Business Continuity & Risk Risk & Resilience in Today’s Economy

1. Business Continuity & RiskRisk & Resilience in Today’s Economy Presented by Alexander C. Tabb Partner TABB Group

2. Agenda • Introduction • House Keeping • Market Trends • Market Wrap Up • Volatility • Impact • Risk & Resilience • Defining Risk • Developing more resilient operations • Concluding Thoughts

3. Risk & Resiliance

4. Over the past year the global markets have retrenched significantly 0% DAX Korea India S&P China FTSE HK CAC Japan Source: Yahoo! Finance

5. Most of the major investment banks stocks have been hammered . . . 0% JPM CS GS DB UBS MS Source: Yahoo! Finance

6. Volatility recedes from record highs, though it is still at significantly increased levels Intraday high 10-24: 89.53 Closing high 11-20: 80.86 Source: Yahoo! Finance, TABB Group

7. Leverage has already come down over the last two years and we expect further declines Leverage Used Two year Leverage Outlook -24% 91% Decrease 7% 2 Year CAGR Increase 14% Same 48% -18% -19% Uncertain 31% Source: TABB Group “Hedge Funds 2008”

8. Impacts to the market . . . • Significant rethinking of market structure with less “Major” participants • Bear Stearns • Lehman bankrupt => Barclays, Nomura • Merrill Lynch =>BoA • Morgan Stanley was in talks with Wachovia and China, Japan . . . • US Gov’t & Others?? • Major layoffs within all areas of the Financial Service sector • Many firms laying off at least 5% to 8%,if not more • Reassessment of risk throughout the industry • Focus moving away from physical risk towards financial and systemic risks • Recent events refocusing nations approach to the financial sector • Major scandals have significantly impacted confidence levels • Washington eyeing significant changes to the regulatory environment • Changing regulator roles for the Fed & SEC (Fed , SEC ???)

9. Impacts on continuity & security • Firms looking to downsize their exposure to risk while limiting their expenses • Re-assessment of roles & responsibilities • Re-alignment of resources • Downsizing of staff • Major staff reductions within the continuity environment • Larger firms looking to ‘right size’ their risk exposure • Smaller firms looking to ‘right size’ their business (>AUM = >$$$) • Technology spend impacted • Firms looking to delay major investments in technology until the sector has a better understanding of the future • Physical Security having to do more with less • Physical risk environment remains unchanged; however less resources available to meet the challenges that exist • Tempting fate ? ? ?

10. Risk & Resiliance

11. Defining Risk. . . • Can you define Risk? • Risk means different things to different people, different organizations and sectors • Defining risk properly is critical when it comes to understanding risk • Risk within financial services sector, risk has been dominated by the ‘Quants’ • Quants – term developed to describe those within the sector who use complex mathematical simulations to define and manage risk • Utilize models such as VaR to better understand & manage the impact of risk

12. Defining Risk. . . . • Infrastructure: Risk – transport for staff, power supply, suppliers, business relationships with partners, dependency on internet and email • Counterparty Risk – The risk associated with the financial stability of the party entered into contract with • Portfolio Risk – The risk related to a portfolio or grouping of assets • Currency Risk – The risk that the value of a financial instrument will fluctuate due to changes in foreign exchange rates • Geopolitical Risk – Any financial or other risk that stems from the possibility of a nation changing its policies • Legal and Regulatory – Risk associated with a change in the laws or regulations affecting a transaction • Environmental Risk – Risk associated w/power consumption & pollution • Political Risk - Political constraints like a change of government • Reputational Risk – The risk associated with the of loss of brand image, or stakeholders’ support • Systemic Risk – The risk which is common to an entire market and not to any individual entity or component

13. Defining Risk. . . • The truth about risk. . . • Risk does not always equate to reward • There a multiple ways to view risk; with each sector using different approaches (risk modeling) • Everyone wants to mitigate their risk; however risk mitigation has its own risk? • Cost, concentration, effectiveness, etc. • Distance & risk are linked (both physically & conceptually) • The closer you are to the risk, the more tangible it becomes • Risk & risk management are asymmetrically linked

14. Defining Risk. . . • There are many ways to try measure risk • Risk Modeling: VaR (and others) • Value at Risk – is a system for modeling risk • Oftentimes equated as a number or value; it is in fact more about the measurement than the resulting number • Has received a great deal of criticism of late. . .heavily used, highly controversial (at the moment) • The challenge with VaR and other models are that they produce objective measurements from subjective data. • VaR suffers from the same challenges that face all risk assessment and measuring tools. . . Risk Measurement is subjective

15. Defining Risk. . . • Another Risk Management tool. . . • Risk Assessment & the BIA • Common place tool used throughout physical risk mitigation • Oftentimes attempts to achieve the impossible. . . wrapping up physical risk is a one-size fits all effort • Can be effective is implemented and utilized properly (similar to risk modeling) • Can be corrupted by the process. • Nobody wants to hear “their baby is ugly” • Many ways to measure risk • Risk assessments • Risk maps • Homeland Security Threat Advisory system

16. Defining Resilience . . . • As with risk, resilience means different things to different people • What constitutes a resilient operation • Operational resilience has been the bastion of continuity & security professionals • Focus has been on physical & technology risk mitigation • Operational plans • Technology • Physical Security (manpower & technology) • Crisis Management & Incident Response

17. Achieving Resilience . . . • Historically, risk has been allocated into individual baskets; with individual managers responsible for their portion of the pot • Risk Management within the industry received a great deal of resources, but . . . • Chief Risk Officer solution never achieved its goals • Risk to wide a field for one person to manage effectively • Too many competing interests; and technical challenges to be vested in the hands of one person • Effective CRO’s were the exception not the rule (highly dependant upon personality)

18. Achieving Resilience . . . • What is the role of risk management moving forward? • Identify, measure and hedge risk? • Identify challenges and develop contingencies? • New models being developed • Movement towards Risk Management Committee • Representatives from all risk mitigation fields • LOB’s, Security, IT, Compliance, Business Continuity, etc • Too early to determine if this new model is the way of the future. . .

19. Final Thoughts

20. Final Thoughts • Risk is going to be the hot topic for some time to come • Who will manage risk in the future is still undecided (moving away from the CRO) • Risk models are like any other tool, they have a use. • Firms need to better understand the role of risk modeling • They need to use the information contained within the model properly • Vigilance is key. . . • Events will continue to occur, and risk will always be a factor in the markets (macro & micro)

21. Business Continuity & RiskRisk & Resilience in Today’s economy Alexander C. Tabb Partner, TABB Group ATabb@Tabbgroup.com 646-747-3204