AIG 2013 Annual Report Download - page 188

Each business unit is primarily responsible for managing its operational risks and implementing the components of
the operational risk management program. In addition, certain corporate control functions have been assigned
accountability for enterprise-wide risk management for their respective areas. These control functions include:
Sarbanes-Oxley (SOX), Business Continuity Management (BCM), Information Technology Security Risk, Compliance,
Model Validation and Vendor Management. Senior business operational risk executives report to their respective
business unit CRO and to the Head of our ORM. This reporting structure is designed to enable close alignment with
the businesses while ensuring consistent implementation of operational risk management practices.
A strong operational risk management program facilitates the identification and mitigation
of operational risk issues. To accomplish this, our operational risk management program is
designed to:
• pro-actively address potential operational risk issues;
• create transparency throughout the organization; and
• assign clear ownership and accountability for addressing identified operational risk issues.
As part of the ORM framework, we deploy an integrated risk assessment approach which includes top-down risk
assessments to identify our most significant operational risks, a Risk and Control Self Assessment (RCSA) process
to identify key operational risks conducted at the business units and corporate functions and the identification of
emerging risks through our Vulnerability Identification (VID) process which considers risks that have not yet fully
manifested but could become significant over time. Corrective action plans are developed to address identified
issues. Businesses are accountable for tracking and remediating these issues.
Operational risk management reporting to senior management and operational risk governance committees provides
awareness of operational risk exposures, identifies key risks and facilitates management decision making. Reporting
includes operational risk mitigation and monitoring, RCSA results and the status of issue resolution to senior
management.
Except as described above, we manage our business risk oversight activities through our insurance operations.
Our insurance businesses are conducted on a global basis and expose us to a wide variety of risks with different
time horizons. We manage these risks throughout the organization, both centrally and locally, through a number of
procedures:
• pre-launch approval of product design, development and distribution;
• underwriting approval processes and authorities;
• exposure limits with ongoing monitoring;
• modeling and reporting of aggregations and limit concentrations at multiple levels (policy, line of business, product
group, country, individual/group, correlation and catastrophic risk events);
• compliance with financial reporting and capital and solvency targets;
• use of reinsurance, both internal and third-party; and
• review and establishment of reserves.
We closely manage insurance risk by monitoring and controlling the nature and geographic location of the risks in
each line of business underwritten, the terms and conditions of the underwriting and the premiums we charge for
taking on the risk. We analyze concentrations of risk using various modeling techniques, including both probability
distributions (stochastic) and single-point estimates (deterministic) approaches.
Insurance Operations Risks
..................................................................................................................................................................................................................................
AIG 2013 Form 10-K170
ITEM 7 / ENTERPRISE RISK MANAGEMENT
..................................................................................................................................................................................
............................................................................................................................................................................................