1. Risk Appetite – Taking the Right Amounts of the Right Risks ACSDA Senior Summit – December 5, 2013

2. 2 Agenda 1.Introduction and Risk Appetite Overview (20 minutes) 2.CDS Case Study (60 minutes) 3.Discussion Groups (45 minutes) 4.Presentation of Discussion Group Results (45 minutes) Please ask questions or provide comments at any time and share your experiences!

3. Defining Risk Capacity and Risk Appetite Risk capacity refers to the maximum potential impact of a risk event that the firm could withstand and remain a going concern(1). Risk appetite expresses the total amount of risk that an organization is willing to take to achieve its strategic objectives and meet its obligations to its stakeholders(2) 3 (1)Committee of Sponsoring Organizations of the Treadway Commission (COSO), Strengthening Enterprise Risk Management for Strategic Advantage, 2009 (2)Towers Watson, Risk Appetite –The Foundation of Enterprise Risk Management, 2010 Capacity Appetite Overview

4. Need for a Risk Appetite Statement 4 Not having a risk appetite statement can: – lead to inadequate control resulting in the acceptance of undesirable risk positions, or – an avoidance of acceptable risks and underperformance All the cool kids are doing it – Organizations that we consider our peers in risk management have developed or are developing risk appetite statements Lastly, the regulators require it! – The CPSS/IOSCO Principles for Financial Market Infrastructures (PFMIs) explicitly require FMIs to have a risk tolerance statement Overview

5. CDS Case Study Objective: To share the experience that CDS has had in order to (a) provide useful guidance to CSDs beginning a similar exercise (b) provoke discussion of experiences of other CSDs (c) to inform CDSs next phase of enhancements CDSs experience in developing and using risk appetite has had 3 distinct phases: Phase 1 (2007 to 2010) Phase 2 (2010 to 2013) Phase 3 (2013+) 5 CDS Case Study

6. Phase 1 – A Starting Point Defined risk tolerance only for the purposes of identifying our most important risks A key enterprise risk is an event which, if it occurred, could plausibly create an outcome exceeding CDSs risk tolerance, more specifically: – A financial loss to CDS in excess of its reserves, currently $10 million; – A financial loss to participants who are members of a collateralized credit ring in CDSX or cross-border services in excess of realized value of the collateral available in the relevant collateral pools; – An inability of CDS to meet fundamental services requirements; – An inability of CDS to meet its financial obligations as contractually obligated; – A reputational loss to CDS such that its ability to effectively provide services to its participants and customers is seriously questioned. 6 CDS Case Study

7. In 2007, CDS had not expressed its willingness to take risk in any meaningful way 7 December 2007 Risk tolerance used as threshold for identifying risks that require attention by senior management and Board Missed opportunity to use expression of willingness to take risks as part of day-to-day management of risks In 2007, we thought that if these risks really existed, we would likely have been put out of business by then CDS Case Study

8. Risk metrics without context 8 CDS presented these charts as part of a presentation on responding to market turmoil at the 2008 ACSDA general assembly in Toronto Are these results good or bad? What can we measure them against in order to determine if they are acceptable? CDS Case Study

9. Phase 2 – The light starts to go on! We realized that our risk tolerance was not our willingness to take risk, but our maximum capacity to take risk We needed to distinguish the risk appetite and capacity of our participants from that of CDS Most importantly, we needed to address critical cultural issues: – Need to eliminate zero risk tolerance mindset – Need to drive ownership and accountability for risk management to the business units 9 CDS Case Study

10. Relative Size of Proprietary and Participant Risk Capacity and Appetite 10 The Eye Chart was presented to CDSs Risk Management Committee in December 2010 CDS Case Study

11. Development of CDSs risk appetite statement – 4 key inputs 11 Risk Appetite Governing objective representing the value proposition of CDS to its key stakeholders Risk capacity and constraints representing CDSs ability to bear risk Risk philosophy representing CDSs set of shared beliefs and attitudes on risk taking Business strategy and objectives which embody the strategic direction of CDS over the planned time horizon CDS Case Study

12. Phase 2 - Risk Appetite Development Cycle 12 Draft initial statements Improve with input from senior management Improve with input from all stakeholders Board review and approval Governing objective, risk capacity and constraints, risk philosophy, business strategy and objectives Keep senior management in the loop as statement changes with stakeholder input! Stakeholders: participants, regulators, Board members (should have included staff!) CDS Case Study

13. Risk appetite considerations Risk appetite is still an evolving concept and CDSs risk appetite statement will evolve as we better understand our willingness to accept risk and as the environment and our strategy changes A risk appetite is not an excuse for poor performance, unexpected losses or lack of commitment to operational excellence Expressing a risk appetite does not mean that we dont care about losses within our risk appetite…we will investigate and learn from losses…could it have been worse?…do we need to adjust our behavour in light of the loss? 13 CDS Case Study

14. Risk philosophy With the senior management team, we identified a number of basic beliefs and expressions about how we think about risk: CDS Clearing is fundamentally a risk averse organization. CDS Clearing recognizes that its ability to manage risk can ultimately affect the financial welfare of Canadians. CDS Clearing has a fiduciary responsibility as a result of holding assets in safekeeping for our participants. CDS Clearing considers its peers in risk management to include large financial institutions, public institutions vital to the health and welfare of Canadians and enterprises whose products require extreme levels of safety and reliability. CDS Clearing is too important to fail (without the moral hazard implications). CDS INC and CDS Innovations are able to take more risk than CDS Clearing. 14 CDS Case Study

15. Risk outcome rating exercise conducted with Board Conducted workshops with the Risk Management and Audit Committee of Board: Discuss a number of risk exposures faced by CDS; Identify the relevant risk capacity for that type of exposure; Identify and quantify actual or potential scenarios that have caused or could cause losses due to this type of risk exposure; Rate CDSs appetite for the risk that could cause this outcome or scenario on an appropriate scale. 15 CDS Case Study

16. Board Workshop Exercise #1 CDS holds cash owned by its participants and customers and invests that cash to generate a return. These investments can fluctuate in value as a result of changes in prices (market risk). The total value of these investments typically range between $50 million and $100 million. What is an acceptable level of risk for these investments? 16 CDS Case Study

17. Board Workshop Exercise #2 In order to record securities in CDSX, critical information about the characteristics of each security such as conversion and extension privileges must be extracted from various documents and entered into the system. Interpreting and recording this information is subject to error (operational risk). What is an acceptable level of risk? Observed historical loss 17 CDS Case Study

18. Board Workshop Exercise #3 The daily operation of CDSX is vital. As an IT system, CDSXs availability can be affected by hardware, software and network failures. The recovery time objective (RTO) for CDSX is 2 hours after declaration of disruption. How much risk of a CDSX outage is acceptable? 18 CDS Case Study

19. Phase 2 – Where did we end up? 19 CDS Case Study Quantitative and qualitative statements of our willingness to take specific kinds of risks Different legal entities are willing to take different amounts of risk Examples of these statements are provided in the appendix

20. Example 1 – Using risk appetite to manage risk exposure 20 October 2008November 2013 Relevant Risk Appetite Statement: Participants are willing to accept losses which result from a defaulters collateral in a central counterparty service being insufficient. Participants expect that these uncollateralized losses should occur in no more than 1% of potential defaults for CNS. CDS Case Study

21. Example 2 – Using risk appetite to manage risk exposure 21 October 2008 November 2013 Relevant Risk Appetite Statement: Participants are willing to accept losses resulting from the default of a fellow member of a category credit ring up to the amount of the collateral pledged to the collateral pool by the surviving members (red line in graph). CDS Case Study

22. Phase 3 – Risk appetite becomes fundamental part of decision making for everyone at CDS Today, there are still a number of issues that CDS needs to address: The use of risk appetite as a key input into risk decisions is not consistent Many parts of the organization are unfamiliar with relevant risk appetite statements Operational risk appetite statement has not successfully been translated to day-to-day operations Lingering cultural issues – perception of zero risk tolerance still exists; often viewed as an excuse for not taking risk Our ownership structure has fundamentally changed and we need to generate return for our shareholders while appropriately balancing that return with the resulting risks given our systemic importance 22 CDS Case Study

23. Phase 3 - Risk appetite in the context of a comprehensive approach to managing our business 23 Organizational Objectives RCSA – Risk Assessment Control Objectives Control Design Process RCSA Control Procedures Internal Audit Review Business Strategy Compliance Rules Risk Appetite Mngt Supervision Escalation Self-Assessment Create coaching opportunities CDS Case Study

24. Conclusions and lessons from CDSs experience (so far) Defining and using your risk appetite statement is a journey, it should and will evolve Keep things simple Use real examples from your business Involve all stakeholders Tailor it for your organization, make it your own 24 CDS Case Study

25. Discussion Groups Each group is assigned a topic for discussion and will report back on the results: Group 1 – What corporate cultural issues can you foresee (or have experienced) in developing and implementing risk appetite and how can these be addressed? Group 2 – Operational risk is an important category of risk for CSDs and presents particular challenges for defining and implementing risk appetite statements. What are those challenges and how can they be addressed? Group 3 – CSDs operate with different ownership structures while providing systemically important services in their markets. How can risk appetite help balance meeting the needs of owners (e.g. return) and market participants (e.g. low cost and safety)? Group 4 – A risk appetite statement typically includes a series of quantitative and qualitative measures. What are the characteristics of effective measures for risk appetite statements? If your group prefers to address a new topic, please go ahead! Select a spokesperson for your group and report on the results of your discussion. 25 Discussion Groups

26. Appendix: Other examples of risk appetite statements Operational Risk Are willing to accept cumulative losses (to CDS itself or to its participants caused by CDS) resulting from known and accepted operational risk exposures up to 0.5% of total expenses during any 12-month period (approx. $350,000). Are willing to accept losses from operational processes where the cost of mitigating the risk is greater than a reasonable estimate of the potential future loss (subject to limit above). Strategic Risk Are willing to invest up to $10 million each year in enhancements to existing businesses with an expected positive return in terms of reduced cost, improved efficiency or value for participants. 26

27. Appendix: Other examples of risk appetite statements Financial Risk Are willing to accept only extremely low amounts of market, credit and liquidity risks for investments made on behalf of third parties: – Market risk: Maximum one-day portfolio market value decline resulting from interest rate changes of less than 0.2% with 99% confidence ; – Market risk: Zero foreign exchange risk; – Credit risk: Extremely low issuer default risk (federal and provincial government securities only); – Liquidity risk: Lowest possible risk of being unable to immediately liquidate positions without loss. 27

28. 28