Bring on tomorrow - AIG.com

ITEM 7 / ENTERPRISE RISK MANAGEMENT.....................................................................................................................................................................................Transaction Approval and Business Practices Committee (TABPC): TABPC provides the primary corporatelevelreview function for all proposed transactions and business practices that are significant in size, complex inscope, or that present heightened legal, reputational, accounting or regulatory risks. Our EVP and Treasurer servesas TABPC Chair and additional members include our EVP and General Counsel, EVP and CRO, EVP and CFO,EVP – Investments, and a senior executive from Finance.Operational Risk Committee (ORC): This Committee is tasked with overview of the enterprise-wide identification,escalation and mitigation of risks that may arise from inadequate or failed internal processes, people, systems, orexternal events. The Committee approves AIG’s Operational Risk Management (ORM) framework and relatedpolicies, which includes the risk and control self assessment (RCSA), Risk Events, Key Risk Indicators (KRIs) andScenario Analysis. The Committee monitors the adequacy of ORM staffing and ensures applicable governancestructures are established to provide oversight of operational risk at each Business Unit and Corporate Function. TheORC also reviews aggregate firm-wide operational risk reports. Our Chief Administrative Officer is Chair of the ORCand our Head of Operational Risk Management serves as ORC Secretary. Other ORC members include senior AIGexecutives with expertise in legal, compliance, technology, finance and operational risk, as well as businesscontinuity management and the chief risk officers of our business units.Group Risk Committee (GRC)Chair: EVP and AIG Chief RiskOfficerFinancial Risk Group (FRG)Chair: EVP and AIG Chief RiskOfficerTransaction Approval &Business Practices Committee(TABPC)Chair: EVP and TreasurerOperational Risk Committee(ORC)Chair: EVP and ChiefAdministrative OfficerBusiness Unit Risk & CapitalCommittees (BU RCCs)(AIG PC, AIG L&R, UGC)15FEB201318003640Business Unit Risk Committees: Each of our major insurance businesses has established a risk and capitalcommittee (BU RCC) that serves as the senior management committee responsible for risk oversight at the individualbusiness unit level. The BU RCCs are responsible for the identification, assessment and monitoring of all sources ofrisk within their respective portfolios. Specific responsibilities include setting risk tolerances, approving capitalmanagement strategies (including asset allocation and risk financing), insurance portfolio optimization, riskmanagement policies and providing oversight of economic capital models. In addition to its BU RCC, each majorinsurance business has established subordinate committees which identify, assess and monitor the specificoperational, transactional and financial risks inherent in its respective business. Together, the BU Risk Committeesand AIG Risk Committees described above provide comprehensive risk oversight throughout the organization.Risk oversight activities also continue to be coordinated with discontinued operations, such as ILFC, until pendingsale transactions are closed.Risk Appetite, Identification, and Measurement..............................................................................................................................................................................................ERM has developed a company-wide Risk Appetite Statement (RAS), which will be updated on at least an annualbasis. By formally defining our risk appetite, we seek to integrate stakeholder interests, business goals and availablefinancial resources through taking measured risks that are intended to generate repeatable, sustainable earnings andproduce long-term value and stability.The RAS articulates our risk-taking capacity by setting consolidated capital and liquidity tolerances as observedunder expected and stressed business and economic conditions. RAS also reflects constraints on minimum capitalpositions for our insurance operations. These constraints inform the requirements for capital adequacy for individualbusinesses, based on capital assessments under rating agency, regulatory and other business needs. Consistentwith our risk appetite, we have established risk tolerances that are reflected in our business planning and areintegrated into the management of our operations. Risk tolerances cover insurance company capital ratios as well asmetrics associated with AIG Parent resources, including consolidated company capital ratios and parent liquidity. OurGRC routinely reviews the level of risk taken by the consolidated organization in relation to established risktolerances. A consolidated risk report is also presented to the FRMC by our CRO...................................................................................................................................................................................................................................156 AIG 2012 Form 10-K