The Hartford 2012 Annual Report Download - page 97

Table of Contents
Citizens Property Insurance Corporation in Florida (“Citizens”), a non-affiliate insurer, provides property insurance to Florida homeowners and businesses
that are unable to obtain insurance from other carriers, including for properties deemed to be “high risk.” Citizens maintains a Personal Lines account, a
Commercial Lines account and a High Risk account. If Citizens incurs a deficit in any of these accounts, Citizens may impose a “regular assessment” on
other insurance carriers in the state, such as the Company, to fund the deficits, subject to certain restrictions and subject to approval by the Florida Office of
Insurance Regulation. Carriers are then permitted to surcharge policyholders to recover the assessments over the next few years. Citizens may also opt to
finance a portion of the deficits through issuing bonds and may impose “emergency assessments” on other insurance carriers to fund the bond repayments.
Unlike with regular assessments, however, insurance carriers only serve as a collection agent for emergency assessments and are not required to remit
surcharges for emergency assessments to Citizens until they collect surcharges from policyholders. Under U.S. GAAP, the Company is required to accrue for
regular assessments in the period the assessments become probable and estimable and the obligating event has occurred. Surcharges to recover the amount of
regular assessments may not be recorded as an asset until the related premium is written. Emergency assessments that may be levied by Citizens are not
recorded in the income statement.
Operational Risk Management
The Hartford has an Operational Risk Management (“ORM”) function whose responsibility is to provide a comprehensive and enterprise-wide view of the
Company's operational risk on an aggregate basis. The Company defines operational risk as the risk of loss resulting from inadequate or failed internal
processes, people and systems, or from external events. This inadequacy or failure may come from internal or external events. It includes legal risk and
considers reputational risk as an impact. The Company has developed a library of operational risks which have been classified into the following seven risk
categories:
•Internal Fraud
•External Fraud
•Employment Practices & Workplace Safety
•Business Disruption & Systems Failures
•Clients, Products & Business Practice
•Damage to Physical Assets
•Execution, Delivery & Process Management
ORM is led by the Chief Operational Risk Officer (“CORO”) who is responsible for establishing, maintaining and communicating the framework, principles
and guidelines of The Hartford's operational risk management program. In addition, the CORO also manages business continuity, model risk management
and risk assessments. Responsibility for day-to-day management of operational risk lies within each business unit and functional area.
ORM works closely with the Operational Risk Committee (“ORC”), an enterprise wide governance body comprised of senior leaders from functional areas
such as ORM, Enterprise Services, Enterprise Operations, Claims, Information Technology, Compliance and Internal Audit. The ORC meets regularly and
provides a forum for ensuring the effective management of operational risks across the enterprise. The ORC's responsibilities include reviewing and
approving: policies governing operational risk, functional risk tolerances, and risk mitigation strategies. This group also identifies emerging operational risks,
prioritizes them, and determines action plans. Individual committees, such as the Enterprise Sourcing Board, Enterprise Privacy and Security Committee,
and the Enterprise Health, Environment and Safety Committee focus on specific operational risk issues and report to the ORC.
ORM is responsible for ensuring controls and providing a framework for managing operational risks. ORM has various tools and processes for identifying,
monitoring, measuring, prioritizing, and reporting operational risks. ORM uses a centralized Governance, Risk, and Compliance (GRC) system to help
manage operational risk across the Company's finance, legal, data security, and information technology functions. The ORM (Archer) Steering Committee
manages the direction, strategy and priorities of the initiatives that support governance, risk and compliance.
The Company's business risk assessment process is used to identify operational risks, evaluate controls to mitigate those risks, and monitor control
improvements.
96