Aon Global Risk Consulting – Alex van den Doel / Rubert Nieuwenhuis VimpelCom – Ramon Tolk DACT 8 November 2013 Business Continuity Management Do you know the impact of business interruptions on your companies' financial performance? How to enhance your risk management function by implementing BCM

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 Why Business Continuity Management matters 1 Ship route Suez Canal essential for international trade

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 Stress Testing your continuity risks – approach 2 What (extreme) scenarios can jeopardize your financial objectives? Approach Define risk bearing capacity Develop scenarios –Industry specific –Organization specific –Out-of-the-box Quantify impact of scenarios Evaluate against risk bearing capacity

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 Stress Test – Risk Bearing Capacity Information from financial statements –Balance sheet total: 880M –Equity: 330M –Solvency ratio = 38%  Claim of 50M will lower ratio to 32%  An impact of 28M will lower the ratio to 34% → RBC = 28M  Covenant in financing arrangement specifies a threshold of 34% 39 % 38 % 37 % 36 % 35 % 34 % 33 % 32 % 31 %  Breach of Covenant!

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 Source: Aon Global Risk Management Survey respondents representing a broad range of industry sectors in 70 countries (64% > 1B turnover) Perception of business continuity risks 4

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 Impact on financial performance An average impact of 25% on shareholder value and an impact which commonly lasts for two years! Historically, supply chain disruptions can lead to an average of 9 percent lower sales and 11 percent higher costs! Both physical and non-physical events drive supply chain disruptions, and 85% of companies reported disruptions in 2011 (study of BCI in 2011) Other recent examples: 5 Source: Vinod Singhal, Professor at Georgia Institute of Technology, and Professor Kevin Hendricks, Richard Ivey School of Business, The University of Western Ontario, London, Ontario N6A-3K7, Canada CompanyEventValueReaction TEPCOJapan EQ-89.6%- $ 37bln DexiaGreek debt-87.3%- $ 3.9 bln Research in MotionService Disruption-49.7%- $ 6 bln BPExplosion / Oil spill-29%- $ 53 bln AppleIphone Antenna-2.4%- $ 6 bln

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 Objectives Protecting your financial performance from the impact of business interruption risks Understanding methods and techniques to map supply chain interruption risks and quantify the financial impact on revenue generating activities Enhancing Enterprise Risk Management by implementing Business Continuity Management and focus on high impact exposures Evolving the Risk & Insurance function towards a more mature operational risk management function 6

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 Agenda Analyzing the impact of business interruption exposures on financial performance Business Continuity Management - Execution –Link BCM – ERM –Buiness Continuity Management Process –Quantifying financial impact Business Continuity Management – In Practice –Case study VimpelCom – Peter den Dekker Questions 7

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 What is BCM "BCM is the ongoing process of identifying continuity threatening risks and defines a program for mitigating those risks and recovering as soon as possible within predefined time objectives". 8 Structured programme and process

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 How does BCM link ERM? 9 BCM is becoming more and more a strategic topic!! BCM is the key mitigation for continuity risks

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 BCM Process 10 Analysis - Conduct business impact analysis - Conduct threat analysis - Conduct requirement analysis Design - Define continuity strategy Strategic Tactical Operational Implementation - Implement response organization - Implement response plans Validation - Maintain - Review - Exercise

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 Quantifying financial impact - Business Impact Analysis (BIA) BIA provides a very structured and efficient approach to: –Identify and quantify business interruption risks –Map complex and global supply chains –Measure the value of current mitigation measures BIA enables organizations to consolidate the BI exposure from unit level to every consolidated level (country, regional, global, etc.) The BIA provides a solid basis for risk management improvement: –Clear picture of the biggest interruption risks, accumulation effects and critical issues –Focused development of risk management strategies (loss prevention and response) –Optimization insurance cover and limits –Enhancing business interruption risk awareness and understanding

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 Step 2: Example of results of quantification unit level Supply chain analysis Dataroom analysis Site analysis

DACT | AGRC & VimpelCom Proprietary & Confidential | 8 November 2013 Step 2: Quantifying consolidated level Delivering two key elements: Dependencies network –Based on unit level outcome defining and modeling material dependencies between suppliers, own units and customers –Making use of a "engine" to simulate impact Consolidated risk profile on selected level –Calculating the impact of unit level events though dependency network –Creating consolidated loss exposure profile on selected level