American Express 2013 Annual Report Download - page 46

AMERICAN EXPRESS COMPANY
2013 FINANCIAL REVIEW
acts as a check to the first line of defense managing these risks. The
Internal Audit Group constitutes the third line of defense, and
provides independent assurance that the first and second lines of
defense operate as intended.
CREDIT RISK MANAGEMENT PROCESS
Credit risk is defined as loss due to obligor or counterparty default or
changes in the credit quality of a security. Credit risks in the Company
are divided into two broad categories: individual and institutional.
Each has distinct risk management tools and metrics. Business units
that create individual or institutional credit risk exposures of
significant importance are supported by dedicated risk management
teams, each led by a Chief Credit Officer. To preserve independence,
Chief Credit Officers for all business units report to the Chief Credit
Officer of the Company, who in turn reports directly to the
Company’s Chief Risk Officer.
INDIVIDUAL CREDIT RISK
Individual credit risk arises principally from consumer and small
business charge cards, credit cards, lines of credit, and loans. These
portfolios consist of millions of customers across multiple
geographies, occupations, industries and levels of net worth. The
Company benefits from the high-quality profile of its customers,
which is driven by brand, premium customer servicing, product
features and risk management capabilities, which span underwriting,
customer management and collections. Externally, the risk in these
portfolios is correlated to broad economic trends, such as
unemployment rates and GDP growth, which can affect customer
liquidity.
The business unit leaders and their Chief Credit Officers take the
lead in managing the individual credit risk process. These Chief Credit
Officers are guided by the Individual Credit Risk Committee, which is
responsible for implementation and enforcement of the Individual
Credit Risk Management Policy. This policy is further supported by
subordinate policies and operating manuals covering decision logic
and processes of credit extension, including prospecting, new account
approvals, authorizations, line management and collections. The
subordinate risk policies and operating manuals are designed to
ensure consistent application of risk management principles and
standardized reporting of asset quality and loss recognition.
Individual credit risk management is supported by sophisticated
proprietary scoring and decision-making models that use the most up-
to-date proprietary information on prospects and customers, such as
spending and payment history and data feeds from credit bureaus.
Additional data, such as new commercial variables, continue to be
integrated into the risk models to further mitigate small business risk.
The Company has developed data-driven economic decision logic for
customer interactions to better serve its customers.
INSTITUTIONAL CREDIT RISK
Institutional credit risk arises principally within the Company’s Global
Corporate Payments, Global Merchant Services, GNS, Prepaid
Services and Foreign Exchange Services businesses, as well as
investment and liquidity management activities. Unlike individual
credit risk, institutional credit risk is characterized by a lower loss
frequency but higher severity. It is affected both by general economic
conditions and by client-specific events. The absence of large losses in
any given year or over several years is not necessarily representative of
the level of risk of institutional portfolios, given the infrequency of
loss events in such portfolios.
Similar to Individual Credit Risk, business units taking
institutional credit risks are supported by Chief Credit Officers. These
officers are guided by the Institutional Risk Management Committee
(IRMC), which is responsible for implementation and enforcement of
the Institutional Credit Risk Management Policy and for providing
guidance to the credit officers of each business unit with substantial
institutional credit risk exposures. The committee, along with the
business unit Chief Credit Officers, makes investment decisions in
core risk capabilities, ensure proper implementation of the
underwriting standards and contractual rights of risk mitigation,
monitor risk exposures, and determine risk mitigation actions. The
IRMC formally reviews large institutional risk exposures to ensure
compliance with ERMC guidelines and procedures and escalates them
to the ERMC as appropriate. At the same time, the IRMC provides
guidance to the business unit risk teams to optimize risk-adjusted
returns on capital. A centralized risk rating unit and a specialized
airline risk group provide risk assessment of institutional obligors
across the Company.
Exposure to the Airline Industry
The Company has multiple important co-brand, rewards and
corporate payments arrangements with airlines. The Company’s
largest airline partner is Delta Air Lines and this relationship includes
exclusive co-brand credit card partnerships and other arrangements
including Membership Rewards, merchant acceptance, travel and
corporate payments. Refer to Note 22 in the Consolidated Financial
Statements for further details of these relationships.
Sovereign Debt Exposure
As part of its ongoing risk management process, the Company
monitors its financial exposure to both sovereign and non-sovereign
customers and counterparties, and measures and manages
concentrations of risk by geographic regions, as well as by economic
sectors and industries. A primary focus area for monitoring is credit
deterioration due to weaknesses in economic and fiscal profiles. The
Company evaluates countries based on the market assessment of the
riskiness of their sovereign debt and the Company’s assessment of
their economic and financial outlook and closely monitors those
deemed high risk. As of December 31, 2013, the Company considers
its gross credit exposures to government entities, financial institutions
and corporations in those countries to be individually and collectively
not material.
OPERATIONAL RISK MANAGEMENT PROCESS
The Company defines operational risk as the risk of not achieving
business objectives due to inadequate or failed processes, people, or
information systems, or the external environment, including failures
44