NASDAQ OMX Group (NDAQ)

OMX’S RISK MANAGEMENT PROCESS

OMX’s risk management is a business-integrated process that covers both business and support units at various levels in the organization. The methodology applied is partially based on the international ERM-standard (Enterprise Risk Management standard) in accordance with COSO (the Committee of Sponsoring Organizations of the Treadway Commission) with additional methodology for the areas of Security, Insurance and Internal Control. The

19

risk management process is integrated in the operations conducting business activities, such as strategic management and development work, and is directly linked to the company’s business planning and follow-up.

Risk management is a standardized and continuous process which aims to identify, evaluate, manage, control and report significant risks to which OMX may be exposed. Risk management employs different forms of preventative measures and strategies, such as risk prevention, damage limitation and risk financing, in order to safeguard the Group’s objectives and the majority of goals set at business area and operational levels.

OMX’s risk management not only includes risks in the day-to-day business operations but also risks arising in conjunction with forward-looking strategic investments in order to optimize the company’s business opportunities.

Risk management including control activities is decentralized to each business area and support function. As a result, all business areas, support functions and Group staff functions work with the management of financial, operational and strategic risks. Risks are divided into short-term and long-term risks.

The operations report identified and assessed risks periodically to GRMC, which presents consolidated risk reports to the Risk Steering Group. The CEO reports on consolidated risks in OMX to the Board.

(ii) OMX’s risk management process

OMX’s risk management is a business-integrated process that covers both business and support units at various levels in the organization. The methodology applied is partially based on the international ERM-standard (Enterprise Risk Management standard) in accordance with COSO (the Committee of Sponsoring Organizations of the Treadway Commission) with additional methodology for the areas of Security, Insurance and Internal

13

Control. The risk management process is integrated in the operations conducting business activities, such as strategic management and development work, and is directly linked to the company’s business planning and follow-up.

Risk management is a standardized and continuous process which aims to identify, evaluate, manage, control and report significant risks to which OMX may be exposed. Risk management employs different forms of preventative measures and strategies, such as risk prevention, damage limitation and risk financing, in order to safeguard the Group’s objectives and the majority of goals set at business area and operational levels.

OMX’s risk management not only includes risks in the day-to-day business operations but also risks arising in conjunction with forward-looking strategic investments in order to optimize the company’s business opportunities.

Risk management including control activities is decentralized to each business area and support function. As a result, all business areas, support functions and Group staff functions work with the management of financial, operational and strategic risks. Risks are divided into short-term and long-term risks.

The business areas and central support functions periodically report on risks to GRMC which presents consolidated risk reports to the Risk Steering Group. The CEO is the Chairman of the Risk Steering Group and periodically reports on risks in OMX to the OMX Board.

OMX’S RISK MANAGEMENT PROCESS

OMX’s risk management is a business-integrated process that covers both business and support units at various levels in the organization. The methodology applied is partially based on the international ERM-standard (Enterprise Risk Management standard) in accordance with COSO (the Committee of Sponsoring Organizations of the Treadway Commission) with additional methodology for the areas of Security, Insurance and Internal Control. The

19

risk management process is integrated in the operations conducting business activities, such as strategic management and development work, and is directly linked to the company’s business planning and follow-up.

Risk management is a standardized and continuous process which aims to identify, evaluate, manage, control and report significant risks to which OMX may be exposed. Risk management employs different forms of preventative measures and strategies, such as risk prevention, damage limitation and risk financing, in order to safeguard the Group’s objectives and the majority of goals set at business area and operational levels.

OMX’s risk management not only includes risks in the day-to-day business operations but also risks arising in conjunction with forward-looking strategic investments in order to optimize the company’s business opportunities.

Risk management including control activities is decentralized to each business area and support function. As a result, all business areas, support functions and Group staff functions work with the management of financial, operational and strategic risks. Risks are divided into short-term and long-term risks.

The operations report identified and assessed risks periodically to GRMC, which presents consolidated risk reports to the Risk Steering Group. The CEO reports on consolidated risks in OMX to the Board.

(ii) OMX’s risk management process

OMX’s risk management is a business-integrated process that covers both business and support units at various levels in the organization. The methodology applied is partially based on the international ERM-standard (Enterprise Risk Management standard) in accordance with COSO (the Committee of Sponsoring Organizations of the Treadway Commission) with additional methodology for the areas of Security, Insurance and Internal

13

Control. The risk management process is integrated in the operations conducting business activities, such as strategic management and development work, and is directly linked to the company’s business planning and follow-up.

Risk management is a standardized and continuous process which aims to identify, evaluate, manage, control and report significant risks to which OMX may be exposed. Risk management employs different forms of preventative measures and strategies, such as risk prevention, damage limitation and risk financing, in order to safeguard the Group’s objectives and the majority of goals set at business area and operational levels.

OMX’s risk management not only includes risks in the day-to-day business operations but also risks arising in conjunction with forward-looking strategic investments in order to optimize the company’s business opportunities.

Risk management including control activities is decentralized to each business area and support function. As a result, all business areas, support functions and Group staff functions work with the management of financial, operational and strategic risks. Risks are divided into short-term and long-term risks.

The business areas and central support functions periodically report on risks to GRMC which presents consolidated risk reports to the Risk Steering Group. The CEO is the Chairman of the Risk Steering Group and periodically reports on risks in OMX to the OMX Board.

(ii) OMX’s risk management process

OMX’s risk management is a business-integrated process that covers both business and support units at various levels in the organization. The methodology applied is partially based on the

F-25

international ERM-standard (Enterprise Risk Management standard) in accordance with COSO (the Committee of Sponsoring Organizations of the Treadway Commission) with additional methodology for the areas of Security, Insurance and Internal Control. The risk management process is integrated in the operations conducting business activities, such as strategic management and development work, and is directly linked to the company’s business planning and follow-up.

Risk management is a standardized and continuous process which aims to identify, evaluate, manage, control and report significant risks to which OMX may be exposed. Risk management employs different forms of preventative measures and strategies, such as risk prevention, damage limitation and risk financing, in order to safeguard the Group’s objectives and the majority of goals set at business area and operational levels.

OMX’s risk management not only includes risks in the day-to-day business operations but also risks arising in conjunction with forward-looking strategic investments in order to optimize the company’s business opportunities.

Risk management including control activities is decentralized to each business area and support function. As a result, all business areas, support functions and Group staff functions work with the management of financial, operational and strategic risks. Risks are divided into short-term and long-term risks.

The business areas and central support functions periodically report on risks to GRMC which presents consolidated risk reports to the Risk Steering Group. The CEO is the Chairman of the Risk Steering Group and periodically reports on risks in OMX to the OMX Board.