The Hartford 2014 Annual Report Download - page 11

At the corporate level, the Company's Enterprise Chief Risk Officer (“Chief Risk Officer”) leads ERM. The Chief Risk Officer reports directly to the
Company's Chief Executive Officer (“CEO”). The Company has established the Enterprise Risk and Capital Committee (“ERCC”) that includes the
Company’s CEO, President, Chief Financial Officer, Chief Investment Officer, Chief Risk Officer, General Counsel and others as deemed necessary by the
committee chair. The ERCC oversees the risk profile and risk management practices of the Company. The ERCC also oversees capital management and the
allocation of capital to the lines of business. The ERCC is responsible for significant company-wide risk exposures including, but not limited to, financial
risk, liquidity and capital requirements, insurance risk, operational risks, and any other risk deemed significant. The ERCC reports to the Board primarily
through the FIRMCo and through interactions with the Audit Committee.
The Company also has committees that manage specific risks and recommend risk mitigation strategies to the ERCC. These committees include, but are not
limited to, Asset Liability Committees, Catastrophe Risk Committee, Emerging Risk Committees, Model Oversight Committees and Operational Risk
Committee.
Risk Management Framework
At the Company, risk is managed at multiple levels. The Hartford utilizes three lines of defense in risk management to integrate its risk management strategy
and appetite into all areas of the Company. The first line of defense in risk management is generally the responsibility of the lines of business. Senior
business leaders are responsible for managing risks specific to their business objectives and business environment. The second line of defense in risk
management is generally owned by ERM. ERM has the responsibility to ensure that the Company has insight into its aggregate risk and that risks are
managed within the Company's overall risk appetite. Legal and Compliance also commonly act as a second line of defense in risk management. The third line
of defense in risk management is owned by Internal Audit. Internal Audit provides independent assurance that each business unit’s controls are present,
compliant, and effective, informs the risk identification process and provides audit and consultative support to the Company.
The Company's Risk Management Framework consists of five core elements:
1. Risk Culture and Governance: The Company has established policies for its major risks and a formal governance structure with leadership oversight
and an assignment of accountability and authority. The governance structure starts at the Board and cascades to the ERCC and then to individual
risk committees across the Company. In addition, the Company promotes a strong risk management culture and high expectations around ethical
behavior.
2. Risk Identification and Assessment: Through its ERM organization, the Company has developed processes for the identification, assessment, and,
when appropriate, response to internal and external risks to the Company's operations and business objectives. Risk identification and prioritization
has been established within each area, including processes around emerging risks.
3. Risk Appetite, Tolerances, and Limits: The Company has a formal enterprise risk appetite framework that is approved by the ERCC and reviewed by
the Board. The risk appetite framework includes an enterprise risk appetite statement, risk preferences, risk tolerances and enterprise risk limits.
Enterprise risk limits which quantify tolerances into specific limits by risk category are defined in underlying enterprise risk policies.
4. Risk Management and Controls: While the Company utilizes the committee structure to elevate risk discussions and decision-making, there are a
variety of working groups that provide decisioning and management of risk within determined tolerances and limits. ERM and the appropriate
governing risk committees regularly monitor the Company's risk exposure as compared to defined limits and tolerances and provides regular
reporting to the ERCC.
5. Risk Reporting and Communication: The Company monitors its major risks at the enterprise level through a number of enterprise reports, including
but not limited to, a monthly risk dashboard, and regular stress testing. ERM communicates the Company's risk exposures to senior and executive
management and the Board, and reviews key business performance metrics, risk indicators, audit reports, risk/control self-assessments and risk event
data.
Risk Exposures and Quantification
The Company quantifies its enterprise insurance and financial risk exposures using multiple lenses including statutory, economic and, where appropriate,
U.S. GAAP. ERM leverages various modeling techniques and metrics to provide a view of the Company's risk exposure in both normal and stressed
environments.
11