Enterprise Risk Management Insights & Operationalization

1. Enterprise Risk Management Insights & Operationalization Prepared for the Committee on Finance & IT June 18th 2010

2. Contents • Background • Key findings: • The current state of ERM implementation • Types of ERM program • Organisation of ERM functions • Operationalization of ERM • Open questions • Next steps • About BMR

3. Background to the study

4. A perfect storm • ERM has been a topic of discussion and analysis since the mid 1990s – but economic turmoil has thrown risk management into sharper focus • Regulatory developments – for example, the introduction of SEC Rule 33-9089 – are acting as a powerful catalyst for ERM adoption • Management teams and Boards are under increasing pressure from regulators, investors and the media to demonstrate the effectiveness of risk management efforts – both in protecting shareholder interests AND in adding value • By 2009, FERF had identified a gap in knowledge among FEI members – most of whom knew that they should do something about ERM, but weren’t sure exactly what to do

5. Focus on practical implementation • FERF and BMR agreed that an executive report was needed to help FEI members address the ’operationalization’ of ERM • A steering group was formed, comprising Peggy Yocher of United Technologies; Joan Netzel of SunTrust Banks; and Prof Paul Walker of the University of Virginia, as well as BMR and FERF representatives • Rather than review theoretical frameworks, it was agreed that the study should canvass ERM Managers to find out how ERM is actually being implemented on the ground and to identify trends, patterns and future directions that may be of value to FEI members • It was also agreed that the principal focus should be upon ERM in non-financial companies

6. Participants in the study • Companies interviewed for the study have aggregate revenues in excess of $1.2 trillion and are generally global in scope • They were predominantly Fortune 500 organisations or similar, on the basis that these companies are most likely to have well-developed ERM programs • Personnel interviewed were typically either: • ERM Directors • Treasurers • Strategy Directors • Controllers • In addition to these face-to-face interviews, we also carried out detailed reviews of approximately 15 more ERM programs

7. Key findings1. Current state of ERM implementation2. Two types of ERM program3. Organization of ERM programs4. Operationalization of ERM

8. Current state of ERM implementation

9. Key findings1. Current state of ERM implementation2. Two types of ERM program3. Organization of ERM programs4. Operationalization of ERM

10. Two types of ERM program • ERM programs can be classified according to the categories of risk that are deemed to be in scope; and the overall approach that is adopted to risk management: • In general, programs tend to fall into one or other of two program types: • Type One: programs that take a mainly strategic view of risk, and manage it in a qualitative way; and • Type two: programs that take a more financial / operational view, and tend to manage risks through quantitative control • The view of risk might be said to be either “Enterprise Level” (Type One) or “Enterprise Wide” (Type Two) Type One Strategic Type of risks that a given program is mainly designed to address Type Two Operational Quantitative Qualitative Predominantapproach that a given company takes to management of risk

11. Move toward more integrated, holistic approaches • Most organizations are making efforts to take a more holistic, integrated view of ERM • To do this an organization needs to ask: • How can strategic risks be analyzed on a quantitative level? • How can financial / operational data be interpreted in a qualitative way? • The benefits of successfully adopting a more integrated view are that a virtuous circle would be created, strengthening the links between business strategy and operational planning

12. Key findings1. Current state of ERM implementation2. Two types of ERM program3. Organization of ERM programs4. Operationalization of ERM

13. Organization of ERM functions (1)

14. Organization of ERM functions (2)

15. Key findings1. Current state of ERM implementation2. Two types of ERM program3. Organization of ERM programs4. Operationalization of ERM

16. Operationalization of ERM functions • Most ERM programs are operationalized around five broad activities: • Gathering ‘risk intelligence’ • Cross-functional risk discussion • Risk scoring and prioritization • Risk response • Reporting • Although the activity areas do not necessarily happen sequentially, most programs reviewed for the study operate with a natural ‘cadence’ that resembles a cyclical process • For companies starting out on the ERM journey, gathering of risk intelligence is the most obvious place to start

17. Operationalization of ERM functions

18. Operationalization of ERM functions

19. Operationalization of ERM functions

20. Open questions

21. Questions that require deeper exploration

22. Next steps

23. Engaging the FEI membership • As has been seen, the study leaves a number of questions open for discussion • We also hope that it will provoke debate around this critical issue, which in itself will prove valuable and interesting to FEI members • We are exploring options for further engagement with FEI membership to take forward the conversation we have started with this study. Ideas may include: • Regional round table discussions in key ‘hub’ cities • Webinars • Discussions / presentations at CFRI or other FEI conferences

24. About BMR

25. Who we are • BMR was founded in October 2004 by a group of former Andersen and EY partners • We are now recognised as one of the top three tax firms in India* and the number one M&A service provider for the Indian market** • At the same time, we have established a global reputation for risk and process consulting, having delivered assignments in more than 40 countries • We have a strong track record, with most of our partners having worked together for 20+ years • We offer the high quality that clients expect from a major international firm, combined with a flexible approach that fosters innovation • For the second year, we are ranked among India’s top employers by the Great Place To Work® Institute * Source: International Tax Review, 2009 * * Source: Thomson Reuters, 2009

26. Unique model for outsourcing of risk functions To our knowledge, BMR is the only firm offering an unique global business model for the outsourcing of risk-related functions

27. New Delhi The Great Eastern Centre 70 Nehru Place New Delhi 110 019 Tel: +91 11 3081 5000 Mumbai The Contractor Building 41 RK Marg, Ballard Estate Mumbai 400 001 Tel: +91 22 3021 7000 Bengaluru Embassy Icon Annex 2/1 Infantry Road Bengaluru 560 001 Tel: +91 80 4032 0000 Chennai 21 Sambandam Street Mandaveli Chennai 600 028 Tel: +91 44 24954783/84 Bahrain 32 Sabha Building Diplomatic Area Manama 317 Tel: +97 313 646676 London Berkeley Square House Berkeley Square London W1J 6BD Tel: +44 20 7849 6100 Singapore 10 Anson Road#09-24 International Plaza079903 Singapore Tel: +65 6408 8004 New York 100 Park Avenue New York NY 10017 Tel: +1 212 880 6462 Santa Clara 3940 Freedom Circle Santa Clara CA 95054 Tel: +1 408 834 4699 Contact details