Implementing Enterprise Risk Management

1. Implementing Enterprise Risk Management Creating a Culture that Embraces ERM 2004 Bowles Symposium on Enterprise Risk Management Michael J. LitwinChief Credit & Risk OfficerManaging DirectorMerrill Lynch Capital

2. Today’s Objectives • Five-step Approach to Establishing an ERM Framework • Heller Financial/Merrill Lynch Capital Case Studies • What we’re Doing at MLC to Create a Culture that Embraces ERM

3. 5 Step Approach to Establishing an ERM Framework • Establish the Business Case • Secure the Best Resources • Develop a Framework • Use Pilots and Prototypes • Stay the Course

4. Establishing the Business Case • Get Support from the Top • Articulate an End State Vision • Prove that Benefits Exceed Costs • Don’t be Overly Aggressive in Plan Implementation • Go after the “Low Hanging Fruit” First • Commit to Results

5. Commit the “Best” Resources • Consider Resources Based on Needs and Competencies • Consultants • External Hires • Existing Staff

6. Develop a Framework • Establish an Organization Structure and Reporting Regime • Make Sure Risk Management is Linked to All Areas of the Organization • Understand where Risk Exposures are • Line Units • H.R. • IT • Finance • Operations • Portfolio Management

7. Develop a Framework (Cont.) • Create a Risk Analytics Function to Provide Risk Measurement, Analysis, Metrics, Reporting • Ensure Data and Technology Resources are Adequate • Establish Stakeholder Communications

8. Use Pilots of Prototypes • Establish Early Successes • Provide Practical Feedback on Appropriate Adjustments • Don’t “Stretch” the Organization by Doing Too Much Too Soon

9. Stay the Course • Expect Some Setbacks • Lack of Buy in by Board, Sr. Mgmt. or Business Mgrs. • Lack of Systems Capabilities • Inconsistencies and Redundancies Between Units • Cultural Pushback

10. Keep Your Eyes on the Prize • This Creates Value • Stakeholders Love This • Shareholders • Employees • Regulators • Equity and Debt Analysts • Outside Auditors • Improves The Culture

11. What We’re Doing at ML Capital • Identified and Defined 52 Risks • Aggregated Risks into 9 Categories: • People • Financial • Credit • Reporting & Control • Customer Suitability & Servicing • External • Technology • Legal/Regulatory • Reputational

12. Example of “People Risk” • People Risk: The risk of loss related to management and deployment of people including inappropriate resource management (e.g., lack of training and constrained resources) inappropriate management oversight, employee irregularities, discrimination, harassment and turnover.

13. People Risks • Employee Fraud • Resource Management • Involuntary Downsizing/Restructuring/Constrained Resources • Loss of Key Individuals/Teams • Lack of Training/Experience/Knowledge/Ability • Knowledge Capital Risk • Efficiency Risk • Leadership Risk • Authority/Limit Risk • Performance Incentives Risk • Change Readiness Risk • Alignment Risk

14. High Impact Low High Likelihood What We’re Doing at ML Capital • Identified and Defined 52 Risks • Aggregated Risks into 9 Categories: • Prioritized Major Risk Categories Based Upon Likelihood and Impact

15. What We’re Doing at ML Capital • Identified and Defined 52 Risks • Aggregated Risks into 9 Categories: • Prioritized Major Risk Categories Based Upon Likelihood and Impact • Established Reporting Requirements • What Keeps Us Up at Night • Operational Losses and Near Misses • Metrics

16. ERM • Remember ERM is a Value Creation Endeavor. If You Do it Right you’ll Increase: • Earnings • Returns • Market Capitalization

17. Michael J. LitwinChief Credit & Risk OfficerManaging Director