Maximizing Value Through Enterprise Risk Management

1. Maximizing Value Through Enterprise Risk Management ERM Course May 3, 2005 James Lam President phone: 781.772.1961 Email: jameslam@comcast.net Website: www.jameslam.com

2. Our president, James Lam, has spent 20 years in risk management Professional • President, James Lam & Associates • Founder and President, ERisk • Partner, Oliver, Wyman & Company • CRO, Fidelity Investments • CRO, Capital Markets Services Inc., a GE Capital company Industry Activities • PRMIA Blue Ribbon Panel Member • GARP Inaugural Financial Risk Manager of the Year (1997) • Published over 50 articles and book chapters • Quoted in Wall Street Journal, Financial Times, Risk Magazine, and CFO Magazine Academic • Senior Research Fellow, Beijing University • Adjunct Professor, Babson College • Lectured at Harvard Business School as the subject of a HBS case study • MBA, UCLA School of Business • BBA, Baruch College Client Solutions • Consulting – ERM, strategic risk, financial risk, and operational risk • Software – Operational risk (with OpenPages) and ERM Dashboard (CXO Systems) • Training – board and management workshops

3. We are singularly focused on risk management Client Solutions • Consulting services • Software products • CXO Systems • OpenPages • Training programs Areas of Expertise • Enterprise risk management • Market risk management • Credit risk management • Operational risk management • KRIs and risk reporting

4. As discussed in James’ recent book, we define ERM as a value added function Definition of ERM: “An integrated framework for managing credit risk, market risk, operational risk, economic capital, and risk transfer in order to maximize firm value.”

5. Discussion outline • Key trends and requirements • Best practices and practical applications • ERM in the future

6. Financial Risks Credit Risk Associated with Investments FX risk in a new foreign market MarketRisk Asset Liquidity CreditRisk LiquidityRisk Credit Risk Associated with Borrowers and Counterparties Derivatives documentation and counterparty risk Funding Liquidity IT and business process outsourcing ERM is useful because the risks faced by companies are highly interdependent Enterprise-Wide Risks FinancialRisk Business Risk OperationalRisk

7. Traditionally, risks were managed within organizational “silos” Strategic Risk Business Risk Financial Risk Operational Risk • Business Managers • Project Managers • CFO • Treasurer • Internal Audit • Compliance • IT • Board of Directors • CEO Who • Product plans • Business reviews • Project management • Strategic planning • EVA • Balanced scorecard • Country and credit limits • Trading and ALM Limits • Financial derivatives • Controls • Audits • Contingency planning • Insurance How

8. Broadens risk awareness Aligns risk profile and strategy Minimizes surprises and losses Rationalizes capital requirements Assures regulatory compliance Improves ROE and shareholder value ERM is widely recognized as the best practice approach Financial Institutions Barclays GE Capital JP Morgan Chase Fidelity Investments Non-Financial Corporations Microsoft Boeing Duke Energy Ford Enterprise Risk Management Chief Executive Officer/Chief Fisk Officer Operational Risk Internal Audit Compliance IT Financial Risk CFO Treasurer Business Risk Line managers Project Managers Strategic Risk Board CEO Benefits

9. Enron • WorldCom • Adelphia • Mutual Funds Corporate Disasters • Banks • Asset Managers • Energy Firms • Corporations Best Practices RegulatoryActions • S.E.C. • Sarbanes-Oxley • Basel II • Treadway Report, US • Turnbull Report, UK • Dey Report, Canada IndustryInitiatives The growing acceptance of ERM is driven by four key forces EnterpriseRiskManagement

10. A proactive approach to ERM is based on best practices, not regulations Proactive Approach Reactive Approach Currentstate CEO ? ? ? • Benchmarking • Gap analysis • Recommendations ? ? Desired state (best practices or best-in-class practices) Sarbanes- Oxley Basel II • Common themes • Unique standards New industry standards Sarbanes- Oxley New industry standards Basel II Governance Requirements Governance Requirements

11. Early adopters of ERM have reported significant and tangible benefits

12. Annualized total shareholder returns (1998-2003) for differing degrees of risk model sophistication and business application Source: PA Consulting Survey of Global Banks

13. Discussion outline • Key trends and requirements • Best practices and practical applications • ERM in the future

14. The role of a chief risk officer • Establish an ERM framework – policies, processes, and systems • Manage risk interdependencies and aggregations • Provide risk transparency to key stakeholders • Ensure company practices meet or exceed regulatory requirements • Balance business and risk requirements, and avoid “irrational exuberance” • Optimize risk/return by integrating ERM into strategic planning and day-to-day business processes • Attract, retain, and develop talented risk professionals

15. 1. Corporate Governance Establish top-down risk management 3. Portfolio Management 4. Risk Transfer 2. Line Management Transfer out concentrated or inefficient risks Business strategy alignment Think and act like a “fund manager” 6. Data and Technology Resources 5. Risk Analytics Develop advanced analytical tools Integrate data and system capabilities 7. Stakeholders Management Improve risk transparency for key stakeholders An ERM framework should encompass seven key building blocks

16. The enterprise risk management process Risk Identification and Assessment Risk Measurement and Reporting Risk Mitigation and Management ERM Foundations • Top-down assessments • Barriers to strategic and financial goals • Executive team CSAs • Bottom-up assessments • Barriers to business, customer, and product goals • Business unit CSAs • Functional unit CSAs • Independent assessments • Internal audit • External audit • Regulators • Customers • Other stakeholders • Senior management and board participation (“tone from the top”) • Governance structure • Resource allocation • Culture, principles, and values • ERM framework and policies • Linkage to strategy, performance measurement and incentives • Organizational learning • ERM dashboard • Earnings volatility • Key risk metrics • Policy compliance • Real-time event escalation • Drill-down capabilities • Scenario analysis • Historical • Managerial • Simulation-based • Disclosure • Board reporting • External reporting • Policy enforcement • Value-based growth and restructuring strategies • Risk transfer strategies • Contingency planning and testing • Event and crisis management

17. Characteristics and sources of effective key risk indicators 1 7 4 Track in time series against standards or limits 6 Be useful – support business decisions and actions Reflect objective measurement Balance of leading and lagging indicators 9 Timely and cost effective 8 5 • Incorporate risk drivers: • Exposure • Probability • Severity • Correlation Can be benchmarked internally or externally 2 Tie to objectives, risk owners, and risk categories 10 Simplify risk without being simplistic Key Risk Indicators 3 Be quantifiable – $, %, # Strategies/ Objectives Regulations & Policies Losses & Incidents Stakeholder Requirements • Actual losses • Incidents • Industry data • Business plans • Management goals • Performance metrics • Legal requirements • Regulatory standards • Policy limits • Customers • Vendors • Other

18. ERM Dashboard BUSINESS RISK CREDIT RISK MARKET RISK OPERA-TIONAL RISK RISK “PILLARS” Data Mining Internal and External Data An ERM dashboard provides an integrated view of all risks, with drill-down capabilities • Basic ERM applications: • Executive reporting • Key risk indicators • Loss/incident tracking • Control self assessments • Early warning indicators • Risk mitigation projects tracking • ERM content management • Advanced ERM applications: • Risk transfer • Economic capital • Scenario analysis • Shareholder value management

19. An ERM dashboard should address five key questions for senior management • Are any of our strategic, business, and financial objectives at risk? • Are we in compliance with policies, limits, laws, and regulations? • What risk incidents have been escalated by our risk functions and business units? • What key risk indicators and trends that require immediate attention? • What are the risk assessments that we should review?

20. Background 3-Year ERM Program • $1 trillion of assets under management • Private company • Decentralized business culture • Organized Global Risk Forum • Implemented annual Global Risk Review • Automated loss accounting • Developed ERM framework • Implemented intranet-based Global Risk MIS • Experienced significant reduction in loss ratio Case study:

21. Basic risk management processes can lead to significant improvements Education • New associates • Management • Business/Operational processes • Best practices • Lessons learned Actual Loss Experience Risk Event Log 85% Decline Root Controls Event Loss Needed Causes Risk Metrics Goal MAP

22. Risk Management Impact • Risk-based pricing • Target customer selection • Relationship management Revenue - Expenses   -  Losses • Risk oversight costs • Insurance/hedging expense  • Credit, market operational write-offs ROE    • Capital management • Risk transparency Equity Shareholder Value   New Business • New business development  Growth M&A • M&A/Diversification strategy  • Risk Management by Silos (5, 6) • Integrated risk management (4–7) • Enterprise risk management (1-10) ERM provides linkage between risk management and key value drivers

23. Probability Change in Value Economic capital represents a common currency for risk Credit Risk Market Risk Operational Risk • Credit Risk • Earnings volatility due to variation in credit losses • Market Risk • Earnings volatility due to market price movements • Operational Risk • Earnings volatility due to changes in operating economics (e.g. volume, margins or costs) or one-off events Enterprise-wide Risk

24. Economic capital underpins risk-based profitability measurement and pricing Calculate ROE Calculate Pricing Exposure $100 mm $100 mm Margin 2.50% 2.20% Revenue $2.5 mm $2.2 mm Risk Losses <0.5 mm> <0.5 mm> Expense <1.0 mm> <1.0 mm> Pre-Tax Net Income $1.0 mm $0.7 mm Tax <0.4 mm> <0.3 mm> Net Income $0.6 mm $0.4 mm Economic Capital $2.0 mm $2.0 mm RAROC 30% 20%

25. Will lose competitors Risk-Adjusted who use risk-adjusted Price price Will win business from competitors Non-Risk- but earn below Adjusted Price hurdle rate return Companies without risk-based pricing suffer adverse selection Price AAA AA A BBB Risk Rating

26. Business/risk reviews of major investments and projects

27. Hard Side Soft Side • Measures and reporting • Risk oversight committees • Policies & procedures • Risk assessments • Risk limits • Audit processes • Systems • Risk awareness • People • Skills • Integrity • Incentives • Culture & values • Trust & communication ERM requires balancing the hard and soft side of risk management

28. Background 2-Year ERM Program • New capital markets business • Traders hired from foreign bank • Aggressive business and growth targets • Established risk policies and systems • Instilled risk culture • Survived “Kidder” disaster • Captured 25% market share with zero policy violations • Recognized as best practice Case study:

29. Hallmarks of success in ERM • Engaged senior management and board of directors • Established policies, systems, and processes, supported by a strong risk culture • Clearly defined risk appetite with respect to risk limits and business boundaries • Robust risk analytics for intra- and inter-risk measurement, summarized in an “ERM dashboard” • Risk-return management via integration of ERM into strategic planning, business processes, performance measurement, and incentive compensation

30. Discussion outline • Key trends and requirements • Best practices and practical applications • ERM in the future

31. Ten predictions on the future of enterprise risk management • ERM will become the industry standard • CROs prevalent in risk-intensive companies • Audit committees will evolve into risk committees • Economic capital in; VaR out • Risk transfer executed at enterprise level • Advanced technologies key to advancement • A measurement standard will emerge for operational risk • Risk-based or economic reporting becomes standard • Risk becomes part of corporate and college programs • Salary gap among risk professionals continues to widen