Steve Dreyer Managing Director, Standard & Poor’s SCRLC Meeting, June 6, 2007

1. Enterprise Risk Management:Impact on Standard & Poor’s Credit Ratings Steve Dreyer Managing Director, Standard & Poor’s SCRLC Meeting, June 6, 2007

2. An Unofficial Definition A comprehensive, forward-looking, active, iterative, permanent discipline to … imagine, understand, identify, then mitigate, remove, or learn to live with … anything that can destroy your company.

3. What Motivated S&P to Introduce ERM into Credit Ratings? • A Deeper Understanding of Management • Force Forward Thinking • Communicate More Clearly and…. • Companies were “ERM-Ready”

4. A Subtle Change in Language… and Management Earnings… “Return on Invested Capital” “Return per Unit of Risk” Forecasting… “Single/Limited Scenarios” “Unlimited Scenarios” Strategy… “Making Smart Bets” “Selecting along the Efficient Frontier”

5. Where Has ERM Been Applied in the Ratings Process? • Financial Institutions • Insurance • Energy Firms • Other Non-Financial Sectors

6. When Does it Make Sense to Include ERM in Ratings? Quality of Risk Controls Low ------------------------------- High

7. Before Formal ERM Evaluation Lower Higher ERM Quality Lower Higher Risk Tolerance Low High Rating

8. With Formal ERM Evaluation Lower Higher ERM Quality Lower Higher Risk Tolerance Low High Rating

9. Low Risk Tolerance Business Profile 20 15 10 5

10. High Risk Tolerance Business Profile 20 15 10 5

11. Complex Business Profile 20 15 10 5

12. Analysis of Complex Business Profile 20 15 10 5

13. With ERM Complex Business Model 20 15 10 5

14. Strategic Efficient Frontier Strategic Choices Reward Risk

15. Strategic Efficient Frontier (2) Strategic Choices Risk Tolerance Reward Hurdle Rate Risk

16. Strategic Efficient Frontier (3) Strategic Choices Risk Tolerance Reward Hurdle Rate Risk

17. Strategic Choices Risk Tolerance Reward Hurdle Rate Risk Strategic Efficient Frontier (4)

18. Sector Specific Application ERM is not the same in each sector – • The Universal ERM Framework is not a straight-jacket blindly applied to each company • S&P carefully explores each sector and develops an ERM platform that makes sense for that sector • Flexibility allows for company differences in application of ERM

19. Application of ERM inthe Insurance Sector

20. Insurance Credit Ratings – 15 years ago “Prudential tolerates more aggressive balance sheet risk than some peers.” “Prudential has detailed methodology to compare the risk/reward tradeoffs for various investment opportunities …15% of the general account is invested in higher risk assets.” “[mortgage] concentrations exist in California (23%), New York (10%) and New Jersey (7%)…” S&P Credit Research Report, Feb. 15, 1992 Prudential Insurance Co. of America Financial Strength Rating: AAA

21. Insurance Credit Ratings – Today “…reflects Prudential's strong risk-management culture, integrated approach to risk monitoring, and excellent credit risk management capabilities. The otherwise strong ERM is somewhat mitigated by the lack of an overall quantitative view of risk from which an adequate strategic risk management process can be formed.” S&P Credit Research Report, Jan. 12, 2007 Prudential Insurance Co. of America Financial Strength Rating: AA-

22. Weak Excellent 5% 3% Strong 12% Adequate 80% Insurance Scores as of October 2006 Overall ERM Evaluation (207 Insurers)

23. Introduction of ERM inthe Electric Power Sector Quality of Risk Controls Low ------------------------- High

24. Trading Risk Management – Three Part Analysis • Capital adequacy Measures discrete risks of market, credit and operational risks • Liquidity Measures exposure to collateral calls under stress scenarios • Risk management practices – ‘PIM’ Evaluation of a company’s ability to identify and monitor significant risks, limit losses and operate within well-communicated risk tolerances  New!

25. PIM • Policies • Risk Culture and Structure • Infrastructure • Processes and Technology • Methodology • Measurement and Reporting

26. INFRASTRUCTURE PIM Risk Technology Operations Valuation Methods Risk Training Risk Appetite & Strategy Risk Control & Monitoring Disclosure and Awareness Risk Culture POLICIES Model Vetting & Back-Testing Capital Allocation METHODOLOGY

27. PIM Assessment Test Phase • Initiated in April 2006; Completed in May 2007 • Goal: mapping risk management infrastructure to what S&P concludes are best practices • Applied to ten companies initially • Utility and energy merchants • Pure trading • Oil and gas E&P • Big and small

28. Companies Selected • Black Hills Corp. (BBB- / Stable Outlook) • Constellation Energy Group Inc. (BBB+ / Negative Outlook) • Dynegy Inc. (B / Stable Outlook) • Edison Mission Energy (BB- / Stable Outlook) • Exelon Corp. (BBB+ / CreditWatch Negative) • Mirant Corp. (B+ / Stable Outlook) • NRG Energy Inc. (B+ / Stable Outlook) • Reliant Energy Inc. (B / Positive Outlook) • Sempra Energy (BBB+ / Stable Outlook) • TXU Corp. (BB / CreditWatch Negative)

29. PIM Assessment Results Summary • Large variation in risk management infrastructures • Risk appetite often does not match risk management structures and modeling resources • Asset-based trading is less robust that pure trading • Most policies and key system components only in place for a few years for most companies • Dominance of senior management in risk identification and control • Internal reporting is robust but external reporting is poor across the board

30. Next Steps • PIM • Revise PIM methodology from lessons learned • Greater focus of key areas and improve assessment efficiency • Extend assessment to a second group of energy companies with trading operations • Begin to formalize risk management reporting into internal and external reports • ERM • Assess ERM potential and criteria for all companies in the energy sector • Issue criteria later in 2007 with request for comment

31. The Big Picture

32. Strategic Risk Management Risk Mgt Culture & Governance Universal ERM Structure Risk B Control Processes Risk A Control Processes Risk C Control Processes Emerging Risks Mgmt

33. Strategic Risk Management Risk Mgt Culture & Governance Universal ERM Structure Risk A Control Processes Risk B Control Processes Risk C Control Processes Emerging Risks Mgmt

34. Strategic Risk Management Risk Mgt Culture & Governance Universal ERM Structure Risk B Control Processes Risk A Control Processes Risk C Control Processes Emerging Risks Mgmt

35. Strategic Risk Management Risk Mgt Culture & Governance Universal ERM Structure Risk B Control Processes Risk A Control Processes Risk C Control Processes Emerging Risks Mgmt

36. www.standardandpoors.com Analytic services and products provided by Standard & Poor’s are the result of separate activities designed to preserve the independence and objectivity of each analytic process. Standard & Poor’s has established policies and procedures to maintain the confidentiality of non-public information received during each analytic process.