CORPORATE STRATEGY AND ENTERPRISE RISK MANAGEMENT
Strategic Planning Process
We recognize that driving long-term sustained value requires sound and prudent strategic planning and execution. Accordingly, our Board of Directors approves and then regularly reviews execution on the Company’s strategic plan, the environment in which we operate, our risk profile, regulatory expectations, and the progress we are making toward the goals we set.
Our Board has established a three-year strategic plan that clearly defines strategic priorities and underlying business unit objectives, which are set against a Board-approved Risk Appetite Statement. The Company’s Risk Appetite Statement summarizes the risk appetite for each Line of Business and the level and types of risk that the Company is willing to accept in executing its strategy. The Board reviews and approves updates to the three-year strategic plan and Risk Appetite Statement annually to ensure that they remain current and relevant. The annual review process is robust, with Directors assessing the strategic plan during a two-day offsite retreat, historically held in the third quarter, and the Board and its Executive Committee providing continued feedback through Board approval in January. The resulting updated plan, including underlying key performance indicators (“KPIs”), is approved by the Board at the beginning of each year, and execution against the plan and performance of the KPIs are reviewed throughout the year by the Board and its Executive Committee.
Risk Management Philosophy and Enterprise Risk Management Program
We also recognize that risk is an inherent part of our daily business and activities as a financial services institution. Given the complex and evolving nature of our lines of business, we invest time and resources in maintaining a risk management culture that is incisive and knowledgeable and subject to ongoing review and enhancement to align with our evolving risk profile as well as our commitment to ownership, accountability and transparency.
Through robust and comprehensive risk management programs, underlying policies and controls, and a comprehensive governance framework in which Management and Board Committees provide focused oversight over risk management, we seek to effectively manage the various risks we face. These programs, policies and frameworks are influenced by our risk management philosophy, which focuses on achieving risk-adjusted returns through prudent risk-taking that is intended to protect shareholder value, manage unpredictability of risks, and minimize potential adverse impact on operating performance and financial condition.
Risks are primarily identified and managed through our Board-approved ERM Program, which helps to holistically manage the various risks that the Company is exposed to in pursuit of its strategic objectives, including but not limited to strategic, credit, market, liquidity, operational, compliance, legal, and reputational risks through early identification of emerging internal and external issues or events which have the potential to impact our strategic objectives. The ERM Program, coupled with underlying area-specific risk programs (e.g. Bank Secrecy Act and Office of Foreign Asset Controls (“OFAC”), Fair Lending, CRA, Information Security, Fraud) and an effective policy framework, allows us to establish appropriate risk mandates and limits, which enables and controls specific risk-taking activities.
Management of risk is embedded into each level of the Company, with all associates responsible for the awareness and management of risks. This is done by specifying responsibilities through a “Three Lines of Defense” model where each line is overseen by the next, resulting in a strong risk management framework with independence and robust governance. Under this model, the Company’s risk management and compliance functions, respectively, operate independently from the lines of business, enabling second line of defense risk leaders to effectively challenge business leaders. The Company’s risk management and compliance functions are responsible for defining policies and frameworks for the management of risk across the Company. We also deploy a separate and independent internal audit function that reports directly to the Board’s Audit Committee, and serves as the Company’s third line of defense to risk.
Governance Structure
Company and Board committees provide strong oversight over the administration of our ERM and other documented risk programs. Management-level Risk committees include, but are not limited to, the Company Compliance Committee, BSA/AML and OFAC Committee, the Fraud Prevention Committee, and the Allowance Committee, each of which report into the Executive-level Company Risk Committee (“CRC”). The CRC reports into the Risk Oversight Committee of the Board and ultimately the Board of Directors.