1. CONFIDENTIAL AND PROPRIETARY. Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. Copyright (c) 2007 Standard & Poor’s, a subsidiary of The McGraw-Hill Companies, Inc. All rights reserved. Enterprise Risk Management: Impact on Standard & Poor’s Credit Ratings Steve Dreyer Managing Director, Standard & Poor’s SCRLC Meeting, June 6, 2007

2. 2. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 An Unofficial Definition A comprehensive, forward-looking, active, iterative, permanent discipline to … imagine, understand, identify, then mitigate, remove, or learn to live with … anything that can destroy your company.

3. 3. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 What Motivated S&P to Introduce ERM into Credit Ratings? A Deeper Understanding of Management Force Forward Thinking Communicate More Clearly and…. Companies were “ERM-Ready”

4. 4. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 A Subtle Change in Language… and Management Earnings… “Return on Invested Capital”“Return per Unit of Risk” Forecasting… “Single/Limited Scenarios”“Unlimited Scenarios” Strategy… “Making Smart Bets”“Selecting along the Efficient Frontier”

5. 5. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Where Has ERM Been Applied in the Ratings Process?  Financial Institutions  Insurance  Energy Firms  Other Non-Financial Sectors

6. 6. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Significance of Risk Low -------------------------------------- High Quality of Risk Controls Low ------------------------------- High When Does it Make Sense to Include ERM in Ratings?

7. 7. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Before Formal ERM Evaluation ERM Quality Lower Higher Low Risk Tolerance Lower Higher Rating High

8. 8. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 With Formal ERM Evaluation ERM Quality Lower Higher Low Risk Tolerance Lower Higher Rating High

9. 9. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Low Risk Tolerance Business Profile 5 15 10 20

10. 10. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 High Risk Tolerance Business Profile 5 15 10 20

11. 11. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Complex Business Profile 5 15 10 20

12. 12. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Analysis of Complex Business Profile 5 15 10 20

13. 13. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Complex Business Model 5 15 10 20 With ERM

14. 14. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Strategic Efficient Frontier Risk Reward Strategic Choices

15. 15. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Strategic Efficient Frontier (2) Risk Reward Strategic Choices Hurdle Rate Risk Tolerance

16. 16. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Strategic Efficient Frontier (3) Risk Reward Strategic Choices Hurdle Rate Risk Tolerance

17. 17. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Risk Reward Strategic Choices Hurdle Rate Risk Tolerance Strategic Efficient Frontier (4)

18. 18. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Sector Specific Application ERM is not the same in each sector – The Universal ERM Framework is not a straight-jacket blindly applied to each company S&P carefully explores each sector and develops an ERM platform that makes sense for that sector Flexibility allows for company differences in application of ERM

19. 19. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Application of ERM in the Insurance Sector

20. 20. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Insurance Credit Ratings – 15 years ago S&P Credit Research Report, Feb. 15, 1992 Prudential Insurance Co. of America Financial Strength Rating: AAA “Prudential tolerates more aggressive balance sheet risk than some peers.” “Prudential has detailed methodology to compare the risk/reward tradeoffs for various investment opportunities …15% of the general account is invested in higher risk assets.” “[mortgage] concentrations exist in California (23%), New York (10%) and New Jersey (7%)…”

21. 21. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 S&P Credit Research Report, Jan. 12, 2007 Prudential Insurance Co. of America Financial Strength Rating : AA- “…reflects Prudential's strong risk- management culture, integrated approach to risk monitoring, and excellent credit risk management capabilities. The otherwise strong ERM is somewhat mitigated by the lack of an overall quantitative view of risk from which an adequate strategic risk management process can be formed.” Insurance Credit Ratings – Today

22. 22. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Insurance Scores as of October 2006 Overall ERM Evaluation (207 Insurers) Strong 12% Excellent 3% Weak 5% Adequate 80%

23. 23. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Introduction of ERM in the Electric Power Sector Significance of Risk Low ---------------------------------- High Quality of Risk Controls Low ------------------------- High

24. 24. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Trading Risk Management – Three Part Analysis Capital adequacy Measures discrete risks of market, credit and operational risks Liquidity Measures exposure to collateral calls under stress scenarios Risk management practices – ‘PIM’ Evaluation of a company’s ability to identify and monitor significant risks, limit losses and operate within well-communicated risk tolerances  New!

25. 25. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 PIM Policies – Risk Culture and Structure Infrastructure – Processes and Technology Methodology – Measurement and Reporting

26. 26. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 PIM METHODOLOGY POLICIES INFRASTRUCTURE Risk Technology Operations Risk Training Capital Allocation Risk Culture Risk Appetite & Strategy Risk Control & Monitoring Disclosure and Awareness Model Vetting & Back-Testing Valuation Methods

27. 27. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 PIM Assessment Test Phase Initiated in April 2006; Completed in May 2007 Goal: mapping risk management infrastructure to what S&P concludes are best practices Applied to ten companies initially – Utility and energy merchants – Pure trading – Oil and gas E&P – Big and small

28. 28. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Companies Selected Black Hills Corp. (BBB- / Stable Outlook) Constellation Energy Group Inc. (BBB+ / Negative Outlook) Dynegy Inc. (B / Stable Outlook) Edison Mission Energy (BB- / Stable Outlook) Exelon Corp. (BBB+ / CreditWatch Negative) Mirant Corp. (B+ / Stable Outlook) NRG Energy Inc. (B+ / Stable Outlook) Reliant Energy Inc. (B / Positive Outlook) Sempra Energy (BBB+ / Stable Outlook) TXU Corp. (BB / CreditWatch Negative)

29. 29. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 PIM Assessment Results Summary Large variation in risk management infrastructures Risk appetite often does not match risk management structures and modeling resources Asset-based trading is less robust that pure trading Most policies and key system components only in place for a few years for most companies Dominance of senior management in risk identification and control Internal reporting is robust but external reporting is poor across the board

30. 30. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Next Steps PIM –Revise PIM methodology from lessons learned –Greater focus of key areas and improve assessment efficiency –Extend assessment to a second group of energy companies with trading operations –Begin to formalize risk management reporting into internal and external reports ERM –Assess ERM potential and criteria for all companies in the energy sector –Issue criteria later in 2007 with request for comment

31. 31. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 The Big Picture

32. 32. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Universal ERM Structure Risk Mgt Culture & Governance Risk A Control Processes Emerging Risks Mgmt Risk C Control Processes Strategic Risk Management Risk B Control Processes

33. 33. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Universal ERM Structure Risk Mgt Culture & Governance Risk A Control Processes Emerging Risks Mgmt Risk C Control Processes Strategic Risk Management Risk B Control Processes

34. 34. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Universal ERM Structure Risk Mgt Culture & Governance Risk A Control Processes Emerging Risks Mgmt Risk C Control Processes Strategic Risk Management Risk B Control Processes

35. 35. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Universal ERM Structure Risk Mgt Culture & Governance Risk A Control Processes Emerging Risks Mgmt Risk C Control Processes Strategic Risk Management Risk B Control Processes

36. 36. SCRLC Meeting June 6, 2007 Permission to reprint or distribute any content from this presentation requires the written approval of Standard & Poor’s. August 2005 Analytic services and products provided by Standard & Poor’s are the result of separate activities designed to preserve the independence and objectivity of each analytic process. Standard & Poor’s has established policies and procedures to maintain the confidentiality of non-public information received during each analytic process. www.standardandpoors.com