Slide 1

[Audio] 0 KPC ERM Transformation Journey, Achievements & Challenges MENA ERM - June 2014.

[Audio] 1 Kuwait Petroleum Corporation KPC Upstream KOC KGOC KUFPEC Midstream KOTC IM Downstream KNPC KPI PIC KAFCO The national oil company of Kuwait; Operates in Exploration and Production, Refining, Petrochemical and Transportation; Activities concentrated domestically with increasing growth overseas; Overseas expansion mostly through joint ventures and joint operations; Production currently in excess of 3,127,000 million BPD and 120 million SCFD of associated and free gas; Petrochemical business focused on poly-olefins, aromatics and glycols; Turnover – KD 29.085bn (2010/11) Assets – cKD 30 million (2012/13) Capex in fixed assets KD1. 5bn (2010/11) Number of employees – c18338.

[Audio] 2 KPC ERM Journey Treat Risks Assess Risks Communicate & Consult Monitor & Review Establish the Context Identify Risks Analyze Risks Integrate Risks Evaluate Risks Avanon OpRisk Suite OpRisk Reporting Module ( ORM) Loss Tracking Module ( LTM) Self Assessmen t Module ( SAM) Indicator Rating Module ( IRM) Action Tracking Module ( ATM) Quants. ( QTM) Administration Management Module (AMM) Corporate Risk Management Department formed in 2002; essentially an insurance buyer of standard energy policies; Defined an Enterprise Risk Management ( ERM) Strategy in 2005 based upon the principles of COSO and the AZ/ NZS 4360: 2004 Risk Management Guidelines; Implemented first phase of strategy through 2006 and 2007 with following features:-  ERM Policy created;  Subsidiaries implemented policy at subordinate level  ERM Framework and procedures introduced;  Semi qualitative risk matrix and risk register developed;  Integrated processes adapted and deployed;  Early risk quantification of some key risks;  Resource growth and capability building;  ERM Information System from Avanon introduced;  Insurance programs continue to be adapted; In 2009 our ERM maturity was deemed to be comprehensive. ERM 2030 Strategy developed in 2010 with implementation beginning September 2011, aims at placing KPC ERM at the Strategic Maturity level..

[Audio] Maturity Description Commentary Level 5 Strategic Risk management is built into decisionmaking. The organization selectively seizes opportunities because of its special ability to exploit risks. • Focus on value creation and preservation • Institutionalized • Confidence in ability to manage risks based on track record Level 4 Integrated Risks are treated as a portfolio at the enterprise level and are correlated and aggregated across risk types and business units. • Calculation of risk measures that can be aggregated • Risk treatment integrated and costs optimized Level 3 Comprehensive Risk management is enterprise-wide and encompasses all risk types including strategic and operational. • Risks clearly linked to strategic objectives • Defined and documented • Forward looking • Clear accountability Level 2 Fragmented Risk management functions independently within business units. Risk types managed are limited to hazard, financial, and compliance. • Capabilities vary across BUs • No cross-BU coordination • Some expertise within limited number of risk types such as market, credit, or hazard Level 1 Initial/ Ad Hoc Risk management activities are ad hoc. No overarching risk management philosophy or objectives are defined. • Success depends on individuals • People are unaware of risks • Risks managed reactively ERM Capability Maturity Model 2002 2014 2010.

[Audio] Moving towards quantifying risks and using risk-based metrics to take strategic and investment decisions 1 Metrics used in one or more major project / portfolio decisions in recent years; breath of applicability throughout organization varies SOURCE: McKinsey Most financial institutions use RAROC in their investment decisions Natural resources corporations also use risk-based quantitative metrics for appraising their investments, although the actual metrics vary All these metrics are covered by the risk-return quantification methodology ▪ Investment decision ▪ Project prioritization ▪ P10 and P90 of project value ▪ Value at risk (P50-P10) ▪ IRR at risk Example risk-based metrics1 Decisions impacted Company ▪ Prioritization of small projects ▪ IRR at risk ▪ Project approval ▪ Portfolio selection ▪ Cumulative NPV distributions ▪ Prioritization of major mining projects ▪ Full NPV and IRR proba bility distribution curves ▪ Project approval ▪ Portfolio selection ▪ Risk adjusted returns ▪ Net income distributions ▪ Portfolio risk-return assessment vs. risk appetite ▪ Projects prioritization ▪ Expected NPV ( P50) ▪ P10 and P90 of project value.

[Audio] Question 29 – For which strategic decisions is risk management consulting mandatory? The ambition to increase understanding of risk in strategic and investment decisions is in line with what we observe in the industry Total number of responses 7 3 8 7 7 Funding strategy Evaluation of new investments Portfolio decisions Strategic planning including capital allocation Portfolio hedging Comments ▪ "We have people (that report to Risk) in every major business unit to closely support decision making" ▪ "We (risk) are very involved in supporting all key strategic decisions made by the company" 1 Total of individual choices exceeds 10 as respondents were allowed to choose multiple options Selected results of risk management readiness survey of 10 global oil & gas and mining companies1 Risk-return trade-offs are becoming increasingly important as companies focus on value rather than volume and the world is becoming increasingly volatile.

[Audio] 6 Corporations across sectors are taking a hard look at how they manage risk Loss of confidence • "Given recent events, we have lost confidence in our ability to reliably anticipate, assess, and respond to our risks." Discontinuities • "We do not sufficiently understand how our risks are changing, as a result of changes in our environment or in our own strategy." External scrutiny • "We are under increasing pressure to bring our risk management to best-practice levels." Finding balance • "We need a better approach to 'setting the dial' on risk taking, to avoid whipsawing between too bold and too conservative" Efficiency • "Our risk management approach is too complex, bureaucratic, and ineffective. How can we refocus on value?".

[Audio] 7 KPC Vision and mission Vision: To reach leading global position in the oil and gas field through • Being secure and reliable supplier of hydrocarbons • Manage our operations with worldclass HSSE standards • Being highly profitable and performance driven enterprise • Being one integrated company • Being employer of choice • Being positive role model for Kuwait How ERM is supporting achievement of the overall vision of the Kuwaiti Oil Sector • An effective management tool to support better decision making • A much deeper understanding of major risks and how they affect the businesses and Oil Sector's ability to implement the 2030 strategy • Suitable leading risk indicators and a good understanding how to quantify and assess the impact of a range of mitigation options • Ability to evaluate the investment portfolio from a risk adjusted point of view to create increased organisational value both at a KPC level and individual K-co level • The capability within the organisation to conduct risk analysis and provide recommendations We are committed to transform Risk Management as a way to support our 2030 strategy.

[Audio] 8 KPC ERM Objectives: Three key objectives of KPC's risk journey Achieve high certainty that the oil sector will meet the expectations of the State Enable the oil sector to make a more factbased and quantitative assessment of risk vs. return tradeoffs in its activities and projects Ensure the availability of adequate funding to support oil sector capital expenditure.

[Audio] 9 Do you understand your risks (in your current business as well as new businesses)? Can you measure them? Do you have true insight into risks that matter most? Insight and risk transparency 1 Risk appetite statement, and strategy 2 3 Risk-related decisions and managerial processes 5 Integrated Enterprise Risk management Risk culture and performance transformation What is your overall capacity and appetite for risk? Which risks are you advantaged to own? Which should you transfer or mitigate? Are critical business decisions made with a clear view of how they change your company's risk profile? Are structures, systems, controls, and infrastructure in place for you to manage risk across the whole business? Is your governance model robust? Risk Management should be based on an integrated approach with 5 key elements Does your culture reinforce risk management principles? What formal and informal mechanisms support the right mindsets and behaviors? 4 Risk organization and governance.

[Audio] 10 We have a comprehensive list of initiatives in our 2030 risk journey to build our capabilities Insight and risk transparency 1 Risk appetite statement, and strategy 2 3 Risk-related decisions and managerial processes 4 Risk organization and governance 5 Integrated Enterprise Risk management Risk culture and performance transformation • Define appropriate at-riskmeasures across KPC • Aggregate risks across subsidiaries • Quantify KPC Group Risks • Embed ERM in KPC day to day business • Allocate capital according to risk return profile • Appraise projects according to Risk Adjusted Return on Capital • Define risk governance • Develop risk management competency • Achieve Quick-hit enhancements • Build an eminence program • Discuss risk appetite statements • Optimize risk financing.

[Audio] KPC Risk journey aims at enhancing our institutional ability to manage Risk exposure in an integrated fashion Initiatives implemented internally Quick hit enhancements ERM embedded in business Risk governance structure update Optimized risk financing Risk management competency development Eminence building program Initiatives with McKinsey support A Deploy appropriate at-risk measures across KPC B Quantify KPC Group Risks (using measures chosen in A) C Aggregate risks within and across subsidiaries D Deliver quantitative risk appetite and tolerance statements E Perform project appraisal using Risk Adjusted Return on Capital ( RAROC) F Allocate capital based on a risk return profile G H I J L K.

[Audio] 12 Cash Flow at Risk reporting Risk appetite statements 1 2 Capital project risk appraisal Capital allocation based on risk return profile 3 4 We have already developed and deployed tools to drive our transformation.

[Audio] Best practice observations ▪ Aggregated view of risks ( risk taxonomy, risk register, cashflow@risk tools, heat maps and scenario planning) ▪ Model validation process by either external parties or risk corporate department ▪ Risk reporting system is aimed at decision support ▪ Explicit risk appetite statement ▪ Risk appetite statement implications are well understood and agreed ▪ Structured contingency plans to cope with major extreme events ▪ Risk management is at the core of company decision process regarding strategic and operational issues ▪ Board is actively involved in risk management beyond "routine" approval of business plan ▪ Operational control and implementation is done at the executive level ▪ Regular risk culture assessment ▪ Risk KPIs are built into performance evaluations ▪ Awareness programs to highlight progress of risk development/ transformation programs While we have made great progress more needs to be done to meet our aspiration Relative position vs. peers Peer average Peer best practice KPC 2010 KPC Today KPC 2015 KPC 2010 KPC Today KPC 2015 KPC 2010 KPC Today KPC 2015 KPC 2010 KPC Today KPC 2015 KPC 2010 KPC 2015 Note: Based on survey with 10 IOCs from Europe and US during H2 2013 conducted by McKinsey & Co KPC Today Insight and risk transparency 1 Risk appetite and strategy 2 Risk related decisions and managerial processes 3 Risk organization and governance 4 Risk culture and performance transformation 5.

[Audio] 14 Best practice observations ▪ Aggregated view of risks ( risk taxonomy, risk register, cashflow@risk tools, heat maps and scenario planning) ▪ Model validation process by either external parties or risk corporate department ▪ Risk reporting system is aimed at decision support ▪ Explicit risk appetite statement ▪ Risk appetite statement implications are well understood and agreed ▪ Structured contingency plans to cope with major extreme events ▪ Risk management is at the core of company decision process regarding strategic and operational issues ▪ Board is actively involved in risk management beyond "routine" approval of business plan ▪ Operational control and implementation is done at the executive level ▪ Regular risk culture assessment ▪ Risk KPIs are built into performance evaluations ▪ Awareness programs to highlight progress of risk development/ transformation programs While we have made great progress more needs to be done to meet our aspiration Relative position vs. peers Peer average Peer best practice KPC 2010 KPC Today KPC 2015 KPC 2010 KPC Today KPC 2015 KPC 2010 KPC Today KPC 2015 KPC 2010 KPC Today KPC 2015 KPC 2010 KPC 2015 Note: Based on survey with 10 IOCs from Europe and US during H2 2013 conducted by McKinsey KPC Today Insight and risk transparency 1 Risk appetite and strategy 2 Risk related decisions and managerial processes 3 Risk organization and governance 4 Risk culture and performance transformation 5.

[Audio] Risks, Risk Modeling and Metrics. . . Risks, Risk Modeling and Metrics.

[Audio] Risk modeling aims to increase transparency and improve decision making KPMs help measure success of these directives…. KPC's strategic directives (not exhaustive)… Upstream ▪ Increase crude production to 4.0 mmbpd by 2020 ▪ Increase non-assoc. gas prod. capacities to 2.1 Bcsf/ d by 2020 ▪ … Downstream ▪ Grow domestic refining capacity to 1.4 mmbpd (new built) and subsequent 1,6 (tbc) mmbpd ( enhancement of facilities) ▪ Increase refining complexity ( CFP) ▪ … Midstream and others ▪ Human Capital attraction and retention ▪ … Production/ capacity ▪ Free gas production ▪ Proven reserves ▪ … Costs ▪ Cost of risk ▪ R&T spend vs. plan ▪ … HSEE ▪ Fatal cases ▪ Environmental incidents ▪ … Kuwaitization and stake- holders ▪ Percentage of Kuwaitis in KPC ▪ Share of Capex spent locally ▪ … Profitability ▪ Profit margin ▪ ROACE ▪ … ▪ Strategic project risk ▪ Political/ regulatory ▪ Operational/technical ▪ Portfolio/ business risk ▪ Financial risks ( counterparty, liquidity, market) Ability to attain targets on KPMs are influenced by multiple risks.

[Audio] 1 7 17 Cash flow at risk model Model top risk effects via quantitative risk model Price Technical Political ▪ Capex ▪ Production disruption ▪ Tax changes ▪ Nationalization Company-bycompany profiles ▪ Production ▪ Capex ▪ Opex LOX-ZZV233- 20061123- MHDC 13 Working Draft - Last Modified 11/ 24/ 2006 4: 22: 00 AM Industry has a limited set of project growth options. We characterised these with 28 projects covering 75% of industry growth potential Russia non-PSC Norway oil GoM DW Canada oil sand NOC bonusbuyback Mid East GTL Angola DW U.K. oil Nigeria DW Oman oil Mid East LNG Malaysia DW U.K. gas US onshore gas NA Arctic gas Mexico DW Central Africa Oil NOC redevelopment OECD Frontier Exploration Non-OECD Frontier Exploration NA Steam flood Estimated 75% of future hydrocarbon resource types modelled Source: USGS; McKinsey $ 35 0 40 80 120 $ 55 Forward Curve Growth projects/Strategic initiatives Company portfolio Risk assessment Quantitative risk model Project valuation model Risk return portfolio model.

[Audio] Top 10 KPC risks Top risks Strategic project risk ▪ Large project execution risks 3 Portfolio/ business risk ▪ Disruptions in hydrocarbon market due to demand shifts in import countries 4 Financial risk ( Counterparty, Liquidity, Market) ▪ Global crude/ gas price volatility and related country/ credit risk ▪ Refining/ petrochemical margins and related FX risks 5 6 Political/ regulatory risk ▪ External influence on key decisions ▪ War or political instability in the region 1 2 Operational/ technical risk ▪ HSSE and HR risks ▪ Operational risks leading to unplanned shutdowns or other supply chain disruptions ▪ New technologies risks Company reserves 7 8 9 10 3 step approach to arrive at list of top 10 risks for KPC ▪ Evaluate high and very high risks from bottom up KPC risk registry ▪ Compare with risks most important to Oil and Gas industry in top-down review ▪ Map risks against KPC strategic directives.

[Audio] 1 9 The impact of risks will be assessed by five key measures, in line with KPC and K-Companies KPMs Refining capacity Risk measures ▪ Annual crude capacity Financial risk measures ▪ Annual cash flow to both Kuwaiti government and KPC (remaining cash flow share) Gas production ▪ Annual associated and nonassociated gas production Crude capacity ▪ Annual refining capacity Probability distribution variable Stakeholder and KPC cash flow Cash flow for KPC and Subsidiaries ▪ Annual cash flow for next year(s) (operating cash flow) Nonfinancial risk measures Risk measures chosen on the basis of KPC and K-Companies KPMs ▪ For financial KPMs (e.g., ROACE), cash flow identified as main driver of uncertainty ▪ For non-financial KPMs, production and capacity levels identified as most impactful factors.

[Audio] Architecture: 4 modules centralized at KPC and 7 modules maintained at K-Company level 2 0 SOURCE: Team analysis KPC level K-Company level 5 14 … KPI CFAR PIC CFAR KOC CFAR K-companies have option to change shared assumptions for running their own scenarios but the changes will be reflected for other KCompanies only if KPC implement the changes centrally Shared K-company run data 3 KNPC CFAR KGOC CFAR Shared engine Assumptions master 2 4 KPC CFAR model 1.

[Audio] Each K Company has it's own risk model; output measures risks modelled both in deterministic and stochastic cases 2 1 SOURCE: Team analysis; expert interviews; k-company working teams War/political scenario Project delays Oil price Relevant risk factors ▪ All relevant risks modelled for all K Companies ▪ Focused risks modelled in detail for K Companies ▪ Deviation from base case due to each of these risks modelled separately Financial models ▪ All 9 K companies deterministic financial cash flows is modelled ▪ For each of these deterministic, the impact of all relevant risks modelled separately for output … KPI KNPC KOC Model output Financial Non-financial ▪ Cash flow distribution (by each risk type for each K Company) 1 ▪ Varies by K company ▪ For KGOC and KOC – Oil capacity – Gas production ▪ For KNPC – Refining capacity 1 While we calculate cumulative cash flows, we will use discount rate as follows – 0% for next 5 years, 10% for remaining 15 years/there after.

[Audio] The risk-return quantification methodology adds probabilistic metrics on top of the current appraisal and strategic metrics SOURCE: Team analysis ▪ Stress-test expected economic performance of the project ▪ Prioritize and assess magnitude of key risks to focus mitigation actions ▪ Estimate likelihood of project success and the underlying value to the organization Return metrics Time metrics Sensitivity/ Scenarios Value metrics Additional risk-adjusted metrics introduced by the methodology Metrics currently used for program appraisal1 ▪ Expected IRR ▪ RAROC ( Risk adjusted return on capital) ▪ IRR ▪ Profitability index ▪ Expected payback period ▪ Payback period ▪ NPV at risk ( NPVaR) ▪ Probabilities – To breakeven – To meet baseline ▪ Sensitivity of NPV to – CAPEX overrun – Oil price – Project delay ▪ Scenarios ▪ Expected NPV ▪ NPV 1 Using base case assumptions.

[Audio] Key risks identified specific to the project Oil price volatility Capex overrun Project execution delay Availability of feedstock Refining margins volatility Relevance to project ▪ Exposed to oil price volatility as oil is source of feedstock. ▪ Uncertainty in feedstock compositions at this stage results in uncertainty over which configuration will be selected. ▪ Exposed to refining margins volatility as proceeds from product sales are sources of revenues ▪ Exposed to capex overrun and execution delay risk. The labor and equipment part of the capex is correlated with execution delay and the plant part is independent of it. The delay in project execution stretches the capex spend profile. Key parameters SOURCE: Illustrative- interviews with planning team and project team; interviews with SMEs ▪ Most likely overrun of 10%, between 5% to 40[break]% ▪ Average delay of 11 months with a standard delay of 6 months ▪ Average margin volatility of ~ 20% for the various refined products ▪ Crude price volatility of ~ 29% based on historical Brent prices ▪ Based on strategy with delay risk overlaid for each project.

[Audio] 3 interlinked ERM quantitative processes Objectives Example output CFaR model ▪ Provide a risk perspective on the FYP by introducing major risk factors ▪ Identify key risks for KPC and the State ▪ Monitor evolution of risk exposures over time and against tolerance limits ▪ Provide a risk perspective on Program economics (including RAROC, Expected NPV, probability to break even) ▪ Identify key risks on a program ▪ Quantify impact of mitigation actions and support creation of action plans Programlevel riskreturn quantification ▪ Assess the risk return profile of different strategic options for the portfolio ▪ Support selection and definition of strategic directions ▪ Estimate the impact of strategic decisions on the portfolio Portfoliolevel riskreturn quantification.

[Audio] 25 Three challenges to meet our aspiration Build the conviction that risk management improves our performance and cost optimization Enhance risk capabilities throughout the organization Break silos to make people work together which strengthens the organization.

[Audio] 26 We invite you to share and discuss how to overcome these challenges in ERM transformations.

[Audio] By the end of the ERM journey KPC would have achieved Strategic ERM Maturity A much deeper understanding of major risks and how they affect the businesses and Oil sector's ability to implement the 2030 strategy Concrete materials with quantification of the risks improving ability to engage the stakeholders in an informed manner Attention drawn towards the extreme tail risks facing the oil sector Suitable leading risk indicators and a good understanding how to quantify and assess the impact of range of mitigation options Ability to evaluate the investment portfolio from a risk adjusted point of view to create increased organisational value both at a KPC level and individual K-co level The capability within the organisation to conduct risk analysis and provide recommendations An effective management tool to support better decision making.

[Audio] Thank You. . . ä-uuu#.a Kuwait Petroleum Corporation and subsidiaries.