1. The Executive Summary (pages ES‐1 & ES‐2), and Chapters 1 and 2 (pages 1‐13) [Note: in Acrobat these are pages 11‐25] of the Contingency Planning Guide for Information Technology Systems (http://cs

❏Re-assess resources versus needs ❏Monitor productivity of personnel ❏Prioritize reallocation of resources ❏Provide appropriate retraining ❏Monitor employee morale ❏Guard against employee burnout ❏Monitor for delayed stress / trauma ❏Provide counseling and support ❏Pay employees / beneficiaries timely Technology / Management ❏Identify / prioritize mission critical applications ❏Prepare business impact analyses by unit ❏Re-assess original recovery plans ❏Continuously assess recovery site stability ❏Recover / reconstruct all critical data Within the recovery environment:

❏Assess the adequacy of information security ❏Assess the adequacy of system security ❏Re-assess recovery tolerance / timeframes ❏Evaluate recovery contingencies ❏Develop and test recovery plans ❏Develop emergency plans for recovery staff Customers, Clients and Suppliers ❏Re-establish customer / vendor contacts ❏Reconsider revenue / profit projections ❏Recover / reconstruct contracts / customer data In the post-disaster environment, assess:

❏Changed customer requirements ❏Ability to respond to customer requests/inquiries ❏Changed customer / supplier market behavior ❏Appropriate products / product mixFocus on your people first. Human resource requirements must be continuously reassessed. ●Frequently review human resources and skill sets ●Match skill sets to changing needs and requirements ●Recruit and train required resources Unclear roles and responsibilities can frustrate recovery.

●Ensure key leaders are clearly identified and chains of command are established and communicated to staff ●Ensure senior management / company officers are visible to employees.

Disaster effects may debilitate managers and staff long after the actual event.

●Monitor morale — watch for delayed signs of stress, guilt and depression ●Offer support and counseling ●Protect dedicated staff from burnout — establish a practical work schedule ●Enforce upper limit on hours / days worked without time off Financial commitments to employees extend beyond meeting current payroll.Ensure delivery of existing and future financial / benefits commitments to:

●Current employees ●Retired employees ●Disabled employees ●Recently terminated employees ●Beneficiaries of recently deceased employees Customer requirements may be radically altered in the post-disaster environment.Assess the disaster’s impact on your clients / customers.

●Consider changes in client / customer requirements ●Review status of existing client / customer orders ●Respond with changes in product(s) mix Demands for information about your recovery will persist for an extended time.Establish a long-term communications plan.

●The plan should respond to incoming inquiries and requests from:

–Owners / shareholders –Employees and their families –Key customers –Key suppliers –Other stakeholders ●And supply required information to:

–Analysts –Regulators –Shareholders Poorly controlled communications endanger recovery and future success.Establish and enforce strict policies and procedures governing all media contacts.

Pre-disaster management tools may be inappropriate for the recov- ery environment. ●Design / establish new post-disaster key performance indicators ●Continuously monitor and report on the capacity and timeliness of your transaction processing / production cycle ●Continuously monitor and report on the performance of suppliers and vendors Recovering all pre-disaster functions may be unnecessary / ineffi- cient. Consider temporary or permanent outsourcing options.Pre-disaster controls may not mitigate new risks in the recovery environment.Immediately assess new / changed operational risks associated with the recovery work environment. ●Design and implement new mitigating controls ●Temporarily or permanently amend existing policies and procedures Pre-disaster security / safeguard systems may be wholly inade- quate in the post-disaster environment.

●Review security system to reduce digital vulnerability ●Evaluate security arrangements for recovered systems to ensure new vulnerabilities are not / were not introduced in recovery mode ●Constantly communicate electronic safeguard procedures to: –Employees –B2B partners –E-customers Be prepared for potential future disruptions that may occur dur- ing execution of initial recovery plan. ●Evaluate contingencies and develop a recovery plan for the ongoing recovery period ●Assess the reliability of utility services and consider alternative business resumption strategies ●Develop specific emergency responses for the recovery team ●Develop a decision guide for invoking the new recovery plan In the post-disaster environment, valuable benefits can be easily overlooked.

●Research and contemplate tax and economic incentives when making permanent relocation decisions ●Identify, track and document relocation / recovery costs for appropriate presentation to:

–Insurance carriers –Tax authorities –Other government agencies ●Carefully and continuously analyze the impact of amended legal and regulatory requirements to obtain and maximize regulatory relief and waivers Contracts may contain valuable exercisable options, as well as potentially costly granted options.

●Analyze existing trade contracts and pending transaction contracts for potentially valuable exercisable options and / or potentially costly options granted to others Corporate liquidity may be subject to unanticipated risks in the post-disaster business environment.

●Adjust cash flow projections to account for the viability of customers and for the anticipated timeliness of their payments ●Continuously review and analyze the availability of com- mercial paper credit, credit available from financial institu- tions and trade credit from vendors / suppliers ●Continuously review cash / collateral required to service marginable derivatives / hedges in turbulent asset markets Post-disaster asset price volatilities and correlations may render management decision tools and risk management tools inaccu- rate.Immediately and continuously update post-disaster volatilities and correlations used in:

●Market-risk computations ●Credit-risk computations ●Risk-adjusted performance measures ●All management decision models Business Recovery Checklist Customers, Clients and Suppliers (continued) ❏Customer / counterparty stability ❏Supplier / vendor reliability ❏Status of existing orders / contracts Financial Management ❏Separately track losses / recovery costs ❏Formally notify insurers of claims ❏Protect facilities from further damage ❏Seek interim relief from insurers ❏Investigate regulatory relief ❏Contact analysts / rating agencies ❏Pay current insurance premiums Re-establish:

❏Payroll processes ❏Benefits processes ❏Accounts payable processes ❏Billing / accounts receivable processes ❏Credit / market risk monitoring ❏External / internal reporting ❏Key reconciliations ❏Other financial controls ❏Meaningful key performance indicators (KPIs) ❏Transaction controls / limits ❏Authorities / approval limits Re-assess:

❏Cash flow projections ❏Budget / budgeting process ❏Closing process / timing Business Operations ❏Assess ability to deliver customer orders ❏Identify outsourcing opportunities ❏Refresh supply chain management ❏Analyze lease requirements / options ❏Establish new risk-mitigating controls ❏Amend policies and procedures ❏Develop meaningful KPIs Continuously re-assess the adequacy of:

❏Recovery site ❏Existing plant and equipment ❏Production capacity ❏Communications / sales capacity ❏Transaction settlement processes I n light of recent events, we know that getting back to business as usual is a challenge. Leaders are faced with issues that were once unthinkable. The ramifications are impacting all aspects of business dealings and operations. At this time, it is critical to identify, respond to and manage the unique risks associated with recovery and business continuity. To assist in the assessment of various business issues, KPMG has put together this guide which outlines key management considerations. We hope this will serve as a reference as you approach the difficult days and weeks ahead. © 2001 KPMG LLP, the U.S. member firm of KPMG International, a Swiss association. All rights reserved.

Printed in the U.S.A. 7781NYGR AMessage to Our Clients and Friends KPMG LLP 345 Park Avenue, New York, NY 10154 If we can help in any way, please contact Karl Ruhry at (212) 872-3133.