Enterprise Risk Management November 17, 2013

1. Enterprise Risk Management A Framework for Proactive Management of Risk MCCA CLE EXPO Enterprise Risk Management November 17, 2013 Alan J. Amico March 13, 2014

2. Table of Contents • Introduction • Here’s How Most Businesses Manage Risk • There are Key Risk Management Concepts Every Business Should Employ • These are the Essential Components of Enterprise Risk Management • An ERM Framework Involves a Continuous Process • Risk Assessment and Control are Fundamental • These are Typical ERM Risk Areas • Operational Risks are Process, People, Technology or Catastrophic Events • Best Practices for Regulatory Compliance Risk Management Using ERM • Summary

3. Introduction • Business is the management of risk • Nearly every business or legal decision includes managing risk • Avoidance of all risk is not the desired outcome • Knowing your company’s risk appetite and how risks outside of it are controlled is the goal • The challenge for business managementis to knowingly make informed risk decisions • The objectiveof enterprise risk management is to balance risk vs.reward - to establish appropriate risk tolerance in pursuit of maximizing earnings

4. Here’s How Most Businesses Manage Risk

5. There are Key Risk Management ConceptsEvery Business Should Employ

6. These are the Essential Components of EnterpriseRisk Management

7. An ERM Framework Involves a Continuous Process • Governance • Risk appetite • Risk policy • Risk owners and accountability • Training and education • Risk Assessment • Assessment method and plan • Risk identification • Risk ranking • Controls effectiveness review Monitoring and Reporting Controls effectiveness monitoring Risk incident and loss reporting Controls evaluation Key risk indicator review • Risk Response • Mitigation plans • Avoid risk • Transfer/share risk • Accept risk • Risk Controls • Detective controls • Preventative controls • Hybrid controls • Risk Tools • Regulatory coverage map • Risk assessment process • Controls framework • Monitoring and auditing

8. Risk Assessment and Control are Fundamental

9. These are Typical ERM Risk Areas Continued on next slide

10. These are Typical ERM Risk Areas

11. Operational Risks are Process, People, Technology or Catastrophic Events

12. Best Practices for Regulatory Compliance Risk Management Using ERM

13. Summary • Adopt an Enterprise Risk Management Approach • Identify Key Risk Areas • Adopt a Risk Management and Controls Framework • Implement Risk Governance and Accountability • Develop Risk Identification and Assessment • Create Risk Mitigation, Planning and Controls Implementation • Design Monitoring and Auditing • Drive Communication and Reporting