Discovery – The Next Generation!: Business Context of Risk Presentation to the North London Branch British Computer Society 19 March, 2008 Dr. Victoria Lemieux Credit Suisse IT Risk

About Credit Suisse Credit Suisse is a leading global bank headquartered in Zurich Credit Suisse is a leading global bank headquartered in Zurich Credit Suisse Group reported income from continuing operations of CHF 8,549 million for the full year 2007 Credit Suisse Group reported income from continuing operations of CHF 8,549 million for the full year 2007 It is focussed on serving its clients in three business lines: investment banking, private banking and asset management It is focussed on serving its clients in three business lines: investment banking, private banking and asset management Total staff worldwide is 45,000 Total staff worldwide is 45,000 Credit Suisse operates in approximately 50 countries globally Credit Suisse operates in approximately 50 countries globally

About IT Risk Business continuity preparedness, readiness, oversight & crisis resolution Develop and implement the tools, framework, capability and testing program to enable successful recovery in the event of a crisis or similar planned outage Improved response and reduced impact Risk advisory, assessment, and oversight Leverage techniques such as risk assessments and metrics tracking to assist clients in evaluating risks and developing mitigation strategies based on risk appetite Effective and efficient resource allocations Training and awareness Disseminate risk guidelines, build risk awareness, and develop the required behavior across Credit Suisse Minimize issues resulting from unknowledgeable staff Regulatory & audit services Assist IT Division in meeting legal, audit and regulatory obligations Improved compliance resulting in lower operational costs IT forensic investigations The use of IT investigation and digital forensics methods to investigate data security and integrity issues Limit damage to the firm Risk management methodology, policies, and standards Develop & maintain BCM, information security & IT risk policies, standards, methodologies & metrics Risk assessment and mitigation Risk reduction initiatives Prioritize, plan, support and execute regional, divisional and global projects for risk avoidance and risk mitigation Reduction of risks in the environment IT environment protection Monitor, assess, and respond to attacks on the Credit Suisse infrastructure, prioritizing response by threat level Minimize impact from attacks

The Legal and Regulatory Landscape Bank for International Settlements (Basel II) Financial Services Authority EBK/ Swiss Banking Secrecy Data Protection Act International Standards Organisation Sarbanes Oxley Federal Financial Institution Examiners Council Gramm Leach Bliley Patriot Act Federal Information Security Management Act California SB1386 Monetary Authority of Singapore Japanese Financial Services Agency

Drivers / Business Benefit Drivers / Business Benefit –Reduced legal and regulatory risk exposure –Reduced costs for retrieval A Balanced Risk View

Drivers / Business Benefit Drivers / Business Benefit –Reduced legal and regulatory risk exposure –Reduced costs for retrieval £50,000 x ? Cases = millions Avoidance of regulatory fines Avoidance of adverse legal rulings Avoidance of reputational damage Downside Risks Downside Risks –Barriers to realising business benefits »Poor organisation of doocuments »Lack of governance »Lack of context –Introduction of new risks »Cross border data access »Data confidentiality »Intellectual Property protection A Balanced Risk View