Executive Insight through Enhanced Enterprise Risk Management Leverage Value From Your Risk Management Investment

Discussion Points The Value of ERM ERM Lessons Learned The ERM Implementation Focus Risk Management Strategy Development and Policy Setting Embed Corporate Culture Management Involvement ERM Continuous Reporting and Communication ERM Structure Roles & Responsibilties

Enterprise Risk Management A PROCESS, effected by an entity’s board of directors, management and other personnel, applied in strategy-setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.

The Value of ERM - Why do ERM? To prevent highly likely and high impact risks from happening at your company or reduce impact of risk To support Board of Directors responsibilities To bring management team to consensus on key risks To lower costs of audits To lower costs of insurance To improve bond ratings To become good at Managing Risk so your company can grow faster To gain a competitive advantage

ERM Lessons Learned Lack of Focus Not properly defined or focused, became too big Paralysis through Analysis Addressed risk symptoms not root cause Not Embedded It never got embedded in the culture or business processes (Ownership) Did not have the right sponsorship Did not have enough training or common language No real governance of ERM projects (Accountability) Lack of Information/Intelligence Not forward looking Not focusing on the managing of the Risks that must keep going right

ERM Implementation - Capabilities Maturity Model Risk Assessment and Analysis, Event Identification, Risk Monitoring and Response, Risk Reporting, ERM Awareness and Training Governance Structure and Processes, and Risk Management Strategy Development and Policy Setting. Ad-Hoc Capabilities characteristics of individuals Initial Process Established in parts of the organization Formalized Formal Consistent processes in each department Optimized Organization focused on ERM as source of competitive advantage Embedded Integrated processes are embedded in the business planning Systemically Build and Improve Enterprise Risk Management Capabilities

ERM Implementation - Designing the ERM Infrastructure The ERM Infrastructure Drives Continuous Improvement of ERM Capabilities Organization Processes Technology

FOCUS Risk Management Strategy Development & Policy Setting

Focus - ERM Strategy and Policies- Align the Vision The Tenets of Effective ERM: Develop a ERM Strategy and Policies Leverage what you have already Integrate with what you do Train People in ERM Strategy and Policies Create a Risk Management Culture Keep it simple!!! ERM is not something to build in a day… But when it is built, it needs to Align to a Vision

Embed Corporate Culture Management Involvement ERM Continuous Reporting and Communication ERM Structure Roles & Responsibilties

Embed – Corporate Culture An insurer’s ERM program must be appropriate to the organization’s culture. Enterprise leadership must create an ERM culture by setting a clear mandate for ERM Risk awareness and policies should be embedded in all layers of the organization

Embed -Enterprise Wide Ownership and Participation BU 1 Pres./CFO Operations and Business Unit Leadership BU 2 Pres./CFO BU 3 Pres./CFO Corporate Leadership and Oversight CEOCFO General Counsel BU 3 Pres./CFO Corporate Support and Monitoring Functions Financial Planning CIOTreasuryController TaxLegalPurchasing Human Resources Internal Control Internal Audit Compliance Risk Management

Embed – ERM Structure and Roles & Responsibilites To CRO or Not to CRO The Board The Audit Committee Internal Audit and Risk Management Corporate Management

Embed – Continuous Communication and Reporting Risk Management Strategy Risk/ Event Monitoring Risk Response Enterprise Risk Assessment Board and Senior Management Communication Awareness and Training A process for monitoring and reporting and responding

Questions & Answers