Regulatory Risk Assessments Approach and key considerations Holly

Regulatory Risk Assessments Approach and key considerations Holly Tucker Senior Manager, Deloitte Financial Advisory Services LLP January 2010

The current environment A multitude of regulations Economic uncertainty Rising stakeholder expectations 1 Regulatory Risk Assessments — Approach and key considerations Copyright © 2009 Deloitte Development LLC. All rights reserved.

Why regulatory risk assessments, why now? • Increased sensitivity to regulatory risks by Board of Directors • Recent high profile global enforcement actions such as Siemens and KBR • Ability to utilize results as a tool to drive strategic change • Provides for insight into key issues/risks facing the business so as to more effectively manage the business • Expansion into new markets with changing regulatory environments • Regulators increasing focus on compliance issues and cooperation agreements with foreign governments • Pressure from stakeholders • Push for greater transparency, sustainability and corporate governance 2 Regulatory Risk Assessments — Approach and key considerations Copyright © 2009 Deloitte Development LLC. All rights reserved.

Conducting a regulatory risk assessment A common approach, methodology and tools directed by corporate is necessary to ensure consistency across the business • Planning the Risk Assessment – What locations? Who will lead the local process? What risk categories and types of risks should be considered? • Conducting the Risk Assessment – What is the timing? How will it be communicated? What will the reporting look like? • Documenting the Risk Assessment – How will you implement a standard process? How will you account for unique market risks and process? • Communicating the results of the Risk Assessment – How will you capture the results and who will they be provided to? • Gap remediation and risk mitigation – How will you remediate the gaps? Who will be responsible? What will be your timeline for implementation? How will you report the progress of risk mitigation? • Monitoring the Risk Assessment – How will you monitor the identified risks? How will you monitor and utilize the results to increase efficiencies in the business? 3 Regulatory Risk Assessments — Approach and key considerations Copyright © 2009 Deloitte Development LLC. All rights reserved.

Developing a program for Risk Intelligence Risk Governance Internal Audit/Risk Management/Compliance Risk Infrastructure & Oversight Risk Ownership Develop and Deploy Strategies Executive Risk Committee People Process Technology Common Risk Infrastructure Risks BU A BU B BU C Identify Risks Assess & Evaluate Risks Respon d to Risks Strategy & Planning Operations / Infrastructure Design, Impleme nt & Test Controls Monitor, Assure & Escalate Sustain and Continuously Improve Board of Directors BU D Governance 4 Regulatory Risk Assessments — Approach and key considerations Compliance Reporting Copyright © 2009 Deloitte Development LLC. All rights reserved.

Challenges and key considerations • Obtaining executive buy-in at local and corporate level • Executing the process • Executing with the right people • Upfront planning and preparation • Consideration of differences in culture • Building a sustainable process • Demonstrating the value of assessment to foreign entities • Development of common definition and evaluation of risks 5 Regulatory Risk Assessments — Approach and key considerations Copyright © 2009 Deloitte Development LLC. All rights reserved.

This presentation contains general information only and Deloitte Financial Advisory Services LLP is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified professional advisor. Deloitte Financial Advisory Services LLP shall not be responsible for any loss sustained by any person who relies on this presentation. About Deloitte refers to one or more of Deloitte Touche Tohmatsu, a Swiss Verein, and its network of member firms, each of which is a legally separate and independent entity. Please see www. deloitte. com/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu and its member firms. Please see www. deloitte. com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Copyright © 2009 Deloitte Development LLC. All rights reserved. Member of Deloitte Touche Tohmatsu