Christopher Whalen Managing Director Institutional Risk Analytics May 3, 2005

1. Internal Ratings:Leveraging ERM For Regulatory and Business ValueEnterprise Risk Management SymposiumConcurrent Session: A5 Christopher Whalen Managing Director Institutional Risk Analytics May 3, 2005

2. How to Leverage ERM? • Control your data by structuring internal and external information using industry standards such as XML/XBRL. Get good peer, customer data. • Control your business by imbedding risk analytics tools and performance metrics into all aspects of management process. • Control your disclosure by displaying your financial results, performance and risk metrics using same structured data and benchmarks. Institutional Risk Analytics

3. ERM Themes • Mark to Model: For banks, regulators are aligning risk creation and control responsibilities under a portfolio-based discipline that rewards modeling skill, execution and risk avoidance. • Internal Controls: For all companies, onus is O&Ds to maintain internal systems that track how risks are taken and mitigated, document extraordinary events, and make disclosure timely and accurate. Institutional Risk Analytics

4. Basle II: New Capital Accord focuses on credit and operational risk. All performance and risk factors must all be quantified and projected via an internal ratings process that is transparent and documented. Sarbanes-Oxley: Regulatory response to corporate fraud and management failures. Mandates normative roles for O&Ds, auditors and counsel in review and disclosure process to assure adequacy of internal operational and financial controls. Interweaving Regulations Institutional Risk Analytics

5. Op-Risk Event Horizon Market/Credit/Business Risk Operational Risk Internal Factors Visible to Management Not Visible to Management Institutional Risk Analytics

6. Risk Segments • External: Those factors beyond the horizon for management. Utilize macro economic, actuarial and other indicators to monitor/price these invisible risks. • Internal: Those factors that may be directly observed by management. Utilize internal financial, op-risk metrics to benchmark business and validate controls. Institutional Risk Analytics

7. Op-Risk Factors Market/Credit/Business Risk Operational Risk Internal Factors • Fraud • Diligence • Execution • Vendor • Competitor • Procedures • Technology • Investment • Terrorism • Ethics • Strategy • Counterparty • Systems • Act of God • Market • Governance • Counterparty Institutional Risk Analytics

8. Risk Opinion Components • Absolute Tests • Patterns that indicate elevated vulnerability to potentially catastrophic events. • Sudden Motion Tests • Sudden deviations from past behavior or extreme volatility in behavior. • Outlier Behavior Tests • Statistically significant deviations from industry peers. Institutional Risk Analytics

9. Indicator Limitations • Credit Analysis • Most credit/risk ratings are based on liquidity models that depend on market prices (EMH) that are vulnerable to manipulation by market makers. Quarterly tie-outs to as-reported fundamentals are not mandatory. While useful for momentum investing, Merton models provide little if any forewarning of fraud and/or restatement. • Behavioral Analysis • Behavioral indicators provide visibility into areas where credit ratings do not cover, but also frequently miss events actually detected by Merton models! Low correlations and high false positive rates vs. historical event distributions suggest additional validation needed to achieve a defendable degree of confidence for SOX and/or Basel II compliance. Institutional Risk Analytics

10. Modeling Alternatives • Path 1: Modify Existing Credit Models to Cover Outlier Behavior Risks • Addition of new factors then recalibration of Regression-Scoring Models. • New modeling to account for “market inefficiency” risk to correct assumptions of Merton models. • Firm Specific Event Risk Modeling for Cash-Flow Simulations. • Path 2: Add a specific behavioral risk profile to capture and score subjects exceeding profile boundary. • Add specific fundamental factors to risk rating profile. • Create/maintain fundamental profile to demonstrate diligence regarding operational factors. Institutional Risk Analytics

11. Ratings System Design Legal Filings Source Data Agency Policy Statements Numerical Benchmarks Academic and Industry Treatments Selection of Test Methods And Metrics Temporal Trends Peer Comparisons Objective: select a test set that covers the relevant risks. Institutional Risk Analytics

12. The Ratings Game • To validate any risk management system, must benchmark projections against actual. • Advantage of a common approach to risk taking and risk management is that business performance becomes expression of both. • By examining financial performance in detail, can assemble a profile of business and operational factors. Institutional Risk Analytics

13. Ratings: Basel II Institutional Risk Analytics

14. Basel II Bank Metrics • Business Performance: • Profitability, productivity, solvency; actual vs. projected vs. peers. • Credit Risk Factors: • P(D), LGD, M, EAD in aggregate and by key lending classes; actual vs. projected vs. peers • Operational Risk Exposure: • Management decisions and external factors generating out of “norm” events; actual vs. projected. Institutional Risk Analytics

15. Summary Risk Profiles Basel II: A qualifying IRB rating system must have two separate and distinct dimensions: (i) the risk of borrower default, and (ii) transaction-specific factors. Institutional Risk Analytics

16. Basel II Risk Modeling Performance “Norm” Tolerance Limit IRB Model Prediction falls within target range. Excessive deviation triggers PCA to recalibrate IRB modeling system. Actual Value Institutional Risk Analytics

17. Basel II Credit Metrics Institutional Risk Analytics

18. Mark to Actual • Use enhanced internal metrics to set up a closed loop assurance function to ensure that bank IRB systems that rely on forward projection statistics are marked to actual.    • Control loop can be used both internally by risk officers and auditors, and externally by regulators, to ensure a healthy system of checks and balances. Institutional Risk Analytics

19. Macro Implications • Basel II credit risk reporting factors will become a de facto standard for comparing all banks among credit analysts and buy-side investors. • Basel factors will be used to streamline regulation, explain operating policy, and facilitate peer comparisons. Banks will rate themselves in real time vs. Basel projections. • Periodic reporting will eventually move to monthly frequency. Internal systems will “mark to actual” vs. real time call report. Institutional Risk Analytics

20. Basel II: M&A Effect Institutional Risk Analytics

21. Macro Implications • Bank risk estimation methods will be benchmarked and certified against legal filings of periodic regulatory reports, providing a very clear and very public measure of performance. • Prompt corrective action (PCA) to eliminate excessive deviations between models and filings will become a key regulation mechanism. • Institutions that excel at execution and managing the rate of external events will win the competitive race. Institutional Risk Analytics

22. Basel II: P(D) Profile Institutional Risk Analytics

23. Ratings: C&I Profile Institutional Risk Analytics

24. Selected C&I Metrics • Business Performance: • Profitability, productivity, solvency, actual vs. projections, and vs. peers. • Risk Factors: • Behavioral analysis, earnings & assets quality, long-term business and competitive trends. • Operational Risk: • Quality of management decisions and external factors generating out of “norm” events, audit, governance. Institutional Risk Analytics

25. Summary Risk Profiles Source: IRA Corporate Monitor/CoreData/S&P Based on the assessment of these and other factors, the risk manager may then assemble an independent rating for the subject companies. Institutional Risk Analytics

26. C&I Profile Visteon Corporation (millions) Source: IRA Corporate Monitor/CoreData Based on the assessment of these and other factors, the risk manager may then assemble an independent rating for the subject companies. Institutional Risk Analytics

27. Analytical Challenges • There are 20 million companies in the US, but only 15,000 are public. • Credit officers frequently rely on “mutual revisions” rather than maintain informed, independent credit opinions, especial on “in-betweens.” • Must extend range of default prediction tools from current 20% probability to 50%, in particular to detect fraud, restatement. Institutional Risk Analytics

28. The “In-Betweens” Institutional Risk Analytics

29. ERM Challenges • Structuring the collection and warehousing of information including the migration and sweetening of existing historical data. • Achieving Advanced IRB compliant end-to-end risk analysis systems deployed at enterprise level by the 2007 date for Basle II start. • Workable expense containment strategies that increase rate of data throughput and analysis, but lower “per transaction” cost. Institutional Risk Analytics

30. Who is Institutional Risk Analytics? • IRA is part of a movement within the financial analytics community to broaden risk measurement tools to include behavioral elements described by fundamental factors. • IRA builds customized risk systems for processing public & privileged data, and publishes research on companies and topics affecting financial policy & regulation. Institutional Risk Analytics

31. Corporate Offices Lord, Whalen LLC dba Institutional Risk Analytics 14352 Yukon Avenue Hawthorne, California 90250 Tel. 310.676.3300 Fax. 310.943.1570 info@institutionalriskanalytics.com WEBSITE: www.institutionalriskanalytics.com For inquiries contact, R. Christopher Whalen Managing Director Head of Sales and Marketing Tel. 914.827.9272 Fax. 914.206.4238 Cell. 914.645.5304 cwhalen@institutionalriskanalytics.com Contact Information Institutional Risk Analytics