Sallie Mae 2013 Annual Report Download - page 123

Primary ownership and responsibility for legal and compliance risk is placed with the business segments to
manage their specific regulatory and compliance risks. Our Compliance group supports these activities by
providing extensive training, monitoring and testing of the processes, policies and procedures utilized by our
business segments, maintaining consumer lending regulatory and information security policies and procedures,
and working in close coordination with our Legal group. Our Corporate Compliance Committee serves as a
regular internal forum where key compliance issues and risks are discussed. At this committee, business,
compliance and legal professionals review testing of existing regulatory compliance procedures and approve new
or revised procedures.
Our Code of Business Conduct and the on-going training our employees receive in many compliance areas
provide a framework for our employees to conduct themselves with the highest integrity. We instill a risk-
conscious culture through communications, training, policies and procedures. We have strengthened the linkage
between the management performance process and individual compensation to encourage employees to work
toward corporate-wide compliance goals.
Reputational and Political Risk. Reputational risk is the risk to shareholder value and growth from a
negative perception, whether true or not, of an organization by its key stakeholders, the changing expectations of
its stakeholders and/or weak internal coordination of business decisions. This could expose us to litigation,
financial loss or other damage to our business or brand. Political risk addresses political changes that may affect
the probability of achieving our business objectives.
Management proactively assesses and manages political and reputational risk. Our government relations
team manages our review of and response to all formal inquiries from members of Congress, state legislators,
and their staff, including providing targeted messaging that reinforces our public policy goals. We review and
consider political and reputational risks on an integrated basis in connection with the risk management oversight
activities conducted in the various aspects of our business on matters as diverse as the launch of new products
and services, our credit underwriting activities and how we fund our operations. Our public relations, marketing
and media teams constantly monitor print, electronic and social media to understand how we are perceived;
actively provide assistance and support to our customers and other constituencies; and maintain and promote the
value of our considerable corporate brand. Significant political and reputational risks are reported to and
monitored by the Finance and Operations Committee of our Board of Directors. Our Legal, Government
Relations and Compliance groups efforts are coordinated through our General Counsel and regularly meet and
collaborate with our Media and Investor Relations teams to provide more coordinated monitoring and
management of our political and reputational risks.
Strategy Risk. Strategic risk is the risk to shareholder value and growth trajectory from adverse business
decisions and/or improper implementation of business strategies. Management must be able to develop and
implement business strategies that leverage the organization’s core competencies, are structured appropriately
and are achievable. The cornerstone of our annual strategy risk management program involves our Board of
Directors approval of our annual strategic business plan and management’s recommendations for how to grow
our business while focused on managing risks to acceptable parameters. Management and the Board of Directors
and its various committees continuously review how we execute on our annual business plan.
121