1. Enterprise Risk Management

2. Roadmap • Definition & Background • Framework • Benefits • Challenges • Future • Action Points Risk Management Dept.

3. Definition • “An integrated framework for managing credit risk, market risk, operational risk, economic capital, and risk transfer in order to maximize firm value.” • ERM is also referred to as: • Integrated Risk Management (IRM) • Holistic Risk Management (HRM) • Global Risk Management (GRM) Risk Management Dept.

4. Background – Basel II • Pillar I: Minimum Capital Requirement • Banks may choose one of the many approaches to calculate capital for credit, market & operational risk • Pillar II: Supervisory Review Process • Contains the key principles according to which bank supervision should be done: • Board and management • Risk management models and process • Internal control • Stress Testing • One of the targets is also to try motivate banks to hold capital buffers in excess of the minimum requirement. • Financial Supervision should be proactive before bank capital goes under the minimum requirement Pillar III: Market Discipline • Includes recommendations and requirements especially regarding disclosure information. Risk Management Dept.

5. Evolution of Industry Practices Early Adopters Barclays GE Capital Citigroup JP Morgan Chase CIBC Fidelity Investments Goldman Sachs Merrill Lynch Deutsche Bank Bank of Montreal Enterprise Risk Management Organizational Business Financial Risk Management Operations Credit Risk Management Market Market Credit Credit Credit Risk Management Dept.

6. Silo Approach to Risk Management Credit Risk Market Risk ALM Risk Operational Risk • Chief Credit Officer • CFO • Business Managers • Treasurer • Asset/Liability Manager • Internal Audit • Corporate Actuarial Who • Investment Limits • Portfolio Return • Growth Limits • Exposure Limits • Portfolio Measurement • Securitization/ Derivatives • Trading and ALM Limits • Value at Risk Management • Financial Derivatives • Controls • Validation • Audit Review • Insurance How Risk Management Dept.

7. Interdependence of Risks Financial Risks Credit Risk Associated with Investments FX risk in a new foreign market Enterprise-Wide Risks MarketRisk Asset Liquidity FinancialRisk CreditRisk LiquidityRisk Business Risk OperationalRisk Credit Risk Associated with Borrowers and Counterparties Derivatives documentation and counterparty risk Funding Liquidity IT and business process outsourcing Risk Management Dept.

8. Integrated Framework Performance Measurement & Management ALM and Investment Strategy Business Portfolio Management Risk and Economic Capital Measurement Pricing Limit Setting Reinsurance Optimisation • Common measurement standard leading to common language • Common risk ‘currency’, interpretation as capital Risk Management Dept.

9. Integrated Framework 1. Corporate Governance Establish top-down risk management 3. Portfolio Management 4. Risk Transfer 2. Line Management Transfer out concentrated risks Business strategy alignment Think and act like a “fund manager” 6. Data and Technology Resources 5. Risk Analytics Develop advanced analytical tools Integrate data and system capabilities 7. Stakeholders Management Improve risk transparency for key stakeholders Risk Management Dept.

10. Dashboard Approach Board of directors Executives Strategic risk Enterprise risk management and chief risk officer Credit risk Market risk Operations risk Boards, senior executives, internal audit, finance, compliance, insurance/underwriting, risk management, legal, business continuity, business operations Users Managed. Efficient use of capital, resource allocation, compliance, earnings volatility, operational integrity Informed. Fewer surprises, communication of policies,less scrutiny, ability to meet strategic objectives and cope with change Impact. Minimize loss, improve shareholder value, appropriateness and adequacy of control, accountability Benefits Risk Management Dept.

11. Dashboard Approach ERM Dashboard BUSINESS RISK CREDIT RISK MARKET RISK OPERA-TIONAL RISK RISK “PILLARS” Data Mining Internal and External Data • Basic ERM applications: • Executive reporting • Key risk indicators • Loss/incident tracking • Control self assessments • Early warning indicators • Risk mitigation projects tracking • ERM content management • Advanced ERM applications: • Risk transfer • Economic capital • Scenario analysis • Shareholder value management Risk Management Dept.

12. Compliance with risk policies and regulations Exposures vs. policy limits Regulatory compliance Earnings-at-risk Major internal drivers Key external variables Risk/return performance tracking Business units Customer segments Products “Right time” risk reporting One touch visibility Drill down capabilities 24x7 escalation Early warning signals An ERM dashboard should provide full Risk Transparency Risk Management Dept.

13. How much value are you creating and where? Where is your equity capital invested? Economic Capital Allocation Risk Management Dept.

14. How much value are you creating and where? What is it earning? RAROC Risk Management Dept.

15. Business Integration Executive Committee Risk/Return Analysis Credit Market Operational Organizational Other Total Risk Risk Risk Unit EconomicCapital Rs Rs Rs Rs Business Unit % % A % % RAROC Business Unit B • • • Product/relationship management • New product/business development • Business strategy and planning • Mergers and acquisitions • Compensation strategy • Resources allocation • Business Unit N Rs Rs Rs Rs Rs TOTAL % % % % % Risk Management Dept.

16. ERM is driven by Best Practices, not Regulations Proactive Approach Reactive Approach Currentstate CEO ? ? ? • Benchmarking • Gap analysis • Recommendations ? ? Desired state (best practices or best-in-class practices) Sarbanes- Oxley Basel II • Common themes • Unique standards New industry standards Sarbanes- Oxley New industry standards Basel II Governance Requirements Governance Requirements Risk Management Dept.

17. Benefits • Broadens risk awareness • Aligns risk profile and strategy • Minimizes surprises and losses • Rationalizes capital requirements • Assures regulatory compliance • Improves ROE and shareholder value Risk Management Dept.

18. Banks should integrate ERM into Business Processes and Value Drivers Risk Management Impact • Risk-based pricing • Target customer selection • Relationship management Revenue - Expenses   -  Losses • Risk oversight costs • Insurance/hedging expense  • Credit, market operational write-offs ROE    • Capital management • Risk transparency Equity Shareholder Value   New Business • New business development  Growth M&A • M&A/Diversification strategy  • Risk Management by Silos (5, 6) • Integrated risk management (4–7) • Enterprise risk management (1-10) Risk Management Dept.

19. Challenges • Data availability & integrity • Data warehousing/ mining • Building up processes & systems • Developing Human Resources • Strengthening skills • Model validation – requires greater collaboration with regulator • Cost - investment in risk analytics and risk technology – getting management buy-in • Stress testing, scenario analysis – building capabilities Risk Management Dept.

20. Balancing the Hard and Soft side of Risk Management Hard Side Soft Side • Measures and reporting • Risk oversight committees • Policies & procedures • Risk assessments • Risk limits • Audit processes • Systems • Risk awareness • People • Skills • Integrity • Incentives • Culture & values • Trust & communication Risk Management Dept.

21. Future • ERM will become the industry standard • Chief Risk Officer will be a visible figure in risk-sensitive banks • Audit committees will evolve into risk committees • Emergence of Economic capital • Risk transfer executed at Enterprise level • Technology key to advancement • Measurement standards will emerge for Operational Risk • Risk-based/ Economic reporting becomes a Standard Risk Management Dept.

22. Challenges • Data Availability (as per Basel II requirements) • IT Systems (non-networked environment, integration with legacy systems, software) • Change Management & Culture Shift (Risk and Corporate Governance systems, Operational Risk Measurement and Management, Emphasis on independence of risk from business etc) • Analytical Skills (Modeling of default histories, Statistical analysis, Banking knowledge, VaR calculations etc) • Retention of Human resources (specifically resources related to implementation i.e., IT specialists, Risk specialists etc) Risk Management Dept.

23. Action Points • The business units to decide on strategy/ timeframe • The strategy could be growth or consolidation • The Finance/ Planning to decide on capital allocation to business units and assess the risk as well as the return • Risk Management to measure & monitor risks and enable estimation of risk premium • Risk Management should not be biased by consideration of profits or performance evaluation • I T infrastructure to enable data being provided for various analysis for risk evaluation and monitoring Risk Management Dept.

24. Thank You