Where Do We Go From Here Penny Cagan

Where Do We Go From Here? Penny Cagan Managing Director

Where We Have Come From © 2008 Algorithmics Incorporated. All rights reserved.

2008: A year of great volatility March 2008: Bear Stearns is acquired by JP Morgan in a transaction orchestrated by the US government July 2008: US Federal government seizes Indy. Mac (largest thrift to fail in US history) Sept. 7, 2008: US government takes over Freddie Mac and Fannie Mae Sept. 14, 2008: Bank of America announces it will acquire Merrill Lynch Pieter Bruegel the Elder, The Fall of the Rebel Angels © 2008 Algorithmics Incorporated. All rights reserved. Sept 15, 2008: Lehman Brothers files for bankruptcy

2008: A Year of Great Volatility Sept. 16, 2008: US government announces $85 billion emergency aid package for AIG Sept. 18, 2008: Federal Reserve and central banks in Asia and Europe pump up to $180 billion into money markets. US Congress considers $700 billion facility to buy bad debt from banks. Sept. 19, 2008: US government announces that it will insure all money market funds. The SEC bans short selling of shares in 799 financial stocks. Sept. 22, 2008: Goldman Sachs and Morgan Stanley announce they have requested a change in their status to Bank Holding Companies, regulated by Federal Reserve Pieter Bruegel the Elder, Landscape with the Fall of Icarus © 2008 Algorithmics Incorporated. All rights reserved.

Where Risk Lies § Underwriting of new loans: Credit Risk (loan quality) & Op. Risk (documentation, background check, integrity of loan process) § Securitization: Reputation & Op. Risk (mis-selling, valuation, investor issues) & Liquidity Risk (cash shortages) § Investor: Credit, Market & Op. Risk (mark-to-market issues, what are securitized loans worth when they are sold in volatile markets, will the investment pay off, what’s under the hood of structured products) § Market Reactions: Market Risk, Op. Risk (increased volatility leads to behavior that can increase oprisk, such as unauthorized trades, questionable valuations, processing issues), Credit Risk (bankruptcies can occur if investors, issuers and packagers can not raise funds. ) © 2008 Algorithmics Incorporated. All rights reserved.

Events by Trigger Sub. Prime Market Volatility - Event Trigger: Number of Events RELATIONSHIP RISK CLASS PROCESS RISK CLASS PEOPLE RISK CLASS EXTERNAL RISK CLASS 0 Source: Algo FIRST © 2008 Algorithmics Incorporated. All rights reserved. 10 20 30 40 50 60 70 80 90 100

Events by Trigger Sub. Prime Market Volatility - Event Trigger: Number of Events BUSINESS & STRATEGIC RISK SECURITIES LAW VIOLATIONS SALES RELATED ISSUES LEGAL LIABILITIES DISCLOSURE RELATED ISSUES LAW/REGULATION CHANGE TRADING MISDEEDS INTERNAL FRAUD EMPLOYMENT, HEALTH & SAFETY SPECIFIC LIABILITIES ERRORS AND OMISSIONS EXTERNAL FRAUD NEGLIGENCE TRANSACTIONAL AND BUSINESS PROCESS RISK 0 10 Source: Algo FIRST © 2008 Algorithmics Incorporated. All rights reserved. 20 30 40 50 60 70 80 90

The Bezzle “At any given time there exists an inventory of undiscovered embezzlement in - or more precisely not in - the country's business and banks. This inventory - it should be called the bezzle. It also varies in size with the business cycle. " from “The Great Crash: 1929” by John Kenneth Galbraith. © 2008 Algorithmics Incorporated. All rights reserved.

Procylicality of Fraud & Market Practice Issues § Supply of fraud is correlated with supply of credit § Access to credit allows for the continuance of both fraud and gray-matter market practice issues § Corporations push the boundaries when credit is available in terms of compensation, disclosure, client relationships, profit taking and financial reporting § Enron, Worldcom, and Madoff frauds initiated during bubble and uncovered during retraction § The absence of credit during a downturn results in uncovering of frauds © 2008 Algorithmics Incorporated. All rights reserved.

Vix Daily Closing Prices CBOE Volatility Index, 1990 -2008, vs. events in the FIRST database Codelco $170 m UAT WGZ $230 m UAT Enron $2. 2 billion fraud Bank. Boston $73 m fraud Kidder Peabody/ J. Jett $350 m UAT Barings $1. 3 billion UAT Source: CBOE, Bloomberg and FIRST © 2008 Algorithmics Incorporated. All rights reserved. AIB Allfirst $691 m UAT Hamilton Bank $130 m fraud December 2008: Bernard Madoff $50 billion Ponzi Scheme Soc. Gen $7. 2 b UAT Calyon $247 m UAT

A Gallery of Rogues: Bernard Madoff and Robert Stanford Bernard Lawrence "Bernie" Madoff (born April 29, 1938 ) is an American businessman and former chairman of the NASDAQ stock exchange. He founded the Wall Street firm Bernard L. Madoff Investment Securities LLC in 1960 and was its chairman until December 11, 2008, when he was charged with perpetrating what may be the largest investor fraud ever committed by a single person. • Robert Alan Stanford, charged with running $9. 2 billion investment fraud • Sold $8 billion of Certificates of Deposit through Stanford International Bank, based in Antigua • Promised double-digit returns over the past 15 years • Bank claimed $51 billion in deposits and assets under management, with more than 70, 000 clients in 140 countries • Possible money laundering charges pending © 2008 Algorithmics Incorporated. All rights reserved.

Largest Losses from Credit Crisis Organization Name Sum of Loss Amount Percentage American International Group Inc. 96, 278, 000 27. 85% Citigroup Inc. 63, 400, 000 18. 34% Bank of America Corporation 55, 038, 000 15. 92% UBS AG 48, 400, 000 14. 00% Wells Fargo & Co. 8, 617, 925, 000 2. 49% Morgan Stanley & Company 3, 700, 000 1. 07% Goldman Sachs Group, Inc. , The 3, 060, 000 0. 89% JPMorgan Chase & Co 1, 600, 000 0. 46% 280, 093, 925, 000 81. 02% 65, 634, 029, 280 18. 98% 345, 727, 954, 280 100. 00% Top 8 Total Others Grand Total Source: Algo FIRST © 2008 Algorithmics Incorporated. All rights reserved.

Product Types Behind Subprime losses Sub. Prime/Market Volatility - Products and Services LENDING PRODUCTS & FINANCING SERVICES INSURANCE PRODUCTS AND SERVICES FINANCIAL PRODUCTS (UNSPECIFIED) EQUITY PRODUCTS DERIVATIVES, STRUCTURED PRODUCTS AND COMMODITIES DEBT PRODUCTS CLEARING SERVICES CASH MANAGEMENT SERVICES ASSET MANAGEMENT PRODUCTS AND SERVICES 0 10 20 30 Number of Events Source: Algo FIRST © 2008 Algorithmics Incorporated. All rights reserved. 40 50 60

The Opportunity: Op. Risk at the Core of the Solution We will see a fundamental re-design of risk management: Operational Risk provides the governing framework IN: Integrated. Consistent. Actionable. Non-deterministic. OUT: Silos, automatic models, compliance running on auto-pilot Categorizations have become meaningless! Operational risk is the driver for change © 2008 Algorithmics Incorporated. All rights reserved.

Largest Bank Failures Organization Name Loss Amount Percentage Kaupthing hf 28, 200, 000 24. 64% Glitnir Bank 23, 400, 000 20. 45% Landsbanki Ã� slands hf. 15, 900, 000 13. 90% Indymac Bancorp Inc 9, 400, 000 8. 21% Bank. United FSB, Coral Gables, Florida 4, 900, 000 4. 28% Wachovia 4, 500, 000 3. 93% Guaranty Bank, Austin, TX 3, 000, 000 2. 62% Colonial Bank, Montgomery, Alabama 2, 800, 000 2. 45% Franklin Bank, S. S. B. , Houston, Texas 1, 500, 000 1. 31% Downey Financial Corp. 1, 400, 000 1. 22% Top 10 Total 95, 000, 000 83. 02% Others 19, 429, 024, 512 16. 98% 114, 429, 024, 512 100. 00% Grand Total Source: Algo FIRST © 2008 Algorithmics Incorporated. All rights reserved.

Control Failings Behind Bank Failures - Contributory Factors CORPORATE/MARKET CONDITIONS LACK OF CONTROL MANAGEMENT ACTION/INACTION STRATEGY FLAW CORPORATE GOVERNANCE OMISSIONS ORGANIZATIONAL STRUCTURE EMPLOYEE ACTION/INACTIONEMPLOYEE MISDEEDS STAFF SELECTION/COMPENSATION 0 20 40 60 80 100 120 Incidence of Factors (An event can have more the on contributory factor) Source: Algo FIRST © 2008 Algorithmics Incorporated. All rights reserved.

Product Types Behind Bank Failures - Products and Services LENDING PRODUCTS & FINANCING SERVICES DERIVATIVES, STRUCTURED PRODUCTS AND COMMODITIES CLEARING SERVICES CASH PRODUCTS CASH MANAGEMENT CARD PRODUCTS 0 20 40 60 Number of Events © 2008 Algorithmics Incorporated. All rights reserved. 80 100 120

Where We Came From: Five Deadly Sins 1. Lack of care for stakeholders 2. Automatic approach 3. Unknowns ignored 4. Silos accepted 5. Risk and return managed separately © 2008 Algorithmics Incorporated. All rights reserved. Domenico di Michelino, La commedia illumina Firenze

1. Lack of Care for Stakeholders Short-term earnings culture threatened shareholder value Failure to put clients’ interests first Fiduciary duties became secondary Compensation Community Role Pieter Bruegel the Elder, The Fall of the Rebel Angels © 2008 Algorithmics Incorporated. All rights reserved.

2. Automatic Approach Perfecting standard models Firms that experienced more significant problems tended to apply a mechanical risk management approach. Senior Supervisors Group (2008) The tendency to overly formalize arcane aspects of an analysis often detracts from the bigger picture. Corrigan Report (2008) © 2008 Algorithmics Incorporated. All rights reserved. Pieter Bruegel the Elder, Parable of the Blind

3. Unknowns ignored Methodology can convey a false sense of precision All models use assumptions and assumptions can have a material impact on the model outcomes. However, most models do not specifically acknowledge what assumptions they are making. Federal Reserve Bank of New York (2008) © 2008 Algorithmics Incorporated. All rights reserved. Pieter Bruegel the Elder, The Adoration of Kings

4. Silos Accepted The existence of organizational silos appeared to be detrimental to performance during the turmoil. Business areas [made] decisions in isolation and in ignorance of other area’s insights. Senior Supervisors Group (2008) Pieter Bruegel the Elder, The Tower of Babel © 2008 Algorithmics Incorporated. All rights reserved.

5. Risk and Reward Separated Pursuing returns without managing risk Firms that recorded relatively larger unexpected losses tended to champion the expansion of risk without commensurate focus on controls. Senior Supervisors Group (2008) Pieter Bruegel the Elder, Gluttony © 2008 Algorithmics Incorporated. All rights reserved.

Where We Can Go From Here: Five Virtues 1. Focus on the Stakeholders 2. Acknowledge uncertainty transparently 3. Imagine and Challenge assumptions 4. Manage risk at the enterprise level 5. Manage risk and return proactively © 2008 Algorithmics Incorporated. All rights reserved. Pieter Bruegel the Elder, Fortitude

1. Focus on the Stakeholders Develop a culture of risk governance Risk management must rely heavily on judgment, communication and coordination. This culture of governance will help to break down the silo mentality. It [requires] rigorous and continuous attention at the highest levels. Corrigan Report (2008) © 2008 Algorithmics Incorporated. All rights reserved. Pieter Bruegel the Elder, Justice

2. Acknowledge Uncertainty Risk is more than a single number [We] must recognize the limitations of mathematical models. Corrigan Report (2008) Managers at better performing firms relied on a wide range of measures of risk. Senior Supervisor Group (2008) Pieter Bruegel the Elder, Prudence © 2008 Algorithmics Incorporated. All rights reserved.

3. Imagine. Challenge Assumptions Discover the Unknown, Don’t Perfect the Known Firms [must] think creatively about how stress tests can be conducted. Corrigan Report (2008) Firms that tended to avoid significant challenges assessed risk positions drawing on different underlying assumptions. Senior Supervisors Group (2008) © 2008 Algorithmics Incorporated. All rights reserved.

4. Manage Risk at the Enterprise Level Dismantle silos Firms that understood quickly the risk they faced relied on information from many parts of their businesses. Better performing firms were able to integrate their measures of market risk and counterparty risk across businesses. Senior Supervisors Group (2008) Institute of International Finance (2008) © 2008 Algorithmics Incorporated. All rights reserved. Pieter Bruegel the Elder, The Tower of Babel

5. Manage Risk (and Return) Pro-actively The need for speed [Firms] must have the capacity to monitor risk concentrations as well as exposures to institutional counterparties in a matter of hours and provide effective and coherent reports to senior management. Corrigan Report (2008) © 2008 Algorithmics Incorporated. All rights reserved.

The Next Wave: A Prediction Black Swans will happen § There will be more risk-related regulation: Recent G 20 and BIS actions are just a start § Comprehensive and active ERM is “back” § Assumptions, models and results will become context specific § Client-centric financial innovation is here to stay Pieter Bruegel the Elder, The Battle about Money © 2008 Algorithmics Incorporated. All rights reserved.

The Next Wave: A Hope Think! § Imagine. Explore what you don’t know § Challenge your assumptions § Communicate, don’t “report” § Use sound judgment Risk management = Decision making under uncertainty © 2008 Algorithmics Incorporated. All rights reserved. Pieter Bruegel the Elder, Hope

Where do we go from here Op. Risk Best Practices is part of the solution § Manage risk on a firm-wide basis and overcome silos § Integrate risk identification, risk and self assessments, monitoring and testing of controls within the enterprise-wide risk framework § Look at all material risks together, and not be limited to market, credit, liquidity and operational risk § Understand assumptions and what happens if assumptions fail § Integrate scenario approaches within overall framework § Lobby to change an organization’s culture § Supplement quantitative tools with qualitative judgment © 2008 Algorithmics Incorporated. All rights reserved.

Thank you for your time For further information contact: Penny Cagan Managing Director penny. cagan@algorithmics. com 212 -612 -7853 © 2008 Algorithmics Incorporated. All rights reserved.