Business Continuity & Security | New York, NY | March 18, 2009

The advantage of first person [risk] knowledge

Business Continuity & Risk

Risk & Resilience in Today’s Economy

Presented by Alexander C. Tabb

PartnerTABB Group

Agenda

Introduction House Keeping

Market Trends Market Wrap Up Volatility Impact

Risk & Resilience Defining Risk Developing more resilient operations

Concluding Thoughts

Risk & Resiliance

Over the past year the global markets have retrenched significantly

0%

Source: Yahoo! Finance

ChinaIndia

JapanCAC

S&PKorea

FTSEHK

DAX

Most of the major investment banks stocks have been hammered . . .

DB

MS

0%

JPM

UBS

GS

CS

Source: Yahoo! Finance

Source: Yahoo! Finance, TABB Group

Intraday high10-24: 89.53Closing high11-20: 80.86

Volatility recedes from record highs, though it is still at significantly increased levels

91%

1.31.6

3.8

2.02.4

6.5

SmallMediumLarge

2008 2006

Leverage has already come down over the last two years and we expect further declines

2 Year CAGR

Source: TABB Group “Hedge Funds 2008”

Leverage Used

-24%

-18%-19%

Same48%

Uncertain31%

Increase14%

Decrease 7%

Two year Leverage Outlook

Impacts to the market . . .

Significant rethinking of market structure with less “Major” participants Bear Stearns Lehman bankrupt => Barclays, Nomura Merrill Lynch =>BoA Morgan Stanley was in talks with Wachovia and China, Japan . . . US Gov’t & Others??

Major layoffs within all areas of the Financial Service sector Many firms laying off at least 5% to 8%,if not more

Reassessment of risk throughout the industry Focus moving away from physical risk towards financial and systemic

risks

Recent events refocusing nations approach to the financial sector Major scandals have significantly impacted confidence levels Washington eyeing significant changes to the regulatory environment Changing regulator roles for the Fed & SEC (Fed , SEC ???)

Impacts on continuity & security

Firms looking to downsize their exposure to risk while limiting their expenses Re-assessment of roles & responsibilities Re-alignment of resources Downsizing of staff

Major staff reductions within the continuity environment Larger firms looking to ‘right size’ their risk exposure Smaller firms looking to ‘right size’ their business (>AUM = >$$$)

Technology spend impacted Firms looking to delay major investments in technology until the sector

has a better understanding of the future

Physical Security having to do more with less Physical risk environment remains unchanged; however less resources

available to meet the challenges that exist Tempting fate ? ? ?

Risk & Resiliance

Defining Risk. . .

Can you define Risk? Risk means different things to different people,

different organizations and sectors

Defining risk properly is critical when it comes to understanding risk

Risk within financial services sector, risk has been dominated by the ‘Quants’ Quants – term developed to describe those within the

sector who use complex mathematical simulations to define and manage risk Utilize models such as VaR to better understand & manage

the impact of risk

Defining Risk. . . .

Infrastructure: Risk – transport for staff, power supply, suppliers, business relationships with partners, dependency on internet and email

Counterparty Risk – The risk associated with the financial stability of the party entered into contract with

Portfolio Risk – The risk related to a portfolio or grouping of assets Currency Risk – The risk that the value of a financial instrument will

fluctuate due to changes in foreign exchange rates Geopolitical Risk – Any financial or other risk that stems from the

possibility of a nation changing its policies Legal and Regulatory – Risk associated with a change in the laws or

regulations affecting a transaction Environmental Risk – Risk associated w/power consumption & pollution

Political Risk - Political constraints like a change of government Reputational Risk – The risk associated with the of loss of brand image,

or stakeholders’ support

Systemic Risk – The risk which is common to an entire market and not to any individual entity or component

Defining Risk. . .

The truth about risk. . . Risk does not always equate to reward

There a multiple ways to view risk; with each sector using different approaches (risk modeling)

Everyone wants to mitigate their risk; however risk mitigation has its own risk? Cost, concentration, effectiveness, etc.

Distance & risk are linked (both physically & conceptually) The closer you are to the risk, the more tangible it becomes

Risk & risk management are asymmetrically linked

Defining Risk. . .

There are many ways to try measure risk Risk Modeling: VaR (and others)

Value at Risk – is a system for modeling risk Oftentimes equated as a number or value; it is in fact

more about the measurement than the resulting number

Has received a great deal of criticism of late. . .heavily used, highly controversial (at the moment)

The challenge with VaR and other models are that they produce objective measurements from subjective data. VaR suffers from the same challenges that face all risk

assessment and measuring tools. . . Risk Measurement is subjective

Defining Risk. . .

Another Risk Management tool. . . Risk Assessment & the BIA

Common place tool used throughout physical risk mitigation Oftentimes attempts to achieve the impossible. . . wrapping up

physical risk is a one-size fits all effort Can be effective is implemented and utilized properly (similar to

risk modeling) Can be corrupted by the process. Nobody wants to hear “their baby is ugly”

Many ways to measure risk Risk assessments Risk maps Homeland Security Threat Advisory system

As with risk, resilience means different things to different people What constitutes a resilient operation

Operational resilience has been the bastion of continuity & security professionals Focus has been on physical & technology risk

mitigation Operational plans

Technology

Physical Security (manpower & technology)

Crisis Management & Incident Response

Defining Resilience . . .

Historically, risk has been allocated into individual baskets; with individual managers responsible for their portion of the pot Risk Management within the industry received a

great deal of resources, but . . .

Chief Risk Officer solution never achieved its goals Risk to wide a field for one person to manage effectively

Too many competing interests; and technical challenges to be vested in the hands of one person

Effective CRO’s were the exception not the rule (highly dependant upon personality)

Achieving Resilience . . .

What is the role of risk management moving forward? Identify, measure and hedge risk?

Identify challenges and develop contingencies?

New models being developed

Movement towards Risk Management Committee Representatives from all risk mitigation fields

LOB’s, Security, IT, Compliance, Business Continuity, etc

Too early to determine if this new model is the way of the future. . .

Achieving Resilience . . .

Final Thoughts

Final Thoughts

Risk is going to be the hot topic for some time to come

Who will manage risk in the future is still undecided (moving away from the CRO)

Risk models are like any other tool, they have a use. Firms need to better understand the role of risk modeling They need to use the information contained within the

model properly

Vigilance is key. . . Events will continue to occur, and risk will always be a

factor in the markets (macro & micro)

Business Continuity & Security | New York, NY | March 18, 2009

The advantage of first person [risk] knowledge

Business Continuity & Risk

Risk & Resilience in Today’s economy

Alexander C. TabbPartner, TABB Group

ATabb@Tabbgroup.com646-747-3204