Chief Risk Officer Forum

1. Chief Risk Officer Forum Dr. Robert M. Mark CEO Black Diamond Tel: 925 878 9943 Bmark.blackdiamond@tmo.blackberry.net Enterprise Risk Management April26-27 Chicago, Illinois

2. Dr. Robert M. Markbmark.blackdiamond@tmo.blackberry.net 925 878 9943 • Dr. Robert M. Mark is the Chief Executive Officer of Black Diamond which provides corporate governance, risk management consulting and transaction services. He serves on several Boards such as the Fields Institute for Research in Mathematical Sciences, IBM’s Deep Computing Institute, Checkpoint Canada, The Royal Conservatory and is an Advisory Director on Entergy Koch’s Audit Committee of the Board . He also serves on Checkpoint’s Investment Committee. In 1998, he was awarded the Financial Risk Manager of the Year by the Global Association of Risk Professionals (GARP). He is the Chairperson of The Professional Risk Managers’ International Association’s (PRMIA) Blue Ribbon Panel • Prior to his current position, he was the Senior Executive Vice-President and Chief Risk Officer (CRO) at the Canadian Imperial Bank of Commerce (CIBC). Dr. Mark was a member of the Management Committee. Dr. Mark’s global responsibility covered all credit, market and operating risks for all of CIBC as well as for its subsidiaries. Prior to his CRO position, he was the Corporate Treasurer at CIBC. • Prior to CIBC, he was the partner in charge of the Financial Risk Management Consulting practice at Coopers & Lybrand(C&L). The Risk Management Practice and C&L advised clients on risk management issues and was directed toward financial institutions and multi-national corporations. This specialty area also coordinated the delivery of the firm’s accounting, tax, control, and litigation services to provide clients with integrated and comprehensive risk management solutions and opportunities. • Prior to his position at C&L, he was a managing director in the Asia, Europe, and Capital Markets Group (AECM) at Chemical Bank. His responsibilities within AECM encompassed risk management, asset/liability management, research (quantitative analysis), strategic planning and analytical systems. He served on the Senior Credit Committee of the Bank. Before he joined Chemical Bank, he was a senior officer at Marine Midland Bank/Hong KongShanghaiBank (HKSB) where he headed the technical analysis trading group within the Capital Markets Sector. • He earned his Ph.D., with a dissertation in options pricing, from New York University’s Graduate School of Engineering and Science, graduating first in his class. Subsequently, he received an Advanced Professional Certificate (APC) in accounting from NYU’s Stern Graduate School of Business, and is a graduate of the Harvard Business School Advanced Management Program. He is an Adjunct Professor and co-author of “Risk Management” (McGraw-Hill), published in October 2000. He also served on the board of ISDA as well as the Chairperson of the National Asset/Liability Management Association (NALMA). Black Diamond Risk Management

3. A significant challenge for a CRO is to stay on top of a complex combination of factors which drive risk • The ability to efficiently integrate all the components of risk as well as to effectively operate in markets while serving customers as well as satisfying regulatory requirements is a direct function of the quality of the people, the associated culture, as well as incentives and experience Customers Investors People Culture Incentives Experience Market Risk Credit Risk Regulators Rating Agencies Equity Analysts Markets Operations Risk Black Diamond Risk Management

4. METHODOLOGIES POLICIES INFRASTRUCTURE A significant challenge for a CRO is to build a proactive risk management function that can be benchmarked in terms of: Black Diamond Risk Management

5. METHODOLOGIES POLICIES INFRASTRUCTURE For example, a proactive risk management function would include building a Credit Portfolio Management Group (CPMG) • The CPMG has become part of the landscape through which proactive risk management functions are actively managing their Credit Portfolio Proactive Risk Management Black Diamond Risk Management

6. Policies • Ongoing Policy Assessment from a CRO’s perspective involves asking several critical questions. These include: • Is the tolerance for risk consistent with the Business Strategies? • Do the risk authorities reflect a desired tolerance for risk? • Is risk properly disclosed internally and externally? Business Strategies Risk Tolerance Appropriate Policies Independent First-Class Proactive Risk Management Authorities Disclosure Black Diamond Risk Management

7. Strategy and Risk Tolerance • A Significant challenge for a CRO is to ensure that there is a formalized process to discuss and debate the tradeoffs amongst the various business units to opportunistically increase their risk. • The tolerance for risk is ideally tied to a well articulated and transparent business model. Business Strategies Risk Tolerance Appropriate Policies Independent First-Class Proactive Risk Management Authorities Disclosure Black Diamond Risk Management

8. Example 1: August 1998: • Equity prices dropped sharply • Equity Volatility increased • Liquidity dried up (Flight to quality) • Correlations broke down • Credit spreads widened • Credit quality deteriorated August ‘98 WideCreditSpread HighVolatility LowLiquidity Black Diamond Risk Management

9. A key challenge for CRO’s during Aug 1998 was to adjust the tolerance for risk in advance of extreme negative markets. For example: VaR July 22 Risk Authorities 58mm Oct 02 38mm 29mm Oct99 Nov 97 Mar98 Jul98 Aug98 Feb99 Jun99 Jul99 Aug99 Sep99 Oct98 Black Diamond Risk Management

10. Risk Disclosure • A test of best practice risk management is an organization’s ability to provide disclosure which makes the risk transparent to managers. • Analytically rich disclosure is critical to a strong risk management process. • Risks and financial flows should be well understood by managers and other stakeholders. Business Strategies Risk Tolerance Appropriate Policies Independent First-Class Proactive Risk Management Authoribties Disclosure Black Diamond Risk Management

11. Certain types of disclosure have now become standardExample 2: Daily Net Trading Revenue vs. Value at Risk ALCO Limit - Upper Boundary Daily Net Trading Revenue Potential Predicted Positive Revenue C$ Millions Potential Negative RevenuePredicted ALCO Limit - Lower Boundary August 27, 1998 Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep Oct Black Diamond Risk Management

12. There are many significant methodological challenges for a CRO • Ongoing assessment of methodologies involves such questions as: • Is the design and implementation of VaR as well as stress testing methodologies appropriate? • Are the mathematical models properly vetted? • Are the positions properly valued? • Are the risk methodologies tied into performance measurement? Independent First-Class Proactive Risk Management Best-Practice Methodologies (formulas) VaR Performance Stress Testing Vetting Black Diamond Risk Management

13. Scenarios P & L Positions Change in Positions Hedging Dynamic Adjustments of The Greeks Impact on Liquidity Horizon Price Path Volatility Positions Adjust Over Time Market Movements Over Time Example 3: A key market risk challenge for a CRO is to realistically capture liquidity risk Trading Rules Initial Position Data Scenarios Data } Results Black Diamond Risk Management

14. Example 4: A credit risk challenge for a CRO is to appropriately characterize credit risk in the trading book and integrate it with credit risk in the banking book • Ex: Credit Limit exposure for derivatives is typically measured through using a single Worst Case (W) or 2/3 W exposure and then combine it with credit risk limits in the banking book against the same obligor Worst Case Terminal Exposure (WT) “ Worst Case” Credit Exposure path Cumulative Average Worst Case (FE = 2/3 WT) “Expected” Credit Expected Terminal Exposure If W set at a 2 sigma Exposure path = WT /5 Cumulative Average Expected Exposure (=2/3 x WT /5) Best Case (0) Time (T) 0 T Black Diamond Risk Management

15. t N t 0 Example 5: A key challenge for a CRO is to arrive at realistic reasonable paranoia stress tests? • Stressing the boundaries of credit risk EXAMPLE . . .To produce perturbations of combined distributions of simulated future credit losses Credit risk factors may be shocked . . . Shocks EXPOSURE PROBABILITY DEFAULTS 0 TIME CREDIT LOSS RECOVERIES Correlations to other factors Black Diamond Risk Management

16. - = - - + - rt P N ( d ) V Fe N ( d ) 1 0 2 - + + s + s 2 2 rT ln( V / F ) ( r ) T ln( V / Fe ) T 1 1 = = 2 2 0 0 d 1 S T S T = - s d d T 2 1 Example 6: A key challenge for the CRO is to price market, credit and operational risk. For example, the credit risk for a Credit Derivative can be modeled as a put (utilizing a Merton Style “structural form” model) • where P is the current value of the put, N(.) is the cumulative standard normal distribution, and • and  is the standard deviation of the rate of return of the firm’s assets. Black Diamond Risk Management

17. - - rT B Fe P ln ln 0 F F = - = y T T T r T cs = - y r T T 1 V cs = - = - + - [ 0 y r ln N ( d ) N ( d )] 2 1 T T - rT T Fe …and can be used to calculate expected credit spreads (CS). Liquidity is a key element that is difficult to incorporate • Yield to maturity and credit spreads can be calculated according to well known technology: Black Diamond Risk Management

18. CROs have benefited from significant progress made in measuring market & credit risk and are now attacking Operational Risk…. but have not yet found a generally accepted Unified Risk Measure The market has reliable risk measures for individual portfolios, but no highly reliable measure for total risk across the trading book and banking book . Black Diamond Risk Management

19. Valuation and Performance • The implementation of best practice calls for methodologies that accurately value transactions and quantifies the return to risk relationships of the individual as well as portfolio of transactions. Independent First-Class Proactive Risk Management Best-Practice Methodologies (formulas) VaR Performance Vetting & Valuation Stress Testing Black Diamond Risk Management

20. Technology Accurate Data INFRASTRUCTURE Independent First Class Proactive Risk Management Operations People (Skills) Infrastructure: Ongoing assessment of infrastructure involves such questions as:Are the appropriate people and operating elements in place to control and report on risk? Are there periodic risk management change initiatives? Black Diamond Risk Management

21. Risk Management Change Initiative Questionnaire CATEGORY QUESTION What major themes underlie your business strategy as a whole? Does this represent a major departure from the past? In what ways? What are your three most critical deliverables this year? What are the most likely impediments to success? Is there a single metric or set of metrics that is most important to you as your monitor progress against your goals? COMMENTS Self Description Black Diamond Risk Management

22. Risk Management Change Initiative Questionnaire CATEGORY QUESTION How do you see the role of Risk Management changing in the context of your changing strategic Agenda? How would this be different from the support you are currently receiving from Risk Management? How do you believe Risk Management is doing in terms of meeting your regulatory/compliance requirements Based on new/changing requirements, what do you feel we need to improve upon? Prepare for? COMMENTS Risk Management’sFocus Black Diamond Risk Management

23. Risk Management Change Initiative Questionnaire CATEGORY New Requirements No Longer Required QUESTION Do you see Risk Management as a resource (problem solving)? How would you see that relationship playing out? What are the values and principles that should guide Risk Management's relationship with its business partners? Based on your new direction, what should RM be doing, that e are not currently doing, in terms of providing support to your business group?   Based on your business priorities, what should RM stop doing that adds any value? Black Diamond Risk Management

24. Risk Management Change Initiative Questionnaire CATEGORY QUESTION What do you believe to be Risk Management's current strengths? What do we do well? What do we need to do better? Can you identify three issues/areas of concern, which you feel Risk Management adversely impacts on organizational effectiveness? COMMENTS General Assessment Black Diamond Risk Management