Volume 2 — Governance and ControlsGovernance and Controls © Copyright 2002, All rights reserved 8 The CRO prudently delegates responsibilities to the corporate risk management department and the middle office. Business units or support functions may be required to provide the CRO with reports or information required for risk assessment and analysis on a regular or ad hoc basis. 2.4 Corporate Risk Management The corporate risk management department reports to the CRO. The department is responsible for implementation of, administration of, and compliance with the company’s risk policy and risk management processes and procedures. To maintain independence, the incentive compensation for corporate risk management should not be tied to trading or merchant energy unit performance. Business units or support functions may be required to provide the CRO with reports or information required for risk assessment and analysis on a regular or ad hoc basis. Corporate Risk Management ― Responsibilities and Duties • Develop and review systems and controls to measure risk. • Monitor compliance as required by the risk policy, including aggregation of risks across the company and review of the company’s overall risk profile. • Review and recommend market risk and credit risk limits. • Develop risk measurement techniques. • Review and recommend for approval, risk measurement calculation and standardized position methodologies. • Review curve validation and stress-test results. • Evaluate the effectiveness of the risk metrics employed. • Oversee the model development, validation, and testing process to ensure that market and credit risks are accurately quantified. • Recommend operational risk and business risk assessment guidelines. • Review business unit returns relative to expectations and to the level of risk incurred. • Assess valuation issues and perform or review analyses on the company’s overall risks, using specialized stress tests and scenario analyses. • Aggregate or consolidate risk measures into enterprise-wide market risk measurement. This includes reviewing the effectiveness of transaction processing systems and procedures relating to risk measurement and overseeing adherence to risk policies, procedures, and limits. • Assess and recommend the allocation of resources necessary for risk oversight and compliance (i.e., human resources, analytical tools, reporting infrastructure, etc.). • Coordinate and distribute independent market fundamental analysis.