AIG 2014 Annual Report Download - page 178

ITEM 7 / ENTERPRISE RISK MANAGEMENT

161
or a committee thereof and a set of supporting tools, including risk tolerances, risk limits and policies, which we use to manage
our risk profile and financial resources.
We articulate our aggregate risk-taking by setting risk tolerances on capital and liquidity measures. These measures are set at
the AIG Parent as well as the legal entity level and cover consolidated and insurance company capital and liquidity ratios. We
must comply with standards for capital adequacy and maintain sufficient liquidity to meet all our obligations as they come due
in accordance with our internal capital management and liquidity policies. The risk appetite for our insurance operations inform
the requirements for capital adequacy for individual legal entities. Our risk tolerances take into consideration regulatory
requirements, rating agency expectations, and business needs. The GRC routinely reviews the level of risk taken by the
consolidated organization in relation to the established risk tolerances. A consolidated risk report is also presented periodically,
as required, to the RCC by our CRO.
Risk Limits
A key component of our Risk Appetite Framework is having a process in place that establishes and maintains appropriate
limits on the material risks identified for our core businesses and allows monitoring and meeting of both internal and external
stakeholder’s expectations. Our objectives include:
• Monitoring of risks, providing early warning indicators, and ensuring timely oversight and enforceability;
• Defining a consistent and transparent approach to limits governance from the group-level to regional entities; and
• Alignment with Risk Appetite Statement, where applicable.
To support the monitoring and management of AIG’s and its business units’ material risks, ERM has established a limits
framework that employs a three-tiered hierarchy:
• Level I Limits are AIG consolidated level limits. They define our aggregate maximum exposures for core risks within the
boundaries set by the Risk Appetite Statement, and constrain our concentration in specific risk types. These limits are set to
manage key risks identified by ERM and to meet requirements by regulators and rating agencies at a consolidated level.
Level 1 Limits are reported to the FRG, GRC and RCC.
• Level II Limits are business unit level limits. They define our appetite for specific, material risk taking activities within
business units and corporate functions. These key risks are identified by ERM for the business unit and/or corporate
function, and risk limits are developed to meet the specific requirements of regulators and rating agencies. Level II Limits
are reported to the BU RCC and FRG.
• Level III Limits monitor risk utilization on the regional or local level and are developed to address any specific requirements
by regulators and rating agencies for that region not captured by the Level I and Level II limits. Level 3 Limits are reported
at the local entity BU RCC.
All limits are reviewed by the FRG, GRC or business unit level risk committees on a periodic basis and revisions, if applicable,
are approved by those committees.
The business units are responsible for complying with all risk limits. The ERM teams and chief risk officers within each
business unit monitor such compliance and provide regular, timely reporting to our senior management and risk committees.
Limit breaches are required to be reported in a timely manner and are documented and escalated in accordance with their
level of severity or materiality. Responsibility for addressing and/or remediating any breach rests with individuals within the
specific unit that experienced the breach.
Risk Identification and Measurement
One tool we use to inform our Risk Appetite Framework is risk identification. We conduct risk identification through a number
of processes at the business unit and corporate level focused on capturing our material risks and key areas of focus for follow-
up risk management actions. A key initiative is our annual integrated bottom-up risk identification and assessment process