Bank of America 2013 Annual Report Download - page 115

Bank of America 2013 113
identifying, measuring, mitigating, controlling, monitoring, testing
and reviewing operational risk, and reporting operational risk
information to management and the Board. A sound internal
governance structure enhances the effectiveness of the
Corporation’s Operational Risk Management Program and is
accomplished at the enterprise level through formal oversight by
the Board, the CRO and a variety of management committees and
risk oversight groups aligned to the Corporation’s overall risk
governance framework and practices. Of these, the Compliance
and Operational Risk Committee (CORC) oversees the
Corporation’s policies and processes for sound operational risk
management. The CORC also serves as an escalation point for
critical operational risk matters within the Corporation. The CORC
reports operational risk activities to the Enterprise Risk Committee
of the Board.
Within the Global Risk Management organization, the
Corporate Operational Risk team develops and guides the
strategies, policies, practices, controls and monitoring tools for
assessing and managing operational risks across the organization
and reports results to businesses, enterprise control functions,
senior management, governance committees and the Board.
Corporate Audit provides independent assessment and
validation through testing of key processes and controls across
the Corporation. An annual Audit Plan ensures that coverage
activities address the significant aspects of the Corporation’s risk
profile. Risk assessments incorporating operational risk are
completed within the audit planning process.
The business and enterprise control functions are responsible
for managing all the risks within their units, including operational
risks. In addition to enterprise risk management tools such as
loss reporting, scenario analysis and RCSAs, operational risk
executives, working in conjunction with senior business
executives, have developed key tools to help identify, measure,
mitigate and monitor risk in each business and enterprise control
function. Examples of these include personnel management
practices; data reconciliation processes; fraud management units;
cybersecurity controls, processes and systems; transaction
processing, monitoring and analysis; business recovery planning;
and new product introduction processes. The business and
enterprise control functions are also responsible for consistently
implementing and monitoring adherence to corporate practices.
Business and enterprise control function management uses
the enterprise RCSA process to identify and evaluate the status
of risk and control issues including mitigation plans, as
appropriate. The goals of this process are to assess changing
market and business conditions, evaluate key risks impacting each
business and enterprise control function and assess the controls
in place to mitigate the risks. Key operational risk indicators for
these risks have been developed and are used to assist in
identifying trends and issues on an enterprise, business and
enterprise control function level. Independent review and challenge
to the Corporation’s overall operational risk management
framework is performed by the Corporate Operational Risk
Validation Team.
Enterprise control functions have risk governance and control
responsibilities for their enterprise programs (e.g., Global
Technology and Operations Group, CFO Group, Global Marketing
and Corporate Affairs, Global Human Resources). They provide
insights on day-to-day risk activities throughout the Corporation by
overseeing and managing the performance of their functions
against Corporation-wide expectations. The enterprise control
functions participate in the operational risk management process
in two ways. First, these organizations manage risk in their
functional department. Second, they provide specialized risk
management services (e.g., information management, vendor
management) within their area of expertise to the enterprise,
businesses and other enterprise control functions they support.
These groups also work with business and risk executives to
develop and guide appropriate strategies, policies, practices,
controls and monitoring tools for each business and enterprise
control function relative to these programs.
Where appropriate, insurance policies are purchased to
mitigate the impact of operational losses. These insurance
policies are explicitly incorporated in the structural features of
operational risk evaluation. As insurance recoveries, especially
given recent market events, are subject to legal and financial
uncertainty, the inclusion of these insurance policies is subject to
reductions in their expected mitigating benefits.
Complex Accounting Estimates
Our significant accounting principles, as described in Note 1 –
Summary of Significant Accounting Principles to the Consolidated
Financial Statements are essential in understanding the MD&A.
Many of our significant accounting principles require complex
judgments to estimate the values of assets and liabilities. We
have procedures and processes in place to facilitate making these
judgments.
The more judgmental estimates are summarized in the following
discussion. We have identified and described the development of
the variables most important in the estimation processes that
involve mathematical models to derive the estimates. In many
cases, there are numerous alternative judgments that could be
used in the process of determining the inputs to the models. Where
alternatives exist, we have used the factors that we believe
represent the most reasonable value in developing the inputs.
Actual performance that differs from our estimates of the key
variables could impact our results of operations. Separate from
the possible future impact to our results of operations from input
and model variables, the value of our lending portfolio and market-
sensitive assets and liabilities may change subsequent to the
balance sheet date, often significantly, due to the nature and
magnitude of future credit and market conditions. Such credit and
market conditions may change quickly and in unforeseen ways and
the resulting volatility could have a significant, negative effect on
future operating results. These fluctuations would not be indicative
of deficiencies in our models or inputs.
Allowance for Credit Losses
The allowance for credit losses, which includes the allowance for
loan and lease losses and the reserve for unfunded lending
commitments, represents management’s estimate of probable
losses inherent in the Corporation’s loan portfolio excluding those
loans accounted for under the fair value option. Our process for
determining the allowance for credit losses is discussed in Note
1 – Summary of Significant Accounting Principles to the
Consolidated Financial Statements. We evaluate our allowance at
the portfolio segment level and our portfolio segments are Home
Loans, Credit Card and Other Consumer, and Commercial. Due to
the variability in the drivers of the assumptions used in this
process, estimates of the portfolio’s inherent risks and overall
collectability change with changes in the economy, individual
industries, countries, and borrowers’ ability and willingness to
repay their obligations. The degree to which any particular