Evan Picoult, Citigroup September, 2004 PAGE 1 INTEGRATED RISK MANAGEMENT PRESENTED TO:World Bank Finance Conference BY:Evan Picoult, Managing Director Risk Architecture Citigroup New York, New York DATE:Wednesday, September 22 PLACE:World Bank Washington, DC

Evan Picoult, Citigroup January, 2004 Page 2 Evan Picoult, Citigroup September, 2004 PAGE 2 WHAT IS THE PURPOSE OF RISK MANAGEMENT? A COMPLIANCE FUNCTION? AN AID TO BUSINESS? WHAT DOES INTEGRATED RISK MANAGEMENT MEAN? THREE RELATED MEANINGS OF INTEGRATED RISK MANAGEMENT.

Evan Picoult, Citigroup January, 2004 Page 3 Evan Picoult, Citigroup September, 2004 PAGE 3 FORMS OF FINANCIAL SERVICES AND FORMS OF RISK COMMERCIAL BANKING INVESTMENT BANKING INSURANCEASSET MANAGEMENT INDIVIDUAL / CONSUMER CORPORATE / INSTITUTIONAL TYPES OF RISK MARKET RISK CREDIT RISK OPERATIONAL RISK INSURANCE RISK CROSS BORDER RISK FIRST ASPECT OF INTEGRATED RISK MANAGEMENT CONSISTENT RISK MEASUREMENTS / POLICIES FOR EACH TYPE OF RISK, ACROSS ALL BUSINESSES. Deposits Loans Payment Mech Trusts BrokerageProp & Casualty Health Life Fiduciary products. Deposits Loans Payment Mech Trading M&A Underwriting Trading Prop & CasualtyFiduciary products.

Evan Picoult, Citigroup January, 2004 Page 4 Evan Picoult, Citigroup September, 2004 PAGE 4 Citigroup Risk Management: Principles INTEGRATION OF BUSINESS AND RISK MANAGEMENT Risk management is integrated with the business plan and strategy. RISK OWNERSHIP All risks and resulting returns are clearly owned and managed by an accountable business. INDEPENDENT OVERSIGHT All risks limits are approved by independent risk managers and business management. Risk managers report to up to independent Chief Risk Officer of firm. COST EFFECTIVENESS All risk management processes are implemented with consideration to cost/benefit dynamics. EXAMPLE OF BROAD, FIRM-WIDE RISK MANAGEMENT PRINCIPLES

Evan Picoult, Citigroup January, 2004 Page 5 Evan Picoult, Citigroup September, 2004 PAGE 5 Citigroup Risk Management: Principles POLICIES AND PROCEDURES/ROLES AND RESPONSIBILITIES. All risk management practices, including the roles and responsibilities to accurately identify, measure, limit, approve and report all risks are clearly and formally documented. Risk policies are approved by independent risk management. RISK IDENTIFICATION AND MEASUREMENT All risks are identified, measured and managed. All risks are measured using consistently defined and approved methodologies including stress scenarios and economic capital. LIMITS AND METRICS All risks are managed within a rationalized limit or economic capital framework. RISK REPORTING All risks are comprehensively reported and clearly communicated. EXAMPLE OF BROAD, FIRM-WIDE RISK MANAGEMENT PRINCIPLES

Evan Picoult, Citigroup January, 2004 Page 6 Evan Picoult, Citigroup September, 2004 PAGE 6 CITIBANK EXPERIENCE BEFORE THE MERGER THAT CREATED CITIGROUP SECOND ASPECT OF INTEGRATED RISK MANAGEMENT BACKGROUND: SOME HISTORY CORPORATE CREDIT DISASTERS OF 1980’s AND EARLY 1990’s –LDC DEBT –REAL ESTATE QUESTIONS FOR MANAGEMEjNT: –WHY DID THIS HAPPEN? SHOULD WE REMAIN IN THIS BUSINESS? –ARE LARGE LOSSES SUCH AS THESE INHERENT IN CORPORATE / INSTITUTIONAL LENDING? –WAS IT CAUSED BY POLITICAL/ECONOMIC FACTORS OUTSIDE THE CONTROL OF THE BANK? –WHAT CAN BE DONE TO MINIMIZE LIKELIHOOD OF HUGH LOSSES OCCURING AGAIN?

Evan Picoult, Citigroup January, 2004 Page 7 Evan Picoult, Citigroup September, 2004 PAGE 7 ANALYSIS: –PERVERSE PERFORMANCE INCENTIVES. –NO MEASUREMENT OF ECONOMIC CAPITAL. –NO RISK BASED PRICING. –NO ACTIVE MANAGEMENT OF PORTFOLIO CREDIT RISK. NEED FOR AN INTEGRATED, COHERENT APPROACH CITIBANK EXPERIENCE BEFORE THE MERGER THAT CREATED CITIGROUP

Evan Picoult, Citigroup January, 2004 Page 8 Evan Picoult, Citigroup September, 2004 PAGE 8 A SECOND ASPECT OF INTEGRATED RISK MANAGEMENT : THOROUGH INTEGRATION OF RISK POLICIES AND PRACTICES INTO BUSINESS DECISION MAKING:  REALISTIC MEASUREMENT OF RISK, INCLUDING EXPOSURES AND ECONOMIC CAPITAL.  COMPREHENSIVE LIMITS ON RISK.  USE OF RETURN ON RISK (I.E. RETURN ON ECONOMIC CAPITAL) AS A COMPONENT OF: - PERFORM EVALUATION AND COMPENSATION - RISK BASED PRICING - CUSTOMER / PRODUCT SELECTION - ALLOCATION OF INTERNAL RESOURCES THROUGH ANNUAL BUDGET AND / OR ACQUISTIONS.  ORGANIZATIONAL STRUCTURE - MANAGEMENT OF LOANS ON A PORTFOLIO BASIS

Evan Picoult, Citigroup January, 2004 Page 9 Evan Picoult, Citigroup September, 2004 PAGE 9 THE TERM “CAPITAL” HAS SEVERAL MEANINGS: SOME MEASURE OF AVAILABLE FINANCIAL RESOURCES:  BOOK CAPITAL =ASSETS – LIABILITIES  MARKET CAPITALIZATION= NUMBER OF SHARES * PRICE PER SHARE =IMPL. MKT. VALUE OF ASSETS – LIABILITIES (Implied Market Value of Assets) A MEASURE OF ECONOMIC RISK (solvency, i.e. debt holders, perspective):  ECONOMIC CAPITAL=MEASURE OF UNEXPECTED LOSS AT HIGH C.L. DEFINITION OF ECONOMIC CAPITAL Exp LossLoss at high CL Economic Capital

PAGE 10 Evan Picoult, Citigroup September, 2004 DEFINITION OF ECONOMIC CAPITAL Economic Capital (EC) is a defined as the pre-tax, potential unexpected economic loss, over a one-year time horizon, at a 99.97% confidence level. Economic losses include any decline in the economic value of assets, any increase in the economic value of liabilities, and any additional loss on the financial statements not otherwise captured above. “Unexpected losses” is the difference between the potential losses at a given confidence level (e.g., 99.97% confidence level) and the expected loss over the time horizon being analysed. Note: –Economic loss not accounting loss or volatility of earning. –One year time horizon for purpose of insolvency measurement. Different time horizon appropriate for pricing multi-year transaction. –Confidence level should be tied to target rating.

PAGE 11 Evan Picoult, Citigroup September, 2004 The probability distribution of potential credit loss, and the ratio UL/EL, depends on the composition of the portfolio and the definition of credit loss. Expected Loss (EL) Loss at a very high CL (e.g. 99.9%) Economic Capital for Credit Risk to cover Unexpected Loss (UL) EXAMPLE: EC FOR CREDIT RISK Economic Capital For Credit Risk=A measure of risk: The unexpected loss, at a high confidence level, in excess of the expected loss.

Evan Picoult, Citigroup January, 2004 Page 12 Evan Picoult, Citigroup September, 2004 PAGE 12 SOME IMPLEMENTATION SSUES REGARDING ECONOMIC CAPITAL ECONOMIC CAPITAL IS A MEASURE OF UNEXPECTED LOSSES. IN GENERAL, BECAUSE OF DIVERSIFICATION BENEFITS: - ECONOMIC CAPITAL TOTAL <  (ECONOMIC CAPITAL STAND ALONE, COMPONENTS ) SOME IMPLEMENTATION ISSUES: - FOR A STAND ALONE ANALYSIS, THE AMOUNT OF ECONOMIC CAPITAL ASSIGNED TO A BUSINESS WITHIN THE FIRM WILL DEPEND ON THE SIZE AND DIVERSIFICATION OF THE BUSINESS. - STAND ALONE ANALYSIS VS. ALLOCATION OF PORTFOLIO BENEFITS. - PRODUCT ANALYSIS VS. CUSTOMER ANALYSIS - RETURN ON ECONOMIC CAPITAL VS. RETURN ON INVESTED CAPITAL INTEGRATED RISK POLICIES

Evan Picoult, Citigroup January, 2004 Page 13 Evan Picoult, Citigroup September, 2004 PAGE 13 THIRD ASPECT: FUNCTIONAL INTEGRATION THIRD ASPECT: WHAT RISK FUNCTIONS CAN AND SHOULD BE INTEGRATED? HOW SHOULD THE RISK ORGANIZATION BE STRUCTURED? - Centralized vs. Decentralized Risk Management - What functions and responsibilities should be kept centrally at the holding company level, what independent functions should be at the business level? WHAT RISK FUNCTIONS CAN AND SHOULD BE INTEGRATED? - Risk Policy? - Risk Measurement and Analytics? - Risk Management across market and credit risk?

Evan Picoult, Citigroup January, 2004 Page 14 Evan Picoult, Citigroup September, 2004 PAGE 14 RISK MANAGEMENT STRUCTURE FOR CITIGROUP GENERAL STRUCTURE SENIOR CITIGROUP RISK OFFICER CITIGROUP RISK ARCHITECTURE CEO OF CITIGROUP Global Corporate and Investment Bank Global Consumer Group Global Investment Management BUSINESS LEVEL CITIGROUP LEVEL Independent Business Risk Mgmt Independent Business Risk Mgmt Independent Business Risk Mgmt PRESIDENT OF CITIGROUP

Evan Picoult, Citigroup January, 2004 Page 15 Evan Picoult, Citigroup September, 2004 PAGE 15 Risk Management Functions Approve and monitor risk limits. Approve limit exceptions. Approve new forms of transactions Function as eyes and ears of senior management with regard to risk taking of business. Risk Architecture Functions Build and maintain risk infrastructure of firm: Develop methods to measure and analyze risks, including economic capital. Develop comprehensive risk reports. Develop risk systems, working with risk IT. Develop risk policies.

Evan Picoult, Citigroup January, 2004 Page 16 Evan Picoult, Citigroup September, 2004 PAGE 16 RISK METHODS AND ANALYTICS MODEL VALIDATION UNIT MARKET RISK ANALYTICS UNIT COUNTERPARTY RISK ANALYTICS UNIT CREDIT PORTFOLIO RISK ANALYTICS UNIT CREDIT DEFAULT RISK ANALYTICS UNIT OPERATIONAL RISK ANALYTICS UNIT RISK METHODS AND ANALYTICS FUNCTIONS

Evan Picoult, Citigroup January, 2004 Page 17 Evan Picoult, Citigroup September, 2004 PAGE 17 SUMMARY DESCRIBED THREE RELATED ASPECTS OF INTEGRATED RISK MANAGEMENT:  Integrated risk management as having consistent policies and methods of measurement of risk through-out the firm.  Integrated risk management as the integration of risk measurements, particularly economic capital, as a component, into all aspects of business decisions.  Integrated risk management as the process of centralizing certain key risk architecture functions, to ensure consistency in measurement and reporting of risk.