Bank of America 2014 Annual Report Download - page 56

54 Bank of America 2014
Management Committees
Management committees may receive their authority from the
Board, a Board committee, another management committee or
from one or more executive officers. The primary management-
level risk committee for the Corporation is the Management Risk
Committee (MRC). Subject to Board oversight, the MRC is
responsible for management oversight of all key risks facing the
Corporation. The MRC provides management oversight of the
Corporation’s credit portfolio, compliance and operational risk
programs, balance sheet and capital management, funding
activities and other liquidity activities, stress testing, trading
activities, recovery and resolution planning, model risk, subsidiary
governance and activities between banks and their nonbank
affiliates pursuant to Federal Reserve rules and regulations. The
MRC is responsible for holistic risk management, including an
integrated evaluation of risk, earnings, capital and liquidity, and it
reports on these matters to the Board or Board committees.
Lines of Defense
In addition to the role of Executive Officers in managing risk, we
have clear ownership and accountability across the three lines of
defense: FLUs, independent risk management and Corporate
Audit. The Corporation also has control functions outside of FLUs
and independent risk management (e.g., Legal and Global Human
Resources). The three lines of defense are integrated into our
management-level governance structure. Each of these is
described in more detail below.
Executive Officers
Executive officers lead various functions representing the
functional roles. Authority for functional roles may be delegated
to executive officers from the Board, Board committees or
management-level committees. Executive officers, in turn, may
further delegate responsibilities, as appropriate, to management-
level committees, management routines or individuals. Executive
officers review the Corporation’s activities for consistency with our
Risk Framework, Risk Appetite Statement, and applicable
strategic, capital and financial operating plans, as well as
applicable policies, standards, procedures and processes.
Executive officers and other employees make decisions
individually on a day-to-day basis, consistent with the authority they
have been delegated. Executive officers and other employees may
also serve on committees and participate in committee decisions.
Front Line Units
FLUs include the lines of business and two organizational units,
the Global Technology and Operations Group and Strategic
Initiatives. FLUs are held accountable by the CEO and the Board
for appropriately assessing and effectively managing all of the
risks associated with their activities.
Two organizational units that include FLU and control function
activities, but are not part of independent risk management are
the Chief Financial Officer (CFO) Group and Global Marketing and
Corporate Affairs (GM&CA).
Independent Risk Management
Independent risk management (IRM) is part of our control functions
and includes Global Risk Management and Global Compliance.
We have other control functions that are not part of IRM (other
control functions may also provide oversight to FLU activities),
including Legal, Global Human Resources and certain activities
within the CFO Group, and GM&CA. IRM, led by the CRO, is
responsible for independently assessing and overseeing risks
within FLUs and other control functions. IRM establishes written
enterprise policies and procedures that include concentration risk
limits where appropriate. Such policies and procedures outline
how aggregate risks are identified, measured, monitored and
controlled.
The CRO has the authority and independence to develop and
implement a meaningful risk management framework. The CRO
has unrestricted access to the Board and reports directly to both
the ERC and to the CEO. Global Risk Management is organized
into enterprise risk teams and FLU risk teams that work
collaboratively in executing their respective duties.
Within IRM, Global Compliance independently assesses
compliance risk, and evaluates adherence to applicable laws, rules
and regulations, including identifying compliance issues and risks,
performing monitoring and testing, and reporting on the state of
compliance activities across the Corporation. Additionally, Global
Compliance works with FLUs and control functions so that day-to-
day activities operate in a compliant manner.
Corporate Audit
Corporate Audit and the CGA maintain their independence from
the FLUs, IRM and other control functions by reporting directly to
the Audit Committee. The CGA administratively reports to the CEO.
Corporate Audit provides independent assessment and validation
through testing of key processes and controls across the
Corporation. Corporate Audit includes Credit Review which
periodically tests and examines credit portfolios and processes.
Risk Management Processes
The Corporation’s Risk Framework requires that strong risk
management practices are integrated in key strategic, capital and
financial planning processes and day-to-day business processes
across the Corporation, with a goal of ensuring risks are
appropriately considered, evaluated and responded to in a timely
manner.
We employ a risk management process, referred to as IMMC:
Identify, Measure, Monitor and Control, as part of our daily
activities.
Identify – To be effectively managed, risks must be clearly defined
and proactively identified. Proper risk identification focuses on
recognizing and understanding all key risks inherent in our
business activities and risks that may arise from business
initiatives or external factors. Risk identification is an ongoing
process occurring at both the individual transaction and
portfolio level. Each employee is expected to identify and
escalate risks promptly.
Measure – Once a risk is identified, it must be measured. Risk is
measured at various levels including, but not limited to, risk
type, FLU, legal entity and on an aggregate basis. These metrics
help us assess our risk profile and adherence to our risk
appetite.
Monitor – We monitor risk levels regularly to track adherence to
risk appetites, policies, standards, procedures and processes.
Through our monitoring, we can determine our level of risk
relative to limits and can take action in a timely manner. We
also can determine when risk limits are breached and have
processes to appropriately report and escalate exceptions.
This includes immediate requests for approval to managers