GE 2013 Annual Report Download - page 41

’   
GE 2013 ANNUAL REPORT 39
Risk assessment and risk management are the responsibility
of management and are carried out through risk managers who
are operationally integrated into each of our businesses. These
risk managers have acquired deep domain expertise through
their long careers and proximity to the business’ operations and
core processes. Both risk managers and the business leadership
teams have specifi c, risk-focused goals and objectives that are
aligned with our overall risk framework.
The GE Board of Directors (Board) has oversight for risk man-
agement with a focus on the most signifi cant risks facing the
Company, including strategic, operational, fi nancial and legal
and compliance risks. At the end of each year, management and
the Board jointly develop a list of major risks that GE plans to pri-
oritize in the next year. Throughout the year, the Board and the
committees to which it has delegated responsibility dedicate a
portion of their meetings to review and discuss specifi c risk top-
ics in greater detail. Strategic, operational and reputational risks
are presented and discussed in the context of the CEO’s report on
operations to the Board at regularly scheduled Board meetings
and at presentations to the Board and its committees by the vice
chairmen, GE and GECC Chief Risk Offi cers (CROs), general coun-
sel and other employees. The Board has delegated responsibility
for the oversight of specifi c risks to Board committees as follows:
• The GE Risk Committee oversees risks related to GE Capital
and jointly meets throughout the year with the GECC Board of
Directors (GECC Board), which is in addition to an annual joint
meeting of the GE and GECC Boards. The GE Risk Committee
also oversees the Company’s four to fi ve most critical enter-
prise risks and how management is mitigating these risks.
• The Audit Committee oversees GE’s and GE Capital’s policies
and processes relating to the fi nancial statements, the fi nan-
cial reporting process, compliance and auditing. The Audit
Committee, in coordination with the GE Risk Committee, dis-
cusses with management the Company’s risk assessment and
risk management practices and, when reviewing and approv-
ing the annual audit plan for the internal audit functions,
prioritizes audit focus areas based on their potential risk to the
Company. The Audit Committee also monitors ongoing com-
pliance issues and matters, and also semi-annually conducts
an assessment of compliance issues and programs. The Audit
Committee jointly meets with the GECC Board once a year,
which is in addition to an annual joint meeting of the GE Risk
Committee and Audit Committee.
• The Management Development and Compensation
Committee oversees the risk management associated with
management resources, structure, succession planning, man-
agement development and selection processes, and includes
separate reviews of incentive compensation arrangements
at GE and GE Capital to confi rm that incentive pay does not
encourage unnecessary and excessive risk taking and to
review and discuss, at least annually, the relationship between
risk management policies and practices, corporate strat-
egy and senior executive compensation. The Management
Development and Compensation Committee also incentivizes
leaders to improve the Company’s competitive position.
• The Governance and Public Affairs Committee oversees risk
related to the Company’s governance structure and processes
and risks arising from related-person transactions, reviews
and discusses with management risks related to GE’s public
policy initiatives and activities, and monitors the Company’s
environmental, health and safety compliance and related risks.
The GE Board’s risk oversight process builds upon management’s
risk assessment and mitigation processes, which include stan-
dardized reviews of long-term strategic and operational planning;
executive development and evaluation; code of conduct com-
pliance under the Company’s The Spirit & The Letter; regulatory
compliance; health, safety and environmental compliance; fi nan-
cial reporting and controllership; and information technology and
security. A vice chairman of GE and GE’s CRO are responsible for
overseeing and coordinating risk assessment and mitigation on
an enterprise-wide basis. They lead the Corporate Risk Function
and are responsible for the identifi cation of key business risks,
providing for appropriate management of these risks within GE
Board guidelines, and enforcement through policies and proce-
dures. In 2013, the Company combined its risk evaluation process
with its quarterly operating reviews to simplify the Company’s
operating rhythm and added a vice chairman position with
responsibility for both enterprise risk and operations. The Policy
Compliance Review Board is a management-level committee
that further assists in assessing and mitigating risk. The Policy
Compliance Review Board, which conducted four compliance
operating reviews and met seven times in 2013, is chaired by
the Company’s general counsel and includes the Chief Financial
Offi cer and other senior-level functional leaders. It has prin-
cipal responsibility for monitoring compliance matters across
the Company.
GE’s Corporate Risk Function leverages the risk infrastructures
in each of our businesses, which have adopted an approach that
corresponds to the Company’s overall risk policies, guidelines and
review mechanisms. Our risk infrastructure operates at the busi-
ness and functional levels and is designed to identify, evaluate
and mitigate risks within each of the following categories:
•
STRATEGIC. Strategic risk relates to the Company’s future
business plans and strategies, including the risks associated
with the markets and industries in which we operate, demand
for our products and services, competitive threats, technol-
ogy and product innovation, mergers and acquisitions and
public policy.
•
OPERATIONAL. Operational risk relates to risks (systems, pro-
cesses, people and external events) that affect the operation
of our businesses. It includes product life cycle and execution;
product safety and performance; information management
and data protection and security, including cyber security;
business disruption; human resources; and reputation.