AIG 2014 Annual Report Download - page 186

ITEM 7 / ENTERPRISE RISK MANAGEMENT

169
Management. Senior business operational risk executives report to their respective business unit CRO and to the Head of our
ORM. This reporting structure is designed to enable close alignment with the business unit while ensuring consistent
implementation of operational risk management practices.
A strong operational risk management program facilitates the identification and mitigation of operational
risk issues. To accomplish this, our operational risk management program is designed to:
• pro-actively address potential operational risk issues;
• create transparency throughout the organization; and
• assign clear ownership and accountability for addressing identified operational risk issues.
As part of the ORM framework, we deploy an integrated risk assessment approach which includes top-down risk assessments
to identify our most significant operational risks, a Risk and Control Self Assessment (RCSA) process to identify key
operational risks conducted at the business units and corporate functions and the identification of emerging risks through our
Vulnerability Identification (VID) process which considers risks that have not yet fully manifested but could become significant
over time. In addition, we conduct scenario analysis to identify remote but plausible potential risks that could result in severe
financial losses. Corrective action plans are developed to address identified issues. Businesses are accountable for tracking
and remediating these issues.
Operational risk management reporting to senior management and operational risk governance committees provides
awareness of operational risk exposures, identifies key risks and facilitates management decision making. Reporting includes
operational risk mitigation and monitoring, RCSA results and the status of issue resolution to senior management.
Insurance Operations Risks
Except as described above, we manage our business risk oversight activities through our insurance operations. A primary goal
in managing our insurance operations is to achieve an acceptable risk-adjusted return on equity. To achieve this goal, we must
be disciplined in risk selection, premium adequacy, and appropriate terms and conditions to cover the risk accepted.
Our insurance businesses are conducted on a global basis and expose us to a wide variety of risks with different time horizons. We
manage these risks throughout the organization, both centrally and locally, through a number of procedures:
• pre-launch approval of product design, development and distribution;
• underwriting approval processes and authorities;
• exposure limits with ongoing monitoring;
• modeling and reporting of aggregations and limit concentrations at multiple levels (policy, line of business, product group,
country, individual/group, correlation and catastrophic risk events);
• compliance with financial reporting and capital and solvency targets;
• use of reinsurance, both internal and third-party; and
• review and establishment of reserves.
We closely manage insurance risk by monitoring and controlling the nature and geographic location of the risks in each line of
business underwritten, the terms and conditions of the underwriting and the premiums we charge for taking on the risk. We
analyze concentrations of risk using various modeling techniques, including both probability distributions (stochastic) and/or
single-point estimates (deterministic) approaches.