Risk Management at ANZ Banking Group

1. Risk Management at ANZ Banking Group Patrick Zhu Head of Retail Risk China Partnerships Jun 18, 2008

2. ANZ is a leading bank in Australia, and the largest bank in New Zealand • Established in 1835 • Strong market positions in chosen markets • Australian “Bank of the Year” six years in a row • New Zealand’s largest bank • Leading bank in the South Pacific • Leading Australian bank in Asia • Over 5 million customers, across 30 countries • 34,353 employees; 1,265 points of representation • Strong annual performance as at 30 September 2007 • Annual profit AUD$4.2 billion • Total Assets AUD$392 billion • Cost/Income ratio 44.8% • Rated AA

3. ANZ Risk Management structure is aligned to business and meets Basel requirements for consistency ANZ Board Risk Committee Chief Executive Officer Chief Risk Officer Chief Executive Officer, New Zealand Respective Group Managing Directors New Zealand Institutional OTR Asia Pacific Personal Centre Risk Chief Risk Officer ANZNB Head of Risk, Institutional Head of Operational & Technology Risk Head of Risk, Asia Pacific Head of Risk Personal & Chief Retail Credit Officer Group General Manager, Compliance Head of Risk Services

4. The following key principles which are aligned with Basel II underpin the establishment of the ANZ risk function: • Board of Directors should be aware of major aspects of bank’s risks. It should approve and review the bank’s risk management framework which outlines the approach for the identification, assessment, monitoring and control / mitigation of risks. • Board of Directors should ensure the bank’s risk management framework is subject to effective and comprehensive internal audit by operationally independent, appropriately trained and competent staff. • Senior management should have responsibility for implementing the risk management framework. The framework should be consistently implemented throughout the whole banking organisation. Senior management should also have responsibility for developing policies, processes and procedures for managing risk across all of the bank’s material products, activities, processes and systems. The principles fundamentally require that Risk Management exist as an independent and centralised function. As long as Risk Management is independent and centralised, it can be organised by: • Risk type (credit, market, operational etc) or • Line of Business (Retail, SME, Corporate etc) Typically in order to be more responsive to customer needs, the Risk Management function tends to be organised by Line of Business. Refer to the Appendices for options on organisational structure.

5. Whether the Risk Management Function is organised by risk types or Line of Business, there are fundamental risk capabilities that are required as outlined below: RISK MANAGEMENT Centralised Risk Credit Risk in the Business Policy & Framework Reporting & Analysis Portfolio Management Risk Modelling Credit Assessment & Approval Problem Credit Management Set and assure policies and frameworks Set the Credit Approval Discretion framework Provide risk reporting and analysis Specify risk measurement tools (eg. statistical risk grade models) Operate within framework set by Centralised Credit Risk Market Risk Policy & Framework Reporting & Analysis Portfolio Management Risk Modelling Risk Assessment & Approval Operational Risk Policy & Framework Reporting & Analysis Portfolio Management Risk Modelling Risk Assessment Business Continuity Planning

6. Centralised Risk Management and Risk Management in the Business Centralised Risk Management Define Risk Appetite Develop framework to ensure management of risk within acceptable range including: • Policies • Credit Approval Discretions • Risk measurement (e.g. Models) • Portfolio Management Risk Management in the Business Operate within risk management framework set by Centralised Risk Management

7. Policies: Roles and Responsibilities The level of policy will determine the owners and approvers, and level of oversight. Risk principles (Level 1) Risk frameworks (Level 2) Risk policies (Level 3) Risk operating procedures (Level 4)

8. Risk committees are key governance mechanisms ANZ Board Audit Committee Risk Committee Audit Committee Defines risk appetite, strategy Authorises Group Limit framework Delegates authority to committees Review risk control framework and compliance Operational Risk Executive Committee (OREC) Credit & Trading Risk Committee (CTC) Group Asset & Liability Committee (ALCO) (CTC) • Policy framework for all balance sheet risks and operations. • Interest rate risk • Liquidity & funding • Balance sheet structure • Structural FX exposures • Funds transfer pricing • Policy framework • Credit risk • Market (traded) risk • Approve major lending decisions • Approve asset writing strategies • Manage bank portfolio Operational Risk Compliance Information Security

9. Process: Credit Assessment and Approval Front Office Loan Processing LOB Risk Management Relationship Management Assessment and Administration • Assess and Grade Risk • Structure Loans and Facilities • Execute – Internal and External documentation • Security Management Credit Approval Follow rules Centralised Risk ManagementFramework & Portfolio Ensure compliance to framework

10. Six Key Benefits of a Risk Grading System Earning Warning System that identifies treatment of NPLs Centralised understanding and management of risk at the portfolio level Guides asset writing and pricing Risk Grading Objective, business outcome based staff performance management Timely and cost-effective decision making and customer response (automation) Enables low risk revenue growth – data mining of behavioural scoring

11. Risk Grading System – Expanded Scale Equals Expanded Capability ANZ’s Credit Rating Scale Expanded performing risk grade scale provides the capability to build an effective early warning system Traditional rating scales in China Estimate of Comparative Scale

12. Customer Security Loan security cover Ability to service/repay Risk of default Security Indicator Customer Credit Rating RISK GRADE Risk Grading System – Fundamentals Predicts likelihood of loss, using 2 distinct dimensions: • Risk/Likelihood of default - ability of the customer to repay the loan • Loss given default - loss in the event of non-payment of the loan