AMERICAN INTERNATIONAL GROUP INC

Business and strategy risk encompasses those risks that stem from strategy risk, risk of legal and regulatory actions, risk of rating agency actions, reputational risk and intercompany dependencies. The major AIG strategy risks capture risk of losses due to the inability to implement appropriate business plans and strategies, make decisions, allocate resources or adapt to changes in the business environment. These risks include, but are not limited to pricing, distribution channels, acquisitions, and dispositions. The risk of legal and regulatory actions is defined as the risk that legal action or a change in regulation in the regions in which AIG does business will materially impact business operations, financial performance, and/or capital requirements. Risk drivers include, but are not limited to, adverse actions in legal or regulatory environment, and adverse actions or added complexity of accounting/tax standards. A downgrade by one or more of the rating agencies in the Insurer Financial Strength ratings of AIG’s insurance companies could limit their ability to write or prevent them from writing new business and impair their retention of customers and in-force business, and a downgrade in our credit ratings could adversely affect our business, results of operations, financial condition, and liquidity. Reputational risk events are typically linked to risk incidents, whether internal (e.g., data privacy breaches, fraud, etc.) or external (e.g., non-AIG insurance losses). The reputational impact may magnify the financial consequences of the original risk event (e.g., reduced sales in addition to fines).

AIG generates multiple connections and dependencies among its affiliates and legal entities. Financial interconnections are utilized by AIG to support the funding requirements of the business units, optimize group capital deployment within the organization, offer comfort to policyholders, regulators, and rating agencies, provide credit support for higher financial strength ratings, manage exposures, distribute risk appropriately, and meet client or regulatory requirements. To conduct its businesses, AIG relies on operational capabilities of several AIG affiliates and corporate functions. The operational interconnections can be categorized as employees, management information systems, real estate, shared services, and intellectual property.

AIG monitors and reports on the above-mentioned risks through ongoing risk reporting to various committees, monitoring of capital positions, regular interaction with AIG businesses and functions, regulators, and rating agencies. AIG reputational risk protocols are incorporated into the overall risk management framework. On a regular basis, ERM performs Second Line Review and Challenge on many of these processes and approaches, including, but not limited to, budget and expense assumptions, pricing and reserving models, assumptions, and results. The Internal Audit Group performs audits on key processes and provides continuous monitoring on remediation of audit findings. Processes and controls are designed to respond proactively and in some cases, reactively, in an effective and consistent way.