Bank of America 2015 Annual Report Download - page 51

Bank of America 2015 49
Each of the committees shown on the above chart regularly
reports to the Board on risk-related matters within the committee’s
responsibilities, which is intended to collectively provide the Board
with integrated, thorough insight about our management of
enterprise-wide risks.
Enterprise Risk Committee
The Enterprise Risk Committee (ERC) has primary responsibility
for oversight of the Risk Framework and material risks facing the
Corporation. It approves the Risk Framework and the Risk Appetite
Statement and further recommends these documents to the Board
for approval. The ERC oversees senior management’s
responsibilities for the identification, measurement, monitoring
and control of all key risks facing the Corporation. The ERC may
consult with other Board committees on risk-related matters.
Audit Committee
The Audit Committee oversees the qualifications, performance and
independence of the Independent Registered Public Accounting
Firm, the performance of the Corporation’s corporate audit
function, the integrity of the Corporation’s consolidated financial
statements, compliance by the Corporation with legal and
regulatory requirements, and makes inquiries of management or
the Corporate General Auditor (CGA) to determine whether there
are scope or resource limitations that impede the ability of
Corporate Audit to execute its responsibilities. The Audit
Committee is also responsible for overseeing compliance risk
pursuant to the New York Stock Exchange listing standards.
Credit Committee
The Credit Committee provides additional oversight of senior
management’s responsibilities for the identification and
management of Corporation-wide credit exposures. Our Credit
Committee oversees, among other things, the identification and
management of our credit exposures on an enterprise-wide basis,
our responses to trends affecting those exposures, the adequacy
of the allowance for credit losses and our credit-related policies.
Other Board Committees
Our Corporate Governance Committee oversees our Board’s
governance processes, identifies and reviews the qualifications of
potential Board members, recommends nominees for election to
our Board, recommends committee appointments for Board
approval and reviews our stockholder engagement activities.
Our Compensation and Benefits Committee oversees
establishing, maintaining and administering our compensation
programs and employee benefit plans, including approving and
recommending our Chief Executive Officer’s (CEO) compensation
to our Board for further approval by all independent directors, and
reviewing and approving all of our executive officers’
compensation.
Management Committees
Management committees may receive their authority from the
Board, a Board committee, another management committee or
from one or more executive officers. The primary management-
level risk committee for the Corporation is the Management Risk
Committee (MRC). Subject to Board oversight, the MRC is
responsible for management oversight of all key risks facing the
Corporation. The MRC provides management oversight of the
Corporation’s compliance and operational risk programs, balance
sheet and capital management, funding activities and other
liquidity activities, stress testing, trading activities, recovery and
resolution planning, model risk, subsidiary governance and
activities between member banks and their nonbank affiliates
pursuant to Federal Reserve rules and regulations. The MRC is
responsible for holistic risk management, including an integrated
evaluation of risk, earnings, capital and liquidity, and it reports on
these matters to the Board or Board committees.
Lines of Defense
In addition to the role of Executive Officers in managing risk, we
have clear ownership and accountability across the three lines of
defense: FLUs, independent risk management and Corporate
Audit. The Corporation also has control functions outside of FLUs
and independent risk management (e.g., Legal and Global Human
Resources). The three lines of defense are integrated into our
management-level governance structure. Each of these is
described in more detail below.
Executive Officers
Executive officers lead various functions representing the
functional roles. Authority for functional roles may be delegated
to executive officers from the Board, Board committees or
management-level committees. Executive officers, in turn, may
further delegate responsibilities, as appropriate, to management-
level committees, management routines or individuals. Executive
officers review the Corporation’s activities for consistency with our
Risk Framework, Risk Appetite Statement, and applicable
strategic, capital and financial operating plans, as well as
applicable policies, standards, procedures and processes.
Executive officers and other employees make decisions
individually on a day-to-day basis, consistent with the authority they
have been delegated. Executive officers and other employees may
also serve on committees and participate in committee decisions.
Front Line Units
FLUs include the lines of business and an organizational unit, the
Global Technology and Operations Group. FLUs are held
accountable by the CEO and the Board for appropriately assessing
and effectively managing all of the risks associated with their
activities.
Three organizational units that include FLU and control function
activities, but are not part of independent risk management are
the Chief Financial Officer (CFO) Group, Global Marketing and
Corporate Affairs (GM&CA) and the Chief Administrative Officer
(CAO) Group.
Independent Risk Management
Independent risk management (IRM) is part of our control functions
and includes Global Risk Management and Global Compliance.
We have other control functions that are not part of IRM (other
control functions may also provide oversight to FLU activities),
including Legal, Global Human Resources and certain activities
within the CFO Group, GM&CA and the CAO Group. IRM, led by the
Chief Risk Officer (CRO), is responsible for independently
assessing and overseeing risks within FLUs and other control
functions. IRM establishes written enterprise policies and
procedures that include concentration risk limits where
appropriate. Such policies and procedures outline how aggregate
risks are identified, measured, monitored and controlled.