AIG 2014 Annual Report Download - page 185

ITEM 7 / ENTERPRISE RISK MANAGEMENT

168
long-term viability and ability to fund our ongoing business, and to meet short-term financial obligations in a timely manner in
both normal and stressed conditions.
Our Liquidity Risk Management Framework includes a number of liquidity and funding policies and monitoring tools to address
AIG-specific, broader industry and market related liquidity events.
Risk Measurement
Comprehensive cash flow projections under normal conditions are the primary component for identifying and measuring
liquidity risk. We produce comprehensive liquidity projections over varying time horizons that incorporate all relevant liquidity
sources and uses and include known and likely cash inflows and outflows. In addition, we perform stress testing by identifying
liquidity stress scenarios and assessing the effects of these scenarios on our cash flow and liquidity.
We use a number of approaches to measure our liquidity risk exposure, including:
Coverage Ratios: Coverage Ratios measure the adequacy of a portfolio of assets to meet the forecasted net cash flow
over a specified time horizon. The portfolio of assets is selected based on our ability to convert those assets into cash
under the assumed market conditions and within the specified time horizon.
Asset Ratios: Asset Ratios measure and track the quality of an entity’s assets that can be used to raise liquidity over a
specified period of time.
Cash Flow Forecasts: Cash Flow Forecasts measure the liquidity needed for a specific legal entity over a specified time
horizon.
Stress Testing: Coverage Ratios and Asset Ratios are re-measured under defined liquidity stress scenarios that will
impact net cash flows, liquid assets and/or other funding sources.
Relevant liquidity reporting is produced and reported regularly to AIG Parent and business unit risk committees. The frequency,
content, and nature of reporting will vary for each business unit and legal entity, based on its complexity, risk profile, activities
and size.
Operational Risk Management
Operational risk is defined as the risk of loss, or other adverse consequences, resulting from inadequate or failed internal
processes, people, systems, or from external events. Operational risk includes legal risk, but excludes business and strategy
risks.
Operational risk is inherent in each of our business units and corporate functions. Operational risks can have many impacts,
including but not limited to: unexpected economic losses or gains, reputational harm due to negative publicity, regulatory action
from supervisory agencies, operational and business disruptions, and/or damage to customer relationships.
Our ORM function, which supports our ORC, has the responsibility to provide an aggregate view of our operational risk profile.
Our ORM function oversees the Operational Risk policy and framework, which includes risk identification, assessment,
monitoring and measurement. The ORM program captures various types of risk to provide an aggregate view for each
business and function. This includes operational risks related to core insurance activities, investing, model risk, technology
(including cyber security, access, data privacy and data security), third party providers, compliance and regulatory matters.
Each business unit is responsible for managing its operational risks and implementing the components of the operational risk
management program. In addition, certain corporate control functions have been assigned accountability for enterprise-wide
operational risk management for their respective areas. These control functions include Sarbanes-Oxley (SOX), Business
Continuity Management (BCM), Information Technology Security Risk and Compliance, Model Validation and Vendor Risk