CHALLENGES OF RISK-MANAGEMENT BY M. Kamal MOKDAD, MOROCCO

1. CHALLENGES OF RISK-MANAGEMENTBY M. Kamal MOKDAD, MOROCCO Titre de la présentation

2. ContemporaryRisk-management Risk = inherent and permanent component of the business environment • Conditions for the implementation of activities and the attainment of objectives continually take new shapes of vulnerability et require a more and more rigorous control of businesses’ key resources. • With its fundamental mandate, Risk Management is being understood more and more as the analysis of these vulnerabilities, the development of methodologies and indicators in such as way as to protect commitments, and to prevent and control any negative impact on the objectives. • This set of steps is encouraged by a legislative context that is increasingly restrictive (Basel II, SolvencyII, LSF, Sarbane Oxley, etc.)... Let us also note the more and more formal requirements from rating agencies for many players, through pressure from shareholder groups. Risk Management aims not only the sustainability the various threats, the power control, compliance against the law, but it also contributes to improving the performance of the company or organization. Date 2

3. Severaldefinitionsabound, however… Bear= Danger / Hazard A corepotential for damages. Is it a risk? Talking about riskmakes no sensewithout the mention of uncertainties, hazards, dangers… Talking about riskmakes no sensewithout the mention of whatisatstakes (human, financial, corporate imageetc…). Example:  An Risk= An Event Assessment of the danger by the frequency and the gravity of itseffects. Titre de la présentation Date 3

4. The 5 Stages of TheRisk Control Process • Policies and procedures are defined and deployed in order to ensure the effective imlpementation and application risk management measures. • Internal and external events that may affect the achievement of an organization’s objectives must be identified by distinguishing between risks and opportunities. • Opportunities are taken into account when developing the strategy or while in the process of setting goals. • au cours du processus de fixation des objectifs.  Control measures  Identification of risks Steering  Management of Risks • Management defines solutions that help confront the risks(avoidance, acceptance, reduction or sharing). To do this, managamentdevelops a set of measuresthathelpsto align the level of risk with the acceptance threshold and the risk appetite of the organization. • Risks are analyzed, both in terms of the likelihood of their occurrence as in their likelihood of impact. This analysis serves as the basis for determining how they should be managed. Inherent risks and residual risks are assessed.  Assessment of Risks • Coordination teams that manage risk • Control of the "virtuous circle" of Risk Management, • Organizing a permanent monitoring system for potential or proven risks • Management of proven risks Titre de la présentation Date 4

5. Frequency Gravitylevel The World of Risks andAppropriateResponses Frequency of Risks Gravitylevel of Risks Avoid Provisions Self-Insurance Insurance TradingAccountsHazards Reinsurance Financements alternatifs ProjectedLoss UnexpectedLoss IncomeStatement – Profits and Loss « RiskCapital» - ExternalGuarantees– Capuital Stock Titre de la présentation Date 5

6. Risk Management, Internal Control and Auditing The World of Risks andAppropriateResponses Positionning of Risk Management GovernanceAuthorities (CA, SupervisoryBoard) Supervision Risk Control + Internal Audit Facilitatingmeasures by the Risk Manager Risk Management Risk consolidation and analysis of major risks General Directorate Management of organisationalentities Management of Risks Mapping of risks and elements of control Titre de la présentation Date 6

7. Risks Treatment & Management Compliance Governance Tasks Forces Internal Check & Auditing Conseil Administration External Communication General Directorate Risk Management Presidency Insurance Strategicsteering Stakeholders’ notification Risk management policies Criminalrisks… Riskstransfer Manage risks – For whom? Potentialorder of beneficiaries and donnors

8. General Directorate Risk Manager Operations Directorate Expectations • Global vision of risks • Understanding the level of Risks control Expectations Expectations • Riskstransfer • Identification of causes & theirconsequences – > Insurance? • Risks monitoring via indicators • Treatment of risks by putting in place preventive and/or protective actions • . Consolidation, analysis of major risks ManagingRisks: Stakeholder Expectations

9. Mapping of risks, a component of business management A toolthatiswellknown and usedtoday for multiple puporses: • Unavoidable stage in risk control • Identification of major risksat the Group level, by the Task Force • Thorough identification of operationalrisks • Putting of risksunder control • Regulatory or prescriptive compliance (OACI, COSO, …) • Performance improvement (efficiency of control measures) … but whose expectations reasonablyvaryfromstakeholder to stakeholder

10. Mapping of Risks– The global approach Identify, assess, map and manage risksthrough a structuredapproachtooledaccording to a declarative or quantitative mode Tools Results Risk management Capitalization of analyses List of risksenrichedwith attributs Capitalisation 1. Identifier les Risques 1. Identification of risks R Review of the processes Base incidents Interview guides des interviews Guide d ’ interview 2. Evaluer les Risques 2. Assessment of Risks Cartographie Cartography of risks des risques Fiches Fiches d d ’évaluation Modèles ’é valuation Fiches de risque Riskscard 3.Traiter ou 3. Assessment of Risk Control Transf é rer Action plans Plan d ’ ’ actions les Risques - - Par risques By Risk - - Par fonction By role 4. Monitor clearlydefinedrisks and targetrisks 4.1 Suivre les Risques R é f é rentiel des Reference document for indicators Table of Indicators Tableaux de bord indicateurs indicateurs

11. Mapping of Risks – Identification Several possible approachesfor risk identification…but a certain « order » to respect … Bottom Up Top Down BottomUp Top Down Integration in the Processes Processus Objectives / Constraints/ Compliance Security management system Implementation of Regulations • • Jobs Métiers Objectifs / Contraintes • • Management Management • • Support Support Prescriptive & RegulatoryReferentials Référentiels Appropriation atEntity and Activitieslevel Treatment by Resources Ressources and / or et / ou bases de données Database Coherent & consolidatedapproach Defined by group of Experts Feedback of Experience Retour d’Expérience … . . Use of Base Incidents Improvement by task forces Exploitation de bases incident

12. Illustration of the Mapping of Risks Stage 1: Risksinventory by process Stage 2 : Riskvaluation

13. Illustration for RiskMapping Stage 3: Assessment of existing DMR Assessment of existing DMR Details on the tracks of actions in relation to subsequent insufficiency observed in terms of risk coverage for the high degree of risk exposure of the danger zone

14. Illustration for RiskMapping Stage 3: Assessment of existing DMR Assessment of existing DMR

15. Requiredtools for riskmapping Questionnaires, base incidents are the first « tools » of the RiskManager Preliminaryriskanalysis Validation and prioritization Preparation Summary Workshop or Interviews Base de risques Questionnaires et interviews Cartography Interviews are an essential step in the process: they must be prepared, analyzed, consolidated, updated… n individualrisksidentified N major risks by theme

16. In Conclusion...