Bank of America 2014 Annual Report Download - page 108

106 Bank of America 2014
Operational Risk Management
The Corporation defines operational risk as the risk of loss
resulting from inadequate or failed internal processes, people and
systems or from external events. Operational risk may occur
anywhere in the Corporation, including outsourced business
processes, and is not limited to operations functions. Its effects
may extend beyond financial losses. Operational risk includes legal
risk. Successful operational risk management is particularly
important to diversified financial services companies because of
the nature, volume and complexity of the financial services
business. Operational risk is a significant component in the
calculation of total risk-weighted assets used in the Basel 3 capital
estimate under the Advanced approaches. For more information
on Basel 3 Advanced approaches, see Capital Management –
Advanced Approaches on page 58.
We approach operational risk management from two
perspectives within the structure of the Corporation: (1) at the
enterprise level to provide independent, integrated management
of operational risk across the organization, and (2) at the business
and control function levels to address operational risk in revenue
producing and non-revenue producing units. The Operational Risk
Management Program addresses the overarching processes for
identifying, measuring, monitoring and controlling operational risk,
and reporting operational risk information to management and the
Board. A sound internal governance structure enhances the
effectiveness of the Corporation’s Operational Risk Management
Program and is accomplished at the enterprise level through formal
oversight by the Board, the ERC, the CRO and a variety of
management committees and risk oversight groups aligned to the
Corporation’s overall risk governance framework and practices. Of
these, the MRC oversees the Corporation’s policies and processes
for sound operational risk management. The MRC also serves as
an escalation point for critical operational risk matters within the
Corporation. The MRC reports operational risk activities to the
ERC. The independent operational risk management teams
oversee the businesses and control functions to monitor
adherence to the Operational Risk Management Program and
advise and challenge operational risk exposures.
Within the Global Risk Management organization, the
Corporate Operational Risk team develops and guides the
strategies, enterprise-wide policies, practices, controls and
monitoring tools for assessing and managing operational risks
across the organization and reports results to businesses, control
functions, senior management, governance committees and the
ERC and the Board.
The businesses and control functions are responsible for
assessing, monitoring and managing all the risks within their units,
including operational risks. In addition to enterprise risk
management tools such as loss reporting, scenario analysis and
RCSAs, operational risk executives, working in conjunction with
senior business executives, have developed key tools to help
identify, measure, monitor and control risk in each business and
control function. Examples of these include personnel
management practices; data reconciliation processes; fraud
management units; cybersecurity controls, processes and
systems; transaction processing, monitoring and analysis;
business recovery planning; and new product introduction
processes. The business and control functions are also
responsible for consistently implementing and monitoring
adherence to corporate practices.
Business and control function management uses the
enterprise RCSA process to capture the identification and
assessment of operational risk exposures and evaluate the status
of risk and control issues including mitigation plans, as
appropriate. The goals of this process are to assess changing
market and business conditions, evaluate key risks impacting each
business and control function, and assess the controls in place
to mitigate the risks. Key operational risk indicators for these risks
have been developed and are used to assist in identifying trends
and issues on an enterprise, business and control function level.
Independent review and challenge to the Corporation’s overall
operational risk management framework is performed by the
Corporate Operational Risk Program Adherence Team and reported
through the operational risk governance committees and
management routines.
Where appropriate, insurance policies are purchased to
mitigate the impact of operational losses. These insurance
policies are explicitly incorporated in the structural features of
operational risk evaluation. As insurance recoveries, especially
given recent market events, are subject to legal and financial
uncertainty, the inclusion of these insurance policies is subject to
reductions in their expected mitigating benefits.
Complex Accounting Estimates
Our significant accounting principles, as described in Note 1 –
Summary of Significant Accounting Principles to the Consolidated
Financial Statements, are essential in understanding the MD&A.
Many of our significant accounting principles require complex
judgments to estimate the values of assets and liabilities. We
have procedures and processes in place to facilitate making these
judgments.
The more judgmental estimates are summarized in the following
discussion. We have identified and described the development of
the variables most important in the estimation processes that
involve mathematical models to derive the estimates. In many
cases, there are numerous alternative judgments that could be
used in the process of determining the inputs to the models. Where
alternatives exist, we have used the factors that we believe
represent the most reasonable value in developing the inputs.
Actual performance that differs from our estimates of the key
variables could impact our results of operations. Separate from
the possible future impact to our results of operations from input
and model variables, the value of our lending portfolio and market-
sensitive assets and liabilities may change subsequent to the
balance sheet date, often significantly, due to the nature and
magnitude of future credit and market conditions. Such credit and
market conditions may change quickly and in unforeseen ways and
the resulting volatility could have a significant, negative effect on
future operating results. These fluctuations would not be indicative
of deficiencies in our models or inputs.
Allowance for Credit Losses
The allowance for credit losses, which includes the allowance for
loan and lease losses and the reserve for unfunded lending
commitments, represents management’s estimate of probable
losses inherent in the Corporation’s loan portfolio excluding those
loans accounted for under the fair value option. Our process for
determining the allowance for credit losses is discussed in Note
1 – Summary of Significant Accounting Principles to the
Consolidated Financial Statements. We evaluate our allowance at
the portfolio segment level and our portfolio segments are Home
Loans, Credit Card and Other Consumer, and Commercial. Due to
the variability in the drivers of the assumptions used in this