Sallie Mae 2012 Annual Report Download - page 90

Risk Management
Our Approach
The products and services we provide, as well as the financial markets in which we participate, continue to
undergo dramatic competitive, operational, technological and regulatory changes. Identifying, understanding, and
effectively managing the risks inherent in our business is critical to our continued success. Risk oversight,
management and assessment responsibilities are clearly assigned and documented, reviewed and coordinated at
various levels of our organization. We maintain comprehensive risk management practices to identify, measure,
monitor, evaluate, control, and report on our significant risks.
Risk Oversight
Our Board of Directors and its standing committees oversee our overall strategic direction, including setting
our risk management philosophy, tolerance and parameters; and establishing procedures for assessing the risks
our businesses face as well as the risk management practices our management team develop and utilize. We
escalate to our Board any significant departures from established tolerances and parameters and review new and
emerging risks with them.
In 2012 our Board and senior management took significant steps to further enhance, formalize and
centralize our existing enterprise risk management activities. We expect these efforts to continue into 2013 and
beyond and to further evolve as our Bank achieves “large bank” status under the Dodd-Frank Act. The steps
taken in 2012 included:
• The addition of a new, extended meeting of our Board focused exclusively on Sallie Mae’s strategic
direction and priorities. This meeting will occur annually and in advance of management’s development
and presentation of its business plan for the following fiscal year.
• The development and, then, adoption in early 2013 of a formal Risk Appetite Framework which
reinforces our commitment to an organized enterprise risk management program that identifies, measures,
monitors, reports and escalates risks to our senior management and Board in line with developed and
agreed risk profiles, tolerances and escalation mechanisms.
• The initial development and testing of a strategy and stress testing tool designed to overlay our previously
existing, well-developed financial, credit and operational models that can evolve to provide Sallie Mae
and the Bank with the capability to more rapidly analyze key risks in light of actual or assumed changes
in strategy, economic conditions, and asset, liability and portfolio performance.
• Enhancement to our existing incentive compensation plan risk oversight policies and procedures which
included the following: the creation of a new committee, the Corporate Incentive Compensation Plan
Committee, to oversee our incentive compensation plans; enhancements to our incentive compensation
plan governance policy, which among other items, require appropriate risk mitigation elements in our
incentive compensation plans and annual review of the effectiveness of such plans; and increase in
coverage of plans during our annual risk review.
Risk Management Philosophy
Our risk management philosophy is to do all we can to ensure all significant risks inherent in our business
can be identified, measured, monitored, evaluated, controlled and reported. In furtherance of these goals, we seek
to (i) maintain a comprehensive and uniform risk management framework; (ii) maintain accountability and
ownership at the business segment level for risks to which they are exposed; (iii) provide appropriate reporting
tools to management and the Board and its committees; and (iv) reinforce this philosophy to our employees.
88