FINANCIAL SERVICES A D V I S O

FINANCIAL SERVICES A D V I S O R Y Tuning Risk for Return KPMG LLP Operational Risk Implementation & its Impact on Financial Institutions Institute of International Bankers December 11, 2007 Jonathan Rosenoer jrosenoer@kpmg. com © (year) KPMG (member firm name if applicable), the (jurisdiction) member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in (country). (Insert document code) 1

"All of life is the management of risk, not its elimination. " Walter Wriston © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 2

Enterprises need to apply to the management of “tail risks” the same judgment that they use to run the business © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 3

Industrial age risk management tools are not sufficient for today’s business risks • Insurance • Narrow scope of insurable or covered “perils” • Direct physical damage typically required • Controls review • Focus on existence and quality of control process, not direct testing of effectiveness Source: S. Giuffre, “Insuring Operational Risk, How Good is the Coverage, ” Viewpoint, Feb. 2004. © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 4

Needed: A future vision and roadmap © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 5

• Getting down to basics and avoiding stumbling blocks © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 6

Governance is a primary requirement; execution can be challenging Audit Comm. Board Risk Committee • Assess/propose risk capacity • Oversight Independent review • Define strategy / risk appetite • Set “tone” Education E. g. , • Regulators • External auditor(s) • Internal audit Risk Management Insurance Risk Mgt. Executive (Cx. O) Management • Identify risk • Set policy • Define methodology / framework • Review, validate & test Lines of Business Risk Mgt. Functional Units Outsourced Services © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 7

Tactical building blocks are sometimes needed • • Risk education, culture, and language “Single view of organization” ü Legal entity data • Business risk identification ü “Single view of process” ü Homogenization of risk types and control elements at BU and group level ü Internal data creation, acquisition, and management ü Reference data ü External (industry) event data • Workflow orchestration © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 8

Process and Operations simplification: Optimizing risk management and control; driving lower cost § Greater likelihood that compliance objectives are achieved consistently across the organization § Sustainable framework to effectively address existing and emerging domestic and global regulatory § § § requirements Greater process efficiency resulting in improved shareholder value through more cost efficient operations Increased integrity of and timely availability of risk information Better risk management leading to optimal business decisions Risk & Compliance Departments (example) Risk Management Data capture and analysis BUs/CCs (example) Compliance Internal Audit Finance Department Legal Department Simplification overlay on Regulatory Compliance Processes Corporate Banking Retail Banking Investment Banking Wealth Management Treasury © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. Efficiency IT 9

• Gaining focus and traction © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 10

Risk identification and evaluation Identify and prioritize hot spots across the enterprise. • • Create visibility Size exposures Focus attention on high risk areas Control spending © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 11

Risk modeling and quantification is a cornerstone of enterprise-wide risk management Risk modeling enables managers to understand risk exposure over 3 dimensions: üAnalytic: What is the overall quantified risk exposure? üDiagnostic: • How effective are technologies, controls, and mitigants? • What is the ROI for change? üPredictive: What are the key causes and indicators of risk? © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 12

Effective management of Operational Risk requires understanding the relationship between risk reduction options and business impact. Operational Risk can be quantified by: • Identifying business processes of interest • Identifying applicable event drivers, and • Estimating the effectiveness of controls, countermeasures, and mitigants (e. g. , insurance), as well as their combined economic impact on business process. © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 13

A transparent, risk-driven ROI calculation can assist managers to understand risk and where best to make changes Fault Uncertain event Error Countermeasure Financial statement impact Loss Mitigant Countermeasure Ldirect A F 1 Ca E 1 Cb m 1 I Lindirect “As Is” Exposure “To Be” Exposure (with new control) Adverse Event Control A Not capable cause = 55% Capable cause = 45% B No Loss = 91. 9% Loss = 8. 1% New Control E Caught = 96. 1% Not caught = 3. 93% Mitigant Financial Statement Impact C No Loss = 98. 9% Loss = 1. 14% D Expected Loss = $3. 42 M © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 14

• The benefits of effective risk management © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 15

Effective risk management can drive growth, profitability, and shareholder value Increase product ROIC Economic Value Added (NOPAT – Capital Charge) Net Operating Profit After Taxes (NOPAT) (NOPAT/Average Capital) Operating Margin (EBITA/Revenue) Invested Capital WACC Improve credit rating Capital Utilization (Revenue/Invested Capital) Cash Flow at Risk Organic Growth M&A Release capital Corporate Risk Capital Credit Risk Market Risk Operational Risk © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 16

With risk as a key parameter, executives can model and optimize enterprise value add for a range of key business decisions In-house Third Party Cease / Postpone • Captive insurance Capital Allocation • Business process transformation • Third party • Control improvement insurance • Technology upgrade • Securitization • Infrastructure redesign • … • Co-source • Outsource • … RAPM / ERM Risk Certainty Efficient Frontier Risk Tolerance Industry Benchmark Frontier Sub-Optimal frontier Optimized controls Value creation Cost savings Efficiency gains “To Be” State “As Is” State © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 17

Questions Jonathan Rosenoer Partner, Global Advisory Financial Services KPMG jrosenoer@kpmg. com 1 -415 -465 -4500 © 2007 KPMG, the KPMG Luxembourg Advisory Support S. a. r. l. , member firm of KPMG International, a Swiss cooperative. All rights reserved. Printed in Luxembourg. 18