Sallie Mae 2015 Annual Report Download - page 73

71
• The re-engineering of the model risk management framework within the business to ensure the integrity of our
model inventory, particularly as it relates to the DFAST; and
• Continued investment in the ERM infrastructure and staffing to ensure the program can appropriately address the
challenges facing our business and industry.
The Governance Framework
Our overall objective pertaining to risk and control is to ensure all significant risks inherent in our business can be
identified, remediated, controlled and monitored. To this end, we have adopted the “three lines of defense” governance
framework. Specifically, the business units form the “first line of defense” and are the “owners” of risks present in their
business activities. As the owners of risk, the first line of defense is accountable for the day-to-day execution of risk and control
policy and procedures. The “second line of defense” (e.g., ERM and Compliance) provides oversight of the execution by the
first line of defense. Rather than focused on execution, the second line of defense is accountable for the related policy and
standards executed upon by the first line of defense. Finally, the Internal Audit function comprises the “third line of defense.”
The Internal Audit function provides opinions to the Board on the effectiveness of the first and second lines of defense. The
lines of defense distinction determines accountabilities; the ERM framework contains the processes and infrastructure
necessary to deliver on those accountabilities.
Enterprise Risk Management Policy and Framework
The ERM policy and framework are designed to provide a holistic perspective of risk and control performance across the
Company. The policy, which is approved annually by the Board of Directors, outlines the framework used to ensure that risk
and control issues across the enterprise are identified, remediated, controlled and reported. The Bank’s ERM framework and
related policies are the core of the overall governance structure within the enterprise.
The risk appetite statement is a central component of the ERM framework. The risk appetite statement establishes the
level of risk we are willing to accept within each risk category, described below, in pursuit of our business objectives. Our risk
appetite is captured in a set of performance metrics specific to our business activities, both quantitative and qualitative. These
metrics have corresponding thresholds and limits and are adopted as operating standards. Compliance with our risk appetite is
monitored by our management-level Enterprise Risk Committee ("ERC") with escalation to the Risk Committee of the Board or
the Board of Directors, as appropriate. Our Board of Directors approves the risk appetite statement annually and requires that
management provide periodic updates on compliance to the Risk Committee of our Board.
Board of Directors Committee Structure
We have a robust committee structure that facilitates oversight, effective challenge and escalation of risk and control
issues.
Risk Committee. The Risk Committee of the Board was established to assist the Board in fulfilling its oversight
responsibilities of risk and controls. The Risk Committee recommends the ERM framework, related policies and the risk
appetite statements to the Board of Directors for approval. The Risk Committee receives periodic updates on compliance with
the ERM framework from the ERC.
Audit Committee. The Audit Committee is responsible for oversight of the Internal Audit function. Additionally, the
Audit Committee oversees the quality and integrity of our financial reporting process and financial statements; the
qualifications, hiring, performance and independence of our independent registered accounting firm; the performance of our
Internal Audit function; our system of internal controls; and our compliance with the Code of Business Conduct.
Nominations, Governance and Compensation Committee. The Nominations, Governance and Compensation Committee,
among other things: (1) periodically reviews our compliance and performance against the risk measures and limits as contained
in our Board approved risk appetite framework relating to our personnel, including compensation policies and practices,
attrition and succession planning, and aspects of shareholder confidence relating to compensation policies, and assesses whether
any such risks are reasonably likely to have a materially adverse effect on us; and (2) periodically reviews our compliance and
performance against the risk measures as contained in our Board approved risk appetite framework relating to political risk,
reputational risk and governance risks as related to compliance with NASDAQ listing standards and applicable rules and
regulations relating to Board of Directors and management composition, governance, and independence.
Preferred Stock Committee. The Preferred Stock Committee monitors and evaluates proposed actions that may impact
the rights of holders of preferred stock.