CONFIDENTIAL AND PROPRIETARY. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. Copyright (c) 2007 Standard & Poor’s, a subsidiary of The McGraw-Hill Companies, Inc. All rights reserved. Enterprise Risk Management: Impact on Standard & Poor’s Credit Ratings Raam Ratnam – Standard & Poor’s

2. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 An S&P Definition of ERM A comprehensive, forward-looking, active, iterative, permanent discipline to … imagine, identify, understand, then mitigate, remove, or learn to live with … anything that can impair a company’s ability to repay debt in full and on time.

3. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Why are Rating Agencies Interested in ERM? A Deeper Understanding of Management More Forward-Looking Ratings Clearer External Communications Better Differentiation

4. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 A Subtle Change in Language… and Behavior Earnings… “Return on Invested Capital” “Return per Unit of Risk” Forecasting… “Single/Limited Scenarios” “Unlimited Scenarios” Strategy… “Making Smart Bets” “Selecting Strategies along the Efficient Frontier”

5. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Where Has ERM Been Applied in the Ratings Process?  Financial Institutions  Insurance  Traders (Power, Agriculture, Commodities)  Other Sectors

6. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Before Formal ERM Evaluation ERM Quality Lower Higher Low Risk Tolerance Lower Higher Low High Credit Rating:

7. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 With Formal ERM Evaluation ERM Quality Lower Higher Low Risk Tolerance Lower Higher High Credit Rating:

8. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 With Formal ERM Evaluation ERM Quality Lower Higher Low Risk Tolerance Lower Higher Rating Pressure Upgrades Low High Credit Rating:

9. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Sector Specific Application ERM is not the same in each sector – The Universal ERM Framework is not a straight-jacket blindly applied to each company S&P carefully explores each sector and develops an ERM platform that makes sense for that sector Flexibility allows for company differences in application of ERM

10. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 General Framework

11. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Universal ERM Structure Risk Mgt Culture & Governance Risk A Control Processes Emerging Risks Mgmt Risk C Control Processes Strategic Risk Management Risk B Control Processes

12. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Universal ERM Structure Risk Mgt Culture & Governance Risk A Control Processes Emerging Risks Mgmt Risk C Control Processes Strategic Risk Management Risk B Control Processes

13. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Universal ERM Structure Risk Mgt Culture & Governance Risk A Control Processes Emerging Risks Mgmt Risk C Control Processes Strategic Risk Management Risk B Control Processes

14. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Universal ERM Structure Risk Mgt Culture & Governance Risk A Control Processes Emerging Risks Mgmt Risk C Control Processes Strategic Risk Management Risk B Control Processes

15. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Application of ERM in the Insurance Sector

16. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Insurance Previously, only qualitative credit given to risk management practices and models Ultimately, may give some quantitative recognition to risk models, but only where models are robust and underlying risk management framework is sound Risk management is at the heart of the insurance business Objective: Enhance ratings process by increasing our analytical focus on insurers’ risk management practices

17. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 ERM & Ratings ERM Quality Evaluation is based on the risks of the company Importance of ERM in the company rating is based on: -Capacity to absorb losses -Complexity of risks A insurer with tight capital and complex risks -ERM is very important A insurer with excess capital and ordinary risks -ERM is not as important

18. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 ERM Quality Classifications Excellent  Advanced capabilities to identify, measure, manage all risk exposures within tolerances  Advanced implementation, development and execution of ERM parameters  Consistently optimizes risk adjusted returns throughout the organization Strong  Clear vision of risk tolerance and overall risk profile  Risk Control exceeds adequate for most major risks  Has robust processes to identify and prepare for emerging risks  Incorporates risk management & decision making to optimize risk adjusted returns Adequate  Has fully functioning control systems in place for all of their major risks  May lack a robust process for identifying and preparing for emerging risks  Performing good classical “silo” based risk management  Not fully developed process to optimize risk adjusted returns Weak  Incomplete control process for one or more major risks  Inconsistent or limited capabilities to identify, measure or manage major risk exposures

19. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 For Insurers with Strong or Excellent ERM Standard & Poor’s will develop robust processes for evaluating insurers' internal economic capital models To be performed only for companies with effective ERM Evaluations of economic capital will be used in conjunction with existing static, risk-based measures Dynamic approach will enhance our existing and prospective view of capital adequacy Standard & Poor’s can incorporate benefits of uncorrelated risks (diversification) Economic Capital Review (2007 Plan)

20. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Insurance ERM Summary 1.ERM is a new organizing concept – A collection of issues we have always covered 2.ERM applies to all insurers globally 3.ERM evaluation is tailored to the risks of each insurer 4.ERM recognizes all the risk management of the insurer – Even if the company does not do “ERM”!!! 5.ERM is reflected in insurer ratings – Importance of ERM will vary among companies – just as every other factor does 6.ERM is a new section in the ratings report 7. ERM is not a new Capital Model – ERM is not primarily concerned with looking at an insurer’s Economic Capital Model Risk Control Emergi ng RM Risk & Capital

21. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Insurance Credit Ratings – 15 years ago S&P Credit Research Report, Feb. 15, 1992 Prudential Insurance Co. of America Financial Strength Rating: AAA “Prudential tolerates more aggressive balance sheet risk than some peers.” “Prudential has detailed methodology to compare the risk/reward tradeoffs for various investment opportunities …15% of the general account is invested in higher risk assets.” “[mortgage] concentrations exist in California (23%), New York (10%) and New Jersey (7%)…”

22. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 S&P Credit Research Report, Jan. 12, 2007 Prudential Insurance Co. of America Financial Strength Rating : AA- “…reflects Prudential's strong risk-management culture, integrated approach to risk monitoring, and excellent credit risk management capabilities. The otherwise strong ERM is somewhat mitigated by the lack of an overall quantitative view of risk from which an adequate strategic risk management process can be formed.” Insurance Credit Ratings – Today

23. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Overall ERM Evaluation (Dec. ’06, 241 Insurers)

24. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Trading Risk Management Analysis: the Electric Power Sector

25. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Trading Risk Management – Three Part Analysis Capital adequacy Measures discrete risks of market, credit and operational risks Liquidity Measures exposure to collateral calls under stress scenarios Risk management practices – ‘PIM’ Evaluation of a company’s ability to identify and monitor significant risks, limit losses and operate within well-communicated risk tolerances  New!

26. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 PIM Policies – Risk Culture and Structure Infrastructure – Processes and Technology Methodology – Measurement and Reporting Risk A Control Process Risk B Control Process Emerging Risks Mgmt

27. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 PIM Assessment Test Phase Initiated in April 2006; Completed in May 2007 Goal: mapping risk management infrastructure to what S&P concludes are best practices Applied to ten companies initially – Utility and energy merchants – Pure trading – Large and small

28. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Companies Selected Black Hills Corp. (BBB- / Stable Outlook) Constellation Energy Group Inc. (BBB+ / Negative Outlook) Dynegy Inc. (B / Stable Outlook) Edison Mission Energy (BB- / Stable Outlook) Exelon Corp. (BBB+ / CreditWatch Negative) Mirant Corp. (B+ / Stable Outlook) NRG Energy Inc. (B+ / Stable Outlook) Reliant Energy Inc. (B / Positive Outlook) Sempra Energy (BBB+ / Stable Outlook) TXU Corp. (BB / CreditWatch Negative)

29. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 PIM Assessment Results Summary Interesting –Large variation in risk management infrastructures –Risk appetite does not necessarily match risk management structures and modeling resources –Most policies and key system components only in place for a short time for most companies Expected –Dominance of senior management in risk identification and control is sometimes a key concern –Asset-based trading is less robust that pure trading –Internal reporting is robust but external reporting is poor across the board

30. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Next Steps in ERM Analysis for S&P

31. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Where we are with ERM Analysis Assess Value of ERM Analysis Evaluate Risk Control Processes Evaluate Enterprise-Wide ERM Publish Draft Methodology; Expose for Comment Conduct Open Forum Discussions Discuss During Regularly Scheduled Review Meetings Non-Financial Sectors Merchant Power, Trading Sectors Financial Sectors Scoring All Firms on ERM Impact on Some Ratings and Dozens of Rating Outlooks Deep Dive ERM Analysis and Advanced Capital Modeling Update PIM Methodology from Lessons Learned Extend to 2nd group of Power Cos and other Traders Incorporate into Analytic Reports

32. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Analytic services and products provided by Standard & Poor’s are the result of separate activities designed to preserve the independence and objectivity of each analytic process. Standard & Poor’s has established policies and procedures to maintain the confidentiality of non-public information received during each analytic process.