1. © 2008 Towers Perrin Embedding ERM — A Tough Nut to Crack Fifth Biennial Global ERM Survey Hélène Pouliot November 2008

2. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 1 Towers Perrin’s fifth biennial survey on Enterprise Risk Management in the insurance sector During May and June of 2008, the Tillinghast business of Towers Perrin conducted a Web-based survey among senior executives in major insurance companies around the world Chief Financial Officers, Chief Actuaries and Chief Risk Officers were asked to document the approaches to, and current status of, ERM activity within their companies A total of 359 executives responded, making this the largest global survey of the insurance industry on its topic Respondents include a wide range of insurance organizations from North America (49%), Europe (29%), Asia/Pacific (19%), Latin America (2%) and Africa/Middle East (1%) Respondents come from all lines of business, including life insurance (34%), P/C insurance (33%), reinsurance (20%) and multiline insurers (13%)

3. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 2 Definitions 2 © 2008 Towers Perrin 2 Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients

4. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 3 Glossary of terms Geographical terms North America — includes the U.S., Canada and Bermuda Europe — includes the U.K. and continental Europe Asia/Pacific — includes Asia and Australia Latin America — includes Mexico and South America Middle East/Africa — includes Middle East and Africa Company size terms Large — Company with annual revenue in excess of U.S. $10 billion Medium — Company with annual revenue between U.S. $1 billion and U.S. $10 billion Small — Company with annual revenue less than U.S. $1 billion DEFINITIONS

5. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 4 Participant Profile 4 © 2008 Towers Perrin 4 Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients

6. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 5 Respondents include a wide range of insurance organizations Company TypePrimary Business Public stock Private stock Mutual or mutual holding company Fraternal Other Life/annuity/pensions insurer Property/casualty (P/C) insurer Multiline (life and P/C) insurer Property/casualty (P/C) reinsurer Health insurer/reinsurer Life/annuity/ pensions reinsurer Multiline (life and P/C) reinsurer Bank Asset manager Other

7. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 6 Our survey covered a wide geographic spread, with a significant contribution from North America, Europe and Asia/Pacific Headquarters CountryRespondent Country Asia/Pacific Africa/Middle East Europe Latin America North America Asia/Pacific Africa/Middle East Europe Latin America North America

8. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 7 Participants included many of the world’s largest insurers; 55% of respondents had revenues over $1 billion and nearly 16% over $10 billion Total Direct Revenues Mean: Approximately U.S. $3.8 billion Total Assets Mean: Approximately U.S. $78 billion $10 billion or more $5 billion to $9.9 billion $1 billion to $4.9 billion $100 million to $999 million Less than $100 million $500 billion or more $100 billion to $499 billion $50 billion to $99 billion $25 billion to $49 billion $1 billion to $24 billion Less than $1 billion

9. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 8 An incomplete list of the companies that agreed to be listed as survey participants Assumption Mutual Life Insurance Co. AVIVA Canada Inc. Blue Cross Life Insurance Company of Canada Co-operators Life Insurance Company Desjardins Financial Security Empire Financial Group Entraide Assurance-Vie Equitable Life of Canada FaithLife Financial Groupe Promutuel Féd. Soc. Mutuelle d'Ass. Gén. Manulife Financial RGA Reinsurance Company Sun Life Financial of Canada Swiss Re Life & Health Canada The Independent Order of Foresters The Standard Life Assurance Company

10. Key Findings 9 © 2008 Towers Perrin 9 Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients

11. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 10 1. Embedding ERM is proving to be a significant challenge 2. Size matters 3. European insurers are better positioned 4. ERM is influencing decisions 5. Economic capital standards are emerging 6. Operational risk remains a weak spot Our 2008 insurance ERM survey produced six key findings

12. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 11 Key Finding #1: Embedding ERM is proving to be a significant challenge A significant percentage of insurers are still focusing on calculating EC (as opposed to using it) 37% of respondents indicate that calculating EC is an area where significant work is needed, with just 10% of insurers believing they have an appropriate capability in place Improvements to EC calculations are focused on getting the basics right, with insurers looking to enhance modeling methodology for individual risks (46%), improve data quality (45%) and extend the risks covered by their models (42%) Factors which are integral to using EC in decision making — timeliness (25%) and granularity of results (16%), and allocation of diversification benefits (22%) — are not yet a high priority Insurers admit significant work is required in the use of EC for performance management (60%) and decision making (55%), but neither is being treated as a top priority. This suggests these “difficult” issues are being deferred until the quality of core EC calculations improves Among European insurers, only 11% consider their internal capital models are sufficiently embedded in how they manage the business to achieve Solvency II approval “Embedding the model within your company’s business” is considered the greatest challenge to achieving internal model approval (mentioned by 63% of participants) Only 30% of insurers incorporate risk measures into incentive compensation arrangements

13. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 12 Good business practice is a key driver of risk management efforts in all regions and for all sizes of respondents Good business practice aside, the key drivers of risk management efforts are: In Europe, Solvency II (86%), shareholder considerations (60%) and rating agency considerations (54%) In North America, rating agency considerations (83%), competitive advantage (46%) and shareholder considerations (42%) In Asia/Pacific, Solvency regulation and shareholder considerations (both 56%)

14. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 13 The shift in responsibility for risk management from CFO/Chief Actuary to CRO/Risk Management Committee is slowing The assignment of primary responsibility for ERM to Chief Risk Officer/Director or Head of Risk is more common in: Large companies (72%) compared to small companies (31%) European companies (57%) and Asia/Pacific companies (56%) compared to U.S. companies (32%) 82% of participants report that the person responsible for risk management has independent access to the Board or to a Board sub-committee Yes: To Board sub-committee Yes: To Board No independent access 2008 2006 2004 Chief Risk Officer or Risk Management Director or Head of Risk Risk Management Committee Chief Financial Officer or Finance Director Chief Actuary or Corporate Actuary Head of Internal Audit Other

15. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 14 Key Finding #2: Size matters Larger insurers are significantly more advanced in most aspects of ERM implementation and are increasingly looking to realize their competitive advantage Large companies demonstrate a superior level of commitment to EC, with 84% already calculating EC, compared to 69% of medium-size companies and 37% of small organizations Larger firms are also already leading the way in utilization of EC: 44% of larger companies use EC in strategic planning and capital allocation compared to 19% of small firms; 40% use EC in product design and pricing, vs. 17% of small firms While 61% of large insurers are giving short term prioritization to using EC in decision- making processes, only 29% of smaller firms are doing so Within two years, a high percentage (84%) of large companies plans to be using EC in performance measurement, but only 46% of small companies plan to do so Competitive advantage features much more strongly as a driver of ERM activities among larger organizations (65%) compared to smaller ones (40%)

16. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 15 Within 12 months, 84% of respondents expect to have a documented risk appetite/tolerance statement in place The development of risk appetite/tolerance statements is less advanced among smaller companies In place Planned within 12 months Not planned Small34%44%22% Medium and Large 57%33%10% No, but planned to be in place within next 12 months Yes No, and no plans to develop within next 12 months

17. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 16 Key Finding #3: European insurers are better placed North American (NA) insurers are trailing their European counterparts in key aspects, such as EC implementation and its use in decision making. Under Solvency II, these capabilities are expected to lead to lower capital requirements and therefore competitive advantage European insurers are generally more comfortable with their ERM capabilities. For example, 23% of NA firms feel significant work is needed in relation to managing market risk exposure, compared to only 7% of EU insurers. Similarly, for EC calculations (45% NA vs. 27% EU) This is further evidenced in the documentation of risk policies, where European insurers and those in Asia/Pacific lead North American firms in most respects Furthermore, a higher proportion of European companies have documented their risk appetite (52% of respondents vs. 40% in North America) and set risk limits for day-to-day management (e.g., for market risk, 88% of respondents in Europe vs. 61% in North America) In addition, more European insurers calculate Economic Capital (78% in Europe, compared to 45% in North America and 59% in Asia/Pacific) Perhaps as a consequence of this, European firms are giving greater short-term priority to using EC within their decision-making processes (56% of respondents), compared to North America (40%) and Asia/Pacific (38%) Within 24 months, 80% to 90% of European insurers expect to be using EC in most major decision-making processes, compared to 60% to 75% of North American firms and 50% to 65% of insurers in Asia/Pacific Moreover, 74% of European insurers expect to be using EC in performance measurement within two years, compared to 54% of North American insurers and 50% in Asia/Pacific

18. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 17 Key Finding #4: ERM is influencing decisions In spite of the challenges of embedding ERM, significant numbers of respondents indicate that their ERM program has resulted in key business changes Major aspects highlighted as having been influenced by ERM programs over the past two years include: Changes in risk strategy or appetite (36% of respondents) Changes in asset strategy (35%) Changes in reinsurance strategy (33%) Changes in product pricing (31%) In addition, a reasonable percentage of insurers indicate that they are already using their EC results in decision-making processes — including capital adequacy/capital management (44%), asset strategy (36%) and product design and pricing (28%) Looking ahead, 44% of respondents highlighted use of EC in decision making as a priority for 2008/9; this proportion increases to 82% for Bermuda respondents and 70% for U.K. respondents Over the next 24 months, insurers anticipate significantly greater use of EC in decision making — for example, in product design and pricing (up from 28% to 67%) and in performance measurement (up from 17% to 59%) However, only 30% of respondents indicate that they incorporate risk measures of any kind into incentive compensation arrangements and only 10% use EC for this purpose. Furthermore, 66% of insurers globally have no future plans to use EC in incentive compensation

19. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 18 Key Finding #5: Economic capital standards are emerging EC methodology is moving toward a one-year VaR approach, with the majority (56%) using a market-consistent terminal balance sheet There has been a substantial global shift toward calculating EC base risk over a one-year risk assessment period, from 32% of participants in 2004, to 56% in 2006 and 68% in 2008 Even in North America, where this approach is less common, the percentage has increased from 43% in 2006 to 57% in 2008 While 85% of larger insurers apply a one-year risk assessment period, a significant percentage of medium-size (35%) and smaller (39%) companies continue to use alternative methods, including a two- to five-year time horizon and the runoff of the portfolio The use of VaR or Risk of Ruin as the primary measure of risk tolerance used to calculate EC has increased from 52% in 2004 to 67% in 2008. During the same period, the use of TVaR or CTE has fallen from 31% to 21% The growing popularity of VaR is consistent across the industry with only marginal differences observed among smaller (61%), medium-size (69%) and larger (75%) firms VaR is most often adopted as a risk measure among multilines (81% of respondents), whereas TVaR is most commonly used among reinsurers (33%) and life insurers (28%) Although the use of a market-consistent terminal balance sheet is common among multilines (85%) and life (67%) companies, just 37% of P/C insurers adopt this approach

20. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 19 Utilization of EC in decision making is set to change dramatically over the next two years Continued… Currently using Plan to use in next 24 monthsDo not use and have no future plans to use

21. © 2008 Towers Perrin Proprietary and Confidential Not for use or disclosure outside Towers Perrin and its clients 20 Key Finding #6: Operational risk remains a weak spot Just 7% of participants believe they have an appropriate operational risk management capability in place and 37% indicate that significant work is required. Operational risk also lags behind other risks in terms of setting risk limits and EC calculation methodology Operational risk is rated by 37% of global participants as requiring significant work, in marked contrast to views expressed on insurance, credit and market risks (9%, 11% and 16%, respectively, requiring significant work) However, operational risk management ranks only seventh among 2008/9 ERM priorities (mentioned by 41% of respondents globally) Of those companies that have set limits to govern day-to-day risk taking, over 70% now have limits for market, credit and insurance risk, but just 26% have limits for operational risk In calculating EC for operational risk, relatively simplistic factor-based methods remain the most commonly used approach (43%), with only 17% using stress testing and 16% stochastic methods Among European insurers, the proportion expected to use an internal model for operational risk (51%) lags significantly behind insurance, market and credit risks (86%, 80% and 65%, respectively)