Management’s discussion and analysis CONDUCT RISK MANAGEMENT Overview Governance and oversight Conduct risk, a subcategory of operational risk, is the risk that any action or inaction by an employee or employees could lead to unfair client or customer outcomes, impact the integrity of the markets in which the Firm operates, or compromise the Firm’s reputation. Each line of business and Corporate is accountable for identifying and managing its conduct risk to provide appropriate engagement, ownership and sustainability of a culture consistent with the Firm’s How We Do Business Principles (the “Principles”). The Principles serve as a guide for how employees are expected to conduct themselves. With the Principles serving as a guide, the Firm’s Code sets out the Firm’s expectations for each employee and provides information and resources to help employees conduct business ethically and in compliance with the law everywhere the Firm operates. For further discussion of the Code, refer to Compliance Risk Management on  page 137 . The Conduct Risk Program is governed by a Board-level approved Conduct Risk Governance Policy. The Conduct Risk Governance Policy establishes the framework for ownership, assessment, managing and escalating conduct risk in the Firm. The CRSC provides oversight of the Firm’s conduct initiatives to develop a more holistic view of conduct risks and to connect key programs across the Firm in order to identify opportunities and emerging areas of focus. The CRSC may escalate systemic conduct risk issues to the FRC and as appropriate to the DRPC. The misconduct (actual or potential) of individuals involved in material risk and control issues are escalated to the HR Control Forum. Certain committees of the Board oversee conduct risk issues within the scope of their responsibilities. Conduct risk management encompasses various aspects of people management practices throughout the employee life cycle, including recruiting, onboarding, training and development, performance management, promotion and compensation processes. Each LOB, Treasury and CIO, and designated corporate function completes an assessment of conduct risk quarterly, reviews metrics and issues which may involve conduct risk, and provides business conduct training as appropriate. 138 JPMorgan Chase & Co./2018 Form 10-K