MMC/NERA Operational Risk : An Assessment of Global Market Practices March 18, 2003

1. MMC/NERA Operational Risk : An Assessment of Global Market Practices March 18, 2003

2. Table of Contents • Introduction • Approaches to Operational Risk Management • Capture of Operational Risk Loss Data • Capital Allocation for Operational Risk • Transfer of Operational Risk • Conclusions

3. Introduction

4. NERA Is A Marsh & McLennan Company (MMC) MMC Total 2001 Revenues: $9.9 billion Risk & Insurance Services 2001 Revenue: $5.2 Billion Investment Management 2001 Revenue: $2.6 billion Consulting 2001 Revenue: $2.1 billion • Mercer Management • Consulting • Strategy Consulting • Analysis and expertise in strategic risks • Analysis and expertise in supply chain risks • Modeling and research capabilities forbusiness risks • Marsh • Insurance Broking & Risk Management Services • Insurance broking and advice • Risk control and business continuity planning services for operational, property, casualty andIT risks • Risk information systems and technology • Structuring and placement of innovative riskfinancing alternatives` • Putnam Investments • Investment Services • $328 Billion in assets managed (average 2001) • International portfolio management • William M. Mercer • HR Consulting • Advice and services to manage HR risks • Advice and services to manage treasury risks • Guy Carpenter • Reinsurance Broking & Services • Reinsurance broking advice and services • Sophisticated natural hazard modeling • Guy Carpenter Catastrophe Index • Instrat - Dynamic financialmodeling for insurers • National Economic • Research Associates • (NERA) • Economic Consulting • Risk Assessment and Analysis • Risk Modeling and Valuation • Mitigation Strategy Design and Execution • Legal Liability and Regulatory Advisory

5. Introduction:Operational Risk Capabilities • MMC has assembled an Operational Risk Team from experts across its different entities in an effort to provide cutting edge expertise and advice for its clients on the complex and ongoing issue of operational risk. As part of this effort the MMC Operational Risk Team has been developing a number of tools to assist its clients in the financial sector in addressing some ongoing concerns related to operational risk, including: • Operational Risk Management Benchmarking Project • MMC Operational Risk Loss Event Database • Analytic quantification methods for Operational Risk within financial institutions incorporating qualitative and quantitative estimation techniques • Analysis of insurance effectiveness for covering operational risk

6. Introduction:Review of Global Operational Risk Benchmark • MMC’s Operational Risk Management Global Benchmark study was conducted in two phases. Phase I sought to provide comparative data on current operational risk management practices at financial institutions and identify likely trends in the industry as captured in four distinct categories: • Approaches to Operational Risk Management (people, processes and systems) • Capture of Operational Risk Loss Data • Economic and Regulatory Capital Allocation • Risk Transfer • During Phase I, over 75 interviews were conducted in conjunction with written questionnaire surveys with global banking institutions. Interviews were conducted worldwide between June, 2002 and August, 2002. Participating institutions were located in the United States, Canada, Europe, Japan, Australia and South Africa. • MMC presented results to the Risk Management Group of the Basel Committee on Banking Supervision in Paris in September, 2002. • MMC presented individual benchmark presentations to 45 participants

7. Introduction:Phase II Study • MMC’s Operational Risk: Emerging Best Practices Study seeks to provide regulators and participating firms extended data on outstanding issues relating to operational risk management. These issues include industry practices in resources and processes, the development of economic capital allocation models for operational risk, and the inclusion of insurance mitigation in operational risk management practices. • Over 30 interviews were conducted with global banking institutions during phase II resulting in NERA having conducted over 100 interviews over both studies. The Phase II institutions were selected from the Phase I study for follow-up due to their robust thinking in operational risk management. Interviews were conducted worldwide between December, 2002 and January, 2003. Participating institutions were located in the United States, Canada, the United Kingdom, Europe, Japan, and Australia. • Throughout both studies, MMC presented results to individual country regulators including: • The Federal Reserve System (New York and Washington, DC) • Office of the Comptroller of the Currency (OCC) • Bank of Japan • Canadian Office of the Superintendent of Financial Institutions (OSFI) • Financial Services Authority • De Nederlandsche Bank • Deutsche Bundesbank • Australian Prudential Regulation Authority

8. Participating Institutions

9. Approaches to Operational Risk Management

10. Resources in Centralized Operational Risk Management Function • Firms have agreed on common definitions with the Basel Committee and have subsequently established independent operational risk functions. • Other than the smallest domestic banks, firms have enacted operational risk management functions universally.

11. Resources in Centralized Operational Risk Management Function • Firms have bolstered their operational risk management functions over the past few years, and many believe they have reached a critical mass. • Around 80% of firms in the study have more than 5 people employed at the corporate level in the centralized operational risk management function. This number tends to be bolstered even more with other support functions who have the identified operational risk management duties. These typically include: • IT support and programmers • Information security • Centralized security • Insurance

12. Extent of Operational Risk in Business Decisions • 63% of the banks responding said that operational risk was considered in overall business and strategy decisions. • A number of methods of consideration were noted, though the most common were methods based on examination of how the economic capital charge for operational risk would be impacted by a change in business plans/strategy. • A large number of the respondents noted that before a new business or product is launched it must undergo an operational risk assessment. • A few banks noted that operational risk attracted special attention in considering and managing acquisitions.

13. Comparisons & Progress Over the Last 6 Months • Firms use operational risk considerations in strategy decisions to a similar extent as firms with strategic policies outlined in the Phase I Study. The same firms that outlined such policies in Phase I, now implement those policies in strategic decision-making. • In the Phase I study, 67% of the firms cited policies that outlined operational risk management use in overall strategic objectives. • The assessment of policies outlining strategic objectives and subsequent strategic considerations resulted in the following breakdown from the same 24 firms in Phase I and Phase II of the study. PHASE IPHASE II

14. Operational Risk Reports • Firms’ operational risk reporting varies widely but always includes some cut of senior management, usually through an operational risk committee. • Business Units are often integral in creating the reporting, often being derived from risk self-assessments or collection efforts from the business units. The dissemination is usually through individual Business Unit Managers. • The 17% who do not provide reports to business units largely have fundamentally and geographically diverse business lines – the reports created are general company-wide reviews and the business lines are left to their management to decide unit reporting. • All Boards of Directors are aware of operational risks, though several firms are waiting for data and review experience to support ongoing reporting to the Board.

15. Comparisons & Progress Over the Last 6 Months • Firms have extended their operational risk reporting to include all firms reporting to senior management and extensive reporting to the Board of Directors. • The reporting lines noted in both studies resulted in the following breakdown from the same 24 firms in Phase I and Phase II of the study. PHASE IPHASE II

16. Operational Risk Reports • Operational risk reports that usually are presented to an operational risk committee are often only changed slightly for the Board of Directors and business unit documents. • At around 25% of the firms, reports were given quarterly to risk committees though firms ranged from monthly to annually. • More than half of the operational risk reports to the Board were presented annually as a section of the risk report and quarterly as a review from a group-wide risk review. • Reports typically included: • Analysis and commentary on the operational risk environment, including Basel initiatives • Top operational risks for the group and specific business units’ risks • Representations of risk controls/action plans to combat the stated risks • Reports of specific losses, causes and outcomes • Reports of loss database developments • Reports of self-assessment data • Expectations and “hot spots” for future operational risk management

17. The Use of Self-Assessments • The depth and detail of the self-assessments varied by firm and often varied within business units. The use of self-assessments in capital allocation signaled more depth and accuracy as business units were incentivized by capital allocation. In general, self-assessments were used to: • Creates scenarios for deriving distributions in a capital allocation model • Act as the basis of scorecards for business units, often adjusting business unit specific capital allocation • Monitoring tool for management, and contributor to expert scenario analysis for risk control • Act as the basis of allocating an aggregated pool of capital across the business units • Promote sound operational risk management that identifies problem areas and initiates action plans

18. Description of Risk Scorecards • 67% of banks interviewed are currently using scorecards as a tool in managing operational risk. • 15 of the 19 firms that have current self-assessment programs, also utilize scorecard systems. • Scorecards give some firms a way of viewing risk versus the mitigants of risk, as well as probability and severity. It is used simply to find where inherent risks are high and where controls are not commensurate with the risk.

19. Comparisons & Progress Over the Last 6 Months • Only 36% of all firms in the Phase I study used risk self-assessments or scorecards to help determine economic capital for operational risk. • A comparison of banks that participated in both studies reveal that at least pilot scorecard and self-assessments have been implemented where banks had planned to implement them. • The consideration of risk self-assessments or scorecards in capital allocation models resulted in the following breakdown from the same 24 firms in Phase I and Phase II of the study. PHASE IPHASE II

20. Key Risk Indicators, Risk Thresholds & Limits • The majority of banks interviewed currently use Key Risk Indicators (KRIs) to manage operational risk on an ongoing basis. All of the banks that do not use Key Risk Indicators are either in the process of identifying and implementing them or are planning to undertake an effort to develop them in the foreseeable future. • Banks are in the process of monitoring potential firm-wide KRIs, often relying on their own business units’ experiences in collecting KRIs.

21. Comparisons & Progress Over the Last 6 Months • The use of key risk indicators to proxy operational risk exposures in the ongoing management of operational risk has expanded over the last six months. • 54% of the firms that were in both studies were not actively using key risk indicators in Phase I, while the percentage dropped to just 29% who were not using them in the Phase II study. • The use of key risk indicators resulted in the following breakdown from the same 24 firms in Phase I and Phase II of the study. PHASE IPHASE II

22. Capture of Operational Risk Loss Data

23. Operational Risk Loss Events: Types, Examples • Most banks have begun collecting operational risk loss data generally adaptable to Basel guidelines:

24. How Long Have You Been Capturing Losses? • Most firms have begun to systematically collect operational risk losses within the last 3 years – all firms with systems in place longer than that have generally just adjusted general ledger systems and use historical GL collections within the database.

25. Capture of the Basel Committee’s Historical Window • Most firms do not yet have the three years of historic data proposed by the Basel Committee, although many have just started the data collection process and plan on having the historical data by 2006. • “We question the veracity of going back to get data that far in the past, so while we don’t have the three years of data now, we will have it by 2006.”

26. Breadth and Scope of Data Collection Efforts • 52% of banks surveyed in Phase II have all business units currently contributing to their operational loss databases. The majority of banks placed the ultimate responsibility on each business unit to report losses. • While the thresholds for losses collected by banks varied from as high as $10,000 (US) to as low as one penny, the majority of banks are collecting all losses regardless of size. • Some firms are struggling with issues related to timing. Firms expressed confusion on accounting for the date of a loss: on the day that the event occurs, the day that the bank finds out about it, or the date that the full loss is realized.

27. Comparisons & Progress Over the Last 6 Months • Since the Phase I Study, firms have implemented more definite operational risk management plans resulting in broader resources, reporting and database development. • The assessment of breadth of data collection resulted in the following breakdown from the same 24 firms from Phase I and Phase II. PHASE IPHASE II • Losses are now collected by all of our Phase II participants, with over half of the participants believing that their collection processes are complete. • The utilization of operational risk considerations in business decisions is growing slowly, but has maintained its importance in merger and acquisitions analyses.

28. Determination and Tracking Losses in Market and Credit Risk • Firms were generally evenly split in their method for dealing with operational losses associated with market and credit risk, and several noted the need for further regulatory guidance on the issue. • The method for tracking operational risk losses associated with market and credit risk that is used by around a third of the firms is earmarking those events having an operational risk component to them but leaving them in the credit or market risk bucket for economic capital purposes. • Earmarking these losses allows for both the ability to recognize the need for additional controls, and the opportunity to retroactively parse out operational risk losses once a clearly defined policy is put into place.

29. Capital Allocation for Operational Risk

30. Approaches to Calculating Economic Capital • Firms have taken two different approaches to creating distributions for modeling economic capital: • Some firms have implemented a loss distribution approach based mainly on internal data, external data or most often some combination of both. • Other firms have implemented a loss distribution approach based mainly on scenario analysis, often taken from risk and control self-assessments: • Some scenarios are developed from analyses of internal loss events • Other scenarios are developed from analyses of external events with some rough scaling and filtering of possible events. • The few firms that have not implemented a model for capital distribution are moving towards one of these methods this year.

31. Analysis of Loss-Data based Loss Distribution Approaches • Of firms that use a loss-data based loss distribution approach, most firms do not have the depth of internal data to create a full distribution of losses and therefore use a combination of internal and external data. • Most firms are using at least a 99.9% confidence interval over a one-year holding period. Some firms are setting their confidence interval in such a manner so as to maintain corporate ratings • While basing the approach on loss data, these firms often still use risk self-assessments and scorecards systems to give management a reflection of the internal controls and the likelihood of a tail event in a given business line. Most firms will then adjust the capital allocation as a reflection of the qualitative assessments and use those as incentives for business lines.

32. Analysis of Scenario Based LDA Calculations • Of firms that use a scenario-based approach, nearly 70% of the firms derive scenarios from a self-assessment process, while the remainder do top-down scenarios elicited from senior management. • All of the firms in the study have collected internal operational risk losses though firms using scenario approaches have used the loss data in different ways: • As support for framing of scenarios in the self-assessment process or in reviewing and auditing self-assessments some firms have used the data to back-test and validate their scenario analyses.

33. Comparisons & Progress Over the Last 6 Months • Since the Phase I Study, firms’ economic capital allocation models have evolved with much more emphasis placed on quantitative approaches relying on loss data. • In the Phase I study, 29% of the firms used loss-data based distribution approaches (Quantitative), while that number jumped to 46% several months later. • The assessment of capital allocation models resulted in the following breakdown from the same 24 firms in Phase I and Phase II of the study. PHASE IPHASE II • The evolution of loss databases in the last half-year contribute to the loss-data based LDA approaches taken in Phase II of the study.

34. Use of Internal Data • All firms in the study are currently collecting internal data and plan to use it in operational risk modeling by 2006. • However, today only half of the firms in the study are currently using internal data in their economic capital allocation models: • 50% of the firms use internal data as a direct input into a distribution model. Some firms use internal data exclusively, while others use it as a very small input into a more diversified distribution • 25% of the firms are collecting data with the expectation that it will be useful for modeling after several more year’s worth of data for depth and breadth of operational risk losses • 25% of the firms use internal data to support internal scenario analysis as well as to validate or back-test the expectations generated from different models; these firms also expect to use internal data as a key input in future capital allocation models

35. External Data – Comparisons & Progress Over the Last 6 Months • Nearly 80% of firms in the study use external data, while the vast majority of those firms use it to simply benchmark themselves. • Most firms still have problems filtering and scaling external data, making the use of it in modeling difficult. • The consideration of external data utilization in capital allocation models resulted in the following breakdown from the same 24 firms in Phase I and Phase II of the study. PHASE IPHASE II

36. Recognition of Internal Control Factors • 54% of the banks surveyed adjust their economic capital allocation for operational risk according to some measurement of the effectiveness of internal controls • Most of those banks that did not account for internal controls in their economic capital allocations were planning on instituting some adjustment in the future, though a few banks did not see any value in the exercise. • A number of banks insisted that the ability to reduce capital in this manner provided a good incentive for banks to improve their controls.

37. What Constitutes a “Tail” Risk? • 67% of the banks surveyed acknowledged using a confidence interval of around 99.9% with a one year holding period to define their “tail” risks. • While the majority of these banks simply picked this metric off of their loss distribution, some banks, used expert estimates of worst case scenario losses as the 99.9% risk event to define the parameters of their distribution. • Many banks used confidence intervals of greater than 99.9% to remain in accordance with corporate risk management guiding principles.

38. Transfer of Operational Risk

39. Use of Insurance in Operational Risk Management • The utilization of insurance to mitigate operational risk is an evolving issue that most firms have not reached a consensus on, but which all firms agree should have a place in the future of operational risk management. • Outstanding issues remain in the development of insurance as a mitigant in operational risk. These issues include: • The development of modeling capabilities is evolving and thus how to include insurance in the models is unclear. • The regulators have yet to identify the extent to which insurance will be included in the mitigation of operational risk capital. • It is difficult to purchase insurance right now in the markets with very high deductibles and premiums. • There is no singular definition for a tail event, and while it includes fraud in some cases, in other cases large property losses from weather-related events are considered the worst-case scenarios. • Finally, there is a split in the analytical rigor of firms, some of whom develop sophisticated quantitative modeling, while others believe traditional and conventional approaches to insurance are currently sufficient to meet mitigation requirements.

40. Use of Insurance as a Mitigant in Calculating Economic Capital • The utilization of insurance mitigation in capital allocation models is now beginning to grow with over a quarter of the firms in the study considering its effects in their internal models. • The timing of when it is considered varies from independent inclusion into Monte Carlo simulations to qualitative consideration by business units during the self-assessment process. • “For each category and each department, we have the loss data and the insurance appropriate to that category and the coverage and limits on lower and upper parameters.” • “In the self-assessment process, the business units should tell us how the risks are mitigated by insurance and report only a net risk.”

41. Comparisons & Progress Over the Last 6 Months • Since the Phase I Study, firms’ economic capital allocation models have evolved resulting in much more focused consideration of the risk-mitigating effects of insurance. • 57% of all the firms in the Phase I study did not know or did not respond to the extent which insurance reduces economic capital, with only 12% saying it worked in their capital allocation models. The remaining 31% of firms noted no reduction from insurance mitigation. • The consideration of insurance into evolving models resulted in the following breakdown from the same 30 firms in Phase I and Phase II. PHASE IPHASE II • The 41% of firms in Phase I with no expressed view have now formed their positions which trends towards more inclusion of insurance in the economic capital models.

42. Mapping of Insurance into Loss Event Types • Most firms acknowledge that they track the types of insurance available and the types of events they cover, but most have not formally mapped those to specific loss event types. • Some firms have not mapped insurance because of time constraints while other firms note that insurance policies can fall into multiple categories, making the exercise moot.

43. Operational Risk Losses and Insurance Performance • Firms have encountered a large variety of operational risk losses, with insurance performing well within its expectations. • Most firms are not experiencing the large losses from which they could evaluate the effectiveness of insurance in major tail risk situations, but insurance has performed well in addressing losses actually encountered. • Smaller firms contend that their tail events are not large enough to warrant buying the high deductible insurances, but rather consist of unexpected property losses or system breakdowns. • Insurance has performed very well in traditional policies, including resounding support for the property insurance regarding World Trade Center losses. • Typical loss experiences include: • Property damages from various sources including external events and fire • Weather-related property losses due to floods, tornados, etc. • Internal fraud • External fraud

44. Operational Risk Losses and Insurance Performance • Firms have encountered some losses that are not insurable or lawsuits that have made recovery untimely or unattainable. • Several firms have encountered regulatory fines as their largest operational risk losses and there is no insurance available to protect against that risk. • Firms contend that the lawsuits necessary to recover losses from some events are prohibitively expensive, resulting in a loss because recovering it would cost more than the loss itself. • The markets are so expensive in insurance right now that most firms feel the insurance industry needs to work with them to try and meet their evolving operational risk needs, though several firms remain skeptical of insurance offsets. • Typical loss experiences include: • Trading losses due to untimely execution • Regulatory fines • Credit default events • Reporting errors • Various lawsuits

45. Conclusions

46. Conclusions • Financial institutions’ approach to operational risk management has been evolving rapidly over the past 6 months, and emerging best practices have resulted in several key areas: • Resources are growing to a critical mass • Reporting has grown and familiarity with operational risk is pervading the banks • Self-assessment systems and data collection have been implemented in preparation for 2006 • Two disparate approaches have been adopted in economic capital allocation, though firms vary widely still on how they incorporate self-assessment data, scorecard data, internal and external loss data, key risk indicators and insurance considerations. The two approaches are: • A loss data-based Loss Distribution Approach • A scenario-based Loss Distribution Approach • Insurance is beginning to be incorporated into capital allocation models, and has performed well in many ways, though its utilization in operational risk management is still largely undetermined.

47. Contact Information • Robert Mackay Senior Vice President National Economic Research Associates, Inc. 1255 23rd St., NW Washington, DC 20037 Tel: (202) 466-9291 Email: Robert.Mackay@nera.com.com • Bradley P. Ziff Vice President National Economic Research Associates, Inc. 1166 Avenue of the Americas New York, NY 10036 Tel: (212) 345-7717 Email: Bradley.Ziff@nera.com.com • Geremy Connor Analyst National Economic Research Associates, Inc. 1166 Avenue of the Americas New York, NY 10036 Tel: (212) 345-6773 Email: Geremy.Connor@nera.com • Chris Bolton Analyst National Economic Research Associates, Inc. 1255 23rd St., NW Washington, DC 20037 Tel: (202) 466-9205 Email: Christopher.Bolton@nera.com.com