Enterprise Risk Management ERM Integrating Strategy Capital and

Enterprise Risk Management (ERM) Integrating Strategy, Capital and Risk GARP 2008 Presented by: Joe Rizzi Cap. Gen Financial February, 2008 The views expressed are those of the author and do not necessarily reflect those of Cap. Gen Financial

Table of Contents 1 Current State of Risk Management 2 Enterprise Risk Management 3 Enterprise Risk Management Program 4 Integrating Strategy, Capital and Risk 5 Conclusion 2

Overview Importance of Risk Management is driven by four key forces Competitive Rivalry Shareholder Expectations Risk Management Regulatory Environment Complex and Volatile Business Environment Risk Management lies somewhere between astrology and alchemy 3

Attitudes, Values and Objectives Out with the old. . . Line of Business Risk Management § My job is: grow earnings / do business To § Risk is: A § My job is: To prevent losses/risky activity § Risk is: normal cost of doing business Volatility to be avoided § Memory horizon: Short-term: What § Memory horizon: Long-term: are the prevailing market conditions? What’s the worst thing that has ever happened? § Stereotypical attitude: No risk, no return. Don’t handcuff me relative to the competition § Metrics: Volume in front-line positions; Profit for senior positions § Stereotypical attitude: ‘The Cautious Librarian’: best way to keep books from being damaged is not to let anyone borrow them § Metrics: Volume in front-line positions; Profit for senior positions Business focuses on the center, while Risk Management focuses on the tails of the distribution 4

Attitudes, Values and Objectives. . . and in with the new. Partnership Line of Business § Manages the budget / P&L § Acts as primary risk manager § Our job is: To create shareholder value through earnings growth and appropriate returns to capital § Risk is: A potential source of competitive advantage as shareholders require us to manage risk prudently. § Memory horizon: Appropriately long to anticipate future cycles, informed by changes in the market over time Risk Management § Manages performance information § Serves advisory and control function § Metrics: RAROC; SVA Risk Management does not make you safer – just more efficient 5

Risk Management Continuum According to recent RMA survey, most firms indicate that they have “closed in” on the integrated approach. Silo-ed Approach Aggregated Approach Integrated Approach Moving beyond exposure accounting and control ERM 6

Table of Contents 1 Current State of Risk Management 2 Enterprise Risk Management 3 Enterprise Risk Management Program 4 Integrating Strategy, Capital and Risk 5 Conclusion 7

Enterprise Risk Management (“ERM”) § Vision: Manage all material risks and opportunities across the organization § Objective: Improve decision making through portfolio management of interrelated risks § Result (Value Proposition): Increase value by managing to objectives consistent with stakeholder expectations Strategic not transaction focus 8

Scope of ERM – Top level Risk view… ERM is… • Integrated view and awareness of risk across organizational disciplines • Standardized risk-related information, metrics, and communication • Common definitions • Coordination of risk related projects ERM is NOT… • Just Risk Management • Just a centralized body for aggregation and translation of data • Meant to discourage specialization • Organizational restructuring • ONLY for Control/Regulatory Compliance …as a strategic input, not an afterthought 9

Enterprise Risk Management Big Ideas § Analytical Solution: Economic Capital § Organizational Solution: Chief Risk Officer § Informational Solution: Dashboard § Management Solution: Governance actions § Cultural Solution: Communications It works in practice, but will never work in theory 10

ERM – a work in progress Source: Deloitte Global Risk Survey, 2006 …need to tailor to your governance and operating philosophy 11

Table of Contents 1 Current State of Risk Management 2 Enterprise Risk Management 3 Enterprise Risk Management Program 4 Integrating Strategy, Capital and Risk 5 Conclusion 12

The four pillars of an ERM Program II IV Communications and Escalation Strategic Planning and Alignment Management Information I Risk Oversight and Independence Enterprise Risk Management Program Value Creation Risk Philosophy Risk Foundation Value creation through Risk Management not minimization 13

ERM Dashboard – make things as simple as possible Key Risk Indicators Comprehensive Risk Assessment Quantitative Risk Com'l PFS Global Markets AL Asset Global Business Mgmt. Units Clients Integrated Risk, Reward and Strategy View Transaction Banking Private Clients Services Management Priorities Total Business Credit Operational Market Interest Liquidity Strategic Qualitative Risk Compliance ALM - RWA ALM - EC Human Cap. IT Legal SOX Audit Executive sponsorship Forward looking, actionable, risk escalation tool Top 10 Risks – Heat Map Key Performance Indicators Overall Efficiency Ratio Revenue Growth (Yo. Y) Return on ARC YTD Target …but no simpler Status 14

Governance Actions ERM Governance Model defines three legs — Businesses that take and manage risk, Risk Management to provide policy and analysis, and Audit to provide assurance. Board of Directors Business Areas ERM Committee Risk identification Risk assessments CRO & Risk Committees Internal Audit Strategy & Action to address Risk Within Policy Policies, governance and information flow Validation of controls Provide assertions on risk exposure for business / function Risk assessment methods Objective review of risk management process Ownership of risk and responsibility for management and mitigation Measurement, aggregation rules and tools Monitor risk exposure status and provide reporting to Board Governance allocates decision rights Assurance to Senior Executive management and Board on assertions of risk exposure 15

ERM Culture Development and Escalation ERM Communications Strategy Adopt theme: “Everyone is a Risk Manager” Develop Tactical Communications plan External Conferences / Communication Escalation Clarification of escalation expectations Promote learning culture Standards of Conduct to include risk issue escalation Culture as organizational DNA Align with compliancerelated policies and procedures 16

Strategic Risk Management Enterprise Strategy Risk Appetite Agree ERM role and Pf. C process Performance contract process to embrace ERM People do what you pay them to do, not what you tell them to do Align Finance & Risk Strategic Agendas 17

Lessons Learned Sponsorship Sustainability 1. Successful Risk Management implementations require senior management and Board support. 3. To sustain progress and momentum, maintain program team continuity. Enterprise Risk Management Program Risk Management Framework 6 Change Management 2. Significant effort will be required to overcome organizational inertia and change a mindset to a risk-reward culture Project Management 4. Do not underestimate launch complexities or cultural challenges. 5. Pilot programs prior to global roll outs. Risk as a senior management responsibility not a specialist function 18

Table of Contents 1 Current State of Risk Management 2 Enterprise Risk Management 3 Enterprise Risk Management Program 4 Integrating Strategy, Capital and Risk 5 Conclusion 19

ERM Value Creation Framework – if you can make money Regulators CEO Risk Appetite External Stakeholders Shareholders Rating Agencies CFO Value Creation Return on Risk Internal Stakeholders CRO Cost of Capital Assets (Return) Portfolio of Enterprise Risks Risk Structure Capital Management Capital Required (Risk) Portfolio of Capital Resources Economic Capital Allocation Capital Structure (Funding) (Use) …You can lose money 20

Risk Appetite Do you want to eat well. . . § Risk Appetite – Total risk exposure an organization is willing to accept and prepared to lose in the execution of its strategy. § Factors impacting Risk Appetite: § Financial Objectives § Competitive Situation § Market Conditions . . . or sleep well? 21

Risk Appetite Risk may be one word. . . § Risk types: Include hard to measure risks and interrelationships § Risk Tolerance: § Credit § Market § Liquidity § Operational § Reputation § Compliance . . . but it is not one number § Strategic 22

Enterprise Risk and Risk Appetite Translate statistics into. . . § ERM involves moving Risk Management to an integrated Risk and Capital Strategy § Comprehensive § Earnings fluctuations from strategic or business factors can exceed those from financial risk exposures § Risk appetite for financial risk must reflect the current level of business risk § Business risks cannot be measured in the same manner as financial risk, and are largely ignored by economic capital § Interrelationships § Overcome silos: unintended consequences § Top down perspective: integrated one firm view . . . shareholder value 23

Enterprise-level Risk Appetite (RA) Source: Deloitte Global Risk Survey, 2006 24

ERM in Practice Integrating strategy, capital and capital § Choose target debt rating based on financial distress considerations. § Maintain ability to access capital markets under most conditions § Requires high investment grade (A+/AA-) rating § Estimate asset risk based on investment decisions and risk appetite. § Estimate capital requirement to support asset risk and target rating. § Optimize capital and risk combinations to maximize shareholder value subject to target rating based on market considerations. § Underwriting selection - opportunity loss § Increase capital given fixed investment plan § Increased capital charge Out of Risk Appetite Within Risk Appetite B A Capital § Hedging – direct cost Return LGD (Severity) § Reduce risk given fixed capital level PD (Likelihood) Conservatism of risk principle – Risk never disappears 25

Value Implications of Risk Appetite Changes Not all Risk is the same Expected Profitability Optimal Portfolios Efficient Frontier for Group Business Portfolio C A B A = Group’s actual portfolio B = Alternative portfolio C = Group’s Target portfolio Perceived Risks (Economic Capital) Risk Management is not free 26

Table of Contents 1 Current State of Risk Management 2 Enterprise Risk Management 3 Enterprise Risk Management Program 4 Integrating Strategy, Capital and Risk 5 Conclusion 27

Conclusion – Things will improve § ERM: Integrates risk, strategy and capital to create shareholder value § Risk Paradox: Conservatism of risk principle - Risk never disappears Risk Management does not make you safer – just more efficient § Risk Management is not free Transaction Costs Opportunity Costs Direct Costs Capital Costs …despite our efforts to improve them 28