1. Deutsche Bank Corporate Security & Business Continuity Business Continuity Metrics March 19 th 2008

2. Legal, Risk & Capital DB Corporate Security & Business Continuity – March 19 th 2008 page 2 ■What is measured and why? ■How is it measured? ■How is the information used? ■What is next?

3. Legal, Risk & Capital DB Corporate Security & Business Continuity – March 19 th 2008 page 3  What is measured and why?  Readiness + Capability  Readiness = Business Impact Analysis (BIA) & Business Recovery Plan (BRP)  Capability = Call Tree & Site Testing  Business Continuity Management (BCM) Compliance as a Key Risk Indicator

4. Legal, Risk & Capital DB Corporate Security & Business Continuity – March 19 th 2008 page 4  How is it measured?  Business unit scorecard  Business group scorecard  Global business group scorecard

5. Legal, Risk & Capital DB Corporate Security & Business Continuity – March 19 th 2008 page 5 Scorecard by Business Unit

6. Legal, Risk & Capital DB Corporate Security & Business Continuity – March 19 th 2008 page 6 Scorecard by Business Group

7. Legal, Risk & Capital DB Corporate Security & Business Continuity – March 19 th 2008 page 7 How is the information used?  Control by the BCM group and senior management  Compliance information is reviewed by the Audit Group  The information is part of the Economic Capital Calculation

8. Legal, Risk & Capital DB Corporate Security & Business Continuity – March 19 th 2008 page 8  Economic Capital Calculation ■The amount of equity capital needed at any given time to absorb unexpected losses arising from current exposures.

9. Legal, Risk & Capital DB Corporate Security & Business Continuity – March 19 th 2008 page 9 Operational Risk Coverage of Special Risk Types Risk Types and Control Groups Fiduciary Service Risk Orig. & Execution Risk FRRRTPRITRStaff Risk Vendor Risk Regula- tory Risk Real Estate Risk Security Risk Business Continuity Risk Assessment Approach and Organization Level Use ORM db-SAT process Use results from SOx Workflow assessment Use results from existing assessment process Use results from existing dbRAMM process Use ORM db-SAT process Use results of existing SA in db-SAT Data provided by CRES for all relevant buildings Use ORM db-SAT process Detailed Reviews Bottom Up by Product: GM GTB CF CI PBC AM PWM LEMG Front Office Control- ling GTOITRCHRSourcing Compli- ance CRESCSBC Control Group Waived for 2007 Q1/08 IB TPR (Starc) Q1/08

10. Legal, Risk & Capital DB Corporate Security & Business Continuity – March 19 th 2008 page 10  What is next?  New Metrics based on Calculation of Potential Loss

11. Legal, Risk & Capital DB Corporate Security & Business Continuity – March 19 th 2008 page 11 Potential Loss Based Key Risk Indicator (KRI) Total Revenue (€) Compliance ××= % Planned recovery based on: - Recovery Seats - Work from Home - Pass the Book Recovery Capability % Compliance w/ BCM Lifecycle: - BIA, BRP - Testing Adjusted Revenue (€) ■ New Metrics based on Calculation of Potential Loss Total Revenue (€) Adjusted Revenue (€) –= Revenue at Risk (€) Used to derive KRI (%)

12. Legal, Risk & Capital DB Corporate Security & Business Continuity – March 19 th 2008 page 12 Questions? Thank you! Oscar Menendez