RISK MANAGEMENT SUPPORTED BY CORPORATE GOVERNANCE COLOMBIA Alfonso Parias, Risk Control Manager October 9, 2007

2 Risk Management Is defined as the culture, processes and structure aimed at obtaining potential opportunities while dealing adverse events Culture Processes Structures Introduction

3 Corporate Governance Corporate Governance is a system of guidance, established by standard management practices which operates within a structure of governance that has been designed for the organization. System of guidance Management practices Governance structure

4 Therefore Having adequate Corporate Governance practices, guidance and management systems, culture, processes and structures are adopted in order to obtain potential opportunities and to handle adverse effects. Thereby increasing, maximizing and maintaining the organization’s value.

5 Risk Management and Corporate Governance Risk Management Corporate Governance Corporate Governance is the organization’s strategic response to risk, and effective risk management is the cornerstone of solid governance. System of guidance Management practices Governance structure Culture Processes Structures  =

6 Risk Management is a good Corporate Governance policy. Risk Management is a proactive policy. Risk Management is a strategic policy. Risk Management is compliance with rules and regulations. Global Risk 2007 from World Economic Forum – Global Risk Network Report. A future vision of Risk Management Comments

7 The ATLAS syndrome Risk Management is party to Corporate Policy, not the exclusive responsibility of one part of the organization

8 Evolution of integrated risk management Reactive level :  Neither the Board of Directors nor senior management place sufficient emphasis on risk management  Risk management exists; however it is isolated  Risk coverage is incomplete in some critical aspects  There is no common approach nor language for risk management

9 Evolution of integrated risk management Tactical level:  There is strong support from the Board of Directors and senior management  A Risk Committee exists  Periodically, risk profiles are determined  The need for comprehensive risk management is recognized

10 Evolution of integrated risk management Strategic level:  There are proactive risk committees with the Board and senior management  An administration and evaluation of risks is performed throughout the entire organization  There is a common approach and language  There is an analysis of risk in real time  Optimization and risk reports

11 A new approach : PREVIOUSLYPresently Risks were considered separatelyRisks within the context of corporate strategy Identification and evaluation of risk Develops a risk “portfolio” Considers all risksConsiders critical risks Risk mitigationRisk optimization Limits of riskStrategies of risk Risks for which no one is responsible Assigned responsibilities according to the risk Quantifying inconsistent riskObservation and measuring Risk is not my responsibilityRisk is everyone’s responsibility The old methods of risk management are no longer appropriate, and as a result a new approach has been adopted:

12 The greatest risk of all is to have unknown weaknesses …… and on account of this, it is necessary…… to design a corporate strategy that is capable of detecting unknown weaknesses and to create a plan of action Therefore……………

13 The management of a risk administration through Corporate Governance Establish a context Identify risks Analyze risks Evaluate risks Handle risks AS/NZ 4360 Standard Corporate Governance Observation and measurement Communication and consultation Structure

14 The key principles that support a solid Corporate Governance:  Establish solid principles for management and supervision.  Structure the Board of Directors in a manner that value will be added.  Recognize and handle risk.  Provide guidance.  Generate control.  To be accountable.  Determine authority.  Manage.  Supervise. Principles related to risk management

15 Corporate Governance Committees Board of Directors Corporate Governance 3 MEMBERS FROM THE BOARD OF DIRECTORS 1 INDEPENDENT MEMBER Risk Committee Appointments Committee Corporate Governance Committee Financial Committee SCOPE: Strategic risks. Financial Risks. Market risks. Operational risks. Image risks. Legal Risks.

16 Management structure for the administration of risks through Corporate Governance Board of Directors Risk Management President Corporate Governance Risk Committee

17 Character and aim of the Risk Committee The Risk Committee is a collegiate organization with direct responsibility to the Board, and whose aim is to guarantee acceptable policies, mechanisms and procedures for Risk Management.

18 Functions and Responsibilities of the Risk Committee  Risk Management.  Program for Business Continuity.  Evaluation and adoption of international standards in risk matters in accordance with recommendations from the Bank of International Payments, the Committee for the System of Payments and Settlement of Securities, the International Organization of Securities Commissions (IOSCO) and the Group of 30.  Prevention and Control of Asset Laundering and the Financing of Terrorism.  Code of Conduct.

19 Benefits derived by the Board from the Risk Committee  More efficient strategic and operational planning.  Greater confidence in achieving planned objectives, both strategic and operational.  Greater flexibility within the organization wasting less time and improving the organization’s potential for taking advantage of opportunities.  Greater confidence in the decision making process.  Greater confidence by the parties involved and an increase in equity.  Board Member’s protection.

20 Sources: Principles of Good Corporate Governance and Best Practice Recommendations, Corporate Governance Counsel, ASX, april Australian Stock Exchange Corporate Governance Council. Global Risk 2007 from the World Economic Forum – Global Risk Network Report. Standard AS/NZ Handbook 254 – Colombian Technical Norm 5254 – Colombian Institute of Technical Norms and Certification, ICONTEC.

21 Alfonso Párias Polanco RISK AND COMPLIANCE MANAGER with DECEVAL S.A. Member of the risk committee of ICONTEC de COLOMBIA. Member of the working group on the evaluation and implementation on the Colombian Technical Norm NTC 5254 based on international norm AS/NZ Years PRIMA. Member of the PROFESSIONAL RISK MANAGER’S INTERNATIONAL ASSOCIATION – GARP. Member of the GLOBAL ASSOCIATION OF RISK PROFESSIONALS – ACAMS. Member of the ASSOCIATION OF CERTIFIED ANTI MONEY LAUNDERING SPECIALISTS. 2004, 2005, 2006 y 2007.