Operational Risk Ruth Hanna Strong FIRMA Conference San Francisco March 31, 2010 © 2010 Wells Fargo Bank, N.A. All rights reserved. For public use.

11 Agenda  Introduction  Risk Management – An Enterprise Perspective  Operational Risk as part of Risk Management  Regulatory Mandates – Common Frameworks  Operational Risk: Business Continuity Planning  Legislative Update  Conclusion © 2010 Wells Fargo Bank, N.A. All rights reserved. For public use.

22 Risk Management An Enterprise Perspective  Fiduciaries frequently approach risk from an enterprise perspective.  Enterprise risk management models agree that essential responses to risk fall into four broad categories:  Accept it, formally or informally  Share it through insurance or hedging strategies  Mitigate against it or control it  Ignore it, intentionally or unintentionally  The response of the organization is dependent on its risk appetite, risk culture, and regulatory oversight. © 2010 Wells Fargo Bank, N.A. All rights reserved. For public use.

33 Operational Risk Management  Within any enterprise, effective operational risk management can: Create and sustain a competitive advantage Protect and enhance firms’ reputations Increase profits by reducing charge-offs and related expenses Minimize required capital and maximize choice about where to invest discretionary capital Increase shareholder value by lower borrowing costs and higher valuations © 2010 Wells Fargo Bank, N.A. All rights reserved. For public use.

44 Operational Risk Management Common Frameworks  Several common frameworks provide detailed guidance, including  The Basel Accords are a framework under the auspices of the Bank of International Settlements, which has its home in Basel, Switzerland,  Financial Industry Regulator Authority (FINRA), focused on the securities industry,  COSO, the Committee of Sponsoring Organizations of the Threadaway Commission,  The Office of the Comptroller of the Currency (OCC), which provides guidance at  The Securities and Exchange Commission published guidance as well, which can be found at © 2010 Wells Fargo Bank, N.A. All rights reserved. For public use.

55 Operational Risk – Business Continuity Planning Current focuses  Recent events in Haiti and Chili reinforce the need for planning against natural disasters of all types.  The continued threat of a pandemic flu outbreak concerns regulators and others.  Risks to communications infrastructure and technology breaches are the focus of many.  Preparedness and its impact on firms’ and their communities’ ability to respond effectively are the foundation of this concern and provide impetus for action. © 2010 Wells Fargo Bank, N.A. All rights reserved. For public use.

66 Operational Risk – Business Continuity Planning Corporate- owned Site Multi-site production Work re-route Internal Sharing Remote Connectivity Infrastructure limitations Potential oversight challenges Existing agreements generally in same metro area Inadequate for extended outage Requires retrieval of paperwork Limited capacity of other sites Lack of centralized governance Potential competition, internal and external, for same space Dedicate-space, ideally out-of- region, with consistently updated technology and tools. LOB-managed sites Vendor Subscriptions & Proprietary Real Estate © 2010 Wells Fargo Bank, N.A. All rights reserved. For public use.

77 Legislative Update Impacts to Fiduciary Businesses  Congress considering legislation on disclosure of service provider compensation, and expenses paid by participants.  Significant action expected from Congress and the Department of Labor in  Proposed expansion of the definition of fiduciary to include plan consultants, brokers and other investment advisers who may not fall under the current definition.  Potential material overhaul of financial services regulation proposed by the Obama Administration. © 2010 Wells Fargo Bank, N.A. All rights reserved. For public use.

88 Conclusion  Risk Management drives our industry, our regulatory environment, and each of our businesses.  Operational Risk Management is a key component of risk management and responsible governance.  Business Continuity Planning serves as a relevant example of recent legislative initiatives and high profile, high impact events and responses.  The legislative environment continues to change, driven by the current economic crisis and other disruptive events, including natural disasters. © 2010 Wells Fargo Bank, N.A. All rights reserved. For public use.

99 Next Steps  Ensure that you remain diligent in understanding changes to risk management principles as well as the regulatory environment applicable to your firm and the potential impacts of both to your organization.  Consider strengthening the framework your organization already has or building out a formal risk management framework if it does not already have one.  Prepare yourselves and your families and businesses to respond to emergencies.  Ready.gov  Ready.gov/kids  Ready.gov/business © 2010 Wells Fargo Bank, N.A. All rights reserved. For public use.