APPA - Enterprise Risk Management

1. APPA - Enterprise Risk Management September 25, 2007 LCRA’s ERM Journey Presented by JoEllen Peterman, ERM Program Manager joellen.peterman@lcra.org 512.473.3353

2. LCRA’S ERM Journey • How & Why We Chose ERM • LCRA’s ERM Structure and Scope • LCRA’s ERM Process, Reporting & Tracking • What’s Underway and On the Horizon?

3. How & Why We Chose ERM • Top Down Guidance • General Auditor • Chief Financial Officer • Driven by COSO & Best Practices • Internal Control Policy Adopted • Business Units (BU) Directed to Address Risk Analysis to Fit Their Needs (2 year period) • Critique of BU Specific Risk Management Activities & Recommendations on How to Proceed • Executive Sponsor and Project Manager • Interdisciplinary Team • External Consultant

4. Board of Directors • Audit Committee Chief Risk Officer ERM Oversight Committee • Chair, ERM Oversight Committee ERM Program Manager • CRO, CFO, COO, CAO • Internal Advisors • Treasurer • Controller • Internal Audit • Legal • Meets Qrtly or more frequently • Manages and Coordinates ERM Activities LCRA’s ERM Structure General Manager Wholesale Power Services Risk Control Manager Water Services Risk Control Manager Transmission Services Corp. Risk Control Manager Corporate Services Risk Control Manager Community Services Risk Control Manager • Key evangelists of ERM Program • Embedded in BU with dual reporting

5. LCRA’s ERM Scope • Includes Risk Management Process NOT Content • Does Not include Middle Office Functions for Fuels & Energy Risk Management • Includes Political, Operational, Employee and Staffing, Regulatory, Financial, Environmental, Technological, and Security Risks

6. Annual Business Plan Risk Analysis Quarterly ERM Oversight Committee Meetings Enterprise Level RiskRegistry* Emerging Issues Risk Analysis Risk Watch List BU Level Risk Registry* Wholesale Corporate LCRA’s ERM Process Water Transmission Community *Risk owners are responsible for maintaining and reporting status of risk mitigation activities at ERM Oversight Committee Meetings and at the BU level.

7. LCRA’s ERM Process - continued • Initially Very Simple • Defined Impact & Probability • No Differentiation Between Nominal and Residual Risk • Process Has Evolved and Matured Over 3 Years • Beginning to Differentiate Between Nominal and Residual Risk (aids in deciding on best form of mitigation) • Assigning Risk Ownership with Accountability and Measures of Success • Better Integration with the Annual Business Plan Process • Expanding to include Integration with Special Interest Groups • Engineering Peer Review Team • Project Management • Internal Controls Self Assessment • Capital Funding Project Oversight & Management • Emergency Preparedness Team

8. LCRA’s ERM Process - continuedFY08 Integrated Reporting

9. LCRA’s ERM Process - continued • After Effects of Hurricane Katrina and Rita • Tool Created Focus for Staff Across LCRA • Nine Days to Produce Aggregated Report of Risks & Prepare Report to Management & Board • Critiqued and Improved Process • Drought Management • Facilitated Risk Work Session • Refining Process – Gaining Efficiencies in Process • Two or Three Day Turnaround for Initial Risks Registry Highlights of Growth in Emerging Risk Process

10. What’s Underway and On the Horizon • Continue Concurrent Critique and Process Improvement • Refine Risk Metrics & Integrate with BU Scorecards • Measure and Report CIP Portfolio Risks • Develop and Implement Training Module for New Supervisors and Managers

11. LCRA’s ERM Process Questions ???