AIG 2011 Annual Report Download - page 183

As part of the operational risk management framework, AIG has implemented a risk and control self
assessment (RCSA) process. The RCSA process is used to identify key operational risks and evaluate the
effectiveness of existing controls to mitigate those risks. Corrective action plans are developed to address any
identified issues. Business units continue to enhance their RCSA processes to perform more robust risk
assessments.
The Operational Risk Management Forum, a company-wide governance body comprised of senior ORM
executives, including the senior business operational risk executives, meets regularly and provides a forum for
approving operational risk policies and ensuring effectiveness of the operational risk management program.
Other than as described above, AIG manages its business risk oversight activities through its operating
segments.
Insurance Operations
AIG’s multiple insurance businesses conducted on a global basis expose AIG to a wide variety of risks with
different time horizons. These risks are managed throughout the organization, both centrally and locally, through
a number of procedures, including:
• pre-launch approval of product design, development and distribution;
• underwriting approval processes and authorities;
• exposure limits with ongoing monitoring;
• modeling and reporting of aggregations and limit concentrations at multiple levels (policy, line of business,
product group, country, individual/group, correlation and catastrophic risk events);
• compliance with financial reporting and capital and solvency targets;
• extensive use of reinsurance, both internal and third-party; and
• review and establishment of reserves.
AIG closely manages insurance risk by overseeing and controlling the nature and geographic location of the
risks in each line of business underwritten, the terms and conditions of the underwriting and the premiums
charged for taking on the risk. Concentrations of risk, including, but not limited to, wind, flood, earthquake,
terrorism and accident are analyzed using various modeling techniques.
AIG has two major categories of insurance risks as follows:
•Property and casualty (Chartis and Mortgage Guaranty) — risks covered include property, casualty, fidelity/
surety, management liability and mortgage insurance. Risks in the general insurance segment are managed
through aggregations and limitations of concentrations at multiple levels: policy, line of business, correlation
and catastrophic risk events. Risks in the mortgage insurance business are managed through geographic
location of the insured properties, the relative economic conditions in the local housing markets, credit
attributes of the borrowers, and the loan amount relative to the value of the respective collateral.
•Domestic Life Insurance & Retirement Service (SunAmerica) — risks include mortality and morbidity in the
insurance-oriented products and insufficient cash flows to cover contract liabilities in the retirement savings-
oriented products. Risks are managed through product design, sound medical underwriting, external
traditional reinsurance programs and external catastrophe reinsurance programs.
AIG is a major purchaser of reinsurance for its insurance operations. The use of reinsurance facilitates
insurance risk management (retention, volatility, concentrations) and capital planning locally (branch and
subsidiary). AIG may purchase reinsurance on a pooled basis. Pooling of AIG’s reinsurance risks enables AIG to
purchase reinsurance more efficiently at a consolidated level, manage global counterparty risk and relationships
and manage global catastrophe risks, both for Chartis and SunAmerica.
AIG 2011 Form 10-K 169
BUSINESS UNIT RISK MANAGEMENT