Ally Bank 2014 Annual Report Download - page 62

Table of Contents
Management's Discussion and Analysis
Ally Financial Inc. • Form 10-K
50
Risk Management
Managing the risk/reward trade-off is a fundamental component of operating our businesses. Our risk management program is overseen
by the Board, various risk committees, the executive leadership team, and our associates. The Risk and Compliance Committee of the Board,
together with the Board, sets the risk appetite across our company while the risk committees, executive leadership team, and our associates
identify and monitor current and emerging risks and manage those risks to be within our risk appetite. Ally's primary types of risk include
credit, lease residual, market, operational, insurance/underwriting, and liquidity.
• Credit risk — The risk of loss arising from an obligor not meeting its contractual obligations to our firm.
• Lease Residual risk — The risk of loss arising from the possibility that the actual proceeds realized upon the sale of returned
vehicles will be lower than the projection of the values used in establishing the pricing at lease inception.
• Market risk — The risk of loss arising from changes in the fair value of our assets or liabilities (including derivatives) caused by
movements in market variables, such as interest rates, foreign-exchange rates, and equity and commodity prices.
• Operational risk — The risk of loss or harm arising from inadequate or failed processes or systems, human factors, or external
events.
• Insurance/Underwriting risk — The risk of loss associated with insured events occurring, the severity of insured events, and the
timing of claim payments arising from insured events.
• Liquidity risk — The risk that our financial condition or overall safety and soundness is adversely affected by an inability, or
perceived inability, to meet our financial obligations, and to withstand unforeseen liquidity stress events (refer to discussion at
Liquidity Management, Funding, and Regulatory Capital within this MD&A).
While risk oversight is ultimately the responsibility of the Board, our governance structure starts within each line of business, including
committees established to oversee risk in their respective areas. The lines of business are responsible for executing on risk strategies, policies,
and controls that are fundamentally sound and compliant with enterprise risk management policies and with applicable laws and regulations.
The line of business risk committees, which report up to the Risk and Compliance Committee of the Board, monitor the performance within
each portfolio and determine whether to amend any risk practices based upon portfolio trends.
In addition, the Enterprise Risk Management and Compliance organizations are accountable for independently identifying, monitoring,
measuring, and reporting on our various risks, and they are responsible for designing an effective risk management framework and structure.
They are also responsible for monitoring that our risks remain within the tolerances established by the Board, developing and maintaining
policies, and implementing risk management methodologies.
All lines of business and enterprise functions are subject to full and unrestricted audits by Audit Services. Audit Services reports to the
Audit Committee of the Board, and is primarily responsible for assisting the Audit Committee in fulfilling its governance and oversight
responsibilities. Audit Services is granted free and unrestricted access to any and all of our records, physical properties, technologies,
management, and employees.
In addition, our Loan Review Group provides an independent assessment of the quality of our credit risk portfolios and credit risk
management practices, and all lines of business and corporate functions that create or influence credit risk are subject to full and unrestricted
reviews by the Loan Review Group. This group also is granted free and unrestricted access to any and all of our records, physical properties,
technologies, management, and employees and reports its findings directly to the Risk and Compliance Committee. The findings of this group
help to strengthen our risk management practices and processes throughout the organization.