1. HBOS Insurance and Investment Division “A New Force In Risk Management” Final draft Paul Moore - November 2002

2. Preliminary remarks Strategies, visions and words are all very well…..but Strategies, visions and words are all very well…..but “The proof of the pudding is in the eating” “The proof of the pudding is in the eating” This briefing pack masks a huge amount of the detail required to implement the ideas set out in it. This briefing pack masks a huge amount of the detail required to implement the ideas set out in it. The thinking in this document is iterative and feedback is always welcomed The thinking in this document is iterative and feedback is always welcomed The next stage is broader communication and the development of detailed operating and implementation plans The next stage is broader communication and the development of detailed operating and implementation plans

3. Our vision for risk management Our vision is threefold:- Our vision is threefold:- To become trusted advisers to our colleagues within IID and HBOS Group by providing a simple, understandable and business focused approach to risk management within the division To become a “New Force In Risk Management” by becoming an independently acknowledged benchmark for best practice. To become the first choice employer for the best risk management professionals by reinventing the approach to organisational development.

4. Our objective Our objective is to work with our business colleagues to increase shareholder value. Our objective is to work with our business colleagues to increase shareholder value. [ We recognise that understanding the needs of our other stakeholders – our customers, colleagues, regulators, communities [and families] - is central to achieving this objective]

5. Our strategy for risk management Our strategy will be focused on:- The right people with the right mixture of skills Being passionately business focused Striving for simplicity with clear accountability over process and complexity Leading a culture of openness and excellence in which fear, blame and pride have no part Driving down the costs of managing or failing to manage risks while driving up the profits from taking them

6. The right people with the right skills This part of the strategy is focused not only on risk management professionals but on business management itself. Probably the single most important key to risk management is having the right people in the right jobs. In relation to risk management professionals, the skills we will focus on are:- – Deep business understanding and empathy – Client relationship / communication and influencing skills – Technical skills – analytical and forensic skills and the skill to be able to develop technical knowledge fast – Judgement – the ability to weigh up facts, analyses, technical knowledge, business understanding and creativity with the needs, requirements and perspectives of multiple stakeholders – Creativity – Independence, integrity and personal courage

7. Being passionately business focused This means we are there to understand and support our business colleagues not to act as an “internal police force”. We do not believe in “The answer’s “no”, now what’s the question. This means we are there to understand and support our business colleagues not to act as an “internal police force”. We do not believe in “The answer’s “no”, now what’s the question. We will treat our colleagues as “clients” and help each client to understand the competing needs of other stakeholders / clients (see next slide) We will treat our colleagues as “clients” and help each client to understand the competing needs of other stakeholders / clients (see next slide) Being business focused DOES NOT MEAN only giving messages that are not challenging but we will work incessantly to make our difficult messages digestible and understandable Being business focused DOES NOT MEAN only giving messages that are not challenging but we will work incessantly to make our difficult messages digestible and understandable Being business focused does not mean letting business colleagues simply ignore other stakeholders in their decisions, and so…….. Being business focused does not mean letting business colleagues simply ignore other stakeholders in their decisions, and so…….. “It takes two to tango”. We expect our business colleagues to work with us in an environment of mutual respect and top business leaders to be the sponsors of this and “walk the talk” “It takes two to tango”. We expect our business colleagues to work with us in an environment of mutual respect and top business leaders to be the sponsors of this and “walk the talk”

8. Our clients / stakeholders Our key clients are:- Our key clients are:- –BU leadership teams (including Retail regulated sales) –BU functional teams (including Retail regulated sales) –IID CEO and Executive Management Team –Group Risk Functions (note we carry out the Group role in respect of regulatory risk across IID plus Retail regulated sales) –Group Audit Committee (generally and specifically in relation to our GRR role) –Our external stakeholders –Our shareholders –Our customers –Our colleagues –Our regulators –Our communities –[Our families]

9. Simplicity with clear accountability Vs complexity Good risk management is much more about the exercise of well-informed, well-educated and well-timed judgement than detailed policy or process It is not about being told what to do by “Risk Management” “More is often less” e.g. too much reporting can lead to “missing the wood for the trees” Policy and process is a highly valuable means to an end BUT NOT an end in itself. Policy and process is particularly valuable as guidance and structure in new environments The risks associated with too much prescription is that people follow the rules blindly and never reflect on the ambiguities and dilemmas involved in managing risk In the new knowledge economy, centralised decision making slows you down and makes you uncompetitive. Too much policy and process can stifle creativity, courage and pace.

10. A culture of openness One of the keys to good risk management is having the right culture. One of the keys to good risk management is having the right culture. The culture – what’s “in” The culture – what’s “in” – –Openness – –Excellence – total dedication to getting things right first time and continuous improvement – this drives down the costs of managing / failing to manage risks The culture – what’s “out” The culture – what’s “out” – –Fear and blame go together and discourage openness – –Pride Pride may be the most risky of these because it encourages the “not invented here” syndrome. “Pride comes before a fall”– Hubris = Nemesis Pride may be the most risky of these because it encourages the “not invented here” syndrome. “Pride comes before a fall”– Hubris = Nemesis NB the strain between “accountability” and “no blame” – people cannot be accountable until they have the competence and confidence to carry out the accountability. NB the strain between “accountability” and “no blame” – people cannot be accountable until they have the competence and confidence to carry out the accountability. Is “Situational Leadership” part of the solution?? Is “Situational Leadership” part of the solution??

11. Good risk management increases profit “If you want someone to do A, pay them to do A” “If you want someone to do A, pay them to do A” If you want business managers to manage risk, pay them to do so If you want business managers to manage risk, pay them to do so We will focus on achieving complete transparency of the costs relating to:- We will focus on achieving complete transparency of the costs relating to:- –Managing risks…down to activity levels. –Failing to manage risks –Identifying profits associated with taking risks This has been called “The institutionalisation of quality cost measurement”. It must not be too complex NB 80/20 rule This has been called “The institutionalisation of quality cost measurement”. It must not be too complex NB 80/20 rule We need to agree what our risk appetite is and what this means. We need to agree what our risk appetite is and what this means. We need to agree ways of increasing the upside associated with our plans by taking more risks e.g AIG’s approach We need to agree ways of increasing the upside associated with our plans by taking more risks e.g AIG’s approach

12. Functional analysis – what we do Our work breaks down into the following categories:- Creating and leading the IID risk management framework, its policies etc – mainly set out in or “informed by” this discussion document. Provision of assurance services agreed with clients and Internal Audit – –Agreed activities normally with Internal Audit – –Attending BU meetings – –Carrying out GRR work relating to its “oversight” role so as to be able to provide assurance to the Group Audit Committee – –Reporting “Watching the outside world” – best practice across the division, across HBOS, across the industry, across the business world plus public policy, external affairs and, in particular, regulatory developments Advisory services – to build requirements – both internal and external into business strategy and processes Special projects – e.g IPSB, Provision of shared services to BUs

13. People matters matter most Our own way of working together will be informed by:- A dedication to technical excellence, client service, independence, integrity, courage etc. Values and ethics – “Moving beyond compliance” We will support each other and create a developmental culture – –“The more I help others succeed, the more I succeed myself – –“In the modern knowledge economy learning is a key strategic imperative not irritating and expensive training” “Feedback is the breakfast of champions” A professional collegiate atmosphere – a team bound by common objectives A cohesive approach to leadership and management based on the “situational leadership” model Fun is part and parcel of the recipe Balance in our lives…and is part of risk management – “Too many emails can damage your health!”

14. The focus of our people Professional services approach focused on “competencies” not job descriptions leading to:- Professional services approach focused on “competencies” not job descriptions leading to:- –Increased flexibility of resource management –A strong business focus....what does the business want and not how shall I expand my work to fill the job description I have –Variety for our staff –Creation of a learning and developmental culture –Less unnecessary "management” –A self employed and professional mindset Key focus for our objectives will be a matrix: Key focus for our objectives will be a matrix: –Clients –Service line –Technical –“Engagements” –People development –Practice management Organisational structure in the standard line management sense will not really exist Organisational structure in the standard line management sense will not really exist Three levels of people – Principal / Senior / Junior Risk Management Adviser Three levels of people – Principal / Senior / Junior Risk Management Adviser

15. Ideas about our key performance indicators KPI’s are to measure your progress against the achievement of your strategy and the operating plans you put in place to achieve it. Our KPI’s need further development but will achieve this principle. In particular, they will focus on the last part of strategy – i.e costs and profits Plus the clarity and simplicity of the risk management MI we design and help our business colleagues to provide Also softer items – –The accuracy and creativity of our risk management advice and assurance services – –The effectiveness of the our risk management framework – –The strength of our relationships with the business and other key stakeholders

16. Key early challenges Key challenges in achieving our vision and strategy are as follows:- – –Newly merged organisation – –New division – –New management teams with varied experiences and backgrounds – –Ambitious growth targets – –Complex and difficult projects to deliver – –A plethora of new regulatory / governmental / EEA policy initiatives and new regulation – –New devolved approach to corporate governance and risk management within HBOS – –New functional teams – –Divisional risk management leadership introducing a major change programme into the way we manage risk - the “start-up” year – –Plus pre-existing issues and risks within the Division need to be managed e.g. – –Management stretch – –Risk management resource and expertise issues – –ELAS issues

17. Some other key messages We are not going to treat the business like this……… We are not going to treat the business like this………

19. We say this…….. We say this……..

20. Risk management and compliance is not “rocket science”

21. And it simply means covering the following bases….. And it simply means covering the following bases…..

22. Key risk management processes Analyse risks accordingly Train & explain Understand business activities Identify business and external requirements Define accountabilities Take action Review Produce MI Check Changes in business or external requirements Changes in appetite for risk Changes required after “review” Design processes

23. But we always remember that the processes are not good enough on their own……..and we must also focus on……. But we always remember that the processes are not good enough on their own……..and we must also focus on…….

24. Creating the culture Watching the outside world Relationship with clients & regulators Key compliance processes Risk management - the environmental factors

25. If we do all this, we will avoid the stereotype If we do all this, we will avoid the stereotype

26. Risk management - a play in three acts? The business Risk management Real risks

27. And then, we can go and do what we really want to do…. And then, we can go and do what we really want to do….

28. Risk management department - the ultimate vision Risk management department