Exhibit 11.3 Risk-Identification Interview Tool

Risk Identification:

1. How do you define risk?

2. How do you identify risk in your area?

3. What do you feel are the top five real or perceived risks in your department, division, or organization?

4. What is the impact of identified risks in your area? (Inadequate staffing, inefficient use of resources, diminished capital, etc.)

5. How often do they occur?

Risk Ownership:

6. How do you (or will you) engage employees in risk initiatives?

7. How will each division/unit/team contribute to meeting the goals of the ERM strategy?

8. How will teams/individuals be held accountable for success?

Risk Prioritization:

9. What method do you use to prioritize risk? (Cost, benefit, easy to implement?)

10. How are the identified risks ranked? (Frequency, impact, severity?)

11. What are the consequences if these risks are not addressed?

Risk Treatment:

12. How are the identified risks currently managed?

13. Is the approach effective?

14. Do you feel resources are being wasted or used inefficiently? If so, how?

Risk Solutions:

15. What action plans should be in place?

16. How are risks monitored?

17. How is success measured?

Risk Treatment:

13.