Enterprise Risk Management (ERM) Integrating Strategy, Capital and Risk

1. Enterprise Risk Management (ERM)Integrating Strategy, Capital and Risk GARP 2008 Presented by: Joe Rizzi CapGen Financial February, 2008 The views expressed are those of the author and do not necessarily reflect those of CapGen Financial

2. Table of Contents 1 Current State of Risk Management Enterprise Risk Management 2 3 Enterprise Risk Management Program 4 Integrating Strategy, Capital and Risk 5 Conclusion

3. OverviewImportance of Risk Management is driven by four key forces Competitive Rivalry Risk Management Regulatory Environment Shareholder Expectations Complex and Volatile Business Environment Risk Management lies somewhere between astrology and alchemy

4. Attitudes, Values and Objectives Out with the old... Line of Business Risk Management • My job is: To grow earnings / do business • Risk is: A normal cost of doing business • Memory horizon: Short-term: What are the prevailing market conditions? • Stereotypical attitude: No risk, no return. Don’t handcuff me relative to the competition • Metrics: Volume in front-line positions; Profit for senior positions • My job is: To prevent losses/risky activity • Risk is: Volatility to be avoided • Memory horizon: Long-term: What’s the worst thing that has ever happened? • Stereotypical attitude: ‘The Cautious Librarian’: best way to keep books from being damaged is not to let anyone borrow them • Metrics: Volume in front-line positions; Profit for senior positions Business focuses on the center, while Risk Management focuses on the tails of the distribution

5. Attitudes, Values and Objectives ...and in with the new. Partnership • Our job is: To create shareholder value through earnings growth and appropriate returns to capital • Risk is: A potential source of competitive advantage as shareholders require us to manage risk prudently. • Memory horizon: Appropriately long to anticipate future cycles, informed by changes in the market over time • Metrics: RAROC; SVA Line of Business Risk Management • Manages performance information • Serves advisory and control function • Manages the budget / P&L • Acts as primary risk manager Risk Management does not make you safer – just more efficient

6. Risk Management Continuum According to recent RMA survey, most firms indicate that they have “closed in” on the integrated approach. Aggregated Approach Integrated Approach ERM Silo-ed Approach Moving beyond exposure accounting and control

7. Table of Contents 1 Current State of Risk Management Enterprise Risk Management 2 3 Enterprise Risk Management Program 4 Integrating Strategy, Capital and Risk 5 Conclusion

8. Enterprise Risk Management (“ERM”) • Vision: Manage all material risks and opportunities across the organization • Objective: Improve decision making through portfolio management of interrelated risks • Result (Value Proposition): Increase value by managing to objectives consistent with stakeholder expectations Strategic not transaction focus

9. Scope of ERM – Top level Risk view… …as a strategic input, not an afterthought

10. Enterprise Risk Management Big Ideas • Analytical Solution: Economic Capital • Organizational Solution: Chief Risk Officer • Informational Solution: Dashboard • Management Solution: Governance actions • Cultural Solution: Communications It works in practice, but will never work in theory

11. ERM – a work in progress Source: Deloitte Global Risk Survey, 2006 …need to tailor to your governance and operating philosophy

12. Table of Contents 1 Current State of Risk Management Enterprise Risk Management 2 3 Enterprise Risk Management Program 4 Integrating Strategy, Capital and Risk 5 Conclusion

13. The four pillars of an ERM Program Enterprise Risk Management Program Value Creation I II III IV Management Information Strategic Planning and Alignment Risk Oversight and Independence Communications and Escalation Risk Philosophy Risk Foundation Value creation through Risk Management not minimization

14. Global Asset Global Private Transaction Com'l PFS Markets AL Mgmt. Clients Clients Services Total Banking Business Credit Operational Quantitative Risk Market Interest Liquidity Strategic Compliance ALM - RWA ALM - EC Human Cap. Qualitative Risk IT Legal SOX Audit Overall YTD Target Status Efficiency Ratio Revenue Growth (YoY) Return on ARC ERM Dashboard – make things as simple as possible Key Risk Indicators Management Priorities Integrated Risk, Reward and Strategy View Comprehensive Risk Assessment Business Units Executive sponsorship Forward looking, actionable, risk escalation tool Top 10 Risks – Heat Map Key Performance Indicators …but no simpler

15. Governance Actions ERM Governance Model defines three legs — Businesses that take and manage risk, Risk Management to provide policy and analysis, and Audit to provide assurance. Governance allocates decision rights

16. ERM Culture Development and Escalation ERM Communications Strategy Adopt theme: “Everyone is a Risk Manager” Develop Tactical Communications plan ExternalConferences /Communication Escalation Clarification of escalation expectations Promote learningculture Standards of Conduct toinclude risk issue escalation Align withcompliance-related policies and procedures Culture as organizational DNA

17. Strategic Risk Management Enterprise Strategy Risk Appetite Agree ERM role and PfCprocess Performancecontractprocess toembrace ERM Align Finance & Risk StrategicAgendas People do what you pay them to do, not what you tell them to do

18. Lessons Learned • Sponsorship • Successful Risk Management implementations require senior management and Board support. • Sustainability • To sustain progress and momentum, maintain program team continuity. Risk Management Framework Enterprise Risk Management Program 6 • Project Management • Do not underestimate launch complexities or cultural challenges. • Pilot programs prior to global roll outs. • Change Management • Significant effort will be required to overcome organizational inertia and change a mindset to a risk-reward culture Risk as a senior management responsibility not a specialist function

19. Table of Contents 1 Current State of Risk Management Enterprise Risk Management 2 3 Enterprise Risk Management Program 4 Integrating Strategy, Capital and Risk 5 Conclusion

20. CEO Internal Stakeholders Regulators External Stakeholders CRO CFO Shareholders Rating Agencies ERM Value Creation Framework – if you can make money Risk Appetite Assets (Return) Value Creation Return on Risk Cost of Capital Portfolio of Enterprise Risks Portfolio of Capital Resources Capital Required (Risk) Capital Allocation (Funding) Capital Management Risk Structure Capital Structure Economic Capital (Use) …You can lose money

21. Risk Appetite • Risk Appetite – Total risk exposure an organization is willing to accept and prepared to lose in the execution of its strategy. • Factors impacting Risk Appetite: • Financial Objectives • Competitive Situation • Market Conditions Do you want to eat well... ...or sleep well?

22. Risk Appetite • Risk types: Include hard to measure risks and interrelationships Risk may be one word... • Risk Tolerance: • Credit • Market • Liquidity • Operational • Reputation • Compliance • Strategic ...but it is not one number

23. Enterprise Risk and Risk Appetite Translate statistics into... • ERM involves moving Risk Management to an integrated Risk and Capital Strategy • Comprehensive • Earnings fluctuations from strategic or business factors can exceed those from financial risk exposures • Risk appetite for financial risk must reflect the current level of business risk • Business risks cannot be measured in the same manner as financial risk, and are largely ignored by economic capital • Interrelationships • Overcome silos: unintended consequences • Top down perspective: integrated one firm view ...shareholder value

24. Enterprise-level Risk Appetite (RA) Source: Deloitte Global Risk Survey, 2006

25. ERM in Practice Integrating strategy, capital and capital • Choose target debt rating based on financial distress considerations. • Maintain ability to access capital markets under most conditions • Requires high investment grade (A+/AA-) rating • Estimate asset risk based on investment decisions and risk appetite. • Estimate capital requirement to support asset risk and target rating. • Optimize capital and risk combinations to maximize shareholder value subject to target rating based on market considerations. • Reduce risk given fixed capital level • Hedging – direct cost • Underwriting selection - opportunity loss • Increase capital given fixed investment plan • Increased capital charge Return Out of Risk Appetite LGD (Severity) Capital B Within Risk Appetite A PD (Likelihood) Conservatism of risk principle – Risk never disappears

26. Value Implications of Risk Appetite Changes Not all Risk is the same Optimal Portfolios Efficient Frontier for Group Business Portfolio C A B Expected Profitability A = Group’s actual portfolio B = Alternative portfolio C = Group’s Target portfolio Perceived Risks (Economic Capital) Risk Management is not free

27. Table of Contents 1 Current State of Risk Management Enterprise Risk Management 2 3 Enterprise Risk Management Program 4 Integrating Strategy, Capital and Risk 5 Conclusion

28. Conclusion – Things will improve • ERM: Integrates risk, strategy and capital to create shareholder value • Risk Paradox: Conservatism of risk principle - Risk never disappears Risk Management does not make you safer – just more efficient • Risk Management is not free Transaction Costs Opportunity Costs Direct Costs Capital Costs …despite our efforts to improve them