1. Assessing the Internal
Control Environment
- Reassessment resulting from the Doorstep results
Confidential

2. Index Topic Page number Current responsibilities 3 Current status 4
Our corporate goal 7
Goals of the assessment 9
Improvements to current process 10
Internal audit vs risk management 11
Going forward
Guidelines of assessment process 13
Resources for projects
Skeleton workplan 16

3. Planning Responsibility
Current Responsibilities
BRM
Doorstep
Audit committee
Sponsors
CFO, RAC,
Risk Ops AA
Ongoing monitors
Risk Ops, RAC
Planning Responsibility AA
Risk Ops, RAC AA
Risk Ops, RAC, AA, business controllers
Business Controllers
Execution
Business Controllers

4. Key differences between BRM & Doorstep
Current status - Deliverables and key differences
BRM Doorstep
Deliverables
1) Control opinion 1) Recommendations for improvement
communicated to upper levels of management
2) Documented control processes
2) Management obtains comfort over offices’
3) Update audit committee operations
Key differences between BRM & Doorstep
1) BRM process/monthly control committee 1) Detailed knowledge used by key senior
management
2) Aid to external audit process 2) Self assessment
3) Corporate governance 3) Led by management who has indepth knowledge of issues and day-to-day business issues
4) Focused/targeted control reviews

5. Current status - Key points
BRM Doorstep
Key points
1) Not a true internal audit - not all risks are audited 1) Not independent (self assessment)
2) Recommendations are not appropriately brought to 2) Overlaps some of BRM work
the attention of management
3) Lacks bottom-up buy-in - perception of no added value
5) Based on needs of external audit
6) Control opinion does not cover risk of loss in future periods
BRM
Doorstep
Overlap

6. BRM Doorstep Successes Success of both processes
Current status - Key successes
BRM Doorstep Successes
1) BRM process developed based on independent 1) Routine and extensive communication assessment of risks review between AA and Enron
2) Control documentation completed 2) Material weaknesses identified are brought to the attention of
senior management
3) Created awareness within business units of 3) A process has been established to clear identified weaknesses
key business risk elements
4) Management empowerment for process
5) Self assessment
6) Based on minimum standards/best practices
Success of both processes
Top level buy-in/approval for resource expenditure
Management has showed a willingness to enhance/challenge current process

7. Current status - BRM & Doorstep
Does management believe that the two processes are sufficient to monitor the achievement of our corporate goal?

8. Our corporate goal
To develop and maintain a world class internal control environment consistent with our business aspirations
Definition of a world class internal control environment
1) Leader in the field - acknowledged in market place
2 )Leveragable in commercial negotiations (asset, not liability)
3) Up to date with business developments
4) Regularly and independently monitored and assessed
5 ) Highly automated
6 ) Transparent at all levels within the organization
Enron believes it is necessary to have an assessment process in place to monitor the internal control environment

9. Goals of the assessment
Current goals
to obtain an independent opinion on Enron’s control environment
to assess the operational risk of each location
communicate key issues to upper management
assess risks of commodities and trade types
Additional goals not currently met
assess all risks of Enron
to have Enron lead the process, direct planning, execution, and follow up

10. Improvements to current process - Gaps
Enron must be involved planning and executing (BRM)
Process/goals need to become transparent
Balance between corporate governance and self assessment
Minimum standards/best practices to be formalized
High risk deviations from minimum standards must be brought to attention of senior management
Follow up and improvements must be continually assessed and performed
A plan to ensure internal audit standards are must exist

11. Internal audit vs risk management
Definition - Design of internal audit as defined by the Internal Institute of Auditors
Internal auditing reviews the reliability and integrity of information, compliance with policies and regulations, the safeguarding of assets, the economical and efficient use of resources, and established operational goals and objectives. Internal audits encompass financial activities and operations including systems, production, engineering, marketing, and human resources.
Do we need to audit all the above mentioned items?
Do the current processes meet the requirement for an internal audit?
C - Compliance
A- Achieving goals and objectives
R- Reliability of information
E- Efficiency and effectiveness
S - Safeguarding assets

12. Going forward

13. Guidelines of assessment process
All assessment processes should be driven by Enron
Self assessment - Risk operations/RAC
Corporate governance - Audit committee/CFO
Deliverables and goals need to be transparent
Processes must be ongoing and continually improved
Processes cannot be done in a vacuum - all assessments should work together
Design minimum standards
Implement minimum standards at all Enron companies
Establish a plan to test that minimum standards are met
Continuous improvement
Design
Implement
Test/Review
Reengineer/process improvement

14. Project management team/Resources building block for BRM
Key: Independent function to meet requirements for internal audit
In order to maximize efficiency, planning and execution for this must be done with Doorstep team
Audit
committee
Project Sponsors
Senior management
Corporate team, AA
Note: This team must work closely with the doorstep team
Oversite committee
(vision, direction)
Corporate team, AA
Regional controls, control senior managers, global resources
Note: This group should also be responsible for following up findings
Implementation,
review, monitor
AA, Enron execution team
Business controllers
Execution and local coordination

15. Project management team/Resources building block for Doorstep
Key: Business controllers, global committee, and AA involved in developing a plan that meets needs:
IA requirements
Independent opinion
Risks as business units see them
Risks as global sees them
Rick Causey, Rick Buy
Project Sponsors
Sally Beck, Ted Murphy, Fernley Dyson
Shona Wilson, Mike Jordan, Brent Price, regional controllers
Oversite committee
(vision, direction)
Brent Price, Shona Wilson, Mike Jordan, AA
Regional controllers, control senior managers
Implementation,
review, monitor
AA, Enron execution team
Business controllers
Execution and local coordination

16. Skeleton workplan Earmark committee to review current process
Combination RAC, Risk Operations, AA
Input from business controllers
Determine assessments to take place to meet goals
Formally document minimum standards/best practices
Risk Operations
Develop audit program to meet goals AA
Develop timeline for reviews
Earmark resources
Risk Operations, RAC
Formalize reporting structure and data capture
Risk operations, RAC