
Global Markets
Risk
Committee
Insider
Oversight and
Monitoring
Committee