Sallie Mae 2015 Annual Report Download - page 75

73
The credit risk related to Private Education Loans is managed within a credit risk infrastructure which includes: (i) a well-
defined underwriting, asset quality and collection policy framework; (ii) an ongoing monitoring and review process of portfolio
concentration and trends; (iii) assignment and management of credit authorities and responsibilities; and (iv) establishment of
an allowance for loan losses that covers estimated future losses based upon an analysis of portfolio metrics and economic
factors.
Credit risk related to derivative contracts is managed by reviewing counterparties for credit strength on an ongoing basis
and through our credit policies, which place limits on the amount of exposure we may take with any one counterparty and
require collateral to secure the position. The credit and counterparty risk associated with derivatives is measured based on the
replacement cost should the counterparty with contracts in a gain position to the Company fail to perform under the terms of the
contract.
Operational Risk. Operational risk is the risk to earnings resulting from inadequate or failed internal processes, people
and systems and third-party vendors, or from external events. Operational risk is pervasive in that it exists in all business lines,
functional units, legal entities and geographic locations, and it includes information technology risk, physical security risk on
tangible assets, as well as regulatory, legal and governance risk.
Operational risk exposures are managed through a combination of business line management and enterprise-wide
oversight. The ORC is the oversight body for operational risks and supports the ERC in its oversight duties. The sub-committee
is responsible for escalation to the ERC, as appropriate. Additionally, operational risk metrics, thresholds and limits are
included in the periodic reporting to the Risk Committee of our Board of Directors in the context of the ERM framework.
Regulatory, Legal and Governance Risk. Regulatory risk is the current and prospective risk to earnings or capital arising
from violations of, or non-conformance with, laws, rules, regulations, prescribed practices, internal policies and procedures, or
ethical standards. Legal risk is the risk to earnings, capital or reputation manifested by claims made through the legal system
and may arise from a product, a transaction, a business relationship, property (real, personal or intellectual), conduct of an
employee or a change in law or regulation. Governance risk is the risk of not establishing and maintaining a control
environment that aligns with stakeholder and regulatory expectations, including “tone at the top” and Board performance. These
risks are inherent in all of our businesses. Regulatory, legal and governance risk are sub-sets of operational risk, but have taken
on greater significance in the current environment. We can be exposed to these risks in key areas such as our private education
lending, servicing and collections, and oversight of third-party vendors, if compliance with legal and regulatory requirements is
not properly implemented, documented or tested, as well as when an oversight program does not include appropriate audit and
control features.
Primary ownership and responsibility for legal and regulatory risk is placed with the business segments to manage their
specific legal and regulatory risks. Our Compliance group supports these activities by providing extensive training, monitoring
and testing of the processes, policies and procedures utilized by our business segments, maintaining consumer lending
regulatory and information security policies and procedures, and working in close coordination with our Legal group. Our
Operational Risk Committee has oversight over the establishment of standards related to our monitoring and control of legal
and regulatory risks, and the General Counsel reports regularly to the Risk Committee of our Board of Directors.
Our Code of Business Conduct and the on-going training our employees receive in many compliance areas provide a
framework for our employees to conduct themselves with the highest integrity. We instill a risk-conscious culture through
communications, training, policies and procedures. We have strengthened the linkage between the management performance
process and individual compensation to encourage employees to work toward corporate-wide compliance goals.
Market Risk. Market risk is the risk to earnings or capital resulting from changes in market conditions, such as interest
rates, credit spreads, or other volatilities. We are exposed to various types of market risk, in particular the risk of loss resulting
from interest rate risk, basis risk and other risks that arise through the management of our investment, debt and education loan
portfolios. Market risk exposures are managed primarily through ALCO. These activities are closely tied to those related to the
management of our funding and liquidity risks. The Risk Committee of our Board of Directors periodically reviews and
approves the investment and asset and liability management policies and contingency funding plan developed and administered
by ALCO. The Risk Committee of our Board of Directors as well as our Chief Financial Officer report to the full Board of
Directors on matters of market risk management.