1 Enterprise Risk Management 1 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Enterprise Risk Management Presented to The Audit Directors Roundtable Atlanta, Georgia October 16, 1997

2 Enterprise Risk Management 2 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Agenda >“Know yourself” - a starting point for Enterprise Risk Management >A model for Enterprise Risk Management >Four focal points of Enterprise Risk Management >The Unconscious Conspiracy >Sustainable Enterprise Risk Management

3 Enterprise Risk Management 3 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Know yourself - three kinds of risk environment UnprotectedTransitional“Go ahead.....” Processes, systems not in place Cultural attitudes not supportive Basics not strong Typical of: Start-ups, JV’s, different cultures, speed to market. Challenges: Lack of capability; where to start. Financial control processes moderate History of problems, surprises Rapid change, rapid growth situations Challenges: High stress, over-stretched, resource constrained; Fire- fighting Well established systems, common processes Pockets of slackness, many areas for improvement Basics well in place Challenges: Operational, strategic; Unconscious Conspiracy

4 Enterprise Risk Management 4 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Risk Environment OF #1 >How would you describe your current risk environment? >Unprotected >Transitional >Go Ahead

5 Enterprise Risk Management 5 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Risk Readiness Ten indicators of ability to anticipate and manage risk: (COSO, CoCO, etc.) >Objectives and risks >Policies and parameters >Values and ethics >Responsibility and accountability >Trust and communication >Skills and tools >Systems and discipline >Scanning and questioning >Monitoring and follow-up >Assessment and reporting

6 Enterprise Risk Management 6 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Overall Risk Readiness OF #2 >How would you describe your organization’s overall risk readiness? >Very ready >Ready >Fairly ready >Somewhat ready >Very unready

7 Enterprise Risk Management 7 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. >What are you trying to accomplish? >What gets in your way? >What are you doing to manage this? >Where do you feel the most exposed? The Enterprise Risk Model

8 Enterprise Risk Management 8 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Enterprise Risk Model Set Expectations Identify Risks Measure / Assess Risk & Control Monitor Risk Environment Risk Management Business Strategies & Objectives Assess Performance against expectations R - C = E (O) n Assess & Mitigate Exposure

9 Enterprise Risk Management 9 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Enterprise Risk Model Set Expectations Identify Risks Measure / Assess Risk & Control Monitor Risk Environment Risk Management Business Strategies & Objectives Assess Performance against expectations Assess & Mitigate Exposure >Avoidance >Capital >Control>Exposure >Financing >Identification >Measurement >Mitigation >Monitoring >Risk >Risk Management >Significance >Transfer >Uncertainty

10 Enterprise Risk Management 10 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Enterprise Risk Model Set Expectations Identify Risks Measure / Assess Risk & Control Monitor Risk Environment Risk Management Business Strategies & Objectives Assess Performance against expectations Assess & Mitigate Exposure >Avoidance - Declining an opportunity because expectation does not justify the risk involved >Capital - Financial resources that support objectives and that enable survival under adverse outcomes >Control - Action to correct or reduce uncertainty to an acceptable level >Exposure - Susceptibility of objectives to risk remaining after control and mitigation activities >Financing - Economic resources available for use in pursuing objectives and risk management activities >Identification - Recognizing or establishing objectives, risks or exposures as being of a particular type or origin >Measurement - Assessing the likelihood and significance of risks, exposures and related objectives >Mitigation - Action to correct or reduce significance of risks and outcomes to an acceptable level (such as through diversification, financing, transfer, etc.) >Monitoring - The process of continuous identification and measurement >Risk - Anything of variable uncertainty and significance that interferes with achievement of objectives >Risk Management - The business process of managing uncertainty and significance of risk to an acceptable level of exposure >Significance - Importance and magnitude of meaning, influence or effect >Transfer - Sharing a portion of risk and potential reward with another party >Uncertainty - The level of the unknown regarding a future outcome

11 Enterprise Risk Management 11 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Enterprise Risk Model - Risk R (O) Risk (a) Risk is a function of Business Objectives (b)Risk is lost Opportunity >Risk - Anything of variable certainty and impact that interferes with achievement of objectives

12 Enterprise Risk Management 12 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Enterprise Risk Model - Control & Mitigate C n Control & Mitigate Retain & Manage/Mitigate Risk Mitigate - (Detect & Correct) Hedge Risk, diversify, finance Self Insure Avoid Risk Control (Prevent) to reduce likelihood Re-engineer to avoid risk Change objectives (opportunity) Transfer Risk to others Purchase insurance >Control - Action to correct or reduce certainty to an acceptable level >Mitigation - Action to correct or reduce significance of risks and outcomes to an acceptable level (such as through diversification, financing, transfer, etc.)

13 Enterprise Risk Management 13 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Enterprise Risk Model - Exposure E Exposure Function of the Certainty of Risk Occurrence, & Significance of Risk, if it occurred Measured on a spectrum of acceptable unacceptable >Exposure - Susceptibility of objectives to risk remaining after control and mitigation activities

14 Enterprise Risk Management 14 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Risk Exposure Significance VH M VL MVH Certainty Unacceptable Caution Acceptable

15 Enterprise Risk Management 15 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Current Risk Assessment Process OF # 3 >How would you describe your satisfaction with your current enterprise risk management process? >Setting expectations >Identifying risks >Measuring and assessing risks >Assessing and mitigating exposure >Monitoring risk environment and risk management >Assessing performance against expectations

16 Enterprise Risk Management 16 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Focal points for Enterprise Risk Management Basics Behavior Business Burning Examples: Financial processes (purchasing, payments, accounting) Typical Risk Classes: Information, Methods, Technology, Ethics Examples: Structure (accountability, responsibility); Tone: trust, motivation, ethics, enablement Typical Risk Classes: People, Organizational, Environment Examples: Production, sales, distribution, design, engineering, human resources, service Typical Risk Classes: Operational; Methods, Materials & equipment; Interest, Liquidity, Concentration, Market, Environment Examples: Unconscious Conspiracy issues - sales practices; product liability; Challenger; transportation disasters Typical Risk Classes: Ethics, Environment, Organization

17 Enterprise Risk Management 17 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Supporting different starting points.. UnprotectedTransitional“Go ahead.....” Build ItFix It Demonstrate It Basics Behavior Business Burning ? ? ? ? ? ? ? ? ? ? ? ?

18 Enterprise Risk Management 18 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Focal Point for Risk Management OF #4 >What is your organization’s focal point for risk management at this time? 1.Basics 2.Behavior 3.Business 4.Burning 5.Any combination or all of the above

19 Enterprise Risk Management 19 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. The value of Enterprise Risk Management Basics Reduce fraud, Minimize error, Increase efficiency & effectiveness

20 Enterprise Risk Management 20 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Objective: Integrity of assets, transactions, reporting Risk Classes: Methods & systems; Facilities; People; Information; Environment; Technology Control Procedural Risk Frameworks (globally established); Guidance materials; Policy infrastructure (Corporate, accounting); Established through training; Customized for “hostility” of local environment Assessed by audit, or self assessed; Metrics from benchmarking, compliance Risk Consequences: Fraud, error, inefficiency; ineffectiveness Risk Management Focus - Basics Basics

21 Enterprise Risk Management 21 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. CommonCulturalSpecificCore BasicsBehaviorBusinessBurning Capability issues: - what, how, where Policies, procedures, processes; Reengineering, Business process redesign; Quality improvement processes; Benchmarking; best practices; Handbooks; Training; Surveys, questionnaires, audits Four focal points

22 Enterprise Risk Management 22 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. The value of Enterprise Risk Management Basics Behavior Reduce fraud, Minimize error, Increase efficiency & effectiveness Reduce fraud& error; Increase efficiency & effectiveness; Engage & enthuse; Minimize penalty

23 Enterprise Risk Management 23 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Objective: Standards of ethics, trust, integrity, openness of communication, learning, responsiveness Risk Classes: People; Environment; Control Ethics policy infrastructure; Tone at the top; attention to detail Culture creation / development processes Customized for “hostility” of local environment Assessed by culture profiles; Metrics from benchmarking - internal & external Risk Consequences: Fraud, Ineffectiveness, Loss of key people Regulatory penalty, Loss of reputation, Risk Management Focus - Behavior Behavior

24 Enterprise Risk Management 24 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. CommonCulturalSpecificCore BasicsBehaviorBusinessBurning Commitment issues - why, whether Structural issues - accountability, responsibility, authority Leadership issues Cultural issues - trust, motivation Workshops, conferences, workgroups, surveys, Four focal points

25 Enterprise Risk Management 25 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. The value of Enterprise Risk Management Basics Behavior Business Reduce fraud, Minimize error, Increase efficiency & effectiveness Reduce fraud& error; Increase efficiency & effectiveness; Engage & enthuse; Minimize penalty Avoid or transfer risk Quantify risk uncertainty for specific risks Use capital market techniques to manage certain risks Improve quality / timeliness / price / delivery / technology Reduce costs / downtime / lost productivity Improve relationships with customers / employees / suppliers / regulators / investors / creditors Protect against criminal / civil / regulatory penalties Improve achievement of business objectives

26 Enterprise Risk Management 26 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Objective: Achievement of business objectives Strategic; Group; division; department; team Risk Classes: Methods & systems; Facilities; People; Information; Environment; Technology; Operations; Market; Credit; Control Business Risk Frameworks (globally established); Impact & likelihood assessments Business risk management assessment Avoid (Prevent, Re-engineer) Retain & manage (Detect, Correct, Hedge..) Transfer (purchase insurance; self-insure) Policy infrastructure; Engagement of key people; Assessed by audit, or management self assessed; Metrics based on business risk Risk Consequences: Failure to achieve business objectives Risk Management Focus - Business Business

27 Enterprise Risk Management 27 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. CommonCulturalSpecificCore BasicsBehaviorBusinessBurning Objectives / Purpose issues Operational risks; Legal / regulatory; Capital / financial; Strategic Measurement - analysis, hedge, transfer, avoid Assessment - workshop, survey, interview Engage, enable, enthuse Four focal points

28 Enterprise Risk Management 28 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. The value of Enterprise Risk Management Basics Behavior Business Burning Reduce fraud, Minimize error, Increase efficiency & effectiveness Reduce fraud& error; Increase efficiency & effectiveness; Engage & enthuse; Minimize penalty Protect against fundamental risk Avoid or transfer risk Quantify risk uncertainty for specific risks Use capital market techniques to manage certain risks Improve quality / timeliness / price / delivery / technology Reduce costs / downtime / lost productivity Improve relationships with customers / employees / suppliers / regulators / investors / creditors Protect against criminal / civil / regulatory penalties Improve achievement of business objectives

29 Enterprise Risk Management 29 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Objective: Protection from fundamental risk Achieve quantum leap opportunity Risk Classes: All.... Control Structured format for open dialogue Heightened awareness of unconscious conspiracy Cross-silo workshops, conferences, meetings Knowledge / memory management Governance processes Risk Consequences: Massive fraud, or error; Disaster Loss of competitive position Loss of value Risk Management Focus - Burning Burning

30 Enterprise Risk Management 30 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. The Unconscious Conspiracy >Disaster events >No single “cause” >Environment, technology, structure, culture, systems, processes, people all play a role >The organization had all the information about the risk - but no one person had it all, or made the connections. >A number of indicators of unconscious conspiracy were available..... in hindsight.

31 Enterprise Risk Management 31 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. The Unconscious Conspiracy Indicators... >Today’s “Business Imperative” - industry wide >Hot opportunity >High reliance on a few wizards >Dominating objective >Unchallenged assumptions >Dominating individual >

32 Enterprise Risk Management 32 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. CommonCulturalSpecificCore BasicsBehaviorBusinessBurning Learning issues - fundamental issues that are stuck at awareness / action stages Accessed by workshops - shared awareness, moving the unconscious conspiracy to conscious awareness and action Issues are normally fundamental, sometimes critical to survival Four focal points

33 Enterprise Risk Management 33 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Integrated Risk Management BasicsBehaviorBusiness Burning Strategic Operational Governance Accountability Tone Values Ethics Trust Unconscious Conspiracy Policies Procedures Fraud protection

34 Enterprise Risk Management 34 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Integrated Risk Management BasicsBehaviorBusiness Burning Strategic Operational Governance Accountability Tone Values Ethics Trust Unconscious Conspiracy Policies Procedures Fraud protection Information Systems AvoidTransfer Quantify uncertainty Capital Market Strategies Insurance Risk Management

35 Enterprise Risk Management 35 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Integrated Risk Management BasicsBehaviorBusiness Burning Strategic Operational Governance Accountability Tone Values Ethics Trust Unconscious Conspiracy Policies Procedures Fraud protection Information Systems Quantify uncertainty AvoidTransfer Capital Market Strategies Insurance Risk Management Operational Uncertainty (non-quantified)

36 Enterprise Risk Management 36 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Integrated Risk Management BasicsBehaviorBusiness Burning Strategic Operational Governance Accountability Tone Values Ethics Trust Unconscious Conspiracy Policies Procedures Fraud protection Information Systems Quantify uncertainty AvoidTransfer Capital Market Strategies Insurance Risk Management Operational Uncertainty (non-quantified) Risk & control frameworks & Gap analysis Systems quality & integrity

37 Enterprise Risk Management 37 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Integrated Risk Management BasicsBehaviorBusiness Burning Strategic Operational Governance Accountability Tone Values Ethics Trust Unconscious Conspiracy Policies Procedures Fraud protection Information Systems Quantify uncertainty AvoidTransfer Capital Market Strategies Insurance Risk Management Operational Uncertainty (non-quantified) Risk & control Maps & Gap analysis Culture profiles Control environment change management Systems quality & integrity

38 Enterprise Risk Management 38 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Integrated Risk Management BasicsBehaviorBusiness Burning Strategic Operational Governance Accountability Tone Values Ethics Trust Unconscious Conspiracy Policies Procedures Fraud protection Information Systems Quantify uncertainty Business Risk Management Self-assessment of exposure - leading to Action Risk & Control frameworks AvoidTransfer Capital Market Strategies Insurance Risk Management Operational Uncertainty (non-quantified) Risk & control frameworks & Gap analysis Culture profiles Control environment change management Systems quality & integrity

39 Enterprise Risk Management 39 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Integrated Risk Management BasicsBehaviorBusiness Burning Strategic Operational Governance Accountability Tone Values Ethics Trust Unconscious Conspiracy Policies Procedures Fraud protection Information Systems Quantify uncertainty Business Risk Management Self-assessment of exposure - leading to Action Risk & Control frameworks AvoidTransfer Capital Market Strategies Insurance Risk Management Operational Uncertainty (non-quantified) Risk & control frameworks & Gap analysis Culture profiles Control environment change management Governance review Facilitated business & strategic risk assessment Diagnostics Systems quality & integrity

40 Enterprise Risk Management 40 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Integrated Risk Management BasicsBehaviorBusiness Burning Strategic Operational Governance Accountability Tone Values Ethics Trust Unconscious Conspiracy Policies Procedures Fraud protection Information Systems Quantify uncertainty Business Risk Management Self-assessment of exposure - leading to Action Risk & Control frameworks AvoidTransfer Capital Market Strategies Insurance Risk Management Operational Uncertainty (non-quantified) Risk & control frameworks & Gap analysis Culture profiles Control environment change management Governance review Facilitated business & strategic risk assessment Diagnostics Systems quality & integrity Internal Audit based on integrated Risk Framework

41 Enterprise Risk Management 41 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Enterprise Risk Management Implementation approaches Common Cultural SpecificCore BasicsBehaviorBusinessBurning Facilitated workshop Risk Profiles Risk Frameworks Quantitative methods Insurance methods Procedural frameworks Surveys Enterprise risk framework database

42 Enterprise Risk Management 42 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. What are the major challenges you face in developing an integrated approach risk management?

43 Enterprise Risk Management 43 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. What do you think needs to be done to manage these challenges?

44 Enterprise Risk Management 44 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Sustainable Risk Management aligns People, Objectives, Risks >Builds Employee Involvement >Creates Business Value >Builds a Global Connection >Enhances Teamwork >Anticipates risk

45 Enterprise Risk Management 45 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. The value of Enterprise Risk Management Basics Behavior Business Burning Reduce fraud, Minimize error, Increase efficiency & effectiveness Reduce fraud& error; Increase efficiency & effectiveness; Engage & enthuse; Minimize penalty Protect against fundamental risk Avoid or transfer risk Quantify risk uncertainty for specific risks Use capital market techniques to manage certain risks Improve quality / timeliness / price / delivery / technology Reduce costs / downtime / lost productivity Improve relationships with customers / employees / suppliers / regulators / investors / creditors Protect against criminal / civil / regulatory penalties Improve achievement of business objectives

46 Enterprise Risk Management 46 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Presentation Evaluation

47 Enterprise Risk Management 47 Proprietary Information: This presentation contains concepts, ideas and materials which are proprietary to Deloitte & Touche LLP and which may not be used, copied, provided to others or referred to without the express written permission of Deloitte & Touche LLP. Next Steps >Incorporate group brainstorms and Option Finder exercises into a report of today’s session >Distribute report to all participants >Other?