1. Risk-Based Audit Plan Development
Greg Testa
Director, Microsoft Internal Audit

2. Microsoft Internal Audit Org
Agenda
Introduction
Microsoft Internal Audit Org
Risk Based Audit Planning Overview (Luncheon)
In Depth Areas (Technical Session)
Enterprise Risk Management
Risk Theme Development
Project Identification
Capacity and Load
Annual Cycle
Questions

3. Introduction
Microsoft – 7 Years (Internal Audit, SMSG Finance, IT Finance)
PricewaterhouseCoopers – 6 Years (SAP, PeopleSoft)
Honeywell – 3 Years (SAP Security & Controls Implementation)
AIG – 2 Years (Database Design & Implementation)

4. Interdisciplinary Approach
Microsoft Internal Audit Group
Experience
Functional Areas
Broad exposure to the entire company
End-to-end business process knowledge
Strong operational and compliance skillset
Proven leadership development B
Investigation
Risk Management
Advisory
Assurance
Interdisciplinary Approach
What We Stand For
Core Competencies
Vision
Drive governance and compliance
Ensure MS is viewed as a compliant company
Mission
Ensure Microsoft addresses risks
Bring disciplined approach to mitigate risk
Enhance company operations
Process Excellence
Analytics and Problem
Solving
Policy and Compliance
Confidence and Influence
An Eye Toward the Future

5. Microsoft Internal Audit Group
Peter Klein
CFO – Microsoft
Melvin Flowers
CVP –
Internal Audit
Michael Ford
Audit Director
Lyn Cameron
FIU Director
Terri Schwan
Bob Tenczar
Office of ERM Director
Rich Nardi
Greg Testa
Practice Director
Marilee Byers
Audit Committee
Board of Directors
Office of Legal Compliance
Internal Audit Roles
Program Managers
Project Managers
Audit Leads
Audit Staff
Internal Audit Offices
Redmond
Singapore
Dublin
Business Groups, OEM
Financial Integrity Unit
FIU Investigations Team
SMSG (Field Sales)
Enterprise Risk Management
Virtual Team
MSIT, IEB, Skype, GFS, MSCIS
Audit Practice Management
Professional Practice Team
Corporate, Operations

6. Internal Audit Group - Alignment
Program Management
Project Management
Business Groups, OEM
Michael Ford
Audit Director
Meera Venkatesh
R&D, MBD,
STB, OEM
Bob Kaler
OSD, WWLD,
WPD, MS Retail
Lynn Chang
SMSG
Terri Schwan
Audit Director
Ankush Grover
SMSG Field, Segments, M&O, Services
David Low
TBH – Asia
Mike Gaffney - EMEA
MSIT, IEB, Skype, GFS, MSCIS
Rich Nardi
Audit Director
DC Chang
IT Gov, Bus Systems & IT
Processes, BCM, IEB, MSCIS
Louis Couwenberg
Infra & IT Processes,
Security, GFS, Skype
Gerard Morisseau
Corporate, Operations
Marilee Byers
Audit Director
Steven Bean
Corp Finance,
HR, LCA
Devon Pearce
WWLP, Ops, WPG, AC
Erica Campos
Vendor audit
CJ Long
TECA
Dawn Liburd

7. Risk-Based Audit Planning

8. Risk?
What is RISK? Risk is defined as a particular event, or circumstance that, if it were to occur, would impact achievement of a business objective.

9. Risk Assessment Components
Prior Audit Results
SOX Scope
Investigations
10K/ERM
Discussions with Management
Internal Data
Key Changes to the Business/New Initiatives
External Risk Environment

10. Planning Process

11. Planning Process Overview
On-
going
Program Mgrs
Informed by:
ERM board & 10K risks
On-going understanding of the business
Recent fraud activity
Risk assessment
Risk analysis & project identification
Prioritization & resource allocation
Plan validation & presentation
Program Mgrs,
Directors
March
Validate against ERM board risks, analyze gaps
Calibrate assessment
Identify high risks to be addressed by audit plan
Conduct management team risk discussions
April
Directors
Prioritize activities
Allocate resources
May
Pgm Mgrs,
Directors,
CAE
Discuss with management
Validate with senior executives
Present to AC for approval

12. Continuous Audit Planning Cycle
More efficient annual planning cycle
Synchronized with ERM
Responsive to changing risk environment
6-month project planning cycle allows for more flexibility
18-month view
Risk Assessment
Identify Projects
Finalize Audit Plan
AC Plan Review
AC Plan Approval
Execute Audit Plan
Risk Assess-ment
Mid-year Update
On-going
April
May
June
Jul-Dec
December
January -
September
Guidelines (Delete in your customized version) - Use Slide for Presentations to Internal Microsoft Stakeholders, Internal recruiting events and External Presentations.
The following diagram represents a summary of the key Phases of the annual Internal Audit Planning Cycle.
Summary
Audit Projects are identified through the Annual Internal Audit planning Cycle. Auditable units are assessed ranked based on risk scores (as discussed above using data collected through the ERM processes). The final annual audit project plan is approved by the Audit Committee in September. There are mid year updates to the annual risk assessments of auditable units to make changes and adjustments based on new information. The audit projects identified through this Annual Planning Cycle are executed during the internal audit year (September through August).
Strategic Planning & Risk Assessment (April)
The planning methodology is refreshed each cycle to ensure compliance with IIA Standards
IA management team sets key department strategies, priorities & initiatives aligned to Company and finance priorities
IA managers define inventory of auditable units (AUs) for their organization specialization
IA and ERM share the same risk hierarchy and IA managers review each Risk, determine which AU’s hold that risk and score
ERM Data is leveraged for the initial risk scorings of auditable units
Stakeholder meetings are scheduled to validate the preliminary risk scores
A Calibration process occurs to normalize risk assessments across specializations through Risk Q&A roundtables
Project identification (May-Jun)
Risk scores are reviewed by risk category, type, business area, geography, etc. to determine key risks to be addressed by the Audit Plan
Potential audit activities are identified which address key risks
Project budgets are determined
Resource allocations are made based on risk and breath coverage
Calibration of audit plan with D&T and SOX PMO for coordination & reliance opportunities, and with business stakeholders
Plan Finalization (July-Aug)
Review, validation, prioritization and load-balancing of potential project plan against quarterly resource capacity
Finalize planned resource allocation based on project plan
Review plan w/ key stakeholders including CEO, Presidents, CFO for validation
Presentation To AC (Sept)
Present audit plan to AC for approval and adoption
Audit Plan Execution (Internal Audit Year - September through August)
Execute the audit plan
Ongoing risk assessments throughout the year to adjust plan and/or resource allocation based on changes in risk, priorities, or resources, using annual audit plan as baseline
Quarterly updates to AC on performance and changes to approved audit plan

13. New Business = New Risks
Supply Chain Disruption
Scrap Disposal Management
HW Quality Assurance
Factory Labour Conditions
Patents
Manufacturing

15. Key Takeaways Align IA Org to Business
ERM Critical to Navigating Risks
Risk Factors (Impact, Likelihood, and Prior Results)
Measure Risk Variance
Ensure Adequate Capacity
Revisit and Reassess Risk Annually

16. Questions?

17. Enterprise Risk Management

18. ERM at Microsoft – Virtual Structure
Board of Directors: Audit & Finance Committee(s)
Enterprise Risk Office
Executive Sponsor: CVP of Internal Audit
Program Office: Sr. Director of ERM
Strategic
Legal/Compliance
Financial/Reporting
Operational
SLT: CEO
Sponsor: GM- Corporate Strategy
Leader: Corp Strategy Sr. Manager
SLT: SVP Legal Compliance
Sponsor: VP Deputy General Counsel
Leader: Compliance Director
Pillar Support: Compliance Program Attorney
SLT: SVP & CFO
Sponsor: Corp VP of Finance and Administration
Leader: Director
SLT: COO
Sponsor: CVP & CIO
Leader(s): Sr. Principal, Sr. Solutions Manager
Microsoft Confidential - Internal Use Only

19. Risk Categories Improve
Areas of high risk exposure with a low level of control must be key priority for improvements in management and control activities.
Monitor
Areas of high risk exposure where controls are deemed adequate should be monitored to provide ongoing assurance of control effectiveness.
Accept
Areas of low risk exposure that also have a lower level of control may be consciously accepted by the organization.
Optimize
Areas of low risk exposure with a high level of control may generate opportunities to optimize the management and control activities.
Improve
Monitor
High
(Impact x Likelihood)
Risk Level
Accept
Optimize
Low
Low
High
Management & Control Activity Level
Microsoft Confidential - Internal Use Only 19 19

20. Risk Rating Criteria: Impact
NOTE: A risk should be evaluated on the most relevant impact; it does not need to address multiple columns. Also, evaluate the inherent impact rating of a particular risk event or circumstance assuming that the controls or management activities do NOT exist or they fail in either design or operation and fail to mitigate the impact of the risk occurring.
Impact Rating
Description of Impact
Score
Organizational and operational scope
Reputational impact to stakeholders
(i.e., customers, shareholders, employees, key partners, subscribers, 3rd Parties)
Legal/ Compliance/ Environmental
Operating Income (OI)
Impact on Value
Critical
Enterprise-wide: Inability to continue business operations Globally
Permanent loss of stakeholder confidence resulting in legal action, interruption in Enterprise operations globally, and / or defection to competition
Prohibited from conducting business in certain product lines, markets, or geographies
OI >$2.5B
Significant reduction in market capitalization, significant draw on liquidity reserve 5
Severe
2 or more divisions: Significant, ongoing interruptions to business operations within 2 or more divisions
Sustained losses in 2 or more stakeholder groups
Severe restrictions on conducting business in certain product lines, markets, or geographies
OI >$1B
Substantial reduction in market capitalization, substantial draw on liquidity reserve 4
Serious
1 or more division(s): Moderate impact within 1 or more division(s)
Moderate loss in 1 or more stakeholder groups
Significant fines or limitations on conducting business in certain product lines, markets, or geographies
OI >$500M
Limited reduction in market capitalization, limited draw on operating cash flow 3
Moderate
1 division:
Limited impact within 1 division
Limited to minor/short-term loss in 1 stakeholder group
Limited actions against the company with limited effects on operations
OI >$250M
Missed forecast(s) and/or budget(s), limited draw on operating cash flow 2
Mild
Minimal Impact
OI >$100M 1
Use Impact Table for Inherent Impact & Residual Impact ratings
Use Likelihood Table for Inherent Likelihood & Residual Likelihood ratings
Revised for FY13:
Stronger wording in the Legal/Compliance/Environmental column
Operating Income has an OI prefix in prep for adding the Extended Business Unit table later in FY 13
Removed the EPS reference in the Impact on Value
Removed the Duration Column
Moved the Scoring column to the far right.
Microsoft Confidential - Internal Use Only 20

21. Risk Rating Criteria: Likelihood, Control Effectiveness (CE)
NOTE: Evaluate the inherent likelihood rating of a particular risk event or circumstance in absence of the current management activities or controls that exist to mitigate the likelihood of the risk occurring.
Likelihood Rating
Consideration
Description of Likelihood
Score
Probability
Frequency
Expected
The risk event or circumstance is relatively certain to occur, or has occurred within the past year
90-100%
Almost Yearly 5
Highly Likely
The risk event or circumstance is highly likely to occur
70-90%
Every 2 to 3 Years 4
Likely
The risk event or circumstance is more likely to occur than not
50-70%
Every 4 to 6 Years 3
Not Likely
The risk event or circumstance occurring is possible
10-50%
Every 7 to 9 Years 2
Slight
The risk event or circumstance is only remotely probable
< 10%
Every 10 Years and Beyond 1
NOTE: Evaluate the Control Effectiveness / Management Activities Rating for a particular risk event or circumstance based on existing management activities and/or controls that exist both within defined business processes as well as at the entity level and not on future or planned control activities.
CE Rating
Improvement Opportunities
Control Effectiveness (CE)/ Management Activities
Additional Scoring Criteria
Score
Very High
None Identified
Properly designed and operating as intended.
There are no outstanding High or Medium risk audit issues, no material weaknesses or significant deficiencies as defined by SOX or external auditors. 5
High
Limited
Properly designed and operating, no significant deficiencies.
There are no outstanding High risk audit issues, no material weaknesses or significant deficiencies as defined by SOX or external auditors. 4
Moderate
In place, some deficiencies.
There are no outstanding High risk audit issues. There may be some significant deficiencies as defined by SOX or the external auditors. 3
Low
Significant
Limited, high level of risk remains, significant deficiencies.
There are outstanding High and / or Medium risk Audit issues or significant deficiencies as defined by SOX or external auditors. 2
Very Low
Critical
Non-existent or has major deficiencies and do not operate as intended.
There are outstanding High risk audit issues or material weakness(es) as defined by SOX or external auditors. 1
Revised for FY13:
Moved the Scoring Column to the far right hand side
Both Likelihood and Control Effectiveness are now on one page. Printing this in duplex mode results in a “One Pager”.
Microsoft Confidential - Internal Use Only 21

22. Representative Sample
INHERENT Risk Profile
Representative Sample
Expected
Highly Likely
Likely
Not Likely
Slight 5 4 3 2 1
Minimal
Low
Moderate
High
Critical 7 6 9 8 10
Likelihood of Occurrence
Severity of Impact #
Tier 1 Risks - Inherent
Risk 1
Risk 2
Risk 3
Risk 4
Risk 5
Risk 6
Risk 7
Risk 8
Risk 9
Risk 10
Key Message
One primary output of the sessions will be a set of top (or “Tier One”) risks based on impact and likelihood scales, which allows us to look at the relative priority of the risks for Operations.
Speaking Points
This is a representative sample output from the combined results of all risk assessment working sessions for ERM.
Look for material concerns in how risks have been prioritized and drive towards a relative consensus as to the “Top Tier” risks for Operations pillar.
Call out the definition of inherent risk again
Consider the likelihood and the impact
A visual depiction of the risks
What we are working toward with the risk assessment is a prioritized
list of the key business risks to the organization. The risk criteria will cover the impact on the monetary, reputational, regulatory, and market share aspects of the business.
This risk map provides a snapshot of the key business risks based on the impact and
likelihood of occurrence and appropriate assessment activities,
including:
• Surveys across relevant businesses or functions
• Interviews with key risk stakeholders
• Workshop with key executive risk stakeholders to validate and
prioritize the top company risks

23. Representative Sample
RESIDUAL Risk Profile
Representative Sample #
Tier 1 Risks - Residual
Risk 1
Risk 2
Risk 3
Risk 4
Risk 5
Risk 6
Risk 7
Risk 8
Risk 9
Risk 10
High 1 2 3 4 5 6
Improve
Monitor 7 8 9 10
Accept
Optimize
Low
KEY MESSAGE
The residual risk profile is a visual aid for management to plot the risks taking into consideration the control level and management activities that are currently in place. Each quadrant will allow management to make a decision on how to best manage the risk and if there is a need to improve the management activities.
SPEAKING POINTS
The residual risk profile takes into consideration existing management activities and controls that are already in place to manage the risk exposure in certain areas. The diagram helps determine where the level of risk an controls for any given risk. The residual risk profile will help management determine where there is a need to plan new initiatives to further manage risk.
A high risk exposure and low control level will prompt management to implement new processes that will help them manage risk.
A low risk exposure and low control level shows management that the risk and control level are set at an acceptable level within the business unit’s risk appetite.
A low risk and high control level is a sin to management that the risk is not being managed effectively and there might be the opportunity to reduce management’s efforts regarding the risk.
A high risk exposure and high control level signifies that risks are properly being managed, however it is important to monitor the activities as the risk exposure is high.
You can also note that where the axis are drawn between the four quadrants relates to managements “risk appetite”
Low
High

24. 10K Risk Mapped to ERM Board Risks
ERM Risk Category
10K Risk
ERM Board-level Risk
FY10 ERM Status 1
Strategic
Challenges to our business model may reduce our revenues and operating margins
Business model disruptions from competitive landscape
Monitor
Business model pricing erosion
Rise of alternative platforms 2
We face intense competition 3
We make significant investments in new products and services that may not be profitable
Strategic investments 4
Strategic (Operational)
Acquisitions and joint ventures may have an adverse effect on our business
Acquisition integration
Yahoo! Partnership
Improve 5
Legal (Strategic, Financial, Operational)
We may not be able to adequately protect our intellectual property rights
Software piracy 6
Legal
We are subject to government litigation and regulatory activity that affects how we design and market our products
Regulatory scrutiny and antitrust focus 7
Improper disclosure of personal data could result in liability and harm our reputation
Security and privacy of critical data 8
Third parties may claim we infringe their intellectual property rights
Not mapped 9
We operate a global business that exposes us to additional risks
Regulatory non-compliance
Anti-corruption 10
We have claims and lawsuits against us that may result in adverse outcomes 11
Operational
We may not be able to protect our source code from copying if there is an unauthorized disclosure of source code 12
Security vulnerabilities in our products could lead to reduced revenues or to liability claims
Product quality and security - software & services 13
Our vertically-integrated hardware and software products may experience quality or supply problems
Hardware quality and compliance 14
Catastrophic events or geo-political conditions may disrupt our business
Business continuity management 15
We may experience outages and disruptions of our online services if we fail to maintain an adequate operations infrastructure
Inadequate operations infrastructure 16
Our business depends on our ability to attract and retain talented employees
Global employee recruitment & retention
Succession planning 17
Delays in product development schedules may adversely affect our revenues
Product/service launch and sustainability 18
Financial
Adverse economic conditions may harm our business
Financial market volatility
Credit and collections 19
We may have additional tax liabilities
Financial Reporting
Taxation of foreign earnings 20
If our goodwill or amortizable intangible assets become impaired we may be required to record a significant charge to earnings

25. Risk Theme Development (Top Down Approach)

26. Development of Business Risk Themes

27. Prioritization of Risk Themes

28. Themes Themes # of Hours % of Total Sales and Channel Management
19,072
29%
Cloud Implementation
9,088
14%
Compliance & Governance
7,616
12%
Spend Management
7,552
Statutory and Local Requirements
7,296
11%
Product & Service Launch Readiness
4,736 7%
Privacy & Security of Critical Data and Intellectual Property
3,584 6%
Supply Chain
3,328 5%
IT/Business Alignment and System Implementations
1,920 3%
Internal process changes due to shift in business model
512 1%
Grand Total
64,704
100%

29. Project Assignment

30. Project Assignments Align by Risk Theme Align by Risk Pilar Theme
# of Hours
% of Total
Sales and Channel Management
19,072
29%
Cloud Implementation
9,088
14%
Anti-Malware services follow-up
640 1%
Azure Services consumption
Azure Services ISO
1,152 2%
Cloud Services Privacy
Commerce platform & business operations
Commercial Online Services order to cash
768
CRM Online ISO
Online Services Rapid Assessments
Online Services platform automation
SKU, pricing & redemption token management
Windows Phone Marketplace Apollo readiness
Compliance & Governance
7,616
12%
Spend Management
7,552
Statutory and Local Requirements
7,296
11%
Product & Service Launch Readiness
4,736 7%
Privacy & Security of Critical Data and Intellectual Property
3,584 6%
Supply Chain
3,328 5%
IT/Business Alignment and System Implementations
1,920 3%
Internal process changes due to shift in business model
512
Grand Total
64,704
100%
Risk Pilar
Total Hours
Financial
18,255
Legal/compliance
13,750
Operational
32,699
Acquisition integration
230
Business continuity management
536
Anti-Malware services follow-up
128
Azure Services ISO
192
Commercial CSS
216
Data management
616
Facility access and security
856
Global employee recruitment and retention
764
Hardware quality and compliance
768
Inadequate operations infrastructure
5,281
Product quality and security (software & services)
2,656
384
Commercial Online Services order to cash
CRM Online ISO
Nokia SSAE16 readiness
640
Online Services Rapid Assessments
Online Services platform automation
480
Product/service launch and sustainability
1,493
Security and privacy of critical data
8,389
Software piracy
1,015
Spend management
8,350
Strategy and IT resource alignment
1,744
Grand Total
64,704

31. Project Level Risk
Risks are aligned to COSO framework (area/type/category)
Associate risks with auditable unit (AU)
Significance and likelihood scores are absolute
Residual score is calculated based a discounting using the audit experience/knowledge score
Reassess after each project

32. All Up Comparison of Risks YoY (‘Gut-Check’)
FY11 Actual
FY12 Actual
FY13 Plan
FY12 Actual vs FY13
Hours %
% Pts
Financial
26,500
36%
22,600
30%
23,700
28%
1,100
-2 Pts
Compliance
17,300
24%
15,400
20%
17,900
21%
2,500
1 Pts
Operational
29,400
40%
37,300
49%
42,400
51%
5,100
Strategic - 0%
0 Pts
Grand Total
73,200
100%
75,300
84,000
8,700
12%

33. Capacity

34. Resource Capacity FY13 FTE Program Project Invest ERM Internal TotalVP 1
720
180 90
1,800 -
1,620
PPM director
PPM manager
Admins 2
3,600
IA director 4
2,880
2,160
7,200
IA program mgr 8
9,360
1,440
14,400
IA proj/ppl mgr 6
5,940
2,700
10,800
IA proj mgr
IA lead 15
1,350
22,950
27,000
IA staff 18
29,160
3,240
32,400 RA
4,680
2,520
TECA manager
540
630
450
TECA staff
270
FIU director
FIU ppl mgr 3
810
5,400
FIU staff 10
900
15,300
18,000
FIU PM 77
19,620
70,650
19,530
1,710
27,090
138,600
FIU Vendors
5,100
IA Vendors
10,405
11,305
SMSG Vendors
2,900
ERM Vendor
300
PPM Vendor
1,250
Vendor total
13,305
20,855
Total All
20,520
83,955
24,630
2,010
28,340
159,455

35. Load Balancing Row Labels Hours Min Threshold Max Threshold a-Jul
2,624
4,543
5,652
b-Aug
2,752
c-Sep
5,248
d-Oct
5,696
e-Nov
7,595
f-Dec
4,715
g-Jan
6,187
h-Feb
6,592
i-Mar
6,720
j-Apr
6,848
k-May
5,184
l-Jun
3,776
Grand Total
63,937
54,516
67,824

36. Continuous Audit Planning Cycle
More efficient annual planning cycle
Synchronized with ERM
Responsive to changing risk environment
6-month project planning cycle allows for more flexibility
18-month view
Risk Assessment
Identify Projects
Finalize Audit Plan
AC Plan Review
AC Plan Approval
Execute Audit Plan
Risk Assess-ment
Mid-year Update
On-going
April
May
June
Jul-Dec
December
January -
September
Guidelines (Delete in your customized version) - Use Slide for Presentations to Internal Microsoft Stakeholders, Internal recruiting events and External Presentations.
The following diagram represents a summary of the key Phases of the annual Internal Audit Planning Cycle.
Summary
Audit Projects are identified through the Annual Internal Audit planning Cycle. Auditable units are assessed ranked based on risk scores (as discussed above using data collected through the ERM processes). The final annual audit project plan is approved by the Audit Committee in September. There are mid year updates to the annual risk assessments of auditable units to make changes and adjustments based on new information. The audit projects identified through this Annual Planning Cycle are executed during the internal audit year (September through August).
Strategic Planning & Risk Assessment (April)
The planning methodology is refreshed each cycle to ensure compliance with IIA Standards
IA management team sets key department strategies, priorities & initiatives aligned to Company and finance priorities
IA managers define inventory of auditable units (AUs) for their organization specialization
IA and ERM share the same risk hierarchy and IA managers review each Risk, determine which AU’s hold that risk and score
ERM Data is leveraged for the initial risk scorings of auditable units
Stakeholder meetings are scheduled to validate the preliminary risk scores
A Calibration process occurs to normalize risk assessments across specializations through Risk Q&A roundtables
Project identification (May-Jun)
Risk scores are reviewed by risk category, type, business area, geography, etc. to determine key risks to be addressed by the Audit Plan
Potential audit activities are identified which address key risks
Project budgets are determined
Resource allocations are made based on risk and breath coverage
Calibration of audit plan with D&T and SOX PMO for coordination & reliance opportunities, and with business stakeholders
Plan Finalization (July-Aug)
Review, validation, prioritization and load-balancing of potential project plan against quarterly resource capacity
Finalize planned resource allocation based on project plan
Review plan w/ key stakeholders including CEO, Presidents, CFO for validation
Presentation To AC (Sept)
Present audit plan to AC for approval and adoption
Audit Plan Execution (Internal Audit Year - September through August)
Execute the audit plan
Ongoing risk assessments throughout the year to adjust plan and/or resource allocation based on changes in risk, priorities, or resources, using annual audit plan as baseline
Quarterly updates to AC on performance and changes to approved audit plan

37. Key Takeaways Align IA Org to Business
ERM Critical to Navigating Risks
Risk Factors (Impact, Likelihood, and Prior Results)
Measure Risk Variance
Ensure Adequate Capacity
Revisit and Reassess Risk Annually

38. Questions?

39. Thanks!

40. 3/31/ :28 PM
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.