AIG 2015 Annual Report Download - page 180

ITEM 7 / ENTERPRISE RISK MANAGEMENT

180
We use a number of approaches to measure our liquidity risk exposure, including:
Target Liquidity Range: Target Liquidity Range specifies the amount of assets required to be maintained in specific
liquidity portfolios to meet obligations as they arise over a twelve month horizon under stressed liquidity conditions.
Coverage Ratios: Coverage Ratios measure the adequacy of available liquidity sources, including the ability to monetize
assets to meet the forecasted cash flows over a specified time horizon. The portfolio of assets is selected based on our
ability to convert those assets into cash under the assumed market conditions and within the specified time horizon.
Cash Flow Forecasts: Cash Flow Forecasts measure the liquidity needed for a specific legal entity over a specified time
horizon.
Stress Testing: Coverage Ratios and Asset Ratios are re-measured under defined liquidity stress scenarios that will
impact net cash flows, liquid assets and/or other funding sources.
Relevant liquidity reporting is produced and reported regularly to AIG Parent and business unit risk committees. The frequency,
content, and nature of reporting will vary for each business unit and legal entity, based on its complexity, risk profile, activities
and size.
Operational Risk Management
Operational risk is defined as the risk of loss, or other adverse consequences, resulting from inadequate or failed internal
processes, people, systems, or from external events. Operational risk includes legal, regulatory and compliance risks, but
excludes business and strategy risks.
Operational risk is inherent in each of our business units. Operational risks can have many impacts, including but not limited to:
unexpected economic losses or gains, reputational harm due to negative publicity, regulatory action from supervisory
agencies, operational and business disruptions, and/or damage to customer relationships.
ORM oversees the Operational Risk policy and framework, which includes risk identification, assessment, prioritization,
measurement, monitoring, and reporting of operational risk. As part of the framework, we deploy a series of operational risk
programs to support our business units with the identification, monitoring and reporting of operational risks. The ORM
programs include, but are not limited to, several key components as outlined below:
• The Risk Event Capture process enables each employee to identify, document, and escalate operational risk impacts, with
a view to enhancing, processes and promoting lessons learned.
• The Vulnerability Identification (VID) process identifies emerging risks, which we consider to be risks that have not yet fully
manifested themselves but could become significant over time.
• The Ordinal Risk Ranking effort provides an ordinal ranking of the firm’s most significant operational risks at the
Enterprise, Segment or Regional levels, with the goal of prioritizing assessment and remediation activity.
• The Risk and Control Self-Assessments (RCSAs) allow for the identification and assessment of the key operational risks
within our respective business units and a determination as to whether the related controls are effective.
• Scenario Analyses are executed to identify the remote, but plausible, potential risks that could result in severe financial
losses.
ORM, working together with other key second lines of defense functions (e.g., Model Validation and the Technology Risk office,
as well as Compliance, SOX, and Global Business Continuity), provides an independent view of Operational Risk for each
business, and works with the business to facilitate implementation of the above programs. This includes coverage of
operational risks related to core insurance activities, investing, model risk, technology (including cyber security, access, data