American Express 2009 Annual Report Download - page 51

2009 FINANCIAL REVIEW
AMERICAN EXPRESS COMPANY
of a hypothetical 10 percent change in the value of the U.S.
dollar would be immaterial as of December 31, 2009. With
respect to earnings denominated in foreign currencies, the
adverse impact on pretax income of a hypothetical 10 percent
strengthening of the U.S. dollar related to anticipated overseas
operating results for the next 12 months would be
approximately $112 million as of December 31, 2009. With
respect to translation exposure of foreign subsidiary equity,
including related foreign exchange forward contracts
outstanding, a hypothetical 10 percent strengthening in the
U.S. dollar would result in an immaterial reduction in equity
as of December 31, 2009.
The actual impact of interest rate and foreign exchange
rate changes will depend on, among other factors, the timing
of rate changes, the extent to which different rates do not
move in the same direction or in the same direction to the
same degree, and changes in the volume and mix of the
Company’s businesses.
FUNDING & LIQUIDITY RISK MANAGEMENT
PROCESS
Funding & liquidity risk is defined as the inability to access
cash and equivalents needed to meet business requirements
and satisfy the Company’s obligations. General principles and
the overall framework for managing liquidity risk across the
Company are defined in the Liquidity Risk Policy, which is
the responsibility of the ALCO. The Company balances the
trade-offs between maintaining too much liquidity, which can
be costly and limit financial flexibility, with having inadequate
liquidity, which may result in financial distress during a
liquidity event. Liquidity risk is centrally managed by the
Funding and Liquidity Committee, which reports into the
ALCO and is chaired by the Corporate Treasurer. The
Company has developed a liquidity plan that enables it to
meet its daily cash obligations when access to both unsecured
and secured funds in the debt capital markets is impaired or
unavailable. This plan is designed to ensure that the Company
and all of its main operating entities could continuously meet
their maturing debt obligations for a 12-month period in
which their access to all capital markets and deposit financing
is interrupted.
Liquidity risk is managed both at an aggregate company
level and at the major legal entities in order to ensure that
sufficient funding and liquidity resources are available in the
amount and in the location needed in a stress event. The
Funding and Liquidity Committee manages the forecasts of
the Company’s aggregate and subsidiary cash positions and
financing requirements, the funding plans designed to satisfy
those requirements under normal conditions, establishes
guidelines to identify the amount of liquidity resources
required, and monitors positions and determines any actions
to be taken. Liquidity planning also takes into account
operating cash flexibilities.
OPERATIONAL RISK MANAGEMENT PROCESS
The Company defines operational risk as the risk of not
achieving business objectives due to inadequate or failed
processes or information systems, human error or the
external environment (e.g., natural disasters) including losses
due to failures to comply with laws and regulations.
Operational risk is inherent in all business activities and can
impact an organization through direct or indirect financial
loss, brand damage, customer dissatisfaction, or legal or
regulatory penalties. Current areas of significant focus include
data protection, anti-money laundering, vendor risk, impact
of organizational change, financial reporting risk and both
internal and external fraud.
The general principles and the overall framework for
managing operational risk across the Company are defined in
the Operational Risk Policy approved by the ERMC. The
Operational Risk Management Committee (ORMC) provides
governance for the operational risk framework.
In order to appropriately measure operational risk, the
Company has developed a comprehensive operational risk
model. This model assesses (i) risk events, i.e. what occurred
or could have occurred; (ii) root causes, i.e. why did it occur
or could have occurred; and (iii) impact, i.e. how was the
Company affected or might have been affected. The impact
on the Company is assessed from a financial, brand,
regulatory and legal perspective. The operational risk model
also assesses the frequency and likelihood that events may
occur again so that the appropriate mitigation steps may be
taken.
Additionally, the Company uses an operational risk
framework to identify, measure, monitor, and report inherent
and emerging operational risks. This framework consists of a)
the ORMC oversight, b) an operational risk event capture
process, and c) process and entity-level risk self-assessments.
The process risk self-assessment methodology is used to
facilitate compliance with Section 404 of the Sarbanes-Oxley
Act, and is also used for non-financial operational risk self-
assessments. This methodology involves identifying key
processes across the Company and then determining the
inherent operational risks. Once these risks have been
identified, the existing control environment is defined, key
controls are tested and relevant issues are escalated to the
appropriate governing bodies.
The operational risk framework also includes the entity
risk self-assessment. This is a risk workshop where senior
leaders identify the key operational risks that the business unit
or support group faces and determines the Company’s
preparedness to respond should these risks occur. Top risks
are tracked to ensure that the appropriate monitoring or
mitigation is in place.
Managing enterprise risk is an important priority for the
Company and the program continues to evolve.
49