A Recipe for Disaster

Risk Management can be only as effective as a company wants it to be, as evidenced by the continuing saga of American International Group ("AIG").  The Wall Street Journal reported last week that certain high level executives who may have had a hand in limiting access of key risk management personnel remain on the job.  AIG's Chief Risk Officer, Robert Lewis, was at the center of the discussion since he is responsible for AIG's Enterprise Risk Management program.  Here's what the WSJ had to say.

AIG's outside auditor and a regulator raised concerns months before the bailout about the ability of AIG's risk management to monitor what was going on in some units.

At an AIG board-committee meeting in January 2008, AIG's auditor, PricewaterhouseCoopers LLP, "expressed concern that the access" Mr. Lewis's department and other top AIG executives had into the financial-products unit, AIG Investments and other subsidiaries. Access "may require strengthening," according to minutes of the meeting released by Congress last fall.

Two months later, the federal Office of Thrift Supervision, which regulated AIG's financial-products unit, sent a letter to the company, also released by Congress. OTS said the unit "was allowed to limit access of key risk control groups while material questions relating to the valuation of the [swap portfolio] were mounting."  The OTS said those "control groups" included Mr. Lewis's department.

At a congressional hearing last week, Rep. Gary Peters (D., Mich.) asked AIG Chief Executive Edward Liddy, "Where was the risk management of your company? Where was the failure of your own internal risk-management procedures?"

Mr. Liddy responded, "We had risk-management practices in place. They generally were not allowed to go up into the financial-products business."

Selective risk management within a company is a recipe for disaster.  Any area that is deemed "off-limits" should be a gigantic red flag for both senior management and the board of directors.