OP Embedding Discussion Understanding the Scope of SOPUS Effort

1. OP Embedding DiscussionUnderstanding the Scope of SOPUS Effort Embedding Team Houston, Texas 12/06/05

2. Discussion Outline • Level of Effort – Lubes IT C.111/12 • Level of Effort – SOPUS • Training Audience – Lubes IT C.12 • Training Audience SUPUS • Estimators used – Process Comparison • Observations on your Resource Estimator Tool • Our Key Issues – Need Your Advice on Best Approach • Appendix: • - Deliverable model used in Lubes IT

3. C12 Register C11 Register • 26 Original Processes • 19 Current SOX Processes • 66 Controls • 14 Original Applications • 9 Current SOX Applications • 39 Controls Narrative 1 Flow charts 2 Controls 3 Scripts 4 X Technology Used • Excel - SPUD • Visio - LiveLink • Greenlight 1. Level Of Effort – Lubes IT C.11/C.12 How to get Lubes project team content communicated to the BU’s… • How much of testing & finalization BU user can absorb depends on quality (A) and complexity of scope (B) • Operational Roles • Change management • Incident & problem management • Configuration management • Process documentation (procedures) • Understand and manage evidence • SOX Technical Roles • Flow charts • Narratives • Monitor SOX Changes A B C = A X B Quality of Key Documents Tied to Methodology Scope of IT SOX Effort

4. 2. Level Of Effort – SOPUS Scope of controls by BU (Embedding Analysis V2.0 - 12.05.05)… Includes 41 from the Controller’s Organization NOTES: 1. All numbers are directly from SPUD as of 12.05.05 2. Numbers have not been validated with Greenlight * Includes Contract & Procurement, HR, Legal, Risk & Insurance, Credit, Strategy & Portfolio, Tax SOC

5. Process Owners Client Services Data Center Operations IT Infrastructure Manager Communications Database Technologies Server Technologies Client Services Client Services Server Technologies Data Center Operations Data Center Operations Server Technologies Database Technologies Communications Database Technologies Communications Gary Ramsey Mary Stuesser Jackey Gale 6 staff 7 staff 7 staff Pat Wray Cheryl Archie 5 staff Euan Sanguinetti Euan Sanguinetti Keith Milsap Clint Tate Rusty Rushton Kayoor Gajarawala Kevin Haden Cheryl Cowden 5 staff Overall Sign off Review & Sign off Generate Evidence Document & Test 3.Training Audience – Lubes IT C.12 Summary One register, one department, one location requires 42 people to be trained. In Transition, must convert roles to names… Control Owners Control Executors Desk Level Lubricants Infrastructure

6. 4.Training Audience – SOPUS First pass of SOPUS training needs (Embedding Analysis V2.0 - 12.05.05)… *Based on functional titles that translates to multiple individuals NOTES: 1. All numbers are directly from SPUD as of 12.05.05 2. Numbers have not been validated with Greenlight

7. 5. Estimator Test with Lubes IT C12 To test your Estimator… Team Lead responsible for Lubes IT C12 register (Gary Ramsey) filled out the Central Team Resource Calculator V3. Compared results with our “home grown” version developed/applied by OPSS IT in Sept/Oct, 2005

8. 5. OPSS Estimator Model OPSS Estimator for Lubes IT C.12 - How it works...

9. 5. FTE Estimating Guidelines Comparison OPSS Estimator uses classic IT estimating guidelines…

10. 5. Estimator Process Comparison OPSS IT Estimator (bottom-up) vs Central Team top-down…

11. 6. Observations on Resource Estimator Central Team Result Resource Calculator V3… • General • Must be filled out by someone who is intimately familiar with controls and level of effort. (E.g. SOX project lead for the Control) • Timing is important. To accurately reflect how much effort is required, the person filling out the estimator must have experienced what needs to be done. • Our OPSS estimate (Simple formula) was consistent with Central estimate. • Pros • Easy to fill out (took about 15 minutes) • Sets global standards/expectations which will help drive consistent approach to SOX global staffing • Helps eliminate subjectivity and number fudging • Cons • Looks intimidating (recommend we communicate the fact that it takes 20 minutes to fill out)

12. 7. Our Key Issues – Need Your Advice How to get consistency with your other SOPUS BU’s… • SOPUS SOX project is organized by Control Register (CR) – Not AoO • Best knowledge of how to fill in Resource Estimator in SOPUS SOX Project CR leads… • BUT, your estimator model is by AoO… • We could be double counting - because some CR’s cut across multiple AoO’s • A. Need Discussion… • Agree with need to standardize global estimates, but • No “Evidence Maintenance” process in the estimates • Need clarification on the logic of the 288 man days at the bottom of input page • B. Another Discussion • C. Other ideas & discussion • D. Our (joint) suggested approach and reasonable timeline

13. 8. Appendix: Lubes SOX IT Deliverables Deliverables define “when we are done”… Deliverable: Document used as estimating basis and to transfer project team knowledge & work to business users.

14. 8. Appendix: Lubes SOX IT Deliverables IT Team Deliverables define “when we are done”… Deliverable: Document used as estimating basis and to transfer project team knowledge & work to business users.

15. Summary: The Key Transition Challenge Need to get the project team to... STOP Thinking about what they have done so far and START Thinking about where they want people to be