Bank of America 2013 Annual Report Download - page 61

Bank of America 2013 59
consistent with the risk appetite. These risk teams also carry out
risk-based oversight of the enterprise control functions.
Independent business risk teams are responsible for
establishing policies, limits, standards, controls, metrics and
thresholds within the defined corporate standards for the
businesses to which they are aligned. The independent business
risk teams are also responsible for ensuring that risk limits and
standards are reasonable and consistent with the risk appetite.
Enterprise control functions are independent of the businesses
and have risk governance and control responsibilities for
enterprise programs. In this role, they are responsible for setting
policies, standards and limits; providing risk reporting; monitoring
systemic risk issues including existing and emerging; and
implementing procedures and controls at the enterprise and
business levels for their respective control functions.
The Corporate Audit function maintains independence from the
businesses and governance and control functions by reporting
directly to the Audit Committee of the Board. Corporate Audit
provides independent assessment and validation through testing
of key processes and controls across the Corporation. Corporate
Audit also provides an independent assessment of the
Corporation’s management and internal control systems.
Corporate Audit activities are designed to provide reasonable
assurance that resources are adequately protected; significant
financial, managerial and operating information is materially
complete, accurate and reliable; and employees’ actions are in
compliance with the Corporation’s policies, standards, procedures,
and applicable laws and regulations.
To assist the Corporation in achieving its goals and objectives,
risk appetite, and business and risk strategies, we utilize a risk
management process that is applied across the execution of all
business activities. This risk management process, which is an
integral part of our Risk Framework, enables the Corporation to
review risk in an integrated and comprehensive manner across all
risk categories and make strategic and business decisions based
on that comprehensive view. Corporate goals and objectives are
established by management, and management reflects these
goals and objectives in our risk appetite.
One of the key tools of the risk management process is the
use of Risk and Control Self Assessments (RCSAs). RCSAs are
the primary method for facilitating management of the business
environment and internal control factor data. The end-to-end RCSA
process incorporates risk identification and assessment of the
control environment; monitoring, reporting and escalating risk;
quality assurance and data validation; and integration with the risk
appetite. The RCSA process also incorporates documentation by
either the business or governance and control functions of the
business environment, risks, controls, and monitoring and
reporting. This results in a comprehensive risk management view
that enables understanding of and action on operational risks and
controls for all of our processes, products, activities and systems.
The formal processes used to manage risk represent a part of
our overall risk management process. Corporate culture and the
actions of our employees are also critical to effective risk
management. Through our Code of Conduct, we set a high standard
for our employees. The Code of Conduct provides a framework for
all of our employees to conduct themselves with the highest
integrity. We instill a strong and comprehensive risk management
culture through communications, training, policies, procedures,
and organizational roles and responsibilities. Additionally, we
continue to strengthen the link between the employee performance
management process and individual compensation to encourage
employees to work toward enterprise-wide risk goals.
Enterprise-wide Stress Testing
As a part of our core risk management practices, we conduct
enterprise-wide stress tests on a periodic basis to better
understand balance sheet, earnings, capital and liquidity
sensitivities to certain economic and business scenarios,
including economic and market conditions that are more severe
than anticipated. These enterprise-wide stress tests provide
illustrative hypothetical potential impacts from our risk profile on
our balance sheet, earnings, capital and liquidity and serve as a
key component of our capital, liquidity and risk management
practices. Scenarios are recommended by the Asset Liability and
Market Risk Committee (ALMRC) and approved by the CFO and
the CRO. Impacts to each business from each scenario are then
determined and analyzed, primarily by leveraging the models and
processes utilized in everyday management routines. Impacts are
assessed along with potential mitigating actions that may be
taken. Analysis from such stress scenarios is compiled for and
reviewed through our Chief Financial Officer Risk Committee
(CFORC), ALMRC and the Board’s Enterprise Risk Committee.
Contingency Planning Routines
We have developed and maintain contingency plans that prepare
us in advance to respond in the event of potential adverse
outcomes and scenarios. These contingency planning routines
include capital contingency planning, liquidity contingency funding
plans, recovery planning and enterprise resiliency, and provide
monitoring, escalation routines and response plans. Contingency
response plans are designed to enable us to increase capital,
access funding sources and reduce risk through consideration of
potential actions that includes asset sales, business sales, capital
or debt issuances and other de-risking strategies.
Board Oversight of Risk
The Board is comprised of a substantial majority of independent
directors. The Board is committed to strong, independent oversight
of management and risk through a governance structure that
includes Board committees and management committees. The
Board’s standing committees that oversee the management of the
majority of the risks faced by the Corporation include the Audit
and Enterprise Risk Committees, comprised of independent
directors, and the Credit Committee, comprised of non-
management directors. This governance structure is designed to
align the interests of the Board and management with those of
our shareholders and to foster integrity over risk management
throughout the Corporation.