1. Upside of Risk Management vs. Unintended Consequences William McCabe AGA – Montgomery County/Prince Georges County Chapter March 11, 2015

2. History Internal Controls Have Existed Since the Hellenistic Period Not Formally Detailed Until 1977 Under Foreign Corrupt Practices Act Previously Reporting and Transparency were the key risk management tools Sarbanes Oxley Made it Easier to Criminalize Bad Business Judgment and Complex Accounting in Hindsight SOX Was an (Un)-necessary Step at Best SEC Acts of ’33 & ‘34 prohibited fraud & deceit through reporting & disclosures Did not create an environment of government supervision American Capital Markets Dominated the World under these rules

3. History 1980’s Drexel Burnham Lambert Michael Milken Rudy Giuliani 2000’s Tech Bubble Burst – Economic Externalities Eliot Spitzer pursued investment banks Cratering stock prices Exacting Expensive Settlements 2002 Spitzer went after Merrill Lynch - Settled for $100 M Proceeds went to Government coffers, rather than investors or stockholders

4. Currently So Far this year Bank of America, JP Morgan Chase, Citigroup, Goldman Sachs have paid more than $50m, for supposedly misleading investors BP has paid a $13 billion penalty for Operational risk management Wasn’t until 1909 that Corporations were even capable of being found guilty Corporations had neither Bodies to be punished or Souls to be condemned

5. Criminalizing Business Conduct When America was Founded There were only 3 Federal Crimes Treason Counterfeiting Piracy By the 1990’s – Over 300,000 Federal Statutes existed with criminal penalties attached Virtual double jeopardy for Investors, Stockholders, and Bondholders

6. Modis Operandi Find a Large Company (may or may not have done anything wrong) Threaten Manager with Commercial Ruin Force them to pay enormous fines using shareholder money To Drop Charges (if any) Under a Secret Settlement - (no case law exists) No one can check the details (sealed settlements) Results - Increased government revenues In 100 years we have moved from requiring disclosure as the primary risk management tool, to in many cases criminalizing risk taking, bad decision making, and complex accounting issues