Sallie Mae 2012 Annual Report Download - page 91

Risk Management Roles and Responsibilities
Responsibility for risk management is held at several different levels of our organization, including our
Board and its committees. Each business area within our organization is primarily responsible for managing its
specific risks utilizing formalized processes and procedures developed in collaboration with our executive
management team and internal risk management partners. Our compliance, credit, human resources, legal,
information technology, finance and accounting, and information security groups, are responsible for providing
our business segments with the training, systems and specialized expertise necessary to properly perform their
risk management responsibilities.
Board of Directors. Our Board, directly and through its standing committees, is responsible for overseeing
our overall strategic direction and risk management approach. The Board approves our annual business plan,
periodically reviews our strategic approach and priorities and spends significant time considering our capital
requirements and our dividend and share repurchase levels and activities. Standing committees of our Board
include Executive, Audit, Compensation and Personnel, Nominations and Governance, Finance and Operations,
Preferred Stock and Strategy Committees. Charters for each committee providing their specific responsibilities
and areas of risk oversight are published at www.salliemae.com under “Investors-Corporate Governance.”
Additional information regarding their activities and responsibilities will also be contained in the Corporate
Governance section of our Proxy Statement to be filed on Schedule 14A relating to our Annual Meeting of
Shareholders scheduled to be held on May 30, 2013 and is incorporated herein by reference.
Chief Executive Officer. Our Chief Executive Officer is ultimately responsible for ensuring proper
oversight, management and reporting to Board regarding our risk management practices and the timely escalation
of any significant issues. Our Chief Executive Officer is responsible for establishing our risk management culture
and ensuring business areas operate within directed risk parameters and in accordance with our annual business
plan.
Internal Risk Oversight Committees. We have a number of standing management committees dedicated to
oversight of various risks relating to our business. In 2012, we formed the Corporate Incentive Compensation
Plan Committee and in 2013 we will initiate an additional senior-executive level committee, the Enterprise Risk
Committee. Both committees have broader risk oversight agendas and responsibilities. Below is a description of
our key internal risk management committees.
Enterprise Risk Committee. As part of the adoption of our formal Risk Appetite Framework, we recently
formed an Enterprise Risk Committee to more efficiently assist our Chief Executive Officer in the execution of
his risk responsibilities. This committee is an executive management-level committee that will provide a forum
for our senior management team to review and discuss our significant risks, receive periodic reports on
adherence to agreed risk parameters and continue to supervise the evolution of our enterprise risk management
program. Committee membership consists of our Chief Executive Officer, President and Chief Operating Officer,
Executive Vice President and General Counsel, Executive Vice President and Chief Financial Officer, Executive
Vice President and Chief Marketing Officer, Executive Vice President — Administration, Chief Credit Officer,
Chief Compliance Officer and the Chief Audit Officer (in a non-voting capacity). The predominance of
committee members are direct reports to our Chief Executive Officer. The committee will meet at least six times
per year in advance of each regularly scheduled Board meeting and more frequently as may needed to address
particular issues.
Corporate Incentive Compensation Plan Committee. Our Corporate Incentive Compensation Plan
Committee is comprised of a cross-functional team of senior officers from human resources, risk and legal who
oversee our incentive compensation plans. The committee’s responsibilities include ensuring that our incentive
compensation plans do not incent our employees to take inappropriate risks which could impact our financial
position and controls, reputation and operations; reviewing the annual risk assessment of our incentive
compensation plans conducted by our Chief Compliance Officer and Chief Credit Officer; and developing
policies and procedures for the development and approval of new incentive compensation plans in line with our
89