2008 Annual Meeting ● Assemblée annuelle 2008 Québec

1. Canadian Institute of Actuaries L’Institut canadien des actuaires 2008 Annual Meeting ●Assemblée annuelle 2008 Québec JF

2. 2008 Annual Meeting Assemblée annuelle 2008 Enterprise Risk Management “Not just for Insurance Companies” John R.S. Fraser Vice President, Internal Audit & Chief Risk Officer, Hydro One Inc., June 20, 2008 2008 Annual Meeting Conference Canadian Institute of Actuaries, Quebec City

3. Background on Hydro One What we consider ERM to be The Components of ERM The ERM Processes Risk Tolerances and Workshops Risk Profiles Resource Allocation 2008 Annual Meeting Assemblée annuelle 2008 Summary

4. Ontario’s primary electricity transmission & distribution company One of the largest Tx companies in N.A. $12 B of assets $4.6 B of annual revenue $1 B annual capital and maintenance spend 5000 employees plus 1,000 outsourced 2008 Annual Meeting Assemblée annuelle 2008 Background on Hydro One 1

5. 2008 Annual Meeting Assemblée annuelle 2008 ERM – Scope of Mathematical Intensity AU/NZS 4360 COSO ISO 31000 SOA CAS PRMIA Moody’s RIMS S&P Detailed math is the answer Broad ranges are the way to go 2

6. “Enterprise risk management is just basic actuarial science, which is now being applied in all industries.” Sim Segal, FSA, CERA, MAA, Managing Director Aon’s Global Risk Consulting Group (quoted by Rough Notes Magazine - October 2007) 2008 Annual Meeting Assemblée annuelle 2008 ERM is no big deal…. 3

7. “…actuaries of the fourth kind…” (a reference to actuaries working in ERM) by Professor Paul Embrechts of the Swiss Federal Institute of Technology as quoted by Stephen D’Arcy in his 2005 Presidential address to the Casualty Actuarial Society 2008 Annual Meeting Assemblée annuelle 2008 ERM requires a major re-think… 4

8. “There is no point getting into a panic about the risks of life until you have compared the risks which worry you with those that don’t but perhaps should.” Rothchild Quoted by Felix Kloman in Risk Management Reports - Vol. 31 No. 10 - October 2004 2008 Annual Meeting Assemblée annuelle 2008 Risks Identification 5

9. 2008 Annual Meeting Assemblée annuelle 2008 Why have ERM? • “...overly complex methods are likely never to be fully implemented, or, if they are, to generate a lot of resentment, non-compliance and workarounds.” • “…the minutia will be well-managed at great cost while ignoring the big picture, especially the future types of risks.” • David McNamee October 2004 Internal Auditor Magazine 6

10. Sarbanes Oxley Compliance Audits Regulations Performance Measurement Credit, market or operational risk in isolation Detailed calculations without the big picture 2008 Annual Meeting Assemblée annuelle 2008 What our ERM is not about 7

11. Good Governance Good Management (“a proxy for good management”) Agreed objectives and risk strategies Future business outlook Prioritization of objectives, risks and resources Resource allocation (i.e improving the business/operations while knowing your risks and using your resources wisely.) 2008 Annual Meeting Assemblée annuelle 2008 What ERM is about: 10a

12. 2008 Annual Meeting Assemblée annuelle 2008 What ERM is about: Market Strategic Operational Other Credit 10b

13. 2008 Annual Meeting Assemblée annuelle 2008 Policy and Organization(Hydro One ERM Status - April 2002) 11

14. 2008 Annual Meeting Assemblée annuelle 2008 Risk Tolerances and Workshops(Hydro One ERM Status - April 2002) 12

15. 2008 Annual Meeting Assemblée annuelle 2008 Reporting Processes(Hydro One ERM Status - April 2002) 13

16. BOARD COMMITTEE CORPORATE RISK PROFILE POLICY & FRAMEWORK EXECUTIVE MANAGEMENT RISK TOLERANCES 2008 Annual Meeting Assemblée annuelle 2008 MANAGE RISKS, $$ MANAGE RISKS, $$ RISK PROFILES & BUSINESS PLANS LINE MANAGEMENT The ERM Process at Hydro One 14

17. 2008 Annual Meeting Assemblée annuelle 2008 Turning Strategy into Risk Tolerances How will we measure success for each Business Objective?? Business Strategy Business Objectives How are we going to achieve our overall Corporate aims?? Key Performance Indicators What 6-10 objectives do we want to factor in to decision-making? What is our attitude toward failure for each KPI?? Risk Tolerances 15

18. 2008 Annual Meeting Assemblée annuelle 2008 Key Components of ERM Process ERM Policy & Framework Strategic Planning Business Objectives Corporate Risk Tolerances Risk Workshops Asset Planning Scan of Events Corporate Risk Profile Business Plans Audit & Finance Committee Board 16

19. 2008 Annual Meeting Assemblée annuelle 2008 Example of HOI risk tolerances Minor: - noticeable deterioration in results Major: - significant deterioration in results Worst Case: - threatens the survival of the organization in its current form 17

20. Environmental Hazards 2008 Annual Meeting Assemblée annuelle 2008 Number of participants who voted for each category 40 60 80 100% 0 20 Worst Case 5 Severe 4 3 Major 2 Moderate 1 Minor 18

21. Environmental Hazards 2008 Annual Meeting Assemblée annuelle 2008 80 0 40 60 20 100% Worst Case 5 Severe 4 3 Major 2 Moderate 1 Minor 19

22. 2008 Annual Meeting Assemblée annuelle 2008 Briefing Sessions: voted results & meaning • “Meanings:” • themes, patterns in discussion • common causes 20

23. 2008 Annual Meeting Assemblée annuelle 2008 Corporate Risk Profile Note: Each risk category is explained with a half page analysis outlining the sources of the risk and the mitigants in place or planned. 21

24. Vehicles?? 2008 Annual Meeting Assemblée annuelle 2008 House?? Medical?? Travel?? Spending Prioritization: Making choices based on value Intolerable Risks + Highest “Risk Mitigation” Value for money 22

25. 5 Very Likely 4 Likely 2008 Annual Meeting Assemblée annuelle 2008 3 Middle Odds 2 Unlikely 1 Remote 1 Minor 3 Major 4 Severe 2 Moderate 5 Worst Case “True” tolerances: “Red Zone” Intolerable 23

26. 2008 Annual Meeting Assemblée annuelle 2008 Ranking across work programs Intolerable Risk Resources = $14 “BANG for BUCK” (1)i.e. value for $’s 24

27. Is there a statement of risk appetite or risk tolerance? How does the company identify and control each major risk? What information about each major risk is shared with senior management and/or the board of directors? What environmental scanning techniques does the company use to anticipate the emergence of extreme disasters? What contingency plans has the company developed? (Excerpts from Standard & Poor’s January 14, 2008 Bulletin) 2008 Annual Meeting Assemblée annuelle 2008 Standard & Poor’s Questions on ERM: 25

28. 2008 Annual Meeting Assemblée annuelle 2008 Questions?