Assessing the Internal Control Environment - Reassessment resulting from the Doorstep results Confidential

Index Topic Page number Current responsibilities 3 Current status 4 Our corporate goal 7 Goals of the assessment 9 Improvements to current process 10 Internal audit vs risk management 11 Going forward Guidelines of assessment process 13 Resources for projects 14-15 Skeleton workplan 16

Planning Responsibility Current Responsibilities BRM Doorstep Audit committee Sponsors CFO, RAC, Risk Ops AA Ongoing monitors Risk Ops, RAC Planning Responsibility AA Risk Ops, RAC AA Risk Ops, RAC, AA, business controllers Business Controllers Execution Business Controllers

Key differences between BRM & Doorstep Current status - Deliverables and key differences BRM Doorstep Deliverables 1) Control opinion 1) Recommendations for improvement communicated to upper levels of management 2) Documented control processes 2) Management obtains comfort over offices’ 3) Update audit committee operations Key differences between BRM & Doorstep 1) BRM process/monthly control committee 1) Detailed knowledge used by key senior management 2) Aid to external audit process 2) Self assessment 3) Corporate governance 3) Led by management who has indepth knowledge of issues and day-to-day business issues 4) Focused/targeted control reviews

Current status - Key points BRM Doorstep Key points 1) Not a true internal audit - not all risks are audited 1) Not independent (self assessment) 2) Recommendations are not appropriately brought to 2) Overlaps some of BRM work the attention of management 3) Lacks bottom-up buy-in - perception of no added value 5) Based on needs of external audit 6) Control opinion does not cover risk of loss in future periods BRM Doorstep Overlap

BRM Doorstep Successes Success of both processes Current status - Key successes BRM Doorstep Successes 1) BRM process developed based on independent 1) Routine and extensive communication assessment of risks review between AA and Enron 2) Control documentation completed 2) Material weaknesses identified are brought to the attention of senior management 3) Created awareness within business units of 3) A process has been established to clear identified weaknesses key business risk elements 4) Management empowerment for process 5) Self assessment 6) Based on minimum standards/best practices Success of both processes Top level buy-in/approval for resource expenditure Management has showed a willingness to enhance/challenge current process

Current status - BRM & Doorstep Does management believe that the two processes are sufficient to monitor the achievement of our corporate goal?

Our corporate goal To develop and maintain a world class internal control environment consistent with our business aspirations Definition of a world class internal control environment 1) Leader in the field - acknowledged in market place 2 )Leveragable in commercial negotiations (asset, not liability) 3) Up to date with business developments 4) Regularly and independently monitored and assessed 5 ) Highly automated 6 ) Transparent at all levels within the organization Enron believes it is necessary to have an assessment process in place to monitor the internal control environment

Goals of the assessment Current goals to obtain an independent opinion on Enron’s control environment to assess the operational risk of each location communicate key issues to upper management assess risks of commodities and trade types Additional goals not currently met assess all risks of Enron to have Enron lead the process, direct planning, execution, and follow up

Improvements to current process - Gaps Enron must be involved planning and executing (BRM) Process/goals need to become transparent Balance between corporate governance and self assessment Minimum standards/best practices to be formalized High risk deviations from minimum standards must be brought to attention of senior management Follow up and improvements must be continually assessed and performed A plan to ensure internal audit standards are must exist

Internal audit vs risk management Definition - Design of internal audit as defined by the Internal Institute of Auditors Internal auditing reviews the reliability and integrity of information, compliance with policies and regulations, the safeguarding of assets, the economical and efficient use of resources, and established operational goals and objectives. Internal audits encompass financial activities and operations including systems, production, engineering, marketing, and human resources. Do we need to audit all the above mentioned items? Do the current processes meet the requirement for an internal audit? C - Compliance A- Achieving goals and objectives R- Reliability of information E- Efficiency and effectiveness S - Safeguarding assets

Going forward

Guidelines of assessment process All assessment processes should be driven by Enron Self assessment - Risk operations/RAC Corporate governance - Audit committee/CFO Deliverables and goals need to be transparent Processes must be ongoing and continually improved Processes cannot be done in a vacuum - all assessments should work together Design minimum standards Implement minimum standards at all Enron companies Establish a plan to test that minimum standards are met Continuous improvement Design Implement Test/Review Reengineer/process improvement

Project management team/Resources building block for BRM Key: Independent function to meet requirements for internal audit In order to maximize efficiency, planning and execution for this must be done with Doorstep team Audit committee Project Sponsors Senior management Corporate team, AA Note: This team must work closely with the doorstep team Oversite committee (vision, direction) Corporate team, AA Regional controls, control senior managers, global resources Note: This group should also be responsible for following up findings Implementation, review, monitor AA, Enron execution team Business controllers Execution and local coordination

Project management team/Resources building block for Doorstep Key: Business controllers, global committee, and AA involved in developing a plan that meets needs: IA requirements Independent opinion Risks as business units see them Risks as global sees them Rick Causey, Rick Buy Project Sponsors Sally Beck, Ted Murphy, Fernley Dyson Shona Wilson, Mike Jordan, Brent Price, regional controllers Oversite committee (vision, direction) Brent Price, Shona Wilson, Mike Jordan, AA Regional controllers, control senior managers Implementation, review, monitor AA, Enron execution team Business controllers Execution and local coordination

Skeleton workplan Earmark committee to review current process Combination RAC, Risk Operations, AA Input from business controllers Determine assessments to take place to meet goals Formally document minimum standards/best practices Risk Operations Develop audit program to meet goals AA Develop timeline for reviews Earmark resources Risk Operations, RAC Formalize reporting structure and data capture Risk operations, RAC