Roads to Resilience

Risk management is considered to be everybody’s job, it is everybody’s obligation rather than the responsibility of the risk management function: “ … everybody is managing all the risks all the time … risk is everybody’s business and we just push that every time we can, it is everybody throughout the organisation who is involved ” (Chief Risk Officer).

Business structure

The company has in the past couple of years moved away from a silo approach, (with each area having its own approach to what risk was acceptable). In the lead up to the problems of 2008, this approach would have been beneficial because big profits in some areas would offset the lower returns in others and also provide protection against the various shocks (large insurance claims by customers) the organisation would experience from time to time. The silo mentality meant that “ there was minimal corporate infrastructure and so the ability to look horizontally across the business was weak ” (Chief Risk Officer and Head of Strategy for the Property Casualty Business). Senior managers now take a more horizontal view and the risk management function looks more across the business than it did in the past. The company has a functional structure, with the corporate headquarters in New York and headquarters for the EMEA region in London. The firm also operates a matrix structure at a management level. It employs in the region of 63,000 people across the world. AIG see their success as coming through taking a risk – they transfer risk from their clients for a premium. Their experience from the 2008 crisis has had a profound effect on the way they manage their business and particularly on the role of the management of risk. At the Board and Executive team levels, they see one of their tasks as managing the risks the organisation exposes itself to. The company CEO, Bob Benmosche, introduced a monthly risk committee meeting, chaired by himself, which brings together the business unit heads, the head of actuarial, head of audit and head of risk management to discuss the main risks “ we lay out an agenda of all the things we think are the topical risks, the risks of the month, and then we go through and say what do we need to do to deal with them ” (CEO, AIG). The company has improved its communication, there is a recognition that poor communication leads to operational risk, “ poor communication is probably one of the worst situations because it generally adds a lot of risk (operational risk) because poor communication is generating a situation where there is a lack of understanding from the staff all over the organisation about what the company wants to achieve, if there is a lack of clarity across strategies you have a recipe for failure ” (Managing Director, UK). The company has set a clear risk appetite (the parameters within which they will do business) for all the areas of the organisation. The risk appetite is proposed by technical functions and then challenged, validated and approved by the board of directors. This gives the parameters within which the executive management can operate the company, such that it makes a return commensurate with the objectives set by the board. This could be seen as restrictive, however, the intention is to ensure the on-going stability of the business and its continued success “ we have a risk appetite we wish to operate in that could be viewed by underwriters as restricting but that’s Strategy, tactics and operations

98

Appendix A Case study: AIG