There is overwhelming consensus from financial services executives that the current risk environment has become significantly more complex, dynamic, and difficult to navigate. This is evidenced by the performance and growth challenges firms face today - caused in part by failures to adequately manage risk from across financial products, operations, and business units. With this turbulence has come a much greater interest in understanding and managing risk holistically and ensuring Risk Management is truly enterprise-wide, part of the organization's DNA, and much more performance-based. In this presentation, IDC Financial Insights and Guidon Performance Solutions join to discuss principles and the roadmap for building mature and effective Enterprise Risk Management (ERM) that leads to competitive advantages. By viewing you will gain perspective on: - Setting a shared vision for risk management - Linking Enterprise Risk Management to the culture - Ensuring performance - efficiency and effectiveness - Enabling the risk management process with technology

1. Enterprise Risk Management:
Culture, Vision, Performance
June 29, 2011

2. Today’s Panel
• Dave Potterton (Moderator), Vice President of
Research for IDC Financial Insights Global Banking,
Insurance, Capital Markets and Risk Management
practices.
• Michael Versace, Research Director at IDC Financial
Insights, focusing on the Global Risk end-user and
technology marketplace.
• Larry Mead, Vice President and Managing Director for
Guidon’s Financial Services and Insurance practice
focusing on business improvement and solutions across
the financial sector.
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 2

3. Where We Are
Regulatory pressures and today’s global business
realities are forcing financial firms to re-think and
restructure organizations, technologies and business
processes used to manage risk.
It is increasingly vital for But it is also critical to
firms to harness establish agile cultures
technology and with repeatable disciplines
information to make and processes to manage
actionable, optimized, and thru the change and
timely decisions … situational complexities …
keeping risks at staying ahead of the
acceptable levels. competition.
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 3

4. The Organizational Stress
25. Institution has received increased pressure from 18. I am concerned that an increase in regulatory
federal regulators queries is straining my compliance team and resources
8%
No 8%
25%
42% Completely Disagree
Somewhat Disagree
Neutral
Yes
92% 25% Agree
Completely Agree
0.00 0.50 1.00
92% of risk managers interviewed feel 77% of risk managers feel that
they are under siege from federal and increased regulatory scrutiny is
state regulators. stressing out their teams.
Source: IDC Financial Insights 2010 Risk Officer Survey
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 4

5. The Regulatory Complexity
European Regulatory Activates US Regulatory Activities
Regulatory
Macro – Prudential Da Larosiere
Supervision Commission report Restructure Obama Administration Plan
and Reform
Senate Financial
House Resolution 4173
Reform Bill (March 15,
(Wall Street Reform and
European Supervisory 2010) – Restoring
Protection Act of 2009) –
Authorities (ESAs) European Commission American Financial
Regulatory passed in November
(micro-prudential) Stability Act
Coordination
Lisbon treaty Dodd-Frank Wall Street Reform and
European System of
Consumer Protection Act
Financial Supervisors
(ESFS)
G20 Financial • Federal Reserve
Supervisory Board Board
• NY Federal Financial Stability Oversights Council - Office of
European Systemic Financial Research - Office of Insurance -
Reserve Bank
Risk Board Banking Agency Reorganization - Increased
•SEC
ECB and EU Internal •CFTC Capital & Liquidity Requirement - Volker Rule -
Markets and Services •FINRA Orderly Liquidity Authority - Orderly Liquidity
•FDIC Authority - "Grave Threat" Breakup Ability -
European Securities
•Treasury Living Wills - Consumer Financial Protection
and Market Authority Bureau - Derivatives trade/clear and Swap Dealer
(formerly CESR) •FHRA
Regulation - ABS and Hedge Fund regulation -
Omnibus Directive Governance and Executive Compensation -
• Capital requirements Credit Ratings Agencies - Office of the Investor
• Financial Advocate - Liabilities Cap on Large Financial
European Banking conglomerates
Authority Acquisitions - Contingent capital Requirement -
• Pensions Simplified Mortgage Disclosures
• Market abuse
• MiFID
European Insurance & • Prospectus
Occupational • Settlement
Pensions Authority • Transparency Office of Financial Research
• AML
Source: BNY Mellon, FST Summit, October 2010
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 5

6. The Cost of Compliance
The SOX Experience Cost Drivers
• THE COST OF COMPLIANCE •
The average cost of compliance
with the Sarbanes-Oxley Act in
Direct Costs
2006 for companies with under • Assessment
$1 billion in annual revenue………. $2.8m • Documentation
The average cost in 2001…………. $1.1m • Technology
• Legal, …
Percentage increase in costs
between 2005 and 2006………………... 13%
The increase in external audit portion
Indirect Costs
of SOX compliance, 2005-2006………….. 4% • Productivity
• Rework
The total increase in external
audit fees, 2001-2006………………. 271% • Evaluation, …
Source: FOLEY & LARDNER LLP
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 6

7. Risk and Innovation Balancing Act
Regulatory & Efficiency &
Compliance Burden Effectiveness
Channels, New Services &
Analytics and Revenue
Customer Trust Opportunities
Operating
Disciplines & Culture
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 7

8. Industry Leader Perspective
“Risks are an unavoidable consequence of being in business. Efficient
risk management enables an organization to view newly identified risks as
opportunities for increased profit as well as cost reductions, impacting
shareholder value …. Efficient risk management should become a
competitive advantage.”
– European Risk Expert
“Integrating risk culture into a business takes time, discipline, leadership,
and a willingness to be practical in designing and fitting ERM tools and
process with other management routines … culture is very often quite
simply forgotten by CROs and their risk functions.”
– CEO, Large US Insurer
Source: IDC Financial Insights and allaboutrisk.com expert survey 2011
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 8

9. Principle #1 – Map Out the Journey
Where are you going and why?
What are the stops along the way?
15
14 10
11
13
9
12
8 7
6
5
4 1
2
3
Marketplace Compliance?
Advantage?
Enterprise Risk Enterprise Risk
Performance? Management?
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 9

10. Map Out the Journey
Vision and Maturity Fully Recognized
Value
Strategic ERP
High Overall Maturity Curve
ERM
Desired Business
Outcomes
Filling Gaps
Building/
Operationalizing
Reacting
Initiating
Programs
Behind the
curve
Low
Timeline: Cycles-of-Use and
Investment Horizon
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 10

11. Map Out the Journey
Vision and Maturity
Limited ERM Maturing ERM
Characteristics Strategic ERP Characteristics
High Overall Maturity Curve
1. ERM still a promise – 1. Persistent Risk Culture
not yet reality - Risk Performance an
ERM accountability
2. Compliance is the
Desired Business
emphasis – audits are 2. Performance -
the primary tool of Filling Gaps Monitoring and risk
Outcomes
choice evaluation is part of the
company fabric
3. Ownership is generally Reacting
with a Risk Leader or 3. Ownership is shared by
Audit function Leadership; particularly
P&Ls
4. Solutions are a Low
collection of data 4. Solutions are designed,
points – little Timeline: Cycles-of-Use and and customer-centric
integration Investment Horizon
5. Technology supporting
5. Technology, not Launching – Agile - robust metrics,
Enterprise Risk analytics
Architecture, Shared risks not Scalable,
Services, etc. understood, Defensible, and
costly approach, Competitively
reactive Opportunistic
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 11

12. Principle #2 – How Matters More Than What
• Management Disciplines
are the “HOW”
– Strategic Planning and
Deployment
– Business reviews
– Talent Development
– Innovation
– Technology Deployment
• Strategies, business
models and entire
industries change rapidly
today – business
management processes
are the key to adaptation
and execution
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 12

13. “…The two fundamental forces that drive GE…a common
operating system and social architecture…”
Jack Welch
GE 1999 Annual Report
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 13

14. How Matters More Than What
Architecture of the High Performing Enterprise
Operating System
• Business Intelligence
• Technology & MIS
Cycles of Use
• Innovation & Problem Solving
• Business Processes
Mission/Strategy
Social Architecture
• Common language & terminology
• Rewards & Recognition
• Valued Behaviors
Purpose & Values
• Purpose Statement
• Values Statement
High Performing Organizations need a Rosetta Stone to continually
and rapidly recognize external change, understand internal
capabilities, focus on the exceptions & disagreements and deliberate
practice to embed changes in an organization’s DNA.
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 14

15. How Matters More Than What
Framework for a Cultural
• Begin by clarifying the
role of Senior, Middle, “Operating Architecture”
Associate-level
management
• Design the Standard
Playbook for all levels of
the organization –
including the cultural
framework for Enterprise
Risk Performance
• Tools and practices
linked to values of the
organization
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 15

16. Principle #3 – Compete In Dog Years
A time-compressed company does the same thing as a pilot in an
OODA loop… It’s the competitor who acts on information faster who is
in the best position to win.
George Stalk, Jr. & Tom Hout,
Competing Against Time
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 16

17. “At a time when firms in many industries offer
similar products and use comparable technologies,
business processes are among the last remaining
points of differentiation.”
– Tom Davenport, Competing on Analytics
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 17

18. Compete in Dog Years
Speed is Life
Wasted Time and Activity
Core Process Value
Items waiting Excessive Motion and Defective Process
“backlog” Handling (Identifying, Handling, Fixing)
OPERATIONAL LEAD TIME
Missing, Incomplete, Work audit –
Redundant Waiting Overprocessing
often by more
Information (Customer or Staff) than one
“reviewer”
Start with the Customer & Process to drive
efficiency and effectiveness. The key is to reduce
every activity and every effort to “core value.”
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 18

19. Principle #4
Simple First-Class Levers
1st Class 2nd Class 3rd Class
Least Effort Helpful Forget It
Information, Analytics, and Technology are incredible levers
that must be designed around the Customer, Culture,
Process, and true Information Needs to be most enabling
and effective.
Image Source - Professor Beaker’s Learning Labs
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 19

20. Simple First Class Levers
Analytics Evolution & Maturity
Continue Trending from Data to Decisions Data/Content
Technology Predictive, Unified
Analytics
End-Users
Collaboration
Alerting &
Number of people
Workflow
Dashboards Monitoring and
Templates & Data
Visualization Awareness
Unified IT Staff
Ad-hoc Data
Scorecards Access &
Query Models
Analysis
Static, ETL & Knowledge
Data DW Lifecycle
Batch Data capture
Warehousing Management
Reporting Quality & learning
1975–1989 1990–2004 2005–2020
Query, Reporting, OLAP, Data Mining, Statistical analysis
Business intelligence Suites and Analytic Applications
Intelligent Process Automation
Unified Decision Management
Solutions
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 20

21. What are the Risks & Information Needs?
Points of Risk
Credit Risk Market Risk Operational Risk
Default Risk Interest Rate Change Human Capital
Credit Rating, Modeling, Optimization Employment Practices, Workplace Safety
Counterparty Risk Currency Fluctuation Financial Crime
Fraud, Sanctions, PEP, AML
Derivatives, Futures, Swaps, Insurance FOREX
Compliance
Liquidity Risk Commodity Risk Regulations, Policies, Standards, Reporting
Asset Liquidity, Liability Funding
Technology
Asset Liability Management Portfolio Risk Infrastructure, Data Management
VaR, EaR, Cash Forecasting
Legal Risk
Lawsuits, Regulation, Reputation, Liability
Business Strategy
M&A, R&D
Cyber Risk
Malware, IAM, IDS, SEVM, Endpoint
Sovereign Risk
Accounting and Controls
Controls, Reconciliations, Exception handling
Geopolitical Risk
Vendor Risk
Public cloud, vendor management,
Oversight
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 21

22. Simple First Class Levers
Core ERM Solution Components
ERM Solution Definition
IT solutions used to establish, analyze, measure, and report enterprise-wide
risk activities. It identifies potential risks and prioritizes the tolerance for risk
based on the organization's business objectives. ERM leverages internal
Data
controls to manage and mitigate risk throughout the organization.
Applications • Credit and Deposits
• Payments
• Trading
Risk Meta Data • ERP • Security
• Core banking • HR
Analytics and • Trading • Financial Control
Modeling • ERM taxonomy • Settlements • Market Data and
• Law, Regulation, • Policy and Claims Content
Personalization Policy • Audit and
• Leading models • Risk definitions and Compliance
• Modeling and attributes • IT Infrastructure
testing • Media
• Roles and Rule • Scenario
• Workflow management
• Case Management
• Reporting
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 22

23. Map Out the Journey
Vision and Maturity
Limited ERM Maturing ERM
Characteristics Strategic ERP Characteristics
High Overall Maturity Curve
1. ERM still a promise – 1. Persistent Risk Culture
not yet reality - Risk Performance an
ERM accountability
2. Compliance is the
Desired Business
emphasis – audits are 2. Performance -
the primary tool of Filling Gaps Monitoring and risk
Outcomes
choice evaluation is part of the
company fabric
3. Ownership is generally Reacting
with a Risk Leader or 3. Ownership is shared by
Audit function Leadership; particularly
P&Ls
4. Solutions are a Low
collection of data 4. Solutions are designed,
points – little Timeline: Cycles-of-Use and and customer-centric
integration Investment Horizon
5. Technology supporting
5. Technology, not Launching – Agile - robust metrics,
Enterprise Risk analytics
Architecture, Shared risks not Scalable,
Services, etc. understood, Defensible, and
costly approach, Competitively
reactive Opportunistic
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 23

24. Take-Aways for Navigating the White Water
We are in a world of continuous rapids
frequently interrupted by monsoons
Four Principles for the Journey
Map out the Journey
Establish a shared vision that fits
your Business Reality & need
How is more critical than What
Design the cultural framework for
Enterprise Risk Performance
Speed is life!
Start with the Customer & Process
to drive efficiency and effectiveness
Simple First-Class Levers
Enable with Technology; avoid
building ERP around it
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 24

25. Questions?
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 25

26. Thank You!
Guidon Performance Solutions
866-986-4414 or 480-986-4414
lmead@guidonps.com
www.GuidonPS.com
IDC Financial Insights
508-620-5533
dpotterton@idc.com
mversace@idc.com
www.idc-fi.com
© 2011 Guidon Performance Solutions, LLC and IDC Financial Insights. All rights reserved. 26