American Express 2015 Annual Report Download - page 97

Similar to Individual Credit Risk, business units taking institutional credit risks are supported by Chief Credit
Officers. These officers are guided by the Institutional Risk Management Committee (IRMC), which is responsible for
implementation and enforcement of the Institutional Credit Risk Management Policy and for providing guidance to the
credit officers of each business unit with substantial institutional credit risk exposures. The committee, along with the
business unit Chief Credit Officers, makes investment decisions in core risk capabilities, ensures proper
implementation of the underwriting standards and contractual rights of risk mitigation, monitors risk exposures, and
determines risk mitigation actions. The IRMC formally reviews large institutional risk exposures to ensure compliance
with ERMC guidelines and procedures and escalates them to the ERMC as appropriate. At the same time, the IRMC
provides guidance to the business unit risk management teams to optimize risk-adjusted returns on capital. A
centralized risk rating unit and a specialized airline risk group provide risk assessment of our institutional obligors.
Exposure to the Airline Industry
We have multiple important cobrand, rewards, merchant acceptance and corporate payments arrangements with
airlines. The ERM program evaluates the risks posed by our airline partners and the overall airline strategy
companywide through comprehensive business analysis of global airlines. Our largest airline partner is Delta, and this
relationship includes exclusive cobrand credit card partnerships and other arrangements including Membership
Rewards redemption, merchant acceptance, travel and corporate payments. See “Risk Factors.”
Sovereign Debt Exposure
As part of our ongoing risk management process, we monitor our financial exposure to both sovereign and non-
sovereign customers and counterparties, and measure and manage concentrations of risk by geographic regions, as
well as by economic sectors and industries. A primary focus area for monitoring is credit deterioration due to
weaknesses in economic and fiscal profiles. We evaluate countries based on the market assessment of the riskiness of
their sovereign debt and our assessment of our economic and financial outlook and closely monitor those deemed
high risk. As of December 31, 2015, we considered our gross credit exposures to government entities, financial
institutions and corporations in those countries deemed high risk to be individually and collectively not material.
OPERATIONAL RISK MANAGEMENT PROCESS
We define operational risk as the risk of not achieving business objectives due to inadequate or failed processes,
people, or information systems, or the external environment, including failures to comply with laws and regulations.
Operational risk is inherent in all business activities and can impact an organization through direct or indirect financial
loss, brand damage, customer dissatisfaction, or legal and regulatory penalties.
To appropriately measure and manage operational risk, we have implemented a comprehensive operational risk
framework that is defined in the Operational Risk Management Policy approved by the Risk Committee. The
Operational Risk Management Committee (ORMC) coordinates with all control groups on effective risk assessments
and controls and oversees the preventive, responsive and mitigation efforts by Lead Operational Risk Officers in the
business units and staff groups. To preserve independence, the Lead Operational Risk Officers for all business units
report to our Chief Operational Risk Officer, who in turn reports directly to our Chief Risk Officer.
We use the operational risk framework to identify, measure, monitor and report inherent and emerging
operational risks. This framework, supervised by the ORMC, consists of (a) operational risk event capture, (b) a project
office to coordinate issue management and control enhancements, (c) key risk indicators such as customer
complaints or pre-implementation test metrics, and (d) process and entity-level risk assessments.
The framework requires the assessment of operational risk events to determine root causes, impact to customers
and/or us, and resolution plan accountability to correct any defect, remediate customers, and enhance controls and
testing to mitigate future issues. Our impact is assessed from an operational, financial, brand, regulatory compliance
and legal perspective.
INFORMATION SECURITY, PRIVACY, AND DATA GOVERNANCE
We have implemented an Information Security Framework and Operating Model that is designed to protect
information and information systems from unauthorized access, use, disclosure, disruption, modification or
destruction.
Chaired by the Chief Information Security Officer, our Information Security Risk Management Committee, a sub-
committee of the ORMC, provides oversight and governance for our information security risk management program.
In addition, the committee is responsible for establishing cyber risk tolerances and in managing cyber crisis
preparedness. The Information Security Oversight team provides challenges and independent assessment of the
information security program.
86