Do not put content on the brand signature area Istanbul – May 2011 ORC Kick off – (Wholesale) Operational / Non Financial Risks (Information Tecnologies)

Do not put content on the brand signature area Orange RGB= 255,102,000 Light blue RGB= 180,195,225 Dark blue RGB= 000,000,102 Grey RGB= 150,150,150 ING colour balance Guideline Short description business (1 minute) Software Development Technical design, coding and maintenance of core banking applications and integration between core banking applications and other main applications. Data Warehouse & CRM Technical design, coding and maintenance of data warehouse, official reporting, internal reporting, CRM and campaign management. System Planning and Analysis Coordination between IT and Business lines to implement automation of developed or updated applications in an efficient and effective way. Technological Services Design, implement and develop technological infrastructure and operation of related hardware and software in an efficient, effective and confidential way. Banking - Investments - Life Insurance - Retirement Services2 Information Technologies Software Development Data Warehouse & CRM Systems Planning and Analysis Technological Services

Do not put content on the brand signature area Orange RGB= 255,102,000 Light blue RGB= 180,195,225 Dark blue RGB= 000,000,102 Grey RGB= 150,150,150 ING colour balance Guideline Key risks & mitigating measures (2 minutes) Short overview of top 3 risks in business area Risk 1 Risk of uncontrolled and inefficient changes due to; Lack of business analysts, Poor pre-project activities and preparation, Too many small requests and changes, Too many repetitive inefficient activities Mitigating measures in place Change & Release Management Approach Banking - Investments - Life Insurance - Retirement Services3

Do not put content on the brand signature area Orange RGB= 255,102,000 Light blue RGB= 180,195,225 Dark blue RGB= 000,000,102 Grey RGB= 150,150,150 ING colour balance Guideline Key risks & mitigating measures (2 minutes) Risk 2 Risk of problems after deployment of the new systems and applications and bugs on production systems due to Very frequent deployment Mitigating measures in place Change & Release Management Approach Monthly releases & Release management Pre-prod. Systems Banking - Investments - Life Insurance - Retirement Services4

Do not put content on the brand signature area Orange RGB= 255,102,000 Light blue RGB= 180,195,225 Dark blue RGB= 000,000,102 Grey RGB= 150,150,150 ING colour balance Guideline Key risks & mitigating measures (2 minutes) Risk 3 Risk of interruption of batch processes and software errors due to Manually triggered during day or end of day processes by the operators Wrong data entry by the business units Mitigating measures in place Automation of operational processes by using a 3rd party tool for this purpose Changing of relevant screens Enrichment of existing controls and adding new steps in order to check code or data errors Banking - Investments - Life Insurance - Retirement Services5

Do not put content on the brand signature area Orange RGB= 255,102,000 Light blue RGB= 180,195,225 Dark blue RGB= 000,000,102 Grey RGB= 150,150,150 ING colour balance Guideline Main Incidents & Open AO Findings (3 minutes) Incidents summary Number of 2011 year to date incidents is 1*. Top incidents Incident 1 Performance problem occured at Kondor. Loss: EUR Incident 2 N/A Incident 3 N/A * The data consist of the incidents which are related with Wholesale Banking and categorised as Information Technology NFR Area and in the content of ORC Reporting limit Banking - Investments - Life Insurance - Retirement Services6

Do not put content on the brand signature area Orange RGB= 255,102,000 Light blue RGB= 180,195,225 Dark blue RGB= 000,000,102 Grey RGB= 150,150,150 ING colour balance Guideline Main Incidents & Open AO Findings Open finding: Top 3 open AO findings AO finding 1 Performance problems in Kondor caused by deficiencies in batch processes management. Risk level: High, Due date: 31/12/2011 AO finding 2 Testing of Business Continuity for Treasury Systems (Hazine Reuters, Reuters Dealing, Kondor) Risk level: Medium, Due date: 30/04/2011 Banking - Investments - Life Insurance - Retirement Services7