The Role of the Board of Directors in Enterprise Risk Management

1. Dr. Vindel L. Kerr President and Managing Consultant GovStrat Ltd. 1 (876) 324-0606 | vindekerr@cwjamaica.com www.vindelkerr.com The Role of the Board of Directors in Enterprise Risk Management CAAM – 5th Annual Meeting and Conference July 13 – 15, 2011 Hyatt Regency, Trinidad and Tobago

2. Presentation Outline “The Role of the Board of Directors in Enterprise Risk Management (ERM)” ------------------------------------------------------------------------------------- • Introduction • The Business Case for Board Involvement in ERM • Board Going Beyond Chief Risk Oversight to Providing Chief Risk Insight • A Suggested Model for More Prudent Board Insight in ERM Implementation • The Future of ERM and Board’s Role: Conclusions Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

3. Introduction • What is ERM? • The traditional role of the Board in general and in Risk Management in particular • Current and Emerging Role of the Board in ERM Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

4. Introduction (2) • What is ERM? A process of assessing risk across the entire enterprise including all functional areas and business units and is led by the Board of Directors, management and staff. What is a risk? What are some key risks? A RISK is every transaction done, every purchase made, every investment contemplated or effected. With every corporate opportunity there is an associated risk and vice versa. Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

5. Introduction (3) Broadly speaking, there are two categories of risks: 1.) Traditional Regulated Risks • Liquidity • Transaction • Operational • Market • Credit • Economic Capital Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

6. Introduction (4) 2.) The Unconventional Risks a. Strategic Risks • HR: recruitment, compensation, safety • Corporate Governance and Compliance • Strategic Planning • Business Continuity Planning • Succession Planning • Knowing your customers, clients, neighbours, etc Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

7. Introduction (5) Unconventional Risk (contd.) • Reputation Risk • Conduct of Corporate Fiduciaries • Role of SRI and CSR – environmental planning, etc • Product integrity and safety • Health safety and wellness of employees • Corporate philosophy and core values mantra Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

8. From: The Conference Board, 2006. The Role of U.S. Corporate Boards in Enterprise Risk Management, chart 8, p. 21 Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

9. Introduction (6) • The traditional roles of the Board in general and in Risk Management in particular • Provides Oversight to CEOs • Hire and fire the CEO • Monitor CEO and top management performance • Performance evaluation and compensation determination • Rectify strategic decisions and new proposals • Approves Financial Obligations and Utilisation of Resources Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

10. Introduction (7) • The traditional role of the Board in general and in Risk Management in particular (2) • Report to shareholders at AGM – legal obligation for public listed companies • Oversight of Corporate Governance and compliance regime • Boundary Spanning Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

11. Introduction (8) • Current and Emerging Roles of the Board in ERM • The establishment of Risk (ERM) Committee • The appointment of a Chief Risk Officer (CRO) • The putting in place of risk systems and infrastructure • Determination of the CFO direct report (s)—whether to the Chairman of the Mainboard or Chairman of the ERM Committee of the Board • Ensures the CFO is given functional oversight responsibility for treasury, investment and new venture development Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

12. Board of Directors Provides oversight over strategy and ERM processes developed by management • Audit Committee • Internal control over financial reporting • Financial risk management • Risk Committee • Risk inventory • Dashboard • Reviews risk tolerance CEO CFO • Chief Risk Officer • Coordinates the design and • implementation of ERM • processes • Management’s Risk Committee • Develops risk philosophies and policies • Includes: CFO, General Council, • Corporate Secretary, Head of Strategy, • General Auditor, Heads of Business • Units, CRO Business Unit Business Unit Business Unit Note: The CFO currently has the major responsibility to report to the Board, but the CRO position is gaining in popularity From: The Conference Board, 2006. The Role of U.S. Corporate Boards in Enterprise Risk Management, exhibit 4, p. 28 Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr/CAAM 5th Annual Meeting & Conference

13. The Business Case for Board Involvement in ERM The key elements: • Mounting Pressures for ERM • Evolving Legal and Regulatory Developments make it necessary for Boards to play a more active role in ERM Oversight • Increased and convincing Empirical support • Moving from Seeing Risk as a bad thing to Exploiting its Opportunistic Nature (The Upside of ERM) Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

14. The Business Case for Board Involvement in ERM (2) • Pressures for ERM • Globalisation • Increased Frequency of corporate misfeasance • Corporate collapses and failures • Greater and more intense scrutiny from regulators, shareholders and the public at large • Recent and emerging legislative and regulatory framework • Sound ERM Oversight and Implementation are already the norm in many corporations and a few governments and fast developing in many worldwide Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

15. The Business Case for Board Involvement in ERM (3) • Evolving Legal and Regulatory Developments make it prudent for Boards to pay keener and closer attention to ERM • Caribbean • Companies Act –making Directors fiduciary role now more onerous than ever • Public Bodies Management & Accountability Act (Jamaica), State Enterprise Monitoring Manual (Trinidad) and Financial Institutions Act (TT & Jamaica, OECS)--fines and other penalties for breach of fiduciary duties Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

16. The Business Case for Board Involvement in ERM (4) • Evolving Legal and Regulatory Developments make it necessary for Boards to place a more active role in ERM Oversight • USA • Patriot Act—requires financial institutions doing business with the USA to demonstrate knowledge of their customers • Sarbanes-Oxley Act –requires inter alia, the authentication of the Financial Statements by the CEO and CFO. • Business Judgment Rule – protects directors who act in good faith from liability Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

17. The Business Case for Board Involvement in ERM (6) • Empirical support for the Business Case of Board involvement in ERM From: The Conference Board, 2006. The Role of U.S. Corporate Boards in Enterprise Risk Management, exhibit 3, p.15 Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

18. The Business Case for Board Involvement in ERM (7) • Empirical support for the Business Case of Board involvement in ERM From: The Conference Board, 2006. The Role of U.S. Corporate Boards in Enterprise Risk Management, chart 3, p.17

19. The Business Case for Board Involvement in ERM (7) • Moving from a Defensive Posture towards Risk to Exploiting its Opportunistic Nature (The Upside of ERM) • Risk Management should be seen as a value creating business strategy rather and caution/preventative action • ERM is value creating, enhancing, protecting , preserving • ERM can optimize corporate and individual performance • ERM reinforces investor confidence Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

20. Board Going beyond Chief Risk Oversight to Providing Chief Risk Insight • Some Practical Tips • Obtain ERM training, education and continuous development • Review Board compensation and committee structure and charters (TORs) against ERM mandate • Review competency of Board against risk oversight and insight mandate • Look at best-in-class peers for emerging practices in ERM oversight • Spend real time with management to be able to truly assess the core ERM issues Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

21. Board Going beyond Chief Risk Oversight to Providing Chief Risk Insight (2) • Some Practical Tips continued • Visit business units and meet with unit heads periodically to discuss risk inventory • Create a mechanism for the Board to be constantly fed with cutting-edge new information on the success of ERM implementation, its processes and functionalities • Ensure management and staff receive appropriate training & continuous development in ERM knowledge and skills Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

22. Board Going beyond Chief Risk Oversight to Providing Chief Risk Insight (3) • Some Practical Tips continued • Put in place a fully integrated ERM system and be part of its implementation without being the “consultant” – leave this to the experts • Ensure a robust Board level ERM reporting system is in place • Develop and implement a process to assess and monitor performance of risk management processes • Board should discuss and understand the nature of reputation risk—an area of growing strategic importance in ERM and corporate governance Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

23. A Suggested Model for More Prudent Board Insight in ERM Implementation 1. Appreciate the importance of ERM • Board members need to become knowledgeable about ERM to appreciate its strategic value • The Board needs to acquire the appropriate and adequate information, and if necessary retain advice from independent external experts Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

24. 11. Integrate ERM with Existing Systems, (i.e. IT, .. 10. Tract pursuit of Risk Adjusted Strategy 1. Appreciate Importance ERM 9. Monitor ERM Implementation & execution 2. Assess Gaps & Vulnerability 8. Dev. Internal Communication & Reporting Protocols ERM Integrated Approach 3. Set Underlying Mission 7. Define risk response Strategies 6. Select Assessment Techniques & define risk appetite 4. Established Infrastructure & Assign Leadership 5. Compile Inventory Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr/CAAM 5th Annual Meeting & Conference

25. Assess gaps and vulnerability in the existing risk management solutions • The board should be persuaded by the business case for implementing ERM, which should rest on a detailed analysis of the limitations inherent in more traditional, risk management solutions Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

26. Set an underlying mission and program objectives The ERM Business case should be formulated as a concise and effective mission statement, articulated in the main program objectives and tied to the firm’s strategic goals • Established the ERM infrastructure and assign Leadership Board members and senior executives should create a Charter of ERM functions and ensure its full development Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

27. Compile a Risk Inventory Identified, categorized and prioritized risks facing the company. Accuracy of the risk portfolio is critical to its success thus the board should oversee the process to take inventory of risk and become comfortable about its effectiveness and thoroughness Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

28. Select assessment techniques and define risk appetite and tolerance • The selection of appropriate risk measurements should be made based on the nature of each risk in the portfolio, the amount and depth of the data required to apply the measure being considered, and the organisational capacity of the business unit in charge of responding to the event. Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

29. 7. Determine risk response strategies • Risk owners are accountable for the response to events assigned to their area of responsibility • Nonetheless, because of the need to have a comprehensive and cohesive ERM program, their response should no longer be disjointed from other divisions. Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

30. 8. Develop effective internal communication and reporting protocols • Internal flow of information is important to the success of ERM • Board members need to analyse the quality of internal reporting practices, internal reporting lines and be persuaded that information on risk is material for strategic reasons Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

31. 9. Monitor ERM implementation • Should be done on an ongoing basis –any activity to identify, assess and respond to an event • Usually embedded in the program design and at any organisational level so that they can be performed in the ordinary course of running the business • Large companies should avail themselves to dedicated evaluation teams and sophisticated flowcharts and diagrams to ensure the enterprise-wide ramification of the monitoring function Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

32. 10. Choose compensation policies and performance metrics to promote and track the pursuit of a risk- adjusted corporate strategy • According to the Research Group, the board should never let executive compensation issues influence the risk measure selection process. While qualitative and quantitative data might be used as key performance indicators (KPIs) to encourage the enhancement of their business risk management program, corporate boards should ensure that KPIs are chosen only after completing the ERM process design. Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

33. 11. Integrate ERM with existing operational systems • IT, budgeting, planning, internal control, regulatory compliance, etc. According to The Research Group findings, revisiting performance metrics to tie them to a risk-adjusted strategy, and fully integrating ERM with existing operational systems represent the most advanced (and least implemented) stages in an ERM program. Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

34. The Future of ERM and Board’s Role: Conclusions • Caribbean Governments will adopt a government-wide ERM program with Ministries of Finance leading the way • Each Government Ministry will end up with a Chief Risk Offer • ERM will assist governments to better align resources with strategy • ERM when adopted will reduce fraud and theft of Government assets Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

35. The Future of ERM & Board’s Role: Conclusions (2) Changes at Board Level: • Increased Pressure on forming Risk Focused Committees and Higher Level of Collaboration • Risk Management and Corporate Governance Committee • Audit Committee • Board will be required and challenged to assess the tolerance for risk as well as need guidance • Increased Demand for External, Technical Risk Expertise • Demand Influenced by Oversight Groups • e.g., Public Company Accounting and Oversight Board (PCAOB) Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference

36. The Future of ERM & Board’s Role: Conclusions (3) External Influences: • Ratings Agencies will rate Enterprises on the Quality of their Risk Management • Regulators will Continue to be challenged • Continuing dramatic and sizeable firm failures • Stakeholders will expect, demand, and see more disclosures • Equity Analysts, Institutional Investors, and Shareholders • Specific, Quantitative Disclosure (e.g., VaR, Stress Tests, Back-testing) • For the Business Risk, Reputation Risk and Strategic Risk Domains Role of the Board in Enterprise Risk Management/Dr. Vindel L. Kerr CAAM 5th Annual Meeting & Conference