Enterprise Exposure Management What Does This Mean for Internal Controls

1. Return to Risk LimitedWebsite atwww.RiskLimited.com Enterprise Exposure ManagementWhat Does This Mean for Internal Controls Kevin R. Rose October 2004

2. Energy Industry Under Siege • 2004 Industry Environment • Federal/State governments (Sarbanes Oxley and FAS 133) • Continued scrutiny from investors • Wall Street credit rating agencies • Increased financial transparency • Enterprise - wide risk across multiple commodities and operations

3. Enterprise Exposure Management • Ability to construct an overall risk/credit portfolio framework that enables a company to achieve profit targets by taking controllable risks • Fully addressing EEM requires decision-makers to have corporate – wide access to mission critical data in real time • Redefining organizations to be able to identify, measure, and manage new risks across the entire enterprise

4. Challenges to the Energy Industry • The challenge posed by today’s environment, is that energy organizations have multiple energy operations, business processes, and management systems, from front to back office, for multiple commodities. • As a result, when companies go about the task of managing, monitoring, reporting and controlling exposure, they rapidly begin to see that there are major business process and technology issues that must be addressed.

5. Key Issues Surrounding EEM: • Exposure Management Strategy • Exposure Management Control Process • Exposure Management Infrastructure • Exposure Management Systems

6. First Steps • Develop a Plan • Business strategies and capabilities • Strategies to capitalize on new market opportunities • Marketing and supply strategies • Competencies and infrastructure

7. Development of an EEM Plan: • Identifies current situation within business processes and technology assessment • Identifies any gaps within the current business processes and technology practices • Identifies business processes and technology opportunities

8. Questions:Does Our Company have… • Clear definition of its objectives? • Specified goals that are required to meet the objectives? • An adequate assessment of its market readiness: business processes, operations, resources, and technology/systems?

9. Questions:Does Our Company have… • Precise understanding of its motivation? • Proper internal and external business models? • Logical expectations of the results?

10. Business Strategies and Capabilities • Define Your Objectives • Set Goals to Meet the Objectives • Business Processes, Organization, and Infrastructure Assessments • Risk Profile / Strategy

11. Guiding Principles for EEM Program • Governance Structure • Process/Procedures • Trading Authority Levels • Optimization - Exposure Limits • Credit Risk Controls • Monitor and Manage Portfolio

12. An Effective EEM Plan: • Addresses business, operational, and market risks and implements business processes, controls and monitoring capabilities • Develops a portfolio management of company risk providing consistent measuring, monitoring, and reporting (information/data management) • Addresses authority controls/limits, exposure assessment, and decision making processes

13. An Effective EEM Plan: • Identifies core skills and competencies requirements front to back office • Organizes to maximize flexibility and responsiveness of the company • Enhances enterprise - wide business process and technology and systems integration