2. Enterprise Exposure Management What Does This Mean for Internal Controls Kevin R. Rose October 2004 Return to Risk Limited Website at www.RiskLimited.com www.RiskLimited.com

3. Energy Industry Under Siege 2004 Industry Environment –Federal/State governments (Sarbanes Oxley and FAS 133) –Continued scrutiny from investors –Wall Street credit rating agencies –Increased financial transparency –Enterprise - wide risk across multiple commodities and operations

4. Enterprise Exposure Management Ability to construct an overall risk/credit portfolio framework that enables a company to achieve profit targets by taking controllable risks Fully addressing EEM requires decision-makers to have corporate – wide access to mission critical data in real time Redefining organizations to be able to identify, measure, and manage new risks across the entire enterprise

5. Challenges to the Energy Industry The challenge posed by today’s environment, is that energy organizations have multiple energy operations, business processes, and management systems, from front to back office, for multiple commodities. As a result, when companies go about the task of managing, monitoring, reporting and controlling exposure, they rapidly begin to see that there are major business process and technology issues that must be addressed.

6. Key Issues Surrounding EEM: Exposure Management Strategy Exposure Management Control Process Exposure Management Infrastructure Exposure Management Systems

7. First Steps Develop a Plan –Business strategies and capabilities –Strategies to capitalize on new market opportunities –Marketing and supply strategies –Competencies and infrastructure

8. Development of an EEM Plan: Identifies current situation within business processes and technology assessment Identifies any gaps within the current business processes and technology practices Identifies business processes and technology opportunities

9. Questions: Does Our Company have… Clear definition of its objectives? Specified goals that are required to meet the objectives? An adequate assessment of its market readiness: business processes, operations, resources, and technology/systems?

10. Precise understanding of its motivation? Proper internal and external business models? Logical expectations of the results? Questions: Does Our Company have…

11. Business Strategies and Capabilities Define Your Objectives Set Goals to Meet the Objectives Business Processes, Organization, and Infrastructure Assessments Risk Profile / Strategy

12. Guiding Principles for EEM Program Governance Structure Process/Procedures Trading Authority Levels Optimization - Exposure Limits Credit Risk Controls Monitor and Manage Portfolio

13. An Effective EEM Plan: Addresses business, operational, and market risks and implements business processes, controls and monitoring capabilities Develops a portfolio management of company risk providing consistent measuring, monitoring, and reporting (information/data management) Addresses authority controls/limits, exposure assessment, and decision making processes

14. An Effective EEM Plan: Identifies core skills and competencies requirements front to back office Organizes to maximize flexibility and responsiveness of the company Enhances enterprise - wide business process and technology and systems integration