Bank of America 2014 Annual Report Download - page 57

Bank of America 2014 55
and alerts to executive management, management-level
committees or the Board (directly or through an appropriate
committee).
Control – We establish and communicate risk limits and controls
through policies, standards, procedures and processes that
define the responsibilities and authority for risk taking. The
limits and controls can be adjusted by the Board or
management when conditions or risk tolerances warrant.
These limits may be absolute (e.g., loan amount, trading
volume) or relative (e.g., percentage of loan book in higher-risk
categories). Our lines of business are held accountable to
perform within the established limits.
Among the key tools in the risk management process are the
Risk and Control Self Assessments (RCSAs). The RCSA process,
consistent with IMMC, is one of our primary methods for capturing
the identification and assessment of operational risk exposures,
including inherent and residual operational risk ratings, and control
effectiveness ratings. The end-to-end RCSA process incorporates
risk identification and assessment of the control environment;
monitoring, reporting and escalating risk; quality assurance and
data validation; and integration with the risk appetite. This results
in a comprehensive risk management view that enables
understanding of and action on operational risks and controls for
our processes, products, activities and systems.
The formal processes used to manage risk represent a part of
our overall risk management process. Corporate culture and the
actions of our employees are also critical to effective risk
management. Through our Code of Conduct, we set a high standard
for our employees. The Code of Conduct provides a framework for
all of our employees to conduct themselves with the highest
integrity. We instill a strong and comprehensive risk management
culture through communications, training, policies, procedures,
and organizational roles and responsibilities. Additionally, we
continue to strengthen the link between the employee performance
management process and individual compensation to encourage
employees to work toward enterprise-wide risk goals.
Corporation-wide Stress Testing
As a part of our core risk management practices, we conduct
corporation-wide stress tests on a periodic basis to better
understand balance sheet, earnings, capital and liquidity
sensitivities to certain economic and business scenarios,
including economic and market conditions that are more severe
than anticipated. These corporation-wide stress tests provide
illustrative hypothetical potential impacts from our risk profile on
our balance sheet, earnings, capital and liquidity and serve as a
key component of our capital, liquidity and risk management
practices. Scenarios are recommended by the MRC and approved
by the CFO and the CRO. Impacts to each business from each
scenario are then determined and analyzed, primarily by leveraging
the models and processes utilized in everyday management
routines. Impacts are assessed along with potential mitigating
actions that may be taken. Analysis from such stress scenarios
is compiled for and reviewed by the MRC and ERC.
Contingency Planning Routines
We have developed and maintain contingency plans that are
designed to prepare us in advance to respond in the event of
potential adverse outcomes and scenarios. These contingency
planning routines include capital contingency planning, liquidity
contingency funding plans, recovery planning and enterprise
resiliency, and provide monitoring, escalation routines and
response plans. Contingency response plans are designed to
enable us to increase capital, access funding sources and reduce
risk through consideration of potential actions that include asset
sales, business sales, capital or debt issuances, and other de-
risking strategies.
Strategic Risk Management
Strategic risk is embedded in every business and is one of the
major risk categories along with credit, market, liquidity,
compliance, operational and reputational risks. It is the risk that
results from incorrect assumptions, unsuitable business plans,
ineffective strategy execution, or failure to respond in a timely
manner to changes in the regulatory, macroeconomic and
competitive environments, customer preferences, and technology
developments in the geographic locations in which we operate.
We face significant strategic risk due to the changing regulatory
environment and the fast-paced development of new products and
technologies in the financial services industries. Our appetite for
strategic risk is assessed based on the strategic plan, with
strategic risks selectively and carefully considered against the
backdrop of the evolving marketplace. Strategic risk is managed
in the context of our overall financial condition, risk appetite and
stress test results, among other considerations. The CEO and
executive management team manage and act on significant
strategic actions, such as divestitures, consolidation of legal
entities or capital actions subsequent to required review and
approval by the Board.
Executive management develops and approves a strategic plan
each year, which is reviewed and approved by the Board. Annually,
executive management develops a financial operating plan, which
is reviewed and approved by the Board, that implements the
strategic goals for that year. With oversight by the Board, executive
management ensures that consistency is applied while executing
the Corporation’s strategic plan, core operating tenets and risk
appetite. The following are assessed in the executive reviews:
forecasted earnings and returns on capital, the current risk profile,
current capital and liquidity requirements, staffing levels and
changes required to support the plan, stress testing results, and
other qualitative factors such as market growth rates and peer
analysis. At the business level, as we introduce new products, we
monitor their performance relative to expectations (e.g., for
earnings and returns on capital). With oversight by the Board and
the ERC, executive management performs similar analyses
throughout the year, and evaluates changes to the financial
forecast or the risk, capital or liquidity positions as deemed
appropriate to balance and optimize achieving the targeted risk
appetite, shareholder returns and maintaining the targeted
financial strength.
We use proprietary models to measure the capital requirements
for credit, country, market, operational and strategic risks. The
allocated capital assigned to each business is based on its unique
risk exposures. With oversight by the Board, executive
management assesses the risk-adjusted returns of each business
in approving strategic and financial operating plans. The
businesses use allocated capital to define business strategies,
and price products and transactions. For more information on how
this measure is calculated, see Supplemental Financial Data on
page 29.