Managing Risk Through Performance Measurement FIRMA Risk Management Training Conference Lori Loken-King - SVP Union Bank, N.A., Operational Risk Management April 17-22, 2011

2 | Agenda Risk Management & Metrics Why Should We Care? What Makes a Good Metric? Identifying Metrics and Assigning Thresholds Analyzing and Reporting the Results Some Examples

3 | Union Bank Profile $79 Billion full service commercial bank headquartered in San Francisco, CA 401 branches in California, Washington, Oregon, and Texas, plus two international offices Markets include consumer, small business, middle market, real estate, corporate, correspondent, and trade finance Products include investment and financial management, trust services, private banking, insurance services, and global custody services HighMark Capital Management is the bank's investment management subsidiary UnionBanc Investment Services is the bank’s broker-dealer subsidiary Fully owned by Bank of Tokyo Mitsubishi UFJ, Ltd (BTMU) “Opting in” to Basel compliance Efficient follower strategy Entered parallel April 1, 2011

4 | Risk Management & Metrics “Indicators” provide a means to track changes in risk exposure Emerging risks Current exposure levels Past events that could recur Portfolio performance metrics vs. corporate performance metrics – what are we trying to measure? Credit risk and market risk vs. operational risk Risk measurement or risk management Key risk indicators or key performance indicators

5 | Some Terminology to Consider Key risk indicators Metrics used to measure the level of exposure to a given risk at a point in time, and to provide early warning of changing risk exposure “Leading” indicators Key performance indicators Metrics used to measure the achievement of performance targets “Lagging” indicators Key control indicators Provide information on whether a control is meeting its intended objective “Metrics” – can include all of the above and more

6 | The Focus on Metrics – Why Should We Care? Changing regulatory environment and Basel II Benefits of a metrics program Provides ongoing understanding of changes in the risk profile Aligns the level of risk with risk tolerance / risk appetite, and establishes thresholds for taking action When aligned with performance management and reporting, can influence behavior by focusing attention on managing risk to achieve objectives Allows continuous monitoring (and possibly continuous auditing) of risks and controls Provides an objective, transparent, repeatable process for measuring risk and performance

7 | Some Challenges Aligning metrics to business strategies and objectives can be complicated, as can upward aggregation Data overload – too many metrics from disparate sources can blur the picture and sometimes give conflicting results Data integrity – inaccurate or incomplete data can lead to incorrect conclusions The interpretation of metric measures may be misleading if the correlation to the risk is not appropriate Access to data and knowledge of how to use it can encumber the effectiveness of the program

8 | What Makes a Good Metric? To be effective, metrics should be: Relevant to the specific object being measured Quantifiable to enable comparison to thresholds and triggers Meaningful to the intended audience Useful as a driver of behavior Readily obtainable without significant investment in collection efforts Timely to allow for course correction when warranted

9 | Building Meaningful Metrics 1.Identify your audience 2.Understand your risk and control environment 3.Define what to measure and how 4.Set thresholds and triggers 5.Analyze and report results

10 | Identify Your Audience Board of Directors Executive Management Business Line Managers Impacted Personnel Audit & Compliance Risk Appetite Risk Escalation Metrics may or may not be relevant or useful to different audiences, so keep the audience in mind when selecting metrics.

11 | Understand Your Risk And Control Environment Understanding the risk and control environment is critical to building a meaningful metrics program that is: Aligned to business strategies & objectives A meaningful driver of behavior Focused on the most critical risks and / or controls

12 | Define What To Measure And How To Get The Data What is the end goal? Monitoring emerging and environmental risks? Monitoring residual risk? Define metrics that align to organizational risks Consider top down vs. bottom up approaches Use event root cause analysis Consider internal and external loss data Involve subject matter experts How many is enough? How many is too many? How will the metric be measured? Is the data readily available? If not, can it be mined? Is the data reliable? Has it been validated? How frequently should the data be extracted?

13 | Set Thresholds And Triggers Risk thresholds may indicate a metric is out of tolerance requiring corrective actions or change of course Trigger points are set to determine when strategies may need to be revised or controls may need to be more closely monitored. Data is monitored over time against expected results Note: The terms threshold and trigger are sometimes used interchangeably – this is one way to approach them.

14 | Analyze & Report Results Data is useless without the analysis of what it means Data becomes meaningful when compared to trends over time, established triggers and thresholds, expected results, etc. Remember the goal is to drive behavior and improve risk management Reporting may differ by audience – some things to consider: Report metrics in the context of expected results versus actual results to make them meaningful Timeliness is critical to allow for course correction or corrective actions Reporting should clearly show what, if any, action is expected

15 | Union Bank Approach to Operational Risk Metrics Top Down Perspective Focused on the Operational Risk Capital Model and the AMA elements Operational Risk Capital Internal Losses Business Environment & Internal Control Factors Scenario Analysis Bottom Up Perspective Focused on Specific Business Risks

16 | Union Bank Sample Reports – Operational Risk

17 | Union Bank Sample Reports – Key Metrics Key OpRisk Metrics Business Unit Description & RatingExplanation (including action plans) LegendOut of Tolerance Within Tolerance Retail BankingSample Metric 1RatingExplanation of why the metric is out of tolerance and what the business is doing about it Sample Metric 1 explanation Wealth ManagementSample Metric 2Rating Sample Metric 2 explanation UBISSample Metric 3Rating Watch list item - Explanation of what is driving the risk change and whether there is a need for correction action Sample Metric 3 explanation

18 | Questions