3rd FEBRABAN International Operational Risk Conference

Operational Risk Management Overview

May 14, 2010

Agenda

JPMorgan Chase & Co. Operational Risk Overview

Development and Implementation Timeline Objectives and Framework

Tools for Risk Measurement and Risk Management

Control Self Assessment Process Risk Event Database Capital Methodology Reporting

gy Platform Firmwide Technology

Future Agenda: Maximizing Return on Investment

1 2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

Overview

Development and Implementation Timeline

JPMorgan Chase is moving into the fourth stage of a four four-stage stage model

Ad Hoc

Begin loss Risk quantification Orientation and self assessment Begin B i loss l quantification and self assessment
Governance framework Standard loss data reporting Rigorous self assessment model Risk-based capital

Analysis and Integrated Reporting

Analytics

Integrated Framework
Integrated I t t d risk i k management focused on continuous i improvement t
Predictive models Correlations across risk classes Risk mitigation tools

Business B i specific only; no firm-wide data

Traditional Audit & Financial reviews Operational risk management mostly reactive

Analysis A l i and d Reporting

Dashboard reporting Risk driver analysis Root cause analysis Internal and External Benchmarking

Pre 2000

2002

2006

2010

+
2

2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

Overview

Objectives and Framework

Objectives Integrated Framework Design
Ri k & Risk Control Assessment

Improve understanding of drivers

of operational risk
Risk Event Data

Create environment of reliable

data, transparency of issues, escalation and accountability

Move to no surprise environment

with capacity to identify / address issues as they develop and before losses are incurred

Governance Framework

Business Units

Operational Risk Capital p

Meet regulatory requirements:

Basel II, Sarbanes Oxley 404 & FDICIA

Integrated Reporting

Key Risk Indicators

(in development)

Improve financial performance

through lower losses, reduced volatility, greater productivity and more efficient capital usage

Single, Integrated Technology Platform

3 2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

Tools for Measurement and Management

Risk and Control Identification and Management

Central Source of Operational Risk Information in the Firm provided by self-assessment process supplemented by other sources of data
Define Risks

Comprehensive operational risk and control data

Business Processes Information Technology: Infrastructure and Applications SOX 404 Compliance

Identify Controls

Assess Effectiveness

Multiple Sources
Self Assessment Internal Audit External Audit Regulatory Issues

Identify Identify Gaps Gaps & & Action Plans

Dynamic D i Assessment A
Report & Track

Linked to Loss Data and Capital

4 2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

Tools for Measurement and Management

Risk Event Data: Fundamental for Improved Risk Management

Trend of Total Errors by Date Occurred

265 215 165

Integrated Error Reporting

115 65

Trend Analysis
15

01/1

01/2

01/3

01/4

02/1

02/2

02/3

HISTORIC LOSS DATA OpVar Analytics / Capital Allocation

Severity Distribution of Errors $1 Million and Greater (firmwide) 0.2 0.18 0.16 0.14 Probability 0.12 0.1 0.08 1,000 0 06 0.06 200 0.04 0.02 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 0 1 3 5 7 9 0 500 100 0 1-15 15-30 30-90 90-180 Find Time Line 6mo-1yr 1yr+ 1,500 2,000 500 400 300

Best Practices / Lessons Learned

Effect of 'Find Time' on Event Severity
Avg. Impact 2,500 Average Impact # of Events 600 # of Events 700

$ millions

Root Cause Analysis

Risk Event Profile - Activity by Function FY 2001, All Economic and Timing Events (in absolute value, $000)

All Op Risk Events Economic Impact >= $20k (FY 2001/2002, in $ millions)
$300 $6 Avg $5Impact
Total Impact ($000)

60,000

Total Impact

$250

50,000

40,000

$200

$4

30,000

20,000

$150

$3

10,000

N/A - Other Technology / Applications Finance / Corporate Staff

Core Ops / Corp Service Transaction Support & Mgmt Trading / Portfolio Management Client Rel / Front Office Customer Service

$100

$2

$50

$1

Function

$0 Execution Clients Fraud/Theft Employee/Safety

$0 Major External $ Impact Av Impact

Activity Type

5 2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

Tools for Measurement and Management

Capital Methodology
Capital measures of regulatory and economic capital based on statistical model that includes the four required regulatory elements
1. CALCULATE BASE CAPITAL
Internal Loss Data Statistical Model External Loss Data Base Capital

2. ADJUST FOR INTERNAL CONTROL FACTORS

Qualitative Adjustmen t

3. ASSESS CAPITAL APPROPRIATENESS

Internal Losses External Losses

Risk-based Capital

Internal and External Benchmarks

Scenario Analysis y

LDA Frequency distribution based on internal data Severity distribution based on internal and external (ORX) data Aggregate Loss Distribution generated via Monte Carlo simulation

Audit Grades Control Gap Action Plan metrics Potential for other metrics / KRIs

Senior Management Review Appropriateness of Model Results Capital May be adjusted Up or Down

6 2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

Combination of Internal and External Loss Data Enables Risk Measures at Business / Risk Type Level (31 Units of Measure)

C Capital i l Calculated C l l d for f f four aggregated d risk i k types for each business Business Practice / Litigation Risk (BP) Execution Risk (EX) Fraud Risk (FR) Employee E l Dispute Di t Ri Risk k (ED) Plus one aggregated firmwide g to Physical y Assets ( (DPA) ) Damage

Exceptions E i to overcome LDA shortcomings: h i Asset Management BP risk split for Investment Mgmt and Private Banking Investment Banking BP risk split into underwriting and non-underwriting Underwriting risk uses different exposure-based methodology

7 2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

Tools for Measurement and Management

Standard LDA Approach Used (for all but one Unit of Measure)
The Modeling Approach is based on the standard actuarial model of estimating a frequency distribution and a severity distribution to derive an aggregate loss distribution
Frequency of Loss
Density

Severity of Loss

Same Model for Regulatory and Economic Capital Frequency Distribution Poisson Internal Data

Density

Annual Frequency

Loss Amount in $

Aggregate Operational Loss

Severity Distribution Mixture of Lognormal (up to 6 components) Internal Data External ORX Data Capital Calibration

Density

Below threshold losses

Expected Loss

Unexpected Loss

Thold

Mean

99.9th percentile

99.97th percentile

Regulatory Capital Economic Capital

Regulatory 99.9% C.I. 1-Year Holding Period Includes Expected Loss

(= Model EL + Below-Threshold Below Threshold Losses)

Economic 99.97% C.I. 1-Year Holding Period Excludes Expected Loss

8 2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

Tools for Measurement and Management

Large Tail Events Distort Results from Traditional LDA Approach

A Generation 2 Exposure-based Model Developed for IB Underwriting Risk
Model Attributes Exposure E Model Summary
Portfolio of Relationships Total $ amount at risk?

Event Frequency

Probability of Event (PE)

How often do such events occur?

Investor Loss (IL)

Given an event how much could an investor have lost?

Event Severity
Loss Given Event Occurs (LGE) How much could a settlement be as a % of investor loss? What is the joint lik lih d of likelihood f events? t ?
9 2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

Event Correlation

Event Cor rrelation

Tools for Measurement and Management

Reporting
Current Status / Snapshot Losses in current period, risk and control ratings, Issue resolution status, KRIs etc. 9 Information conveyance, actionable reports Historic Data Trends Loss data, CSA metrics, KRIs etc. 9 Information conveyance Ad hoc query capability Tailored reports 9 Supports S t analysis l i Benchmarking Internal loss and CSA data data, capital ratios JPMC vs. ORX Benchmark projects, Range of Practices, LDCE y , some actionable reports p 9 Information conveyance, Visualization Simple management dashboard, Heat maps, E2E process maps 9 More action-oriented
10 2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

Tools for Measurement and Management

One Firmwide Technology Platform for Operational Risk Data

Used by all businesses globally In-house development Launched in 2004 6,500 Registered users 3,000 average users / month

Self assessment Compliance Assessment Test Capture Risk Event Capital IT Risk Administration Reports

My Work My Alerts Key Metrics My Profile

Calendar Updates

11 2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

Future Agenda
Leverage the investment in time, effort and $ to improve risk management practices, and increase financial performance through lower losses, reduced volatility, greater productivity and more efficient use of capital.

Improved Analytics and Reporting

Greater insight Forward looking More actionable

Key Risk Indicator Development

Directionally correct, if not statistically defensible

Benchmarking
Internal: Quantitative and Leading Practices External: Quantitative (via ORX) and Leading Practices (ORX, RMA and others)

Extended Integration
O Op risk i k and db business i performance f metrics ti Op risk and other risk classes

Risk Mitigation Tools

12 2010 JPMorgan Chase & Co. Strictly Confidential and Proprietary

3rd FEBRABAN International Operational Risk Conference

Operational Risk Management Overview

May 14, 2010