Introduction
American International Group, better known as AIG, was once regarded as one of the world’s most powerful insurance and financial services organisations. Before the global financial crisis, it operated across numerous countries, served millions of customers and had consolidated assets exceeding US$1 trillion.
Yet in September 2008, AIG came close to collapse and required extraordinary intervention from the United States authorities.
The episode remains one of the most instructive examples of why an insurance group needs effective Enterprise Risk Management. The crisis was not primarily caused by unexpectedly high conventional insurance claims. Instead, enormous exposures accumulated within AIG Financial Products, a subsidiary involved in complex financial derivatives. When financial markets deteriorated, those risks generated collateral demands and liquidity requirements that threatened the entire group.
The central lesson is simple but powerful: a risk that appears contained within one subsidiary can become an enterprise-wide threat if exposures, correlations and liquidity consequences are not understood at group level.
AIG before the crisis
AIG was a highly diversified organisation with substantial property and casualty insurance, life insurance, retirement and financial services operations.
Its strong reputation and financial standing provided the broader group with significant credibility in financial markets.
AIG Financial Products used this strength to participate extensively in the derivatives market. Among the instruments it entered into were credit default swaps.
A credit default swap essentially transfers credit risk. The seller of protection agrees, subject to the contractual terms, to compensate the buyer if specified credit-related events occur in relation to the underlying securities or obligations.
For AIG Financial Products, this appeared attractive while defaults remained low. The business generated revenue without requiring the type of immediate cash outflow associated with conventional claims.
The problem was that enormous potential obligations were accumulating beneath the surface.
The build-up of risk
AIG Financial Products sold credit protection on large amounts of securities, including collateralised debt obligations containing exposure to residential mortgages.
As long as housing markets remained strong, underlying securities retained their value and AIG maintained strong credit ratings, the strategy appeared manageable.
However, several risks were developing simultaneously.
There was credit risk because the value and performance of mortgage-related securities could deteriorate.
There was market risk because changes in the market value of these instruments affected the valuation of derivative positions.
There was concentration risk because substantial exposure was ultimately connected with the United States housing and mortgage markets.
Perhaps most importantly, there was liquidity risk.
Certain contracts required AIG to provide additional collateral if the value of underlying securities fell or if AIG itself suffered credit-rating downgrades.
This meant that even without waiting for ultimate losses on the underlying securities, adverse market developments could create an immediate need for enormous amounts of cash.
This distinction became critical.
When the housing market turned
As the United States housing market deteriorated, mortgage defaults increased and the value of mortgage-backed securities declined.
The deterioration affected securities on which AIG Financial Products had provided credit protection.
Counterparties consequently began demanding additional collateral.
At the same time, concerns about AIG’s financial position increased. Credit-rating agencies downgraded the company, which generated further collateral requirements under contractual provisions.
A dangerous feedback loop developed:
falling asset values increased collateral calls; collateral calls increased liquidity pressure; liquidity pressure weakened confidence; weakening confidence contributed to rating pressure; and rating downgrades triggered still more collateral requirements.
A risk that might initially have been considered a credit or market risk rapidly transformed into a liquidity crisis.
This is one of the most important risk-management lessons from AIG.
Risk categories do not exist independently. Credit risk can create market losses. Market losses can create collateral requirements. Collateral requirements can create liquidity risk. Liquidity problems can create reputational and funding problems. Eventually, the combination can threaten solvency.
The liquidity crisis
By September 2008, AIG faced severe difficulties obtaining sufficient funding to satisfy its obligations.
The crisis was intensified by the wider turmoil in global financial markets and the collapse of Lehman Brothers.
On 16 September 2008, the United States Federal Reserve authorised an emergency credit facility of up to US$85 billion for AIG. Government support was subsequently restructured and expanded through additional measures.
Authorities concluded that an uncontrolled failure of AIG could create serious systemic consequences because of the organisation’s size, interconnectedness and relationships with banks, investors, policyholders and financial markets.
The intervention demonstrated something particularly important for insurers: a large financial group can face a liquidity crisis even when many of its individual insurance businesses remain viable.
Where Risk Management Failed
Investigations following the crisis identified serious shortcomings in AIG’s risk management and governance arrangements.
1. Risk Was Not Viewed Adequately at Enterprise Level
The Financial Crisis Inquiry Commission concluded that AIG’s problems reflected a profound failure of corporate governance and risk management.
The exposures generated by AIG Financial Products needed to be evaluated not simply in terms of that subsidiary’s expected profitability but according to their potential effect on the entire AIG organisation.
Effective Enterprise Risk Management requires management to ask:
If this business experiences an extreme event, what happens to the rest of the group?
That question was not addressed adequately.
2. Extreme Scenarios Were Underestimated
Risk models often work well under normal conditions and fail precisely when they are needed most.
The derivative strategy depended heavily on assumptions concerning the safety of underlying securities, market behaviour and the likelihood of extreme deterioration.
The crisis demonstrated the danger of relying excessively on historical experience and conventional probability assumptions.
Low-probability events can still be catastrophic when the potential exposure is enormous.
Stress testing should therefore assess not merely what is likely to happen, but what could threaten the survival of the organisation.
3. Liquidity Risk Was Underappreciated
One of the greatest mistakes was failing to appreciate sufficiently the difference between an ultimate economic loss and an immediate liquidity requirement.
An organisation may believe that an underlying asset will eventually recover or that ultimate credit losses will remain manageable. But if contracts require billions of dollars of collateral today, the company can fail before the long-term outcome becomes relevant.
Insurers should therefore stress-test:
- collateral requirements;
- rating downgrades;
- sudden cash demands;
- inability to sell assets;
- closure of funding markets; and
- simultaneous adverse events.
Liquidity is not merely the responsibility of the treasury department. It is an enterprise survival issue.
4. Concentration Risk Was Hidden by Complexity
- Thousands of individual transactions can create the impression of diversification.
- But diversification is ineffective when exposures are ultimately driven by the same underlying factor.
- In AIG’s case, substantial risks were connected directly or indirectly to housing and mortgage-related assets.
- Risk aggregation must therefore look through individual contracts to identify common drivers.
For an insurer, similar concentrations can arise from natural catastrophes, geographic clusters, common reinsurers, technology providers, industries, distribution partners or investment portfolios.
5. Credit Ratings Became a Risk Trigger
AIG’s strong credit rating helped support its business model. But contracts containing rating-related collateral provisions meant that deterioration in the company’s rating created additional liquidity requirements.
This demonstrates the importance of understanding second-order risks.
Management should not merely ask:
“What happens if our credit rating declines?”
It should also ask:
“What contractual obligations, collateral calls, funding pressures and counterparty actions would be triggered by that downgrade?”
The Importance of Risk Appetite
A well-developed Enterprise Risk Management framework requires a clearly articulated risk appetite.
Risk appetite determines how much and what types of risk an organisation is willing to accept in pursuing its objectives.
For a complex insurer, it should be translated into measurable limits covering areas such as:
- insurance underwriting;
- catastrophe exposure;
- investment concentration;
- counterparty exposure;
- liquidity;
- derivatives;
- operational risk; and
- capital at risk.
Limits are effective only when breaches are escalated and management has the authority to reduce exposure.
A highly profitable activity should not be allowed to continue indefinitely merely because it is producing earnings if the potential downside threatens the organisation’s capital or liquidity.
Risk Culture Matters
Risk management cannot succeed through models and policies alone.
Business units may naturally focus on revenue and profitability. The risk function must have sufficient independence, authority and access to senior management to challenge activities generating disproportionate risk.
A strong risk culture allows someone to ask:
“What happens if our assumptions are wrong?”
It also ensures that such questions receive serious consideration even when the business concerned is profitable.
The AIG experience demonstrates the danger of allowing complexity, historical profitability or confidence in sophisticated models to weaken independent challenge.
Lessons for Today’s Insurance Industry
The case remains highly relevant even though the financial crisis occurred nearly two decades ago.
Modern insurers face increasingly interconnected exposures involving cyber risk, climate change, artificial intelligence, outsourcing, cloud computing, catastrophe accumulation, investment volatility and complex reinsurance structures.
The specific risks have changed, but the ERM principles remain similar.
Aggregate Risk Across the Organisation
Management should have a consolidated view of exposures across subsidiaries, products, locations and risk categories.
Stress Test Beyond Historical Experience
Scenarios should include extreme but plausible combinations of events rather than simply extrapolating past losses.
Connect Capital and Liquidity
Capital adequacy does not guarantee liquidity. Both require separate assessment.
Understand Risk Interdependencies
A cyberattack may create operational losses, regulatory penalties, reputational damage and business interruption simultaneously. A catastrophe may generate insurance claims while also reducing the value of investments or disrupting service providers.
Monitor Concentration
Apparently independent exposures may share common underlying risk drivers.
Strengthen Board Oversight
The Board should understand not only headline risk indicators but also major concentrations, emerging risks, stress-test outcomes and scenarios capable of threatening the organisation.
Give the Risk Function Effective Authority
Enterprise risk management should influence business decisions before exposures become excessive, rather than documenting risks after they have already accumulated.
A simple ERM test
The AIG experience suggests a useful test that insurance companies can apply to any major business activity.
Management should ask:
1. What is the maximum plausible loss?
2. What could cause that loss?
3. Could several risks occur simultaneously?
4. How much cash could be required immediately?
5. What happens if our credit rating deteriorates?
6. Could the exposure threaten other companies within the group?
7.Are senior management and the Board aware of the full exposure?
8.Do we have predefined limits and corrective actions?
If these questions cannot be answered clearly, the organisation may not fully understand the risk it has accepted.
Conclusion
The near-collapse of AIG was not simply a story about credit default swaps or the United States housing market. It was fundamentally a lesson about enterprise risk visibility.
One part of a vast organisation accumulated exposures whose consequences eventually spread across the entire group. Credit risk interacted with market risk, rating risk and liquidity risk until the organisation faced an existential crisis.
The episode demonstrates why Enterprise Risk Management is more than preparing risk registers or regulatory reports. Its real purpose is to ensure that senior management and the Board understand how individual risks combine, how severe exposures can become and whether the organisation has sufficient capital, liquidity and resilience to survive extreme conditions.
For today’s insurers, the lasting lesson from AIG is clear:
Risk should never be judged solely by the profitability of the business that creates it. It must be judged by the potential consequences for the enterprise as a whole.
