Tuning Risk for Return

1. FINANCIAL SERVICES A D V I S O R Y Tuning Risk for Return K P M G L L P Operational Risk Implementation & its Impact on Financial Institutions Institute of International Bankers December 11, 2007 Jonathan Rosenoer jrosenoer@kpmg.com

2. "All of life is the management of risk, not its elimination."Walter Wriston

3. Enterprises need to apply to the management of “tail risks” the same judgment that they use to run the business

4. Industrial age risk management tools are not sufficient for today’s business risks • Insurance • Narrow scope of insurable or covered “perils” • Direct physical damage typically required • Controls review • Focus on existence and quality of control process, not direct testing of effectiveness Source: S. Giuffre, “Insuring Operational Risk, How Good is the Coverage,” Viewpoint, Feb. 2004.

5. Needed: A future vision and roadmap

6. Getting down to basics and avoiding stumbling blocks

7. Governance is a primary requirement; execution can be challenging Audit Comm. Board Risk Committee • Assess/propose risk capacity • Oversight Executive (CxO) Management Independent review • Define strategy / risk appetite • Set “tone” • E.g., • Regulators • External auditor(s) • Internal audit Risk Management Education Insurance • Identify risk • Set policy • Define methodology / framework • Review, validate & test Functional Units Risk Mgt. Risk Mgt. Lines of Business Outsourced Services

8. Tactical building blocks are sometimes needed • Risk education, culture, and language • “Single view of organization” • Legal entity data • Business risk identification • “Single view of process” • Homogenization of risk types and control elements at BU and group level • Internal data creation, acquisition, and management • Reference data • External (industry) event data • Workflow orchestration

9. Process and Operations simplification: Optimizing risk management and control; driving lower cost • Greater likelihood that compliance objectives are achieved consistently across the organization • Sustainable framework to effectively address existing and emerging domestic and global regulatory requirements • Greater process efficiency resulting in improved shareholder value through more cost efficient operations • Increased integrity of and timely availability of risk information • Better risk management leading to optimal business decisions Risk Management Internal Audit Legal Department Compliance Finance Department Risk & Compliance Departments (example) Data capture and analysis Efficiency Simplification overlay on Regulatory Compliance Processes Treasury IT Corporate Banking Retail Banking Investment Banking Wealth Management BUs/CCs (example)

10. Gaining focus and traction

11. Risk identification and evaluation Identify and prioritize hot spots across the enterprise. • Create visibility • Size exposures • Focus attention on high risk areas • Control spending

12. Risk modeling and quantification is a cornerstone of enterprise-wide risk management Risk modeling enables managers to understand risk exposure over 3 dimensions: • Analytic: What is the overall quantified risk exposure? • Diagnostic: • How effective are technologies, controls, and mitigants? • What is the ROI for change? • Predictive: What are the key causes and indicators of risk?

13. Effective management of Operational Risk requires understanding the relationship between risk reduction options and business impact. • Operational Risk can be quantified by: • Identifying business processes of interest • Identifying applicable event drivers, and • Estimating the effectiveness of controls, countermeasures, and mitigants (e.g., insurance), as well as their combined economic impact on business process.

14. Ldirect “As Is” Exposure “To Be” Exposure (with new control) A Adverse Not capable cause = 55% Event Capable cause = 45% B New Control Control No Loss = 91.9% Loss = 8.1% E Caught = 96.1% Not caught = 3.93% C Mitigant No Loss = 98.9% Loss = 1.14% D Financial Expected Loss = Statement $3.42M Impact Financial statement impact Fault Error Loss Uncertain event Mitigant Countermeasure Countermeasure A F1 Ca E1 Cb m1 I Lindirect A transparent, risk-driven ROI calculation can assist managers to understand risk and where best to make changes

15. The benefits of effective risk management

16. Effective risk management can drive growth, profitability, and shareholder value Increase product Net Operating Profit After Taxes (NOPAT) ROIC (NOPAT/Average Capital) Economic Value Added (NOPAT – Capital Charge) Operating Margin (EBITA/Revenue) Invested Capital WACC Capital Utilization (Revenue/Invested Capital) Improve credit rating Cash Flow at Risk Organic Corporate Risk Capital Growth Credit Risk Release capital M&A Market Risk Operational Risk

17. Risk Certainty Efficient Frontier Risk Tolerance Industry Benchmark Frontier Sub-Optimal frontier Value creation Optimized controls Cost savings Efficiency gains “As Is” State “To Be” State With risk as a key parameter, executives can model and optimize enterprise value add for a range of key business decisions Capital Allocation In-house Third Party Cease / Postpone • Captive insurance • Third party insurance • Securitization • … • Business process transformation • Control improvement • Technology upgrade • Infrastructure redesign • … • Co-source • Outsource • … RAPM / ERM

18. Questions Jonathan Rosenoer Partner, Global Advisory Financial Services KPMG jrosenoer@kpmg.com 1-415-465-4500