Risk Analysis and Supply Risk Mitigation at Bank of America

1
Risk Analysis and Supply Risk Mitigation at Bank
of America
Major Program Components Overview
SCRLC Meeting June 4 5 , 2008Boeing
Corporation Seattle, Washington
2
Bank of America Business Profile

• 1.4 Trillion in Assets
• According to Forbes latest Global 2000 listing,
  BAC is the worlds 4th largest public company just
  behind CitiGroup Inc, General Electric and AIG.
  (based on composite sales profits, assets, and
  market capitalization)
• The worlds 6th most-profitable company
• Offices in 31 countries serving clients across
  150 countries
• 38 million consumer relationships
• Retail footprint covers more than 75 of the U.S.
  population
• gt16,000 ATMs
• gt5,600 Banking Centers
• 52 of all internet banking transactions
• The number-one issuer of debit cards in U.S.,
  with over 17 million cards outstanding
• Bankers to 96 of the US Fortune 500 and 82 of
  the Global Fortune 500

3
Bank of America Supply Chain Management
LOB Customer Centric
Consumer Card Supply Management
Global Operations and Supplier Relations
Development
GCIB, GWIM GBFS Supply Management
GTO Supply Management
SCM Strategy
ESP S Supply Management
Joe Hill
Joseph Martinez
Jill Bossi
Cesar Penaherrara
Rich Jones
Benjamin Robinson

• Multicultural Sup Dev
• Cross Sell
• European SCM
• Chilean SCM
• Argentinean SCM
• Brazilian SCM
• Uruguayan SCM
• Asian SCMSourcing Services
• Application Deployment
• Process Design
• Supplier Registration
• Archiving Records
• Supplier Manager Services
• Training Certification
• Supplier Scorecards

Global Wealth Investment Management Global
Corporate Investment Banking Global Business
Financial Services

• Transaction Services
• Cash Transport
• Non-Cash X-port
• ATM
• Imaging
• Business Solutions
• Desktop Security
• Tech Outsourcing
• Enterprise Apps
• Tech Infrastructure
• Telecom
• Mainframe / Storage
• Midrange / Software
• Enterprise Access / Svcs

Card Merchant Services Deposit and
Debit Consumer Real Estate E-Commerce
Insurance
Corporate Workplace Global Human
Resources Corporate Marketing Corporate Staff
Support Treasury Quality Productivity Finance
Legal Risk Document Management Corporate
Travel Services

• Risk and Compliance
• Compliance Monitoring
• Risk Assessment
• Risk Monitoring
• Project Management Office
• Offshoring

SCM Transition
SCM Analytics
Tim Marquardt
Dave McCann
4
Supply Chain Management Assumptions
Environment
5
Supply Chain Strategic Propositions

• SCM Role and Value Proposition
• Create Value
• Develop and execute supply strategies for LOBs
• Deliver credible, transparent and sustainable
  productivity gains for the enterprise
• Foster Innovation
• Identify and generate revenue opportunities as
  part of the Universal Bank
• Protect BAC IP to drive competitive advantage
• Minimize Risk
• Ensure that Bank of America suppliers meet
  rigorous risk and quality standards

• Build the Brand SCM Relationship
  Responsibilities
• gt 30,000 suppliers
• 12,346 active contracts (domestic)
• 139 domestic agreements with 102 foreign
  Suppliers located in 20 countries
• Supplier Diversity
• gt 7,500 diverse suppliers
• 1,2 B spend with diverse suppliers
• Supplier Cross-Sell 2002-2007
• 140 deals with over 58MM in Revenue
• Leading BAC efforts on Environmental Impact
• Quarterly OCC Reviews

• Shareholder Value / Low Cost Provider
• SCM Non-Interest Expense Impact
• 14.5 B supplier sourceable spend (est.)
• 35 of the BAC NIE (incl. MBNA)
• SCM Savings Impact
• 2002-2005 Sum 1.18B (SPS 0.19)
• 2005 654.3MM (SPS 0.10)
• 2007P 900MM (SPS 0.16)
• FLEET - 426.0MM Cumulative (2004-2006)
• MBNA - 250.0 MM cumulative (2006 103MM)
• SCM Operating Leverage Impact
• Corporate Travel
• Document / Print Management

• Top Challenges
• Governance Maturity
• Strategic Sourcing
• End-to-End supplier management
• Savings Governance and Execution
• Savings either accrue or are reinvested per LOB
  decision
• Infrastructure Investments
• Not sexy but mission critical
• Proactively Managing Operational Risk
• Global Supply Chain Integration
• Getting Ready for the NEXT BIG THING!

6
Bank of America Supply Chain Mission

• Supply Chain Management has the fiduciary
  responsibility to
• Manage (mitigate) Enterprise Supply Base risk
• Maximize Enterprise Supply Base Value (while not
  violating 1)
• Support business partner needs for goods and
  services. (while not violating 1 or 2)

7
E2E Supplier Relationship Management Process
Lead
SCM Sourcing
LOB Supplier Management
Shared
Engagement
Establish Relationship
Manage Relationship
Terminate/ Change Relationship
Pre-Engagement
Identify business need for sourcing product or service Develop business case Complete risk assessment with Sourcing Create risk mitigation plan performance scorecard Manage day-to-day supplier operations/-relationship Manage supplier risk performance Complete deliverables per Supplier Management Program (SMP) Identify need to change relationship
Identify supply leverage opportunity, sourcing strategy, potential suppliers Review business case Source alternative suppliers Negotiate with suppliers Complete risk assessment with LOB risk partners Finalize contract terms conditions Consult with LOB on supplier risk and performance issues Identify need to change relationship Modify or terminate contract
Oversee SMP for LOB and drive appropriate management routines update LOB leadership on supplier risk performance issues Ensure LOB Supplier Managers comply with SMP standards Provide VOC input to improve SMP Oversee SMP for LOB and drive appropriate management routines update LOB leadership on supplier risk performance issues Ensure LOB Supplier Managers comply with SMP standards Provide VOC input to improve SMP Oversee SMP for LOB and drive appropriate management routines update LOB leadership on supplier risk performance issues Ensure LOB Supplier Managers comply with SMP standards Provide VOC input to improve SMP Oversee SMP for LOB and drive appropriate management routines update LOB leadership on supplier risk performance issues Ensure LOB Supplier Managers comply with SMP standards Provide VOC input to improve SMP Oversee SMP for LOB and drive appropriate management routines update LOB leadership on supplier risk performance issues Ensure LOB Supplier Managers comply with SMP standards Provide VOC input to improve SMP
Oversee supplier selection and contracting Partner with LOB Champions to resolve supplier risk and performance issues Oversee supplier selection and contracting Partner with LOB Champions to resolve supplier risk and performance issues Oversee supplier selection and contracting Partner with LOB Champions to resolve supplier risk and performance issues Oversee supplier selection and contracting Partner with LOB Champions to resolve supplier risk and performance issues Oversee supplier selection and contracting Partner with LOB Champions to resolve supplier risk and performance issues
Provide risk subject matter expertise Partner with LOB to resolve supplier risk and performance issues Includes Legal, GIPBC, GCOR, Corporate Insurance, etc. Provide risk subject matter expertise Partner with LOB to resolve supplier risk and performance issues Includes Legal, GIPBC, GCOR, Corporate Insurance, etc. Provide risk subject matter expertise Partner with LOB to resolve supplier risk and performance issues Includes Legal, GIPBC, GCOR, Corporate Insurance, etc. Provide risk subject matter expertise Partner with LOB to resolve supplier risk and performance issues Includes Legal, GIPBC, GCOR, Corporate Insurance, etc. Provide risk subject matter expertise Partner with LOB to resolve supplier risk and performance issues Includes Legal, GIPBC, GCOR, Corporate Insurance, etc.
LOB Supplier Manager (SM)
SCM Sourcing Manager
LOB Champion
SCM Sourcing Exec.
LOB Risk Partners
Note Roles highlighted in blue represent 1st
LOD roles highlighted in orange represent 2nd
LOD.
8
Supplier Management Program (SMP) Purpose

• Goal
• Implement a World Class Enterprise Supplier
  Management Program to identify and mitigate
  supplier risk and maximize supplier performance
  and value

Supplier Management Program (SMP) A framework of
governance, processes and tools to manage
enterprise supplier risk and performance annually
for Tier 1 and Tier 2 suppliers. Supplier
Managers and Suppliers submit program
deliverables which enable our ability to assess,
manage and mitigate supplier performance and risk
issues in a timely manner. - LOB Supplier
Managers Serve as a liaison between the
supplier and Bank of America while managing day
to day relationship, monitoring supplier
performance, and identifying and mitigating
supplier risk. - LOB Champions Tier and
assign LOB Supplier Manager to LOB Suppliers, act
as a point of escalation and drive appropriate
management routines for the LOB, represent the
LOB as a member of the Supplier Risk Steering
Committee and work with support partners to drive
SMP deliverables and issue resolution.
SMP Suppliers The Supplier Management Program
provides a framework for managing tier 1 and tier
2 suppliers, which include the 550 most
critical/highest risk of Bank of Americas 31,000
total Suppliers. Tier 1 Supplier scores
Significantly High for Information Security,
Business Continuity, Financial or Other
Operational risks OR annual supplier spend totals
150mm or more. Tier 2 Supplier scores High
for Information Security, Business Continuity,
Financial or Other Operational risks OR annual
supplier spend ranges between 35mm and 150mm.
The Three Lines of Defense 1st Line of Defense -
Business unit managers are accountable for all
risks in their units, both existing and emerging.
For SMP - LOB Champions Supplier
Managers. 2nd Line of Defense - Business
partners acting independently, work with business
units to identify, assess and mitigate all risks.
For SMP - includes SCM, GIPBC, Legal, Compliance
Operational Risk, etc. 3rd Line of Defense -
Corporate Audit and Credit Review independently
test, verify and evaluate management
controls. For SMP - Audit.
Supplier Risk Steering Committee (SRSC) The
SRSC, which includes the LOB Champions, meets
quarterly to review the Enterprise SMP status,
the program status for key LOBs, and key supplier
risk issues and themes across LOBs. The SRSC
also decisions SMP enhancements, monitors key
initiatives status, and encourages best practices
sharing across the LOBs. The SRSC provides
quarterly Supplier Risk updates to the Compliance
and Operational Risk Committee (CORC).
9
Supplier Management Program Structure and
Governance
SM Program Governance
Supplier Risk Executive Committee Milton Jones,
CFO Group Greg Taylor, Supply Chain
Management Chris Higgins, GIPBC Mike Brosnan,
Global Risk
LOB Champions Global Supply Chain Management Greg
Taylor Global Risk Management Mike
Brosnan Finance Services Keith Jacobsen GTO SF
Ops Jeanne Spradlin GTO NCG Edie
Fletcher GTO CIOs Meril Thornton Corporate
Workplace Jeff Hipple Global Human
Resources Eadie Ferretti Global Marketing Dave
Upton GCSBB - Deposits Gregg Sheehy GCSBB
eCommerce Ellen Fox GCSBB CRE/Insurance Tim
OBrien GCSBB Card Services Jeff
Hennessy GCSBB Student Banking Tom
Nerad GCSBB Small Business Banking David
Head Global Product Solutions Tim Burdick Global
Capital Markets Investment Banking Marta
Johnson Corporate Investments Leslee
Bertsch Global Wealth Investment
Management Chantalle Couba Global Commercial
Bank Mary Jo von
Tillow Non-US
Joe Hill
SM Program Council Caroline Dellinger
SM Program Teams
10
Manage
Supplier Mgmt Program - Supplier Tiering SMs
Supplier Managers
Supplier Tiering

• Assigned by Line of Business
• All Supplier Managers must
• Complete 2.5 day Supplier Manager training
  program
• Achieve certification w/in 60 days after
  completion of training
• Recertify Annually
• Manage suppliers to annual performance and risk
  management deliverables

• Supplier Tiering is risk based with three key
  components.

Tier Criteria

• Criticality of suppliers product or service to
• Operation of Bank of America
• Operation of Line of Business
• Sensitive Data Handling Risk
• Annual Spend

Tier Assignment

• Supplier tier classifications
• Tier 1 Tier 2 Suppliers require Supplier
  Managers
• Supplier tiers revisited annually
• Tier 3 Low , Low IS
• Tier 4 Negligible exposure

11
Supplier Management Program Requirements
Notes 1Required for suppliers scoring SIG HIGH,
HIGH or MED for BC on START 2For appropriate
suppliers based on START 3Required for suppliers
scoring SIG HIGH, HIGH or MED for IS on
START 4Deliverables in blue are the LOB
Champions responsibility
Not required for Tier 2 Suppliers.
12
Supplier Management Program Metrics

• The Supplier Portfolio Index (SPI)
• Integrated view of supplier residual risk and
  performance.
• Intended to drive simple actions for assessing
  and remediating risk and performance issues.
• Single risk and performance metric for a
  portfolio of suppliers (business unit, LOB and
  enterprise).
• Can be disaggregated to individual components to
  understand where corrective action is required.

• 2008 Hoshin Performance Plans
• Business Executives 1) SPI as component of
  Business Risk Review and/or 2) Compliance to
  SMP Deliverables as component of Compliance
  Program Effectiveness Indicator (CPEI)
• LOB Champions and Senior Supplier Managers 1)
  SPI and 2) targeted supplier enablements 3)
  Compliance to SMP Deliverables as component of
  Compliance Program Effectiveness Indicator (CPEI,
  if B1 or 2)
• Managers of Supplier Managers and Supplier
  Managers 1) SMP deliverables are current,
  complete and submitted on-time in accordance with
  annual SMP Deliverable schedule. Deliverables
  that are not of acceptable quality will be
  rejected. 2) Targeted payment channel supplier
  enablements completed

13
Supplier Management Program Reporting

• Risk Review prepared quarterly
• Used by LOB Champion to identify key risk issues
  themes, drive risk remediation plans report
  to Supplier Risk Exec. Comm.

• Status Report produced weekly
• Used by LOB Champion Supplier Managers to
  monitor compliance with program deliverables

14
Performance and Continuous Improvement

• Program Snapshot
• 552 of highest risk (Tier 1 2) suppliers in
  program
• 2008 YTD 86 of required deliverables completed
• 200 suppliers beginning fourth year of program
• 245 Supplier Managers in program All Certified
  by October of current year
• 60 Recertify
• 2007 Strategies
• Enhanced program quality and simplification (MBF,
  SM Program Council)
• LOB Enablement and Program Integration
• Successful MBNA and US Trust merger integration
• 2008 Strategies
• Move from quantitative to qualitative
  deliverables (5 Auditable deliverables)
• Migration to automated system
• Adapt and drive the program internationally
• Next gen risk opportunities are
  Offshore/Subcontractor and Business Continuity

15
Corporate signature Do Not print this page. For
projector presentations only.