Bank of America 2012 Annual Report Download - page 119

Bank of America 2012 117
We approach operational risk management from two
perspectives to manage operational risk within the structure of
the Corporation: (1) at the enterprise level to provide independent,
integrated management of operational risk across the
organization, and (2) at the business and enterprise control
function levels to address operational risk in revenue producing
and non-revenue producing units. The Operational Risk
Management Program incorporates the overarching processes for
identifying, measuring, mitigating, controlling, monitoring, testing,
reviewing operational risk, and reporting operational risk
information to management and the Board. A sound internal
governance structure enhances the effectiveness of the
Corporation’s Operational Risk Management Program and is
accomplished at the enterprise level through formal oversight by
the Board, the CRO and a variety of management committees and
risk oversight groups aligned to the Corporation’s overall risk
governance framework and practices. Of these, the Compliance
and Operational Risk Committee (CORC) oversees the
Corporation’s policies and processes for sound operational risk
management. The CORC also serves as an escalation point for
critical operational risk matters within the Corporation. The CORC
reports operational risk activities to the Enterprise Risk Committee
of the Board.
Within the Global Risk Management organization, the
Corporate Operational Risk team develops and guides the
strategies, policies, practices, controls and monitoring tools for
assessing and managing operational risks across the organization
and reports results to businesses, enterprise control functions,
senior management, governance committees and the Board.
Corporate Audit provides independent assessment and
validation through testing of key processes and controls across
the Corporation. An annual Audit Plan ensures that coverage
activities address the significant aspects of the Corporation’s risk
profile. Risk assessments incorporating operational risk are
completed within the audit planning process.
The business and enterprise control functions are responsible
for managing all the risks within their units, including operational
risks. In addition to enterprise risk management tools such as
loss reporting, scenario analysis and RCSAs, operational risk
executives, working in conjunction with senior business
executives, have developed key tools to help identify, measure,
mitigate and monitor risk in each business and enterprise control
function. Examples of these include personnel management
practices; data reconciliation processes; fraud management units;
transaction processing, monitoring and analysis; business
recovery planning; and new product introduction processes. The
business and enterprise control functions are also responsible for
consistently implementing, and monitoring adherence to,
corporate practices.
Business and enterprise control function management uses
the enterprise RCSA process to identify and evaluate the status
of risk and control issues, including mitigation plans, as
appropriate. The goals of this process are to assess changing
market and business conditions, evaluate key risks impacting each
business and enterprise control function and assess the controls
in place to mitigate the risks. The RCSA process is documented
at periodic intervals. Key operational risk indicators for these risks
have been developed and are used to help identify trends and
issues on an enterprise, business and enterprise control function
level. Independent review and challenge to the Corporation’s
overall operational risk management framework is performed by
the Corporate Operational Risk Validation Team.
Enterprise control functions have risk governance and control
responsibilities for their enterprise programs (e.g., Global
Technology and Operations Group, Chief Financial Officer Group,
Global Marketing and Corporate Affairs, Global Human Resources).
They provide insights on day-to-day risk activities throughout the
Company by overseeing and managing the performance of their
functions against Company-wide expectations. The enterprise
control functions participate in the operational risk management
process in two ways. First, these organizations manage risk in their
functional department. Second, they provide specialized risk
management services (e.g., information management, vendor
management) within their area of expertise to the enterprise,
businesses and other enterprise control functions they support.
These groups also work with business and risk executives to
develop and guide appropriate strategies, policies, practices,
controls and monitoring tools for each business and enterprise
control function relative to these programs.
Additionally, where appropriate, insurance policies are
purchased to mitigate the impact of operational losses. These
insurance policies are explicitly incorporated in the structural
features of operational risk evaluation. As insurance recoveries,
especially given recent market events, are subject to legal and
financial uncertainty, the inclusion of these insurance policies is
subject to reductions in their expected mitigating benefits.
Complex Accounting Estimates
Our significant accounting principles, as described in Note 1 –
Summary of Significant Accounting Principles to the Consolidated
Financial Statements are essential in understanding the MD&A.
Many of our significant accounting principles require complex
judgments to estimate the values of assets and liabilities. We
have procedures and processes in place to facilitate making these
judgments.
The more judgmental estimates are summarized in the following
discussion. We have identified and described the development of
the variables most important in the estimation processes that
involve mathematical models to derive the estimates. In many
cases, there are numerous alternative judgments that could be
used in the process of determining the inputs to the models. Where
alternatives exist, we have used the factors that we believe
represent the most reasonable value in developing the inputs.
Actual performance that differs from our estimates of the key
variables could impact our results of operations. Separate from
the possible future impact to our results of operations from input
and model variables, the value of our lending portfolio and market-
sensitive assets and liabilities may change subsequent to the
balance sheet date, often significantly, due to the nature and
magnitude of future credit and market conditions. Such credit and
market conditions may change quickly and in unforeseen ways and
the resulting volatility could have a significant, negative effect on
future operating results. These fluctuations would not be indicative
of deficiencies in our models or inputs.
Allowance for Credit Losses
The allowance for credit losses, which includes the allowance for
loan and lease losses and the reserve for unfunded lending
commitments, represents management’s estimate of probable
losses inherent in the Corporation’s loan portfolio excluding those
loans accounted for under the fair value option. Changes to the
allowance for credit losses are reported in the Corporation’s
Consolidated Statement of Income in the provision for credit