Minimizing Operational Risk & Optimizing Institutional Performance

1. Minimizing Operational Risk& Optimizing Institutional Performance

2. Interest in Enterprise-wide Risk Assessments is being driven by Financial & Economic Realities • Global spotlight on risk and corporate governance • Sarbanes-Oxley Act of 2003 & COSO ERM Framework • Increased involvement from the Audit Committee of the Board of Directors with regard to risk management • NYSE listing requirements • Capital adequacy requirements and the need for efficient capital allocation • Basel Capital Accord • Need for alternative risk solutions due to the current insurance environment • Maximizing shareholder value • Sustaining a competitive advantage

3. Basel Committee’s Definition of Operational Risk “The risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events” Operational risk can result in increased write-offs, additional expenses or loss of revenue

4. Operational Risk Management & Shareholder Value Examples of how operational risk management drives shareholder value? • Improving operating efficiency and thus operating margins, by identifying and prioritising process improvement and de-risking opportunities • Improving management effectiveness by enhancing the governance structure • Enabling more effective capital usage by introducing processes to assess exposure & integrate this with an economic capital model • Protecting assets by reducing losses through improved risk control environment and financing programme • Enhanced organizational capabilities & subsequent competitive positioning through continuous improvement

5. How to Reduce Operational Risks? Understand Risks • Benchmarking • Scenario Analysis • Key Risk Indicator’s (KRI) De-Risking Operational Procedures • Define, Measure, Analyze, Improve, & Control Risk Finance & Transfer • Mapping to Insurance Products • Developing New Products • Financing Retained Losses • Transferring Risk to the Insurance & Capital Markets

6. Op Risk/Lean Six Sigma Linkage

7. Six Sigma Defined • A data driven approach to understanding and eliminating process variation and defects • Three, universal, methodologies for process management • A performance target of 3.4 defects per million opportunities

8. Risk Management: How Can Six Sigma Help? • Six Sigma provides three powerful methodologies for: • Designing robust processes • Fixing broken processes • Controlling processes on an ongoing basis (i.e., keeping them from decaying and producing errors)

9. Risk Management: How Can Six Sigma Help? • Designing robust processes: • A structured methodology, DFSS (Design for Six Sigma), assures that: • New processes have high capability (satisfy customers and produce low defects) right from the start • New processes are designed to minimize the risk of failure

10. Risk Management: How Can Six Sigma Help? • Fixing broken processes: • A structured methodology, DMAIC (Define, Measure, Analyse, Improve, Control): • Uses powerful statistical (and non-statistical) tools to locate and eliminate the root causes of otherwise intractable problems • Focuses on removal and prevention of defects • Reduces process variability

11. Risk Management: How Can Six Sigma Help? • Controlling processes, so that their behavior is predictable (within limits). Six Sigma provides: • Special tools and techniques including a framework: • For measuring and judging process variation • For detecting special causes • To providing early warning of process changes • The ability to calculate Process Sigma, an index of process performance

12. Companies Pursue Six Sigma to … • Accommodate customer demands • Drive out waste, cycle time and variability • Direct improvement resource to the most significant opportunities • Establish a standard improvement methodology • Develop leaders • Reduce risk • Grow the top-line • Implement business strategy • Increase product reliability • Initiate cultural change • Accelerate improvement

13. 6 Requirement 5 4 3 2 1 Sigma is a Measure of Process Capability Process performance Performance boundary Six Sigma is a level of process capability such that less than 3.4 “defects” are produced for every million opportunities. Sigma 1 2 3 4 5 6 DPMO 680,000 298,000 67,000 6,000 400 3.4

14. Estimating the Benefits of Six Sigma

15. Process Sigma Advantages The Sigma Scale provides a common metric for comparisonthat includes the customer requirement and the degree of variation. Addresses multiple occurrences.

16. The Antecedents of Six Sigma • Six Sigma is the latest and most powerful in a long line of process management and process improvement methods, e.g.: • Guilds • The Scientific Method • Quality Circles • TQM • Six Sigma has built on these ideas and added powerful tools • It is specially useful for transactional processes

17. Sound Practices inOperational Risk Management Principle 1 The board of directors should be aware of the major aspects of the bank’s operational risks as a distinct risk category that should be managed, and it should approve and periodically review the bank’s operational risk management framework. The framework should provide a firm-wide definition of operational risk and lay down the principles of how operational risk is to be identified, assessed, monitored, and controlled/mitigated. Source: Sound Practices for the Management & Supervision of Operational Risk (Basel Committee – July 2002)

18. Sound Practices inOperational Risk Management Principle 2 The board of directors should ensure that the bank’s operational risk management framework is subject to effective and comprehensive internal audit by operationally independent, appropriately trained and competent staff. The internal audit function should not be directly responsible for operational risk management. Source: Sound Practices for the Management & Supervision of Operational Risk (Basel Committee – July 2002)

19. Sound Practices inOperational Risk Management Principle 3 Senior management should have responsibility for implementing the operational risk management framework approved by the board of directors. The framework should be implemented throughout the whole banking organization, and all levels of staff should understand their responsibilities with respect to operational risk management.Senior management should also have responsibility for developing policies, processes and procedures for managing operational risk in all of the bank’s products, activities, processes and systems. Source: Sound Practices for the Management & Supervision of Operational Risk (Basel Committee – July 2002)

20. Sound Practices inOperational Risk Management Principle 4 Banks should identify and assess the operational risk inherent in all material products, activities, processes and systems. Banks should also ensure that before new products, activities, processes and systems are introduced or undertaken, the operational risk inherent in them is subject to adequate assessment procedures. Source: Sound Practices for the Management & Supervision of Operational Risk (Basel Committee – July 2002)

21. Sound Practices inOperational Risk Management Principle 5 Banks should implement a process to regularly monitor operational risk profiles and material exposure to losses. There should be regular reporting of pertinent information to senior management and the board of directors that supports the proactive management of operational risk. Source: Sound Practices for the Management & Supervision of Operational Risk (Basel Committee – July 2002)

22. Establish Controls Operational Risk Assessment & Analysis Key Risk Indicators (Dashboards) Project Selection Measurement System Validation SIPOC New Process Capability Capability Baseline New Process Pilot IMPROVE Measurement System Validation New Policies & Procedures Process Risk Mapping Process Specifications Confirm Impact Identify Key Risk Drivers Correlation Analysis The 6s Process

23. Mapping 6s to Operational Risk Framework Operational Risk Management Framework Level 2 & Activity Groups Level 1 Business Lines Operational Risk Definition & Analysis • Natural Linkage to Operational Risk Management Framework • Operates at Level 1, Level 2 and Activity Group Level (All Business Lines) • Linked to All Products, Activities, Processes, and Systems • DMAIC Employed to Improve Existing Policies, Procedures, and Processes….DFSS Leveraged to Design New Ones

24. Six Sigma Focus • Identify Risks • Describe Outcome of Failure • Determine Cause & Effect • Evaluate Current Controls Expected Loss Factors Operational Risk Management Using 6s ORIMA Drills-Down From Top Level Business Line to the Processes Within Each Activity Group

25. Operational Risk Management Using 6s The Discipline and Its Approach, Combined With a Rich Set of Analysis Tools, Makes Six Sigma a Perfect Fit for Operational Risk Management

26. A Way Forward Outside In or Inside Out • Outside In: • Review statistics for comparable businesses and identify risk by type • Identify the processes that lie behind the risk (hierarchy) • Perform risk analysis on the key processes (FMEA) • Identify key measures inside and outside of the process • Collect data • Monitor, using dashboards and control charts. Search for signals • Take action as required (DMAIC, Lean, DFSS or other)

27. A Way Forward • Inside Out: • Inventory all processes • Identify those presenting the greatest risk • Identify the sub-processes that lie behind the risk (process hierarchy) • Perform risk analysis on the key processes and sub-processes (FMEA) • Identify key measures inside and outside of the process • Collect data • Monitor, using dashboards and control charts. Search for signals • Take action as required (DMAIC, Lean, DFSS or other)

28. Questions? Further Questions / Information: Lori Marin Telephone: 312-381-4420 Email: lori_marin@ars.aon.com