1. Bruce Branson Associate Director, NC State ERM Initiative September 27, 2012

2. Page 2

3. Page 3 Huge Management Challenge Economic Downturn Liquidity Uncertain Legislative/Regulatory Environments Explosion of Technology Complex Business Transactions Globalization Short Product Cycles Increasing Risks and Complexities Interconnected – with a cascading impacts Higher Expectations for Effective Risk Oversight

4. Page 4 48% Describe their Risk Oversight as Very Immature or Developing 43% Dissatisfied with Entity’s Risk Oversight

5. Page 5 Most Fail to See Value Compliance Exercise Strategic Tool Only 11% say their enterprise’s risk oversight is extensively or mostly providing strategic competitive advantage Loss Prevention Value Creation?

6. Page 6 Traditional Risk Mgt Approach Strategic Market Risks Operations Risks Finance Risks IT RisksLegal Risks Reputation Risks Human Capital Risks

7. Page 7 Traditional Risk Mgt Approach Credit Risks Market Risks Finance Risks IT RisksLegal Risks Reputation Risks Human Capital Risks “Silo” or “Stove-Pipe” Risk Management Risk RiskRisk RiskRisk

8. Page 8 Risk & Return

9. Page 9 Time Range of Uncertainty Develop Strategies Now Risk Oversight is All About the Strategy Observe Performance Later What is our process for managing emerging risks?

10. Page 10 ERM Framework Strategy Objective Setting Risk Identification Risk Assessment Risk Response Controls, Communication, and Monitoring Source: The Committee of Sponsoring Organizations of the Treadway Commission Internal Environment

11. Page 11 Step 1: Really Understand Strategy of Business Member Value Increased Revenues Expense Savings

12. Page 12 Step 1: Really Understand Strategy of Business Member Value Increased Revenues Expense Savings Pursue Acquisitions Build Value Proposition Develop New Products Expand Geographically Pursue Operational Excellence Strengthen Talent Base

13. Page 13 Understanding Strategy 1.What must go right for strategy to be successful? –Processes, people, technologies 2.What assumptions are we making? –How Developed, Impact if Volatile, How Monitored? Risks

14. Page 14 Step 2: Identify Risks Impacting Strategy Member Value Increased Revenues Expense Savings Build Value Proposition Develop New Products Expand Geographically Pursue Operational Excellence Strengthen Talent Base Risks? Pursue Acquisitions

15. Page 15 Key Risks Identified Strategic Initiative #1 Strategic Initiative #2 Strategic Initiative #3 Strategic Initiative #4 Risk #1Xx Risk #2xx Risk #3xx Risk #4xxxx Risk #5x Risk #6xx Risk #7xx Risk #8x Risk #9x Risk #10xx Strategies Risks Create an Enterprise Strategic View of Risks

16. Page 16RatingDefinition Improbable Shocked if this risk happens Possible Not likely, but not surprised if it happens 50-50 Toss-up Probably Likely, but not surprised if it did not happen Near Certain Shocked if it doesn’t happenRatingDefinition Negligible Near zero budget variance, minimal impact on key stakeholders, media coverage improbable Minor Fairly small budget variance, small impact on completion of mission, media coverage improbable to possible Moderate Noticeable budget variance, some delay in projects to complete mission, media coverage is 50/50 Serious Significant budget variance, delay in project schedules, media coverage is probable to near certain Critical Significant budget variance, cancellation of projects, significant negative feedback, media coverage is near certain and widespread Likelihood Rankings * Impact Rankings* Step 3: Need Process to Prioritize Risks

17. Page 17 Step 4: How Are We Managing Risks? 1.How are we currently managing this risk? 2.Is risk response appropriate and adequate? 3.Should we do something differently? 4.Who owns this risk?

18. Page 18 Step 5: Develop Metrics to Monitoring Risks Member Value Increased Funding Expense Savings Strategic Initiative #1 Strategic Initiative #2 Strategic Initiative #3 Strategic Initiative #4 Potential Risk KRIs Strategic Initiative #5 Strategic Initiative #6

19. Page 19 KPI s vs. KRI s Historical Forward Looking

20. Page 20 Time Range of Uncertainty Initial Strategies Proactive Management of Emerging Risks Trigger Points KRIs Revise Strategies KRIs Revise Strategies

21. Page 21 ERM Framework Strategy Objective Setting Risk Identification Risk Assessment Risk Response Controls, Communication, and Monitoring Source: The Committee of Sponsoring Organizations of the Treadway Commission Internal Environment

22. Page 22 Goal: Expand Value Proposition of Risk Oversight Compliance Exercise Strategic Tool Enterprise Risk Management Enterprise Risk Management Loss Prevention Traditional Risk Management Traditional Risk Management

23. Page 23 Interested in Learning More….www.erm.ncsu.edu 1 st Page of Google Search on “ERM” About 7,500 Visitors a month

24. Page 24 Internet About 300 articles summarized

25. Page 25 Twice monthly distribution

26. Visit us at: www.erm.ncsu.edu Mark S. BeasleyBonnie HancockBruce Branson Deloitte Professor Executive DirectorAssociate Director of Enterprise Risk MgtERM InitiativeERM Initiative