1. Minimizing Operational Risk & Optimizing Institutional Performance

2. 1 Interest in Enterprise-wide Risk Assessments is being driven by Financial & Economic Realities Global spotlight on risk and corporate governance –Sarbanes-Oxley Act of 2003 & COSO ERM Framework Increased involvement from the Audit Committee of the Board of Directors with regard to risk management –NYSE listing requirements Capital adequacy requirements and the need for efficient capital allocation –Basel Capital Accord Need for alternative risk solutions due to the current insurance environment Maximizing shareholder value Sustaining a competitive advantage

3. 2 “The risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events” Operational risk can result in increased write-offs, additional expenses or loss of revenue Basel Committee’s Definition of Operational Risk

4. 3 Operational Risk Management & Shareholder Value Examples of how operational risk management drives shareholder value? Improving operating efficiency and thus operating margins, by identifying and prioritising process improvement and de- risking opportunities Improving management effectiveness by enhancing the governance structure Enabling more effective capital usage by introducing processes to assess exposure & integrate this with an economic capital model Protecting assets by reducing losses through improved risk control environment and financing programme Enhanced organizational capabilities & subsequent competitive positioning through continuous improvement

5. 4 How to Reduce Operational Risks? Understand Risks Benchmarking Scenario Analysis Key Risk Indicator’s (KRI) De-Risking Operational Procedures Define, Measure, Analyze, Improve, & Control Risk Finance & Transfer Mapping to Insurance Products Developing New Products Financing Retained Losses Transferring Risk to the Insurance & Capital Markets

6. 5 Op Risk/Lean Six Sigma Linkage Op Risk NeedsSix Sigma Can Provide Identification of critical processes and activities Hierarchical, process view of a business Monitoring of key indicators and warning of potential problems Process Management & Control Cure problems in existing processes Process Improvement via DMAIC & Lean Prevention of problems for new processes Process Design via DFSS

7. 6 Six Sigma Defined A data driven approach to understanding and eliminating process variation and defects Three, universal, methodologies for process management A performance target of 3.4 defects per million opportunities

8. 7 Risk Management: How Can Six Sigma Help? Six Sigma provides three powerful methodologies for: –Designing robust processes –Fixing broken processes –Controlling processes on an ongoing basis (i.e., keeping them from decaying and producing errors)

9. 8 Risk Management: How Can Six Sigma Help? Designing robust processes: –A structured methodology, DFSS (Design for Six Sigma), assures that: New processes have high capability (satisfy customers and produce low defects) right from the start New processes are designed to minimize the risk of failure

10. 9 Fixing broken processes: –A structured methodology, DMAIC (Define, Measure, Analyse, Improve, Control): Uses powerful statistical (and non-statistical) tools to locate and eliminate the root causes of otherwise intractable problems Focuses on removal and prevention of defects Reduces process variability Risk Management: How Can Six Sigma Help?

11. 10 Controlling processes, so that their behavior is predictable (within limits). Six Sigma provides: –Special tools and techniques including a framework: For measuring and judging process variation For detecting special causes To providing early warning of process changes –The ability to calculate Process Sigma, an index of process performance Risk Management: How Can Six Sigma Help?

12. 11 Companies Pursue Six Sigma to … Accommodate customer demands Drive out waste, cycle time and variability Direct improvement resource to the most significant opportunities Establish a standard improvement methodology Develop leaders Reduce risk Grow the top-line Implement business strategy Increase product reliability Initiate cultural change Accelerate improvement

13. 12 Sigma is a Measure of Process Capability Six Sigma is a level of process capability such that less than 3.4 “defects” are produced for every million opportunities. Sigma 1 2 3 4 5 6 DPMO 680,000 298,000 67,000 6,000 400 3.4 Performance boundary Process performance Requirement 1 2 3 4 5 6

14. 13 Estimating the Benefits of Six Sigma

15. 14 Process Sigma Advantages The Sigma Scale provides a common metric for comparison that includes the customer requirement and the degree of variation. Addresses multiple occurrences. PROCESSPERFORMANCE Call servicing32 seconds ASA vs goal of 35 Billing98% accuracy, on time, right location Accounts Receivable33 days average aging vs goal of 40 Customer Service82% rated 4 or 5 responsiveness

16. 15 The Antecedents of Six Sigma Six Sigma is the latest and most powerful in a long line of process management and process improvement methods, e.g.: –Guilds –The Scientific Method –Quality Circles –TQM Six Sigma has built on these ideas and added powerful tools It is specially useful for transactional processes

17. 16 Principle 1 The board of directors should be aware of the major aspects of the bank’s operational risks as a distinct risk category that should be managed, and it should approve and periodically review the bank’s operational risk management framework. The framework should provide a firm-wide definition of operational risk and lay down the principles of how operational risk is to be identified, assessed, monitored, and controlled/mitigated. Source: Sound Practices for the Management & Supervision of Operational Risk (Basel Committee – July 2002) Sound Practices in Operational Risk Management

18. 17 Principle 2 The board of directors should ensure that the bank’s operational risk management framework is subject to effective and comprehensive internal audit by operationally independent, appropriately trained and competent staff. The internal audit function should not be directly responsible for operational risk management. Source: Sound Practices for the Management & Supervision of Operational Risk (Basel Committee – July 2002) Sound Practices in Operational Risk Management

19. 18 Principle 3 Senior management should have responsibility for implementing the operational risk management framework approved by the board of directors. The framework should be implemented throughout the whole banking organization, and all levels of staff should understand their responsibilities with respect to operational risk management. Senior management should also have responsibility for developing policies, processes and procedures for managing operational risk in all of the bank’s products, activities, processes and systems. Source: Sound Practices for the Management & Supervision of Operational Risk (Basel Committee – July 2002) Sound Practices in Operational Risk Management

20. 19 Principle 4 Banks should identify and assess the operational risk inherent in all material products, activities, processes and systems. Banks should also ensure that before new products, activities, processes and systems are introduced or undertaken, the operational risk inherent in them is subject to adequate assessment procedures. Source: Sound Practices for the Management & Supervision of Operational Risk (Basel Committee – July 2002) Sound Practices in Operational Risk Management

21. 20 Principle 5 Banks should implement a process to regularly monitor operational risk profiles and material exposure to losses. There should be regular reporting of pertinent information to senior management and the board of directors that supports the proactive management of operational risk. Source: Sound Practices for the Management & Supervision of Operational Risk (Basel Committee – July 2002) Sound Practices in Operational Risk Management

22. 21 The 6  Process IMPROVE Operational Risk Assessment & Analysis New Process Capability Project Selection SIPOC Capability Baseline Measurement System Validation Establish Controls Measurement System Validation Process Specifications New Process Pilot New Policies & Procedures Identify Key Risk Drivers Correlation Analysis Confirm Impact Process Risk Mapping Key Risk Indicators (Dashboards)

23. Level 1 Business Lines Natural Linkage to Operational Risk Management Framework Operates at Level 1, Level 2 and Activity Group Level (All Business Lines) Linked to All Products, Activities, Processes, and Systems DMAIC Employed to Improve Existing Policies, Procedures, and Processes….DFSS Leveraged to Design New Ones Natural Linkage to Operational Risk Management Framework Operates at Level 1, Level 2 and Activity Group Level (All Business Lines) Linked to All Products, Activities, Processes, and Systems DMAIC Employed to Improve Existing Policies, Procedures, and Processes….DFSS Leveraged to Design New Ones Operational Risk Definition & Analysis Level 2 & Activity Groups Operational Risk Management Framework Mapping 6  to Operational Risk Framework

24. 23 Operational Risk Management Using 6  Six Sigma Focus Identify Risks Describe Outcome of Failure Determine Cause & Effect Evaluate Current Controls Expected Loss Factors ORIMA Drills-Down From Top Level Business Line to the Processes Within Each Activity Group

25. The Discipline and Its Approach, Combined With a Rich Set of Analysis Tools, Makes Six Sigma a Perfect Fit for Operational Risk Management Operational Risk Management Using 6 

26. 25 A Way Forward Outside In or Inside Out Outside In: 1.Review statistics for comparable businesses and identify risk by type 2.Identify the processes that lie behind the risk (hierarchy) 3.Perform risk analysis on the key processes (FMEA) 4.Identify key measures inside and outside of the process 5.Collect data 6.Monitor, using dashboards and control charts. Search for signals 7.Take action as required (DMAIC, Lean, DFSS or other)

27. 26 Inside Out: A Way Forward 1.Inventory all processes 2.Identify those presenting the greatest risk 3.Identify the sub-processes that lie behind the risk (process hierarchy) 4.Perform risk analysis on the key processes and sub- processes (FMEA) 5.Identify key measures inside and outside of the process 6.Collect data 7.Monitor, using dashboards and control charts. Search for signals 8.Take action as required (DMAIC, Lean, DFSS or other)

28. 27 Further Questions / Information: Lori Marin Telephone: 312-381-4420 Email: lori_marin@ars.aon.com Questions?

29. 28

30. 29