© 2003 DelCreo, Inc. All rights reserved. | U.S. Toll-free 866.DELCREO | International 001/ | Enterprise Risk Management Implementation DelCreo, Inc DELCREO

© 2004 DelCreo, Inc. All rights reserved. U.S. Toll-free 866.DELCREO | International 001/ | Potential ERM Benefits Satisfies SOX and COSO requirements keeping the SEC, other regulators & investors happy Reduces the cost of D&O insurance because of enhanced corporate governance Enables the rating agencies to more rationally rate debt and equity Reduces the cost of capital and increases shareholder value Establishes a rational basis for allocating capital and prioritizing investments. thus maximizing ROE Reduces the risk of shareholder lawsuits because transparency & disclosure is enhanced Provides for more consistent risk taking across the organization Improves Executive focus on the risks that have the greatest likelihood and potential to impact to stakeholder interests. BENEFITS

© 2004 DelCreo, Inc. All rights reserved. U.S. Toll-free 866.DELCREO | International 001/ | Tools RiskWeb Early Warning System Assessment and Quantification tools Culture Knowledge Mgmt Metrics Training Communication Assess Risk Treat Risk Monitor & Report Enterprise-wide Integration Strategic Planning Programs/PMO Processes Functions Risk Management Process Allocation of Capital Control Cost Grow Revenue Regulatory Compliance Risk Attributes Lifecycle Individual Portfolio Qualitative Quantitative Organization Enterprise Risk Committee CRO or ERM Manager Risk Strategy & Appetite Internal Audit Risk Mgmt IT Security ERM BCP Legal EH&S Risk Strategy Appetite Prioritize Treatment Approach Program Strategy Develop Deploy Continuously Improve Risk Functions Business Objectives/ Risk Drivers Strategy Capability Value Drivers Capability Functions Process Organization Culture Tools Enterprise- Wide Integration Risk Attributes Risks Strategic Operational Stakeholder Financial Intangible ERM Framework

© 2004 DelCreo, Inc. All rights reserved. U.S. Toll-free 866.DELCREO | International 001/ | EHS Internal Audit Insurance IT Security Physical Security Legal BCP Global RM Legal IT Security BCP Legal Physical Security ERM Internal Audit EHS Risk Risk Management Process RM Process Risk 1 Risk 2 Risk 3 Risk 4 Risk 5 Risk 6 Metrics and Reporting Assess Risk Treat Risk Monitor & Report Coordination among risk functions to increase risk coverage and decrease cost Enable business initiatives to address risk issues quickly, decreasing product time-to-market Alignment with business strategies, objectives and decision making- processes Consistent organization-wide processes World-class risk management tools Focus on risks that have the greatest potential impact on stakeholder value Traditional Cost Assurance Revenue World-Class Transformation Knowledge Sources RiskWeb Risk Management Tools Risk Strategy And Framework Practical Application: Hewlett-Packard ERM Transformation Source: Hewlett-Packard – Used with permission

© 2004 DelCreo, Inc. All rights reserved. U.S. Toll-free 866.DELCREO | International 001/ | Risk Appetite

© 2004 DelCreo, Inc. All rights reserved. U.S. Toll-free 866.DELCREO | International 001/ | Implementation Plan Task May 2003 June 2004 July 2004 August 2004 Sept 2004 Oct 2004 Nov 2004 Define the scope of the ERM program Conduct a Current State Assessment Write a Strategic Plan Develop ERM methodology and terminology Risk appetite Risk classification framework Risk treatment framework Develop risk assessment process Definition of ERM roles & responsibilities Metrics Risk Assessment Define the scope Pilot risk assessment – 1 business unit Remaining risk assessments Pilot risk treatments Remaining risk treatments Develop tools for continuous monitoring, evaluation and management of risk Project Management