1. Assessing ERM Practices ERM Working Group North Carolina State University Raleigh, February 24 th 2006 Copyright © 2005 Standard & Poor's, a division of The McGraw-Hill Companies. All Rights Reserved. Prodyot Samanta Ph.D., Director ERM

2. Agenda  What do firms mean when they talk about ERM?  Standard and Poor’s approach to assessing ERM practices  ERM criteria applied to Trading Risk  Discussion/Q&A

3. 3 10/17/2015 What is ERM?  Several definitions with common themes  Integrated, firm-wide approach for understanding, managing and communicating risk  Cuts across business units, geography and risk types  Delivers a better understanding of the risk/reward trade-off  Aligns strategy with firm’s risk appetite  Different approaches to implementation:  For some, ERM is a qualitative approach to identifying, measuring and managing risks in a consistent, integrated way  For others, the focus of ERM is quantifying and aggregating risk types (e.g. economic capital modelling)

4. 4 10/17/2015 Enterprise Risk Management: A Holistic View ERM Risk Transfer Risk ratings admin control Portfolio Management Fraud Trading Sales Practice Reputation Conflict of Interests Management Incentives Product Innovation Competition Disclosure Risk Appetite Investing Structuring Underwriting Accounting Fiduciary Processing Clearing Credit Market ALM Compliance/ Legal Strategic/ Business Policies Audit Operational Risks within the enterprise are inter- related and cannot be viewed in isolation Risk integration and aggregation is enabled through-out the enterprise via a common data architecture and a single valuation engine Corporate governance is the glue that binds this into a consistent and coherent structure Institutions will have a unified framework for measuring and managing risks

5. What is Standard and Poor’s approach to assessing ERM practices?

6. 6 10/17/2015 The PIM Approach for assessing ERM practices P OLICIES I NFRASTRUCTURE M ETHODOLOGY OPERATIONS GOVERNANCE & RISK CULTURE RISK APPETITE & STRATEGY RISK CONTROL RISK DISCLOSURE RISK ARCHITECTURE VALUATION TECHNIQUES MODEL VETTING & BACK-TESTING

7. ERM criteria applied to assessing trading risk management practices at financial institutions

8. 8 10/17/2015 Implementing PIM to Assessing TRM Practices (1) P IM – Policy & Governance: How is the stature of the risk management function evaluated and how important is this in the aggregate assessment?  Independence of the risk function  Partnership and strategic role with the business  CRO reporting to the CEO In assessing the process by which an institution establishes its risk tolerance, what criteria is applied?  Process for establishing the risk tolerance (qualitative and quantitative) that consider tactical and strategic objectives  Quality of the process for approving new products (NPA committees, clear definitions, documentation, tracking, follow-up)

9. 9 10/17/2015 Implementing PIM to Assessing TRM Practices (2) P IM – Policy & Governance: Is it Standard & Poor’s goal to lead financial institutions to disclose more than required by the SEC? What criteria is applied with respect to disclosure?  No! (That is not the intent)  However, good practice would be where institutions took a leadership role and articulated the relevant risks to their shareholders that go beyond what is dictated by regulation  Assess the quality of both internal and external disclosure  Internal reports to senior management should should summarize financial and non-financial risk

10. 10 10/17/2015 Implementing PIM to Assessing TRM Practices (3) P IM – Infrastructure & Methodology: What is evaluated in terms of Risk Technology and Back Office operations?  Should be independent of the Business  Should track KRIs  Quality and level of systems integration How important is VaR as a risk measure in Standard and Poor’s criteria for assessing the trading risk management practices of an institution?  Unfortunately not much!  Stress Testing and “What-If” scenario analysis is important  And other measures beyond regulation

11. 11 10/17/2015 Ok, What’s The Impact On Ratings? If an institution falls short of, or exceeds, expectations, would it warrant a downgrade or an upgrade? Have there been any such rating actions? If there are any material weaknesses or significant strengths, it could impact rating!

12. 12 10/17/2015 Q&A? Permissions: To reprint, translate, or quote Standard & Poor’s research, contact: Client Services, 55 Water Street, New York, NY 10041; (1) 212-438-9823; or by email to: research_request@standardandpoors.com. Visit us on the web @ www.erm.standardandpoors.com