2.  6 autonomous businesses  208,000 employees  Operations in 70 countries  Net sales $54 Billion  Net USG sales $10 Billion  Member of Dow Jones Industrial Average since 1939 2 Sikorsky Carrier Otis Fire & Security Pratt & Whitney Hamilton

3.  Audit Committee/Chairman set the overall tone › Close working relationship with CFO, General Counsel, Audit, Business Practices  Business Unit Presidents are required to maintain an effective internal control structure  Finance Council oversees implementation of Sarbanes-Oxley certification and assessment requirements 3

4. Independent/active Board of Directors and Audit Committee Un-compromising values and standards communicated in Code of Ethics and Financial Manual Well-respected and highly ethical Chief Executive Officer Anonymous and/or confidential reporting through the Ombudsman/DIALO G program Objective:Addressed Via: Reliability of financial reporting Internal Controls Review Effectiveness and efficiency of operations (including safeguarding of assets) Internal Controls Review Management reviews Compliance with laws and regulation Enterprise Risk Management Expanded compliance audit protocols (Antitrust, Privacy, Export, Improper Payments) Separate Government Accounting functions Business Practices and Legal Organizations 4 Control Environment Internal Control Activities

5.  Scoping › Corporate/business units develop a review plan based on asset and earnings coverage desired › Primary focus on 60 Tier I entities  Requirements for Tier I Entities › Perform a risk assessment  Evaluate general control environment  determine extent of controls testing required › Test key controls outlined in UTCs 10 matrices › Identify and correct control deficiencies › Certify results to Corporate 5

6. 6 Factors to Consider in Evaluating Risks Operational Risk Changing market conditions Legal Proceedings New products Management Risk Management tenure/turnover Management ability to override controls Changes in delegation of authority Financial Risk History of operating losses Significant fluctuations in balance sheet accounts Judgmental reserves Organizational Risk Restructurings Recent acquisitions New outsourcing agreements Complex organization structure Systems Risk New ERP implementation Old unsupported applications Ineffective back-up and recovery procedures Ethics and compliance risk Frequency of ethics investigations Low scores on ethics portion of employee survey Recently verified fraud cases

7.  10 cycles covered › Revenue › Expenditure (Purchasing, Receiving, Accounts Payable, Disbursements) › Payroll › Fixed assets › Production › Treasury › Financial Reporting › Information Technology › Tax (Field Level) › Company Level Controls (General Control Environment) 7

8. 8 Control objectives for the revenue cycle Control activities and testing routine

9. Independent/active Board of Directors and Audit Committee Un-compromising values and standards communicated in Code of Ethics and Financial Manual Well-respected and highly ethical Chief Executive Officer Anonymous and/or confidential reporting through the Ombudsman/DIALO G program Objective:Addressed Via: Reliability of financial reporting Internal Controls Review Effectiveness and efficiency of operations (including safeguarding of assets) Internal Controls Review Management reviews Compliance with laws and regulation Enterprise Risk Management Expanded compliance audit protocols (Antitrust, Privacy, Export, Improper Payments) Separate Government Accounting functions Business Practices and Legal Organizations 9 Control Environment Internal Control Activities

10.  ERM adopted as Corporate policy in 2009  Business units/Corporate Functions identify and mitigate significant business and compliance risk  ERM results and mitigation activities reviewed at: › July Business Reviews with Chairman › October Presidents Council (consolidated results) › December Audit Committee (final assessment) 10

11. ERM – 2010 SUMMARY Risk Ranking Adequacy of Mitigation Lower Higher Consistently applied & effective Inconsistently applied & not fully effective Not effective Business Risks 1.Identified Business Risk 2.Identified Business Risk 3.Identified Business Risk 4.Identified Business Risk 5.Identified Business Risk 6.Identified Business Risk 7.Identified Business Risk Compliance Risks A.Identified Compliance Risk B.Identified Compliance Risk C.Identified Compliance Risk D.Identified Compliance Risk E.Identified Compliance Risk F.Identified Compliance Risk G.Identified Compliance Risk 1 4 3 2 5 6 A B C 7 F D G E 2009 Risk 11

12. Jan 1 Aug 1 Sept 1 Oct 1 Nov 1 Dec 1 Dec 31 Corporate departments perform risk assessments BUs perform risk assessments Complianc e Council (October) Presidents Council (10/25) Audit Committe e (12/13) Review ERM portfolio at: Actions in response (e.g. mitigation) BUs report at OMM II Roll-up risks & risk responses Use results in identifying next year’s objectives Review status with VPBP/IA (June – August) ERM: 2011 CYCLE ERM team responsibility Business Unit responsibility Corporate Office Department responsibility All Use results in identifying next year’s objectives Update Presidents’ objectives Review with Board Per Matrix Roll-up risks/ responses Functional Councils (September) 12