AmazonScience/document-haystack

1notional and an underlying as specified in the contract. Therefore, cash requirements and exposure to credit risk are significantly less 2than the notional amount on these instruments.3Further information on our financial derivatives is presented in Note 1 Accounting Policies, Note 14 Fair Value and Note 15 Financial 4Derivatives.5Not all elements of market and credit risk are addressed through the use of financial derivatives, and such instruments may be 6ineffective for their intended purposes due to unanticipated market changes, among other reasons.7Operational Risk Management8Operational risk is the risk to the current or projected financial condition and resilience arising from inadequate or failed internal 9processes or systems, human errors or misconduct or adverse external events. Operational risk is inherent to the entire organization.10Operational risk management is embedded in our culture and decision-making processes through a systematic approach whereby 11operational risks and exposures are: (i) identified and assessed; (ii) managed through the design and implementation of controls; (iii) 12measured and evaluated against our risk tolerance limits; and (iv) appropriately reported to management and the Risk Committee of 13the Board of Directors. Strong operational risk management and well-informed risk-based decisions benefit us by improving the 14customer experience, enhancing compliance, reducing reputational risk, minimizing losses and establishing an appropriate amount of 15required operational risk capital held by us.16The Operational Risk Management Framework is designed to provide effective and consistent management of operational risk. The 17primary purpose of the framework is to enable us to understand our operational risks and manage them to the desired risk profile, in 18line with our Risk Appetite. Additionally, the guidance established within the framework assists management in making well-informed 19risk-based business decisions.20The framework provides a disciplined and structured process for us to manage operational risk across eight operational risk domains. 21These domains provide a comprehensive view of operational risk and allow us to discuss operational risk in a standard way, 22facilitating reporting and ongoing risk mitigation.23The operational risk domains are:24• Operations: Risk resulting from inadequate or failed internal processes, misconduct or errors of people or fraud.25• Compliance: Risk of legal or regulatory sanctions, financial loss, or damage to reputation resulting from failure to comply 26with laws, regulations, rules, self-regulatory standards or other regulatory requirements.27• Data Management: Risk associated with incomplete or inaccurate data.28• Model: Risk associated with the design, implementation and ongoing use and management of models.29• Technology and Systems: Risk associated with the use, operation and adoption of technology.30• Information Security: Risk resulting from the failure to protect information and ensure appropriate access to, and use and 31handling of, information assets.32• Business Continuity: Risk of potential disruptive events to business activities.33• Third Party: Risk arising from failure of third-party providers to conduct activity in a safe and sound manner and in 34compliance with contract provisions and applicable laws and regulations.35We utilize operational risk management programs within the framework, including Risk and Control Self-Assessments, scenario 36analysis, and internal and external loss event reviews and analysis, to assess existing risks, determine potential/emerging risks and 37evaluate the effectiveness of internal controls. Program tools and methodology assist our business managers in identifying potential 38risks and control gaps.39Lines of business are responsible for identifying, owning, managing and monitoring the operational risks and controls associated with 40their business activities and product or service offerings to within acceptable levels. Centralized functions, such as Business 41Continuity, Enterprise Third Party Management and Information Security, are responsible for the development, implementation and 42management of their individual programs and for the development and maintenance of the policies, procedures, methodologies, tools 43and technology utilized across the enterprise to identify, assess, monitor and report program risks. Additionally, independent risk 44management reviews and challenges line of business adherence to the framework to help ensure proper controls are in place and 45appropriate risk mitigation plans are established as necessary.46Conduct, Reputational and Strategic Risk47PNC’s risk culture seeks to reinforce the appropriate protocols for responsible and ethical behavior through sound processes and 48controls. In order to promote a robust risk culture, the Board and executive management establish code of conduct and professional 49standards to which all employees must adhere. A strong risk culture discourages misconduct and supports conduct risk management at 50PNC. Conduct risk is defined as the risk that employees fail to comply with the ethical standards expected of them. Strong conduct 51 5278    The PNC Financial Services Group, Inc. – 2023 Form 10-K