ABC Bankcorporation

Case Study on

Risk Focused Supervision

Page 2 of 43

Table of contents Page

Institutional Overview……………………………………………………………………………………………………. 3

Credit Risk Material………………………………………………………………………………………………………… 9

Operational Risk Material………………………………………………………………………………………………. 24

Market & Liquidity Risk Material……………………………………………………………………………………. 30

Audit………………………………………………………………………………………………………………………………. 42

Page 3 of 43

Overview and Strategy

Corporate Profile

ABC Bankcorporation (ABC) is a full-service provider of retail and commercial loan and deposit products; including mortgages, trust, asset management, securities brokerage, and insurance. ABC serves 7 million customers in 5 different regions and operates approximately 2,000 branch offices and a 2,800-ATM network. InvestCo, Inc., its investment and securities brokerage, trust and asset management division provides services from over 300 offices.

Legal Entity Structure

ABC Bankcorporation was formed in 1960. A substantial portion of ABC’s growth has been through the acquisition of other financial institutions, including commercial banks and thrift institutions. Since ABC began operations, it has completed 85 acquisitions of financial institutions and financial service providers representing aggregate assets approximating $143.2 billion.

ABC has three primary operating subsidiaries: ABC Bank; InvestCo, Inc; and ABC Insurance Group, Inc.

ABC Bank operates 2,000 branches and a 2,800 ATM network through its footprint of 5 regions and offers a full-line of retail, commercial, corporate, mortgage, and trust products and services to its customers.

ABC Mortgage, a division of ABC Bank, originates and services mortgage loans for long-term investors.

ABC Financial Leasing, Inc. (AFL), a subsidiary of ABC Bank, provides ABC customers with multiple lease financing options. AFL’s leasing structures include: true tax leases for equipment and vehicles; lease purchases for ultimate ownership of the equipment; municipal leases to serve municipals and non-profits; and lease lines where a predetermined amount can be drawn upon to fund single or multiple vendors over a period of time.

InvestCo, Inc. (IC) was founded in 1970 and was acquired by ABC in 2003. IC is a full-service brokerage and investment banking firm. IC offers products and services including securities brokerage, corporate and personal trust, asset management, financial planning, mutual funds, securities underwriting, sales and trading, and investment banking. IC is functionally regulated by the Securities and Exchange Commission.

Page 4 of 43

ABC Insurance Group, Inc. (AIG) was formed in June 2005 as the corporate parent structure for all of the company’s insurance operating subsidiaries

Geography and Lines of Business

Region % of Total Assets % Contribution to Income

Region 1 15 13

Region 2 10 11

Region 3 20 17

Region 4 15 14

Region 5 40 45

Contributions to Net Income

Lines of Business ABC employs a line of business management structure to measure business activities, but manages its business along geographical regional lines. The company’s three primary business lines are: Consumer Services, Business Services, and Financial Services. Consumer Services This business line includes traditional consumer banking, mortgage, and private banking. ABC Mortgage is one of the top residential mortgage loan originators and servicers. The balanced, focused mortgage business offers a full array of residential mortgage products and services through its retail and correspondent lending channels and a warehouse lending banker/broker. Business Services The Business Services group includes Commercial Real Estate, Commercial Banking, Corporate Banking, Business Banking, and Deposit and Treasury Management Services.

Page 5 of 43

Commercial banking at ABC Bank has expanded to mean not only increased lending capacity and a responsive credit approval process, but enhanced treasury management and international products, as well. ABC Bank offers its commercial banking customers a full range of capital markets and investment banking products and services, as well as permanent loan placements, public finance, corporate finance and merger and acquisition products and services, and risk management products such as interest rate derivatives. Financial Services

The Financial Services business line includes the broker-dealer, investment banking and securities underwriting, trust, asset management, mutual funds, and advisory services.

Competitive Strategy

ABC’s business strategy continues to be focused on the diversification of its revenue stream, providing a competitive mix of products and services, delivering quality customer service, and maintaining a branch distribution network with offices in convenient locations.

Financial Highlights

Stock Price Debt Ratings

NYSE Ticker Symbol

ABC Moody’s S&P Fitch

Recent Close 52.57 ABC Bankcorporation

Long-Term Issuer

Senior Unsecured

Subordinated Debt

Short-Term/CP

Trust Preferred

Bank Individual

A1

A1

A2

-

A2

A

A

A-

-

BBB+

A+

A+

A

F1

A

52 Week Range $32.37-$62.15

Page 6 of 43

Stock Price Debt Ratings

NYSE Ticker Symbol

ABC Moody’s S&P Fitch

Market Value $31.75 billion ABC Bank

Senior Unsecured

Subordinated Debt

Short-Term

Certificate of Deposit

Bank individual

-

-

P-1

Aa3

B

-

-

A-1

A+

-

-

-

F1+

AA-

A/B

P/E Ratio 19.7

Financial Condition

ABC’s overall financial condition remains satisfactory. All of the CAMELS components were rated satisfactory at the previous examination. ABC’s financial landscape has changed markedly in recent years due to the significant acquisitions in the past four years.

Capital levels at ABC remain satisfactory to support the volume and risk characteristics of the financial holding company and its subsidiaries. Risk-based capital ratios declined modestly last year as a result of the acquisitions, but continue to exceed regulatory guidelines for well-capitalized institutions. Conversely, the leverage ratio increased 57 basis points four years ago due to debt incurred in a merger. Nevertheless, capital levels remain satisfactory given ABC’s current low level of problem assets and satisfactory earnings. ABC is committed to maintaining appropriate capital ratios by managing future share repurchases, merger and acquisition activity, and dividend payments. Additionally, management is in the process of analyzing capital management strategies to optimize the company’s capital structure. The strategies include issuing preferred stock that will count toward tier 1 capital and repurchasing common stock.

Page 7 of 43

Year-End Capital Ratios

Four Years Ago

Three Years Ago

Two Years Ago

Prior Year

Current Year

Tier 1 Risk-based 8.98 10.11 9.02 8.60 8.07

Risk Based Capital 13.84 15.02 13.51 12.76 11.54

Leverage 6.92 7.49 7.47 7.42 8.30

ABC continues to maintain moderate internal loan growth and stable credit quality. The company’s primary earning assets are loans, which represent 78 percent of total earning assets at last year end. ABC’s loan portfolio is well balanced among C&I, CRE, and Retail portfolio segments. However, raw land concentration of 24 percent exceeds the 20 percent internal policy limit. Underwriting guidelines for land have been revised to facilitate management’s desire to reduce the size of the CRE portfolio. Furthermore, moratoriums on raw land and condo conversions have been implemented. Non-performing assets (NPAs) decreased significantly in last year versus the prior year as a result of packaged sales of $85.4 million in non-accrual loans and a continued favorable credit environment. The ALLL is adequately funded based on the organization’s internal analysis.

Key Credit Ratios

Four Years Ago

Three Years Ago

Two Years Ago

Prior Year

Current Year

ALLL/ Gross Loans 1.44 1.36 1.27 1.30 1.02

Reserves/ NPAs 112.72 124.50 115.52 124.27 140.31

Net Losses/ Avg Loans 0.38 0.34 0.31 0.26 0.28

NPAs/Loans 1.01 0.94 0.81 0.70 0.44

Consolidated earnings are satisfactory with an annualized Return on Average Assets (ROAA) of 1.41 percent. Given the positive trends in asset quality, earnings are adequate to cover anticipated losses and to support ABC’s dividends and capital levels. The Net Interest Margin (NIM) continued to increase over last year but remains below its peers’ margins. However, management has informed the investment community that it expects the NIM to increase during next year due to anticipated rising interest rates

Page 8 of 43

Key Earnings Data

Four Years Ago

Three Years Ago

Two Years Ago

Prior Year

Current Year

ROAA 1.34 1.34 1.23 1.37 1.41

Net Interest Margin 2.78 2.92 3.01 3.08 3.11

ABC’s goal in liquidity management is to satisfy the cash flow requirements of depositors and borrowers, while at the same time meet its cash flow needs. This is accomplished through the active management of both the asset and liability sides of the balance sheet. The liquidity position of ABC is monitored on a daily basis. ABC has a proven track record within the capital markets environment, and ABC’s name in the marketplace remains sound. ABC has a solid level of core deposits, a moderate dependence on non-core funding, and a relatively low overall cost of funding. The company continues to pursue deposit growth initiatives aimed at product promotions and increase its presence in specific markets in its footprint. During the next year and a half of merger-related conversions, customer retention is among management’s top concerns, but the overall level of deposit retention remains uncertain as deposit competition remains intense.

Key Liquidity Ratios

Four Years Ago

Three Years Ago

Two Years Ago

Prior Year

Current Year

Noninterest Bearing Deposits/ Deposits 8.91 9.56 10.55 11.17 10.47

MMDAs+Savings/ Deposits 41.65 46.85 47.84 47.41 45.64

Retail Time Dep/ Deposits 24.32 19.10 19.46 20.12 23.16

Pledged Secs/ Secs 72.39 84.86 83.15 71.85 87.42

Jumbo CDs/ Tot Dom Dep 12.72 12.33 13.66 13.66 15.05

Page 9 of 43

ABC Bankcorporation

Credit Risk Profile

Portfolio Quality

Classified assets totaled $450 million and represented a total classification ratio to capital of 5.0%. Similarly, criticized assets totaled $630 million and represented a criticized asset ratio to capital of 7.0%. During the recent quarter, the levels of classified remained stable while criticized assets rose from their historical low due to the slowing economy and fallout from emerging challenges in the housing & construction markets.

The following chart shows the asset quality trend in the level of criticized and classified loans since the most recent quarter.

Loan Portfolio Characteristics

The loan portfolio is comprised of three primary loan portfolio sectors as follows:

Consumer Loans - 32% of total loans are for consumer purposes and are composed of residential mortgage loans (10%); home equity loans (19%); and consumer installment loans (3%). While the overall proportion of consumer loans changed little over the past few years,

Page 10 of 43

there was a noticeable increase in the volume of home equity loans in the portfolio. Loans in the consumer portfolios are geographically diversified. Loans originated by the residential mortgage banking unit are primarily written to secondary market standards and subsequently sold to secondary market investors. For portfolio growth, management focuses on retaining high quality variable-rate mortgage loans. Consumer loan growth is currently targeted in home equity loans and mortgage loans.

Commercial Loans - 28% of total loans are centered in commercial and industrial loans (12%) and business banking loans (16%). The portfolio is well-diversified in terms of industry risk and geographic concentrations and includes a broad mix of small and large loans with relatively simple loan structures. Continued growth in commercial loans is targeted through expansion of small business banking marketing efforts.

The commercial loan department services customers with annual revenues in excess of $200 million and houses the following specialized lending units 1) Corporate loan book, 2) Leasing, and 3) Capital Markets. The corporate loan department consists of the following industry specialties, 1) Asset Based Lending, 2) Technology, 3) Consumer Retail, 4) Energy, 5) Financial Services, 6) Food and Beverage, 7) Healthcare, 8) Media and Communications, 9) Real Estate Related Lending, and 10) Regional Diversified.

Loans outstanding within the portfolio total $10.7 billion and are centered in Media and Communications – 14.6 %, followed by Food and Beverage, Energy and Real Estate related at approximately 10 % each. Financial Services, Technology, and Asset Based Lending represent the smaller portfolio segments at 7 %, 6 %, and 4 % each. The Regional Diversified portfolio segments contain those general corporate purpose loans and loans not otherwise serviced by the 9 specialized lending units. Collectively, the Diversified portfolio totals approximately 31 % of commercial loans outstanding.

Commercial Loan Portfolio

0%

5%

10%

15%

20%

25%

30%

35%

Asset

Based

Lend

ing

Financ

ial S

ervice

s

Energy

Real E

state

relate

d

Health

care

Region

ally D

iversi

fied

Commun

icatio

n

Techn

ology

Food a

nd Bev

erage

Consu

mer Reta

il

Industry

Perc

ent

Page 11 of 43

Commercial Real Estate (CRE) Loans – 40% of total loans are for CRE purposes and are balanced among Construction, Land Development & Other Land (CLD) loans (22%) and non-construction loans (18%). As of year-end, total funded CLD loans represented 204% of total risk based capital (RBC) while total CRE loans equaled 376% of total RBC. While CRE loans are generally diversified across a range of portfolio segments, there are two CRE product segments that represent concentrations of RBC totaling 25% or more. These concentrations are found in the 1-4 Family Residential Construction segment and the Residential Land & Lot Development segment.

REGIONS CRE EXPOSURE BY PRODUCT TYPE AND AS A PERCENTAGE OF TIER 1 CAPITAL + ALLL AS OF DECEMBER 31, 2006

0%

10%

20%

30%

40%

50%

60%

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

Percen

t of (Ti

er 1 + A

LLL)

Lower Inherent Risk Higher Inherent Risk

25 Percent Concentration

1. 1-4 Family Residential Perm/Mini-Perm 11. Multi-Family Construction (excluding Condos)

2. Multi-Family, Mini-perm 12. Retail Construction

3. Retail Mini-perm 13. Industrial Construction

4. Office Building Mini-perm 14. Office Building Construction

5. Industrial Mini-perm 15. Other Commercial Properties Construction

6. Other Commercial Properties Mini-perm 16. Hotel Construction

7. Hotel Mini-perm 17. Health Care Related Construction

8. Health Care Related Mini-perm 18. Condo Land Development

9. 1-4 Family Residential Construction 19. Condominium Construction

10. Residential Land and/or Lot Development other than for Condos

20. Commercial Land and/or Parcel Development

Exposure by Product Type as a percent of Capital

Page 12 of 43

While historically management has viewed concentrations of credit over 25% as excessive, given the diversity in the CRE portfolio, consideration is being given to having a single CRE limit of 500% of capital.

As shown in the chart below, obligor risk ratings for commercial and CRE loans are heavily weighted toward the mid-range of the 12 grade rating scale. The relatively limited volume of exposure found at both ends of the commercial loan rating structure evidences the bank’s low volume of problem loans, in addition to their limited portfolio of investment grade corporate borrowers.

Category

Borrower Rating

Portfolio Mix by Risk Rating

Commercial & Industrial Portfolio

High Pass

High Middle Pass

Low Middle Pass

Low Pass

Criticized / Classified

Total

Commercial Real Estate Portfolio

High Pass

High Middle Pass

Low Middle Pass

Low Pass

Criticized / Classified

Total

1, 2

3,4,5

6,7

8,9

10,11,12

1, 2

3,4,5

6, 7

8, 9

10,11,12

4.3%

12.8%

75.6%

5.8%

1.5%

100.0%

2.2%

15.7%

73.6%

5.2%

3.3%

100.0%

Stress Testing of the CRE Loan Portfolio

The bank performs stress testing on the commercial real estate portfolio segment of the loan portfolio to measure the level of defaulted borrowers under different economic scenarios. Two stress tests were performed showing the potential effects of increasing interest rates, decreasing net operating income, and changing capitalization rates for the commercial real estate portfolio. One stress test was performed as a low stress scenario (increased interest rates 1%, decreased net operating income by 5%, and increased capitalization rate by 1%) and

Page 13 of 43

the other was a high stress scenario (increased interest rates by 2%, decreased net operating income by 10%, and increased the capitalization rate by 2%).

An additional stress test was performed simulating the worst case scenario in the bank’s trade area real estate market experienced in the last real estate cycle in the 1980’s and 1990’s. The bank took the largest consecutive drop in real estate values to see the effects of a similar percentage drop in value.

For stress testing purposes, the bank assumes a loan will default if the debt coverage ratio is less than 0.90 and the loan-to-value is greater than 100%.

STRESS TEST RESULTS – DEFAULTED LOANS

Loan Classification

Outstanding Balance

Low Stress $ defaulted

Low Stress % defaulted

High Stress $ defaulted

High Stress % defaulted

Historic Stress Test $

defaulted

Historic Stress Test %

defaulted

Residential Construction

5,832,816 36,163 0.62 2,086,982 35.78 1,195,727 20.50

Land Development

4,000,914 0 0.00 1,718,793 42.96 14,803 .37

Retail 2,750,123 36,577 1.33 898,334 32.67 1,165,502 42.38

Office 2,130,136 54,744 2.57 128,234 6.02 145,914 6.85

Industrial 912,110 23,259 2.55 55,364 6.07 32,197 3.53

Hotel 810,275 34,031 4.20 40,919 5.05 114,492 14.13

Medical Buildings

115,111 5,007 4.35 5,813 5.05 19,316 16.78

Other 1,917,362 11,696 0.61 77,270 4.03 206,883 10.79

Total 18,468,847

Dual Risk Rating for Commercial and CRE Loan Implementation

Given the competitive nature of banking, management has recently implemented a dual risk rating system for its commercial and CRE loan portfolio which is currently being run parallel with the existing risk rating system. The development of such a risk rating system should provide for better risk measurement and provide structure to the risk rating process.

Page 14 of 43

Probability of Default

The following flowchart illustrates ABC’s probability of default rating design approach to building their model. For publicly rated borrowers, the debt rating, as determined by the independent rating agency, would be the bank’s final rating and there would be no adjustments. For borrowers without a debt rating, a vendor model (RiskPro) will be used to calculate a rating. RiskPro analyzes financial statements for private companies to produce default probability predictions for corporate borrowers. RiskPro uses 11 financial ratios weighted for significance and estimates the expected default frequency at a one-year time horizon, which is related to a corresponding public debt rating. Vended model components were selected due to the limited availability of the bank’s internal data as they have proven predictive power, represent industry standards used by peer banks, and are built from a much larger dataset than available internally. From the initial rating provided by RiskPro, loan officers will have the ability to review five critical financial ratios to determine if the vendor assigned rating should be adjusted. From this adjusted rating, additional overrides are permitted based on qualitative factors that affect the specific loan type. A final rating determination will be made after changes to the vendor rating are reviewed. Examples of the types of qualitative factors that could be considered include; cash flow stability, quality of management, or the borrower’s tier position in the marketplace.

RiskPro

Quantitative

Bank’s 5 quantitative

factors

Adjusted

Rating

Qualitative

Final

Rating

Flowchart of Borrower Risk Rating (Probability of Default)

Page 15 of 43

Internal Grade 1-Year PDs 1 .01% 2 .02% 3 .04% 4 .05% 5 .08% 6 .12% 7 .45% 8 1.0% 9 2.0% 10 3.0% 11 6.5% 12 9.5%

During the implementation period, approximately 35% of commercial loans have been overridden with qualitative factors.

Loss Given Default

The bank’s loss given default database has captured borrower losses on defaulted loans during the past four years and included observations on over 6,000 obligors. The LGD percentage takes into account the average losses over the previous four years. Shown below are existing LGDs categorized by the bank’s current internal risk ratings where grade A represents the lowest estimated loss and grade G represents the highest estimated loss borrower. See Appendix 1 for sample LGD dataset.

LGD Grade LGD A 5% B 15% C 20% D 25% E 30% F 35% G 40%

Page 16 of 43

Portfolio Strategy

Internal reports project growth expectations for the major portfolio segments as follows:

Commercial Loans - projected to increase approximately 10% over current levels by focusing increased attention on markets that have been underserved and where competition is less intense. Products targeted for growth are Asset Based Lending, corporate, and small business banking loans. While this strategy does not require the roll-out of new products and services, it will require a redirection of lending personnel that previously focused on Commercial Real Estate lending opportunities.

Commercial Real Estate Loans - expected to remain level for the year. With slowing residential construction activity and an internal moratorium on new land and lot loans and condominium conversion loans, exposures to these segments are expected to reduce during the year. Also, management plans to limit new lending activities in locations that have experienced high growth in recent years. New CRE opportunities will instead be pursued in retail, multi-family and industrial product segments in markets that have been underserved and where competition is less intense.

Retail Loans - projected to remain flat for the year. While modest growth in residential mortgage loans is expected, outstanding home equity lines are expected to decrease resulting in an offsetting decline, and other consumer loans are expected to provide limited growth.

Credit Risk Management and Controls Board and Senior Management Oversight

The organization's policies, procedures, and limits are approved by the board or the board’s Risk Management Committee. The board and/or its risk committee have established policies and procedures which allow directors and management to monitor and approve the organization's risk profile, including the establishment of appropriate limits. The risk committee has been designated as the oversight body for the risk management process and focuses on the organization's major risks including credit risk.

The board clearly delegates day-to-day oversight to senior management with appropriate accountability assigned. The board and risk committee meets five times a year, or more frequently if the committee deems necessary, to receive information from the Credit Risk Management Group (CRMG) and others. When issues are raised, the risk committee recommends actions or other steps to be taken, as it deems appropriate. Exception to policies, at least at a high level, are noted and tracked.

Senior management monitors and participates in supervising credit related activities through the Chief Risk Officer, who heads CRMG and participates on the Executive Leadership Committee and the Executive Council. The Executive Council, which meets weekly, is comprised of the organization's top seven executives and sets the organization's strategic direction. The

Page 17 of 43

Executive Leadership Committee, which meets monthly, is an expanded version of the Executive Council and is responsible for the organization's strategic plan. The CRMG meets weekly to discuss developing and ongoing credit risk issues. The CRMG delegates the credit administration process to the Chief Credit Officer, who reports directly to the Chief Risk Officer. The Chief Credit Officer is very experienced and is responsible for credit policy and the administration of the day-to-day credit function as head of the Credit Risk Committee. The Chief Credit Officer, in turn, meets weekly with his direct reports to review credit related issues. The Credit Risk Committee meets quarterly, or more frequently if needed.

An internal, on-going assessment of the credit administration function is provided by Credit Review, who reports to the Chief Risk Officer through the Risk Policy and Credit Review Director, but also has direct access to the CEO and the board's audit committee. An independent review of both Credit Administration and Credit Review is periodically provided by Internal Audit.

Overall relationship credit risk is owned by the relationship manager and ultimately by the relationship manager's Sales Executive for the line of business or geography. The validity of the risk rating is owned jointly by the relationship manager and the corresponding credit administrator. A credit servicing review is underway to review all credit relationships to validate credit grades and other risk-related information. Relationship Managers', Sales Executives' and Credit Administrators' compensation will be impacted by the accuracy of this data.

Policies, Procedures & Limits

Credit policies and procedures reflect the institution’s philosophy and address the strategic goals and objectives of the organization. Loan policies and procedures were reviewed, updated, and consolidated by the Risk Management Group, and were submitted to the board for their annual review and approval. Commercial credits are reviewed and approved by the relationship manager, sales manager, and credit administrator with the authority to approve commitments up to that size. For deal sizes where the bank will hold an amount of $25 million or more, signatures of all of the required line and credit approvers are required (including that of the Chief Credit Officer) and the credit is submitted to the Credit Risk Committee for its approval.

Risk threshold limits are employed by ABC Bank to mitigate concentrations of credit risk within the organization. It is the bank's policy to maintain a diverse loan portfolio with no concentration in any particular loan type. Risk limits are developed and approved by the Credit Risk Committee. Limits are employed relative to the size of obligor obligations, lines of business, and/or product type. Approved exceptions to limits require specified approval.

Loan policies, procedures and underwriting criteria are clearly identified and articulated in policy. Each product type within a line of business (LOB) or lending segment has a specified set of underwriting criteria which must be met before approval. Credit structure, terms, and conditions are well-established, both quantitative and qualitative in nature, and reflect the organization's risk appetite. Additionally, underwriting standards are directed at the organization's make-and-hold rather than initiate-and-sell perspective. ABC Bank uses a number of custom risk rating models for its residential mortgage and consumer portfolios which are well tested and

Page 18 of 43

independently validated. ABC bank is in the process of developing dual risk rating models for its commercial LOBs, but this process is in the beginning stages without complete model validation.

The credit approval process is a signature process rather than a committee process. Lending authorities are set by the Credit Risk Management Policy. A lending officer can approve a credit exposure (based on the total relationship) up to his or her lending authority. If the exposure exceeds the lending authority for a single signature, a two-signature process requiring both a sales officer and credit officer is required for exposures up to $25 million. For exposures over $25 million, the approval of the Credit Risk Committee is required.

Risk Monitoring and Management Information Systems

Throughout the year, ABC Bank employs a credit servicing process that reviews key credit elements relative to the credit quality of the relationship. The objective of credit servicing is to accurately assess risk ratings, ensure that documentation is accurate and complete, review the financial condition of the borrower, and verify that loans are properly booked on the commercial loan system. Credit servicing is performed at least twice a year with one review including a full financial review. The extent of the review is determined by relationship size for relationships $1 million and above. The financial review includes the comparison of the borrower's financial ratios to industry standards. It also includes some stress testing where appropriate, including performance under different economic scenarios. Credit scores and borrower agency provided credit ratings are also reviewed where available.

The loan portfolio is reviewed and analyzed on a weekly, monthly, and quarterly basis. Quarterly, portfolio information is prepared and presented to members of management and the board of directors through the the Risk Management Group, and the Enterprise Risk Oversight Committee. The development of a full suite of loan portfolio reports remains a work in progress. The list of planned reports includes consolidated monthly monitoring reports for the commercial and retail portfolios and more comprehensive quarterly reports. The monthly reports will provide a summary of major product lines and geographies, and recap risk metrics such as past dues and risk rating profiles. The quarterly reports provide a top of the house summary of portfolio metrics such as mix, delinquencies, concentrations, risk rating distributions, etc.

Management has generally relied on inherent credit risk aspects such as limiting concentrations to provide risk mitigation. The bank has not been a frequent user of credit derivatives, other than interest rate swaps, to mitigate its credit portfolio risks. While the use of loans sales and securitizations are limited in the commercial loan portfolio, loan sales in the retail lending portfolio are regularly used to sell off large portfolios of mortgage loans that are originated but not of the quality, yield or duration wanted for the bank’s portfolio.

ABC Bank formed the Special Assets Department (SAD) for the express purpose of servicing, collecting and/or restructuring problem assets. SAD also facilitates the marketing of OREO assets. Management follows detailed board approved policies and procedures for SAD activities. SAD is responsible for: (1) credits rated Special Mention for which an exit strategy has been designated with exposure of $1 million or more, and (2) all commercial credits rated

Page 19 of 43

Substandard or worse regardless of dollar exposure. SAD is effective in developing and following through on proactive plans to resolve problem credits. Credit risk grades are the initial responsibility of the relationship manager; however, these risk grades are subject to review and change by Credit Review or SAD.

Internal Controls and Audits

Credit Risk Review Group Credit Risk Review reports directly to the Chief Risk Officer and independently to both the CEO and the board's risk committee. Credit Review's process includes an assessment of the reviewed area's cultural integration progress. The group’s primary responsibilities include sampling the loan portfolios to validate risk rating assignments, participate in ratings downgrade meetings, and proposing charge-offs related to problem loans. The risk rating group’s loan coverage, over a two year period, is approximately 50% of the portfolio on a name-by-name basis, which equates to an estimated 75% on a dollar basis. The credit risk committee is satisfied with this loan review methodology as it sees the important role of the group to confirm risk ratings on the more problematic, lower grade credits, and ensuring charge-offs are taken at the appropriate time and in correct amounts.

Proposed Coverage of the Loan Portfolio

For the Current Year

Regional Breakdown: Percentage Coverage Region 1 35% Region 2 55% Region 3 30% Region 4 45% Region 5 30% Business Line Breakdown: Land development 35% Asset based lending 55% Home equity lending 40% Installment lending 65% Energy loans 55%

Overall Coverage: 34%

Loan Loss Reserve Methodology

Page 20 of 43

The methodology for determining the level and adequacy of the ALLL is well documented. This methodology is reviewed independently by both Credit Review and Audit. The bank individually reviews nonaccrual loans that are greater than $1 million. The loss history used by the institution for pools of loans is based on the regulatory loss standards of 15% for substandard credits, 50% for doubtful credits and 100% for credits considered loss. The institution does not distinguish between pass and non-pass rated credits for consumer loans.

Page 21 of 43

APPENDIX 1

Loss Given Default Data

Observation Region Vintage Industry Size of Loan

Loan-to-Value at

Origination

Loss

Commercial Loans

Borrower 1 5 Three Years Ago

Grocery 500 92% 25%

Borrower 16 6 Two Years Ago

Grocery 250 90% 15%

Borrower 2 1 Previous Year

Automotive 125 85% 10%

Borrower 25 2 Current Year

Automotive 1,500 75% 15%

Borrower 19 5 Previous Year

Home Center 475 85% 25%

Borrower 3 5 Current Year

Home Center 600 85% 30%

Borrower 7 4 Current Year

Home Center 1,500 85% 20%

Borrower 4 2 Five Years Ago

Electronics 100 80% 5%

Borrower 18 3 Four Years Ago

Electronics 1,800 80% 10%

Borrower 5 1 Current Year

Bldg. Mat. 1,000 80% 20%

Borrower 22 3 Current Year

Bldg. Material

2,200 85% 30%

Borrower 6 2 Six Years Ago

Agriculture 500 85% 5%

Borrower 8 5 Current Year

Floor Covering

1,250 80% 15%

Borrower 20 2 Current Year

Flooring 510 90% 30%

Borrower 9 3 Five Years Ago

Transport 450 85% 0%

Page 22 of 43

Observation Region Vintage Industry Size of Loan

Loan-to-Value at

Origination

Loss

Borrower 10 2 Four Years Ago

Mining 375 90% 5%

Borrower 13 5 Five Years Ago

Hardware 310 82% 5%

Borrower 11 5 Current Year

Hardware 2,100 80% 30%

Borrower 14 5 Current Year

Hardware 1,700 80% 35%

Borrower 15 3 Previous Year

Clothing 420 85% 15%

Borrower 17 4 Previous Year

Office equip 350 80% 15%

Borrower 21 1 Two Years Ago

Jewelry 480 80% 5%

Borrower 23 4 Previous Year

Fuel 800 75% 0%

Borrower 24 5 Current Year

Dept. Store 400 80% 25%

Page 23 of 43

Commercial Real Estate Loans

Observation Region Vintage Industry Size of Loan

Loan-to-Value at Origination

Loss

Borrower 2 1 Three Years Ago

Construct 1,100 80% 5%

Borrower 19 3 Three Years Ago

Construct 900 70% 0%

Borrower 1 5 Two Years Ago

Construct 750 85% 5%

Borrower 12 4 Two Years Ago

Construct 570 80% 5%

Borrower 5 5 Previous Year

Construct 275 75% 25%

Borrower 13 5 Previous Year

Construct 390 85% 20%

Borrower 8 5 Current Year Construct 550 85% 45% Borrower 14 5 Current Year Construct 1,250 85% 40% Borrower 15 2 Six Years

Ago CRE 145 80% 0%

Borrower 20 4 Five Years Ago

CRE 850 80% 5%

Borrower 9 1 Five Years Ago

CRE 1,210 75% 0%

Borrower 10 3 Four Years Ago

CRE 215 80% 0%

Borrower 7 2 Three Years Ago

CRE 1,650 80% 5%

Borrower 4 1 Two Years Ago

CRE 370 80% 5%

Borrower 16 3 Two Years Ago

CRE 1,980 85% 5%

Borrower 17 2 Two Years Ago

CRE 1,795 80% 0%

Borrower 3 2 Previous Year

CRE 1,550 75% 0%

Borrower 6 5 Current Year CRE 1,000 70% 20% Borrower 11 5 Current Year CRE 1,560 95% 40% Borrower 18 5 Current Year CRE 1,650 80% 35%

Page 24 of 43

ABC Bankcorporation

OPERATIONAL RISK PROFILE

Operational Profile

ABC Bankcorporation (ABC) is a regionally managed financial holding company. ABC ranks number twenty-five in asset size of all commercial banks in the United States. The company has approximately 2,000 offices spread throughout five geographical regions, and has about 54,000 full-time employees. The corporation grew rapidly over 15 years beginning in the late 1990s primarily through acquisitions.

Banking operations represent approximately 94% of financial holding company assets. In addition to the branch office network, bank operations include 15 regional commercial loan processing centers, 12 commercial collateral centers, 5 retail loan processing centers, 3 mortgage loan processing sites, 4 retail loan collection centers, and 4 item processing centers. The pace of acquisitions slowed in recent years as management has focused on consolidating and strengthening operations. However, the plans to add up to 340 de novo branches during the next 12 months. The bank is predominantly a retail and middle market commercial lender. Overall, the loan portfolio is moderately complex. The bank is predominately a collateral-based lender with a moderate average transaction size, relatively simple loan structures, a middle-market orientation, minimal exposure to shared national credits, and limited exposure to high risk loan industries or types. Other business lines include trust (ranking among the top 35 trust operations), leasing, factoring, and mortgage lending. Mortgage lending originates, securitizes, and services residential mortgages in all five geographical regions. The mortgage business line ranks among the top 50 mortgage originators and the top 35 largest servicers.

InvestCo, the investment and securities brokerage, trust and asset management division, has approximately 3,200 employees operating out of 300 offices in all five geographic regions. Its net income represents approximately 15% of corporate net income. InvestCo was the leading underwriter of tax-exempt long-term municipal bond issues last year. Its activities are organized along 5 primary business lines: private client services, financial services, equity capital markets, fixed income capital markets, and operations and technology; it also advises a family of 12 mutual funds. While InvestCo is actively involved in underwriting, the true orientation of the firm is more skewed to the distribution/sales side of the business.

ABC Insurance Group (AIG) is a full-line general insurance brokerage firm, emphasizing commercial property and casualty insurance, with smaller business lines in life, group, personal lines, aviation, claims, and third-party administration. Although it is among the top 50 insurance agencies, net income is immaterial to the bank’s financial performance. Because AIG underwrites insurance, operational risk is slightly increased, and arises primarily from product suitability, transaction execution, technology, and employee misconduct/fraud.

Page 25 of 43

Inherent Operational Risk ABC Bank While deposit operations are stable, effective, and efficient, significant consolidation and improvement efforts are occurring in loan operations resulting in increased risks associated with change management. Key loan operations projects that have introduced risks associated with implementation and managing the change process include: • Automated credit scoring and loan underwriting for retail and small business loans; • Automated commercial loan credit scoring; • The introduction of a new, two-tiered loan grading system; • Consolidation to reduce the number of construction and retail loan processing centers; • Efforts to standardize the posting of loan types to specific applications; • Scrubbing inaccurate loan data from files; • The introduction of data entry quality controls; • Capturing an expanded set of loan data to facilitate RAROC analysis; • Development of portfolio risk measurement and modeling tools; and • Revisions to the internal loan review and loan examination processes. Major reorganization in the fiduciary/wealth management line of business has introduced transition risk. Last August, the corporation announced that the trust operations of InvestCo were being merged into those of the bank, a business realignment that created the 33rd largest trust provider in the United States. Simultaneously, the bank’s asset management activities were merged into InvestCo, which will advise the corporation’s family of 12 mutual funds (2 money market funds, a high-yield bond fund, a balanced fund, 3 fixed income funds, and 5 equity funds). Examinations have identified concerns about the adequacy and testing of business unit level continuity plans. Treasury and capital markets operations have been enhanced over the past two years, resulting in better securities portfolio management, improved funding operations, and more robust interest rate risk management. Management has also provided leadership for the RAROC project. Core technology operations have been reorganized and improved over the past 2 years. The technology function has been restructured to provide better alignment with and support for business units, and a new project management office has been created to critically analyze resource allocation and monitor systems implementation. New, capable senior staff have been retained that are expected to strengthen daily operations, enhance systems development, and improve support and delivery of technology services. Nevertheless, several key distributed systems—including those of InvestCo and AIG—remain independent of core technology operations, introducing risks associated with non-standardized equipment acquisition and change management processes, an inability to fully exploit economies of scale, uneven information security administration, and contingency planning that is not fully integrated. Key technology initiatives for the coming year include: upgrade branch and back office servers and workstations; upgrade branch teller platform application; enhancing data warehouse reporting capabilities, improving customer information (CIF) linkage between application data for all business units and affiliates and the data warehouse, and developing sales and marketing support systems; developing a comprehensive disaster recovery plan for client/server

Page 26 of 43

environments; complete the long-delayed migration to in-house internet banking and develop the infrastructure for in-house web site hosting in 2 to 3 years; publish corporate technology standards and further the standardization of business unit technology systems; begin the implementation of product and customer profitability analysis and management systems; implement an enterprise network monitoring application and strengthen controls over branch information security; expand imaging capability and enhance imaging file system stability; and, increase support of business unit technology initiatives and accelerate the delivery pace of technology solutions. Branch operations operate without centralized corporate administration and accountability. This has resulted in internal control weaknesses evidenced by the historically high number of branch internal audit reports with less than satisfactory ratings; however, this number has been declining over the past 9 months. Risks associated with branch operations are heightened slightly by lack of a clearly documented strategy for positioning InvestCo investment advisor offices in branch facilities. While the overall control environment of financial accounting and reporting is adequate to prevent material losses and reporting inaccuracies, the bank has been consistently plagued by lesser losses and reporting problems that heighten the overall operational risk profile. Following its most recent acquisition, the bank experienced significant reconcilement problems that ultimately led to the write-off of $48MM. Last year, the external auditor’s management letter noted the bank’s failure to timely charge off $22.4MM in loans, to place approximately $46.7MM in loans on nonaccrual, to accurately report problem loans, and to reconcile student loan accrued interest, resulting in a $21.6MM write-down. In addition, the bank’s regulatory financial reports often contain errors or are late. The external auditor’s management letter noted a lack of controls over reconcilements in the dealer credit services division; weaknesses in foreign exchange activities that included inadequate separation of duties, a lack of call-back procedures for wire transfers, and inadequate monitoring and reporting of trading activity; weak standards for loan documentation; and delayed completion of internal audit work or reporting of audit findings. InvestCo

InvestCo’s technology operations are managed independently of those of the bank. Core processing is performed on Tandem and IBM i-series platforms using turnkey software. Daily operations, change management processes, information security, and contingency planning are sound, but standards in all areas are not fully consistent with those of the bank’s data center. Internal audit reports have identified isolated weaknesses in the areas of BSA/AML, documentation of compliance regarding customer notifications, pre-approval for brokers trading for their personal accounts. However, management has responded quickly to address audit weaknesses.

AIG

Operational risks arise primarily from product suitability, transaction execution, technology, and employee misconduct/fraud. Per the insurance supervisory agency, there have been no significant consumer complaint, product misrepresentation, misuse of customer funds, or fraud issues related to AIG. Core processing is performed in-house on an IBM i-series platform using

Page 27 of 43

turnkey applications. AIG manages its own data processing and would benefit from standardizing around the better processes of the bank.

Risk Management

BOARD AND SENIOR MANAGEMENT OVERSIGHT OF OPERATIONAL RISK.

ABC Bank A management structure that utilizes committees extensively and shares information continuously and informally, combined with an adequate internal audit program, produces acceptable risk identification. However, during the two previous years management remedies for identified areas of operational concern have achieved limited success. The “confederation of banks” organizational structure has historically tended to disperse responsibility across multiple managers, disrupt communication of best practices, and hamper progress toward effective accountability. Favorably, more effective change management practices became evident during last year. ABC’s senior management, in an effort to increase the rate of change, launched significant restructuring initiatives intended to improve overall risk management, enhance the control environment, and derive organizational efficiencies. The restructuring initiatives have begun to positively impact the organization, and are expected to be increasingly positive over the long term. However, the organization will experience heightened vulnerabilities associated with major change during the transition period. Technology risk management and governance has improved over the past year. Senior as well as operational and business line management technology steering committees have been convened to more effectively prioritize projects and allocate resources, facilitated by the project management office. Information security administration within core technology operations has been centralized and better staffed. An independent information security policy group, reporting to the CIO, has implemented more comprehensive risk assessment and oversight processes. A similarly independent contingency planning function, reporting to the enterprise risk management function, has been better staffed to coordinate risk assessment, planning, and testing processes. However, the organization has not yet developed a forum for sharing best practices among all affiliates. Within the technology function, a chief technology officer has been appointed to establish a standard IT architecture that will be enforced across the organization. InvestCo and AIG Key management officials are represented in corporate leadership forums, facilitating internal communication and information sharing sufficient for enterprise supervision and better understanding of fundamental oversight disciplines. RISK MONITORING AND MANAGEMENT INFORMATION SYSTEMS.

Last year, the former general auditor was named to head an enterprise risk management (ERM) group intended to better assess and manage the spectrum of organizational risk. The ERM function initially developed slowly. New board members and the nascent Risk Committee are being introduced to risk management concepts and educated on ABC’s risk profile. Although

Page 28 of 43

still in their infancy, the Risk Committee and ERM group are expected to oversee a comprehensive risk assessment process, the development of risk management policies, and the cultivation of risk and loss metrics and analytics necessary for the RAROC project. Initial staffing of the ERM function was lean, with direct reports including information security, insurance risk management, and internal consulting. Compliance risks are not centrally identified, assessed, managed, and monitored, and the lack of an enterprise compliance risk management function is an emerging regulatory concern. Oversight and management of the variety of compliance risks is widely delegated, and unevenly administered. A comprehensive regulatory review of compliance risk management has not been conducted, but individual examination activities suggest that business line or functional area compliance risk profiles range from low to high. The bank’s compliance administration for these areas is adequately staffed and mature. Compliance risks associated with privacy and lending activities are moderate. Compliance risks involving the Bank Secrecy Act and Anti-Money Laundering (BSA/AML) are high and pose material legal and reputational risks, and moderate financial risks. Significant weaknesses were identified two years ago in an examination of the BSA/AML operations, and while improvements has been noted, progress was below expectations and significant weaknesses remained, resulting in a formal supervisory sanction. Lack of experience and training within the BSA/AML staff, immature monitoring systems, and inadequate progress in identifying and analyzing high-risk accounts are the key concerns. Management of compliance risk associated with banking, accounting, stock exchange, and other federal regulations for the banking entities appear satisfactory, but trust and fiduciary activities, and other areas require further investigation. InvestCo and AIG InvestCo has the broadest array and greatest sophistication of management reports. AIG is the weaker of the three business lines but MIS is adequate to monitor operational risk. POLICIES, PROCEDURES AND LIMITS.

Policies and procedures are sound comprehensive across the organization, though pockets of weakness exist. However, weaknesses in monitoring for compliance with policies, particularly in the lending areas, detract from the controls provided by policies. AUDIT AND CONTROLS.

ABC named a new director of internal audit early last year. He has reorganized the audit departmental, eliminating the assistant director layer of management to streamline the organizational structure and delegate greater authority to audit managers. However, the audit department lacks management and staff depth in areas with elevated levels of risk, including fiduciary activities, capital markets, and information technology. A new risk assessment methodology implemented last year provides some improvement in discrete risk identification, but notably lacking is a structured methodology for identifying systemic and enterprise-level risks. In addition, the previous examination of the financial statement assertion and attestation process disclosed an undesirable lack of internal audit management involvement. While internal audit reporting of audit findings to line management has improved during the last year, audit reports persistently do not risk rank audit findings. Similarly, audit committee reports have not effectively conveyed the overall risk profile and key risk areas. However, new report content and formats are being tested to address this weakness. Newly appointed board members who will serve on the audit committee are expected to work with the new audit director to improve

Page 29 of 43

the quality and content of committee reports and enhance the internal audit function. The audit director and the audit committee must also work to improve accountability for correcting audit deficiencies and encourage management to solve problem causes not just symptoms. Corporate insurance for risk management is centrally coordinated. Annually, staff analyzes ABC’s loss history and risk appetite and makes a presentation regarding existing and potential insurance coverage to an informal executive committee. Management considers the risk assessment process informal, and no internal audit is conducted of the insurance selection process. The management committee discusses pricing, coverage, and deductibles in determining the cost/benefit basis for using of insurance products to offset risk. Fraud prevention for deposit activities is well-developed. An effective and efficient staff supported by deployed and well-tuned systems for identifying and defeating check fraud, kiting, fraudulent deposits, and suspicious new accounts has resulted in declining losses from deposit operations.

InvestCo and AIG

While the InvestCo internal audit staff reports to the corporate audit director, collaboration between the two groups is considered weak and corporate audit management lacks a thorough understanding of the broker/dealer business and its risks. In addition, the InvestCo internal audit staff has experienced turnover at the manager level, and the current audit director lacks the experience of her predecessor. In addition, the audit director’s absence for maternity leave further detracts from staff adequacy.

The bank’s corporate audit staff performs internal audits for AIG. Recent internal audits of AIG did not identify any weaknesses or concerns. However, the bank’s internal audit staff lacks depth of experience in this industry.

Page 30 of 43

ABC Bankcorporation

Market and Liquidity RISK PROFILE

Market Risk, ABC’s balance sheet is modestly asset-sensitive, in terms of net interest income, in anticipation of gradually rising interest rates. From an economic value of equity standpoint, the interest rate risk profile is shifting towards a neutral to slightly asset sensitive position as management increases asset maturities in the investment portfolio. The dual impact of low interest rates and a flattening yield curve have compressed ABC’s net interest margin as the balance sheet was positioned for a more rapid rate increase per internal forecasts. With that said, ABC’s strategy to extend asset maturity has helped improve net interest margin. Management continues to refine its market risk measurements and assumptions resulting in more and different model measurements of its interest rate sensitivity profile. Enhanced policies have been developed that incorporate guidelines and limits associated with new methodologies. Management develops strategies based on these new measurements and assumptions designed to reduce exposure to rate declines or flattening of the yield curve as well as to better position the balance sheet and to take advantage of anticipated rate increases.

Liquidity Risk. Liquidity risk has become a matter of concern as ABC has recently been downgraded by debt rating agencies. The rating agency downgrades are the result of decreased prior period earnings and recently announced control weaknesses surrounding accounting processes. Despite these events, ABC still has a favorable reputation in global wholesale and capital markets. This allows quick access to long and short term funds at reasonable prices. Management seeks to maintain a diverse, low-cost funding base and routinely performs analyses of alternative funding strategies to evaluate costs, as well as strategic considerations and their impact on rate sensitivity.

INHERENT RISK

Banking Book

ABC's primary market risk exposure is caused by interest rate volatility due to its balance sheet structure. Exposures to foreign exchange rates and commodity prices are minimal. Interest rate fluctuations impact the mortgage securitization business conducted by ABC Mortgage. Changes in interest rates affect production-based fees and mortgage servicing right valuations. Interest rate and equity price fluctuations also affect ABC’s trust and capital market investment banking activities which are expected to be strong contributors to non-interest fee income. Management states in the Annual Report that continued improvement in the InvestCo, Inc. (IC) is dependent on cooperation from the stock market and an economic recovery. They go on to state that strong growth in the debt capital markets sector has benefited ABC’s capital markets fee income.

Page 31 of 43

The balance sheet is structured in a fairly neutral IRR position. Internal simulations indicate earnings over the next twelve months would be positively impacted by increases in rates. The latest simulations show a +100 basis point shock improving NII by 1.2 percent, and a +200 basis point shock improving NII by 1.7 percent. Economic Value of Equity (EVE) at risk model results indicate a 0.9 percent increase in economic value under a +100 basis point shock and 1.40 percent increase under a +200 basis point shock. Declining rate scenarios indicate a dramatic decrease in NII and EVE. Management is not very concerned with the results of down rate scenarios as they believe interest rates are as low as possible and will increase in the future.

The net interest margin has been low but increasing over the past several quarters. The margin is 3.11 percent and has been flat for several quarters. Management expects the NIM will increase in the near future due to anticipated rising interest rates and aggressive deposit promotions. It is expected the institution will remain slightly asset-sensitive for the near term.

Interest rate risk includes a material amount of noninterest income that is sensitive to market rates. These activities include mortgage banking. Mortgage banking activities include a servicing portfolio of unpaid principal balance of $26.8 billion with capitalized Mortgage Serving Assets (MSAs) of $367 million. Approximately $1 million in MSA impairment was reported in the first quarter of this year.

Over the last three fiscal years, ABC’s earnings have been pressured because of weaknesses in its net interest margin (NIM). The last two quarterly earnings releases indicated a slight improvement in the margin resulting loan growth and fee income.

The recent rating agency downgrades proved to be manageable in the normal course of business, although funding cost are expected to increase. However, if ABC’s short-term rating be downgraded to A2/P2, it would likely trigger the funding of backup commitments.

ABC has access to various third-party liquidity sources, such as the Central Bank borrowings, and bank and parent company pre-existing registrations for additional debt issuance. Through internal analysis and the engagement of consultants, management continues assess and improve its liquidity risk management policies, procedures, practices, and contingency funding plan.

ABC continues to exhibit a stable base of core deposits. In an effort to expand retail market share, ABC periodically runs time deposit promotions.

Trading Book

ABC is also exposed to market risk through its trading activities which are primarily entered into through its IC. Trading market risk is fairly minimal as ABC primarily executes transactions as a customer accommodation. Although value-at-risk (VaR) is up substantially on the trading book

Page 32 of 43

versus prior years, the level remains modest relative to ABC’s other market risk exposures. Exposures are generally hedged as opposed to taking proprietary positions. IC participates in derivatives and foreign exchange trading, but only for customer accommodation and traders hedge any open position within a few days with a back-to-back trade. IC does underwrite debt and equity securities from time to time. Management monitors their exposure by calculating VaR on a daily basis and comparing exposures to established limits for each significant desk and for the trading portfolio in total.

Reported VaR exposures indicate minimal risk. Trading book exposures at IC are centered in interest-rate sensitive debt securities. Trading books are to accommodate customer transactions.

Due to the recent mergers of big banks, ABC’s counterparty exposures have grown quite dramatically. Management indicated that they are seeking to diversify these counterparty credit risk exposures by gaining approval to conduct transactions with overseas counterparties.

MARKET RISK MANAGEMENT & CONTROLS

Board and Senior Management Oversight

The Board delegates ALM responsibility to the Asset Liability Management Committee (ALCO). ALCO is responsible for structuring the balance sheet to meet the ALM policy objectives. It is given the authority to determine lending, investment, deposit, borrowing, liquidity and derivative strategies. Its authority includes pricing and product design for all balance sheet assets and liabilities. ALCO is given authority over all asset and liability purchases and sales. Significant transactions as determined by the Chief Executive Officer or Chief Operating Officer will be reviewed by the Board prior to execution.

The ALCO is made up of key senior management officials who influence market risk. The Chief Executive Officer/President, Chief Business Enterprises Executive, Chief Financial Officer, Chief Credit Officer, Head of Consumer and Business Banking, ABC Mortgage CEO, Chief Risk Officer, Corporate Treasurer, and Asset Liability Manager are ALCO members. In addition, one Regional President attends on a rotating basis. The ALCO meets monthly or more frequently as needed. The Treasurer acts as Chairman, the CFO acts as Vice-Chairman and the Asset Liability Manager serves as Secretary. Minutes are taken, and all significant decisions made and actions taken by the ALCO are recorded. The CFO presents ALCO reports to the Board’s Risk Management Committee.

Authority for executing ALCO approved corporate investment strategy is delegated by the Board to the Treasurer as detailed in the Investment Policy. Oversight responsibility for investment activity is delegated to the Treasurer and ALCO. Daily management of the investment portfolio is performed by the Bank Investment Portfolio Manager.

Authority for executing ALCO approved derivative activity undertaken to hedge balance sheet positions is delegated by the Board to the Treasurer as detailed in the Derivatives Policy.

Page 33 of 43

Oversight responsibility for balance sheet derivative activity is delegated to the Treasurer and ALCO. Generally, ABC will use derivatives contracts to reduce exposure to interest rate risk, not to increase risks by taking speculative positions.

ALCO delegates oversight and policy administration for securities and derivatives trading activity to the Capital Markets Committee (CMC). This committee is comprised of individuals representing the ALCO, Enterprise-wide Risk Management, Credit Administration, Internal Audit, and representatives of business lines which create traded or market risk. The Treasurer acts as Chairman. The committee is responsible for assuring that market, counter-party credit, legal, reputation, and operational risks arising from business lines creating market risk are well-managed. Minutes are taken, and meeting topics are discussed at ALCO meetings and recorded in the ALCO minutes.

ALCO delegates deposit pricing authority to regional Deposit Pricing Committees. These committees meet at least quarterly and are comprised of individuals representing the ALCO as well as individuals responsible for determining deposit strategy in local banking markets. These committees implement regional deposit strategies that are consistent with corporate deposit objectives. ALCO communicates and implements global deposit and liquidity strategies through this committee. ALCO members on the Deposit Pricing Committees discuss the Deposit Pricing Committee meetings at ALCO meetings. These discussions are recorded in the ALCO minutes.

Policies, Procedures, and Limits

The Asset/Liability Management Policy identifies ALM objectives, authority to implement strategies, simulation modeling, risk limits, and reporting requirements. Limits include:

NII limits of -5 percent and -10 percent with +/- 100 and 200 basis point rate shocks respectively

EVE limits of -15 percent and -25 percent with +/- 100 and 200 basis point rate shocks respectively

Policy limits are monitored and reported in ALCO monthly. Policy exceptions are allowed only with the approval of ALCO or, in the absence of a quorum, the President and Chief Executive Officer, CEO of Business Enterprises, or Chief Financial Officer.

Management Information Systems and Risk Monitoring

Risk management processes including Enterprise Risk Management, Traded Markets Oversight Committee, and ALCO. ABC uses the IRRate model to simulate changes in net interest income and economic value at risk. IRRate also performs a Monte Carlo analysis of NII using 300 random rate paths to estimate the minimum NII under various confidence levels. IRRate is no longer developed or updated and management indicates that other vendor models currently

Page 34 of 43

available do not offer the capabilities or flexibility of IRRate. Management indicated that weaknesses in IRRate such as the limited number of prepayment tables can be addressed internally. The model requires a greater degree of technical knowledge and financial understanding that must be maintained in-house. The external audit company found no concerns with the model accuracy and indicated it was robust for the size and complexity of the bank. As technology and modeling techniques advance, management understands that they will need to convert to a vendor supported model, but at this time they feel that the benefits do not outweigh the costs.

Eighteen months ago, management identified reporting errors that included the exclusion of loans in mortgage securitization warehouse aged 365+ days. This reporting deficiency revealed greater market risk exposure than had been reported. Management chartered a mortgage securitization warehouse system project that has automated the tracking and reporting of inventory.

Management continues to refine its market risk measurements and assumptions, which are resulting in more and different model measurements of its interest rate sensitivity profile. Management has developed strategies based on these measurements and assumptions. Through the latter part of last year and continuing into this year, MktRisk Consulting Group worked with management to further develop and refine market and liquidity risk management practices and capital analysis as well as trying to identify opportunities to bolster ABC’s NIM.

A funds transfer pricing (FTP) model is used to centralize interest rate risk management within the Treasurer’s group. Beginning this year, the FTP methodology for demand deposits was revised to more closely represent recent deposit behavior.

ABC Mortgage manages the business line’s market risk independent of the Treasury Group, which is responsible for the corporate balance sheet market risk management. This function is well managed and staffed by competent individuals, however, it is purely a business line function and not directly addressed in policy. ABC’s Treasury Department does provide consultative oversight to ABC Mortgage, and serves as an information conduit to the ALCO.

Hedging tools are selectively used to diversify exposures and to mitigate the institution's market risk. Management is increasingly using derivatives, primarily in the form of interest rate swaps, to manage the interest rate sensitivity profile of the institution. However, the level of end-user derivative usage is considered modest relative to some peer institutions.

Internal Controls and Audits

Senior management and line management have good industry experience, and most have been in their positions at ABC for several years. Policies and procedures cover all aspects of the operation, including accounting. Management reports cover all aspects of treasury activity. The trading system captures all funding and investment activity in the bank. The organizational structure supports adequate separation of duties during normal operations. The function is audited periodically.

Page 35 of 43

Established limits are monitored monthly by ALCO and the Board. The Treasury Division’s organizational structure separates the front office and back office functions. This structure ensures separation of duties is in place for funding, investments and derivative activities. Internal audit periodically reviews the Treasury Division. ABC engaged an external auditing company to co-source a model validation with ABC’s Internal Audit.

The past loss of key ALM modeling staff and subsequent transition highlights the importance of enhanced documentation and transparency in the modeling process to help maintain institutional knowledge, management succession, and continuity. Management has indicated that the risk associated with the loss of key modeling staff would be mitigated by improving documentation and transparency of the modeling process.

As noted in the Liquidity Risk Management Review conducted in last year, the Treasury Department is addressing separation of duty issues. At the time of the review, front office and middle office still report to the same individual. It is noted that Treasury has made progress in separating trade confirmation and report checking tasks from the front office to the newly created middle office function.

Earlier this year, the employee in ABC Internal Audit responsible for audit activity in the IC unit left the organization. A replacement has not been named as of mid-year. Unfortunately, her departure comes before the completion of a model validation exercise she was heading-up. This model validation is necessary for the organization’s compliance with the MRA and necessary for meeting supervisory recommendations.

SUPPORTING ANALYSIS

The Future of Interest Rates

ABC’s chief economist predicts that interest rates will increase over the next twelve months. His prediction is consistent with the widely published consensus opinion of 50 business and academic economists. This will occur by short-term interest rates increasing at a steady, but rapid pace; long-term interest rates will slowly drift upward. As a result, the yield curve is expected to flatten.

Page 36 of 43

Interest Rates

Earnings Simulation

Management’s earnings simulation indicates the balance sheet is positioned to moderately benefit from the “most likely” scenario presented by the Chief Economist. ABC’s NII simulation indicates the organization will benefit the most from a general 200 basis point increase.

Earnings Simulation

Page 37 of 43

During previous examinations, it is noted that ABC’s earnings simulation assumes parallel shifts of the yield curve.

Gap Analysis

The forward looking gap analysis of ABC indicates a slight asset sensitive position in the one to three year range and a liability sensitive position in the long-term. To address these gap mismatches and mitigate risk if rates fall, management has recommended to the asset liability committee that the firm enter into a short term receive float, pay fixed swap.

Gap Analysis

Management identifies an ideal gap profile as having equal positive balances (represented by bars) in the years one through five buckets, with a completely neutral position beyond the five years bucket. Management indicated they will not attempt to achieve the ideal position overnight, but would rather opportunistically execute transactions as favorable market conditions develop in order to achieve the desired interest sensitivity profile over time.

Economic Value of Equity

ABC economic value of equity, to measure market risk exposure. Economic value of equity (EVE) uses instantaneous rate shocks/changes, whereas NII simulation generally assumes a more gradual change in rates over time. EVE only considers the current balance sheet and does not incorporate balance sheet changes in contrast to the NII simulation approach. The following graph illustrates ABC’s asset sensitive position under the EVE calculation. The position remains within ABC's current +/- 10 percent change in the economic value of equity,

Page 38 of 43

except for the down 200 basis point scenario. Management does not believe this scenario to be realistic and has not explained the policy violation to the board of director’s risk committee.

Economic Value of Equity

Source: Most recent ABC Corporate ALCO Meeting,

Management continues to review the assumptions underlying the economic value of equity model, with particular emphasis on demand deposit account assumptions. ABC’s model results are significantly impacted by changes in deposit assumptions.

Management views ABC’s greatest risk as being a general decline in interest rates. Management has executed strategies based on prior approvals to reduce exposure to a flattening yield curve as they have attempted to move the institution towards a more neutral rate sensitivity profile. However, management is attempting to maintain at least some relatively short-term asset sensitivity in anticipation of rising interest rates.

Net Interest Margin

Management does not use prior period Net Interest Margin (NIM) to manage their interest rate risk. However, NIM can be useful to look at as a performance metric. A brief review of peer organizations indicates that ABC’s NIM lags similar peers. It is understood that management is

Page 39 of 43

working to reposition the balance sheet. This contributes to ABC’s below peer NIM. Management expects this measure to improve over time.

Net Interest Margin

ABC’s NIM has lagged peer’s for the last five quarters. The spread has been narrowing, however, ABC NIM is 80 basis points below the peer group’s average.

Net Interest Margin Time Series

Investment Portfolio During the third quarter, ABC decreased the size of their investment portfolio. On average, the portfolio yields 3.86%.

2.50

3.00

3.50

4.00

4.50

QTR 1 QTR 2 QTR 3 QTR 4 QTR 5

Peer Average 4.17 4.07 4.00 4.00 3.92

ABC 3.04 3.01 3.11 3.11 3.11

0.00

1.00

2.00

3.00

4.00

5.00

Y to D NIM 3.11 3.96 4.78 4.27 4.08 3.58 3.21 4.04 3.74 Current QTR 3.11 3.92 4.74 4.26 4.04 3.50 3.15 4.01 3.72

ABC Peer Avg Peer 1

Peer 2 Peer 3 Peer 4 Peer 5 Peer 6 Peer 7

Page 40 of 43

The portfolio is concentrated in mortgage-backed securities (MBS), and asset-backed securities (ABS), totaling 54% and 18% respectively. Management has taken steps to extend the maturity of ABC’s investment portfolio to bolster NIM. Value-at-Risk

Management uses value-at-risk (VaR) to measure market risk from trading positions. The VaR calculation measures the potential trading losses in fair value of fixed income, credit derivatives, derivatives, collateralized debt obligations (CDOs), equity, loan trading, and foreign exchange positions managed by the Investment Bank Risk Committee staff. Management uses VaR models provided by MktRisk Consulting.

A standard 99.95 (2.33 standard deviations) percent one-year VaR on end-of-day positions is applied. The holding periods range from one to three days, depending on the product.

Investment Portfolio - September 2004

Govt & Agency, 8%

MBS, 54% CMBS, 6%

Muni, 4%

ABS, 18 %

Corp, 6%

CDO, 2%

Other, 2%

Page 41 of 43

Value-at-Risk

Page 42 of 43

Internal Audit

ABC’s internal audit program uses a continuous, risk-focused approach. The audit universe consists of all material business processes within the organization. The audit department performs an initial risk assessment for each area of the universe to establish inherent risk. The inherent risk ratings are:

• High inherent risk exists when the activity is significant or positions are large in relation to the institution’s resources or its peer group, when the number of transactions is substantial, or when the nature of the activity is inherently more complex than normal. Thus, the activity potentially could result in a significant and harmful loss to the organization.

• Medium inherent risk exists when positions are average in relation to the institution’s resources or its peer group, when the volume of transactions is average, and when the activity is more typical or traditional. Thus, while the activity potentially could result in a loss to the organization, the loss could be absorbed by the organization in the normal course of business.

• Low inherent risk exists when the volume, size, or nature of the activity is such that even if the internal controls have weaknesses, the risk of loss is remote, or, if a loss were to occur, it would have little negative impact on the institution’s overall financial condition.

The audit department views the process as continuous because risk assessments are updated following each audit or whenever information of a material nature that could affect the risk assessment becomes known. To facilitate the continuous risk assessment process, audit staff receives internal reports, attends pertinent meetings as an observer, and maintains regular contact with management to stay abreast of new developments. Following each audit, the area of the audit universe is also rated for residual risk based on the results of the audit testing of the control environment.

Audits are either full-scope audits or targeted based on the level of residual risk, the last audit rating, and the magnitude of change occurring within the business area. Full-scope audits comprehensively cover all activities and internal controls; however, full scope audits may emphasize select areas of particular concern. Targeted audits only focus on activities or controls of particular concern. The findings from each full-scope or targeted audit is used to update the business area risk assessment and, based on the collective audit work during the quarter, a rolling one year audit plan for the entire audit universe.

At the conclusion of every full-scope or targeted audit, a report is issued that summarizes individual findings and contains an overall rating. The audit rating scale is “A” through “D,” with an “A” rating indicating that internal controls are strong. In addition, the report identifies needed corrective actions and the due date for these actions to be completed. Business areas having issues requiring corrective action for significant issues that are adversely rated (“C” or “D”) receive a follow-up audit within 90 days. Monitoring is continued on the corrective action until it

Page 43 of 43

is fully implemented. However, a new rating for the process will not be issued until sufficient time as assed to determine whether the corrective action was effective.

In accordance with the ABC Audit Methodology, internal audit will complete base audits with a “High” inherent risk rating at least every 18 months, “Medium” inherent risk at least every 24 months, and “Low” inherent risk rating at least every 36 months. From time to time, new processes are added to or deleted from the audit universe due to an acquisition the introduction of a new product, or a redesign of the audit universe to better identify risks.

Audit Universe – Current Year

Business Area Months Since Last Audit

Last Audit

Rating1

Inherent Risk

Risk after Controls

ABC Mortgage Loan 16 C High Medium Internet Banking 10 C High Medium Loan Operations 9 B High Medium Residential Real Estate 1 A High Medium Investment Portfolio/Funding 22 B High Medium Consumer Credit 10 B Medium Medium Contingency Planning 18 B Medium Medium Deposit Operations 12 B Medium Medium Branch Operations 1 NYR Medium Low Model Risk Management 2 B Medium Low Loan Pricing Model 11 B Medium Low Marketing 31 A Low Low Credit Review 8 B Medium Low ABC Insurance Group 6 B Medium Medium Commercial Lending 7 B High Medium Commercial Real Estate 14 B Medium Low Trust Operations 4 B Medium Medium Information Security 10 C Medium Medium Corporate Accounting 15 B Medium Low Human Resources 15 B Low Low Planning/Forecasting (budget) 16 A Medium Low

1 A = Strong; B = Satisfactory; C = Marginal; D = Unsatisfactory; NYR = Not yet rated