The Hartford 2015 Annual Report Download - page 11

11
At the corporate level, the Company's Enterprise Chief Risk Officer (“Chief Risk Officer”) leads ERM. The Chief Risk Officer reports
directly to the Company's Chief Executive Officer (“CEO”). The Company has established the Enterprise Risk and Capital Committee
(“ERCC”) that includes the Company’s CEO, President, Chief Financial Officer, Chief Investment Officer, Chief Risk Officer, General
Counsel and others as deemed necessary by the committee chair. The ERCC oversees the risk profile and risk management practices of
the Company. The ERCC also oversees capital management and the allocation of capital to the lines of business. The ERCC is
responsible for significant company-wide risk exposures including, but not limited to, financial risk, liquidity and capital requirements,
insurance risk, operational risks, and any other risk deemed significant. The ERCC reports to the Board primarily through the FIRMCo
and through interactions with the Audit Committee.
The Company also has committees that manage specific risks and recommend risk mitigation strategies to the ERCC. These committees
include, but are not limited to, Asset Liability Committees, Catastrophe Risk Committee, Emerging Risk Committees, Model Oversight
Committees and the Operational Risk Committee.
Risk Management Framework
At the Company, risk is managed at multiple levels. The Hartford utilizes three lines of defense in risk management to integrate its risk
management strategy and appetite into all areas of the Company. The first line of defense in risk management is generally the
responsibility of the lines of business. Senior business leaders are responsible for managing risks specific to their business objectives
and business environment. The second line of defense in risk management is generally owned by ERM. ERM has the responsibility to
ensure that the Company has insight into its aggregate risk and that risks are managed within the Company's overall risk appetite. Legal
and Compliance also commonly act as a second line of defense in risk management. The third line of defense in risk management is
owned by Internal Audit. Internal Audit provides independent assurance that each business unit’s controls are present, compliant, and
effective, informs the risk identification process and provides audit and consultative support to the Company.
The Company's Risk Management Framework consists of five core elements:
1. Risk Culture and Governance: The Company has established policies for its major risks and a formal governance structure with
leadership oversight and an assignment of accountability and authority. The governance structure starts at the Board and
cascades to the ERCC and then to individual risk committees across the Company. In addition, the Company promotes a strong
risk management culture and high expectations around ethical behavior.
2. Risk Identification and Assessment: Through its ERM organization, the Company has developed processes for the
identification, assessment, and, when appropriate, response to internal and external risks to the Company's operations and
business objectives. Risk identification and prioritization has been established within each risk area, including processes around
emerging risks.
3. Risk Appetite, Tolerances, and Limits: The Company has a formal enterprise risk appetite framework and policy that is
approved by the ERCC and reviewed by the Board. The risk appetite framework includes an enterprise risk appetite statement,
risk preferences, risk tolerances and enterprise risk limits. Enterprise risk limits which quantify tolerances into specific limits
by risk category are defined in underlying enterprise risk policies.
4. Risk Management and Controls: While the Company utilizes the committee structure to elevate risk discussions and decision-
making, there are a variety of working groups that provide decisioning and management of risk within determined tolerances
and limits. ERM and the appropriate governing risk committees regularly monitor the Company's risk exposure as compared to
defined limits and tolerances and provide regular reporting to the ERCC and FIRMCo.
5. Risk Reporting and Communication: The Company monitors its major risks at the enterprise level through a number of
enterprise reports, including but not limited to, a monthly risk dashboard, and regular stress testing. ERM communicates the
Company's risk exposures to senior and executive management and the Board, and reviews key business performance metrics,
risk indicators, audit reports, risk/control self-assessments and risk event data.
Risk Exposures and Quantification
The Company quantifies its enterprise insurance and financial risk exposures using multiple lenses including statutory, economic and,
where appropriate, U.S. GAAP. ERM leverages various modeling techniques and metrics to provide a view of the Company's risk
exposure in both normal and stressed environments.