INTEGRATED RISK PROFILE RÉGIME DE RENTES DU MOUVEMENT DESJARDINS (RRMD)

1. INTEGRATED RISK PROFILE RÉGIME DE RENTES DU MOUVEMENT DESJARDINS (RRMD)

2. RRMD: the numbers tell the story Over 500 employers 35 900 active members 6 600 pensioners 12 000 in 2014 $5.5 B $10 B in 2014

3. RRMD – Governance model Three-year strategic plan Annual business plan: 39 initiatives in 2008 Governance plan (internal by-laws): accountability Financing policy Investment policy and risk budget Matching study A “strong” pension committee

4. RRMD – Objectives of integrated risk profile Even better governance Ultimately, increase the RRMD’s viability Ensure that all risks are known and dealt with Keep the plan’s overall risk at an acceptable level

5. RRMD – Steps 1st step • RRMD head office creates a risk inventory (90 risks) • Search for experienced consultant • Create an integrated risk profile (2006) 2nd step (2007) • Review risk profile • Develop a trend chart

6. Risk management core concepts What is risk? • An inherent risk is the expression of the likelihood and impact of an event or a specific set of circumstances before controls are taken into consideration. An inherent risk takes into account the organizational situation and the operating environment underlying the organization or unit. • A residual risk is the level of risk remaining with the potential to influence the achievement of an objective or outcome, once the controls and other mitigation measures have been taken into consideration.

7. Integrated risk management Definition • Integrated risk management (IRM) is a series of management practices supported by a risk culture that make it possible to assess, communicate and manage risk according to the organization’s risk profile and the opportunities available to it.

8. IRM framework

9. Integrated risk management IRM helps take risk management beyond the level of individual activity or functional silos, such that: • risks can be assessed horizontally throughout the plan • risks can be assessed vertically(i.e. at multiple levels) within the plan • all types of risks (strategic, operational, financial, etc.) are examined in such a way as to understand the full extent of the exposure to risk • risk management is incorporated in the planning and decision-making process within the plan

10. Definition of RCSA process • Structured approach geared to specific expertise of plan stakeholders (risk and control self-assessments) • Complementarity of facilitators thanks to their experience and outward-looking approach (independence, impartiality, knowledge of what’s being done elsewhere and recognized risk management managers) • Participants are valued equally, irrespective of their hierarchy in the risk determination and assessment process • The RCSA process helps make decisions to manage risks

11. Typical steps in an RCSA • Defining the action framework • Defining the templates and scales • Collecting and analysing the information available on the plan • Defining the risk categories • Identifying, defining and classifying the risks • Identifying the assessment scales • Setting up assessment workshops (interactive votes) • Drafting the final report (risk maps, analyses, etc.) • Providing support in carrying out actions(trend charts, action plans, risk indicators, etc.)

12. Collecting and analysing information on the plan By analysing the existing documentation and conducting interviews, the following is identified: • Events (cases occurring in the plan or in the industry, incidents that almost happened,...) • Risk factors • Inherent risks • Controls There is a convergence of the inherent risks with the controls assigned to them

13. Risk and control self-assessments • Presentation of inherent risks with associated controls • Self-assessment of each risk through votes to determine: • impact (financial, objective, clients/partners, employees, reputation, sanction) • frequency and likelihood (number of incidents, qualitative observations) • exposure = √(impact*frequency or likelihood) • effectiveness of controls currently in place • residual risk = √(exposure*effectiveness of controls) • trend • strategy to adopt (accept, mitigate, transfer, avoid)

14. Results of an RCSA • Once the strategies have been chosen (accept, mitigate, transfer or avoid), managers define the action plans • An action plan includes corrective measures, the person responsible, a schedule and the strategic objective involved • Indicators (risk levels and trends, appropriateness of controls, maps,...) support the decision-making process • Development / updating of a trend chart for risks • The trend chart is used to track changes in risks and categories based on changes in various indicators

16. Definition of major risks

17. Definition of major risks (cont’d)

18. Advantages of IRM • Improves the decision-making process, strengthens the organization’s governance, increases the ability to achieve objectives and narrows the gap between perception (of the plan) and reality. • Enables organizations to take advantage of optimization opportunities, take charge of their development and protect tangible and intangible organizational assets. • Helps improve results by managing risk proactively. • A tool to improve resource allocation according to the relative importance of the risks

19. The IRM process is an ongoing one • The evolution of risk changes according to internal management, industry and other factors. Consequently, the plan’s risk profile is not static; rather, it evolves within its environment. • This evolution must be monitored and controlled to ensure continuity of activities. • The process gains by being continuous and dynamic. It offers tools and a flexible methodology to facilitate risk management over time. • Makes it possible to develop trend charts that help the plan track changes in risks and the impact of these risks on the ability to achieve objectives.

20. Success factors • A commitment on the part of management and the pension committees, with clear guidelines that are effectively communicated • Solid functional leadership • A risk culture shared throughout the organization • Targeting of risk areas • A method of training and support geared to “learning through action”