Maximizing Risk Dollars

Risk management has gained in recent months a new place in organizational awareness. Events, including the terrorist incidents of 9/11, and significant business failures at Enron and Arthur Anderson, among others, have raised the attention of executive officers and board members on the value of risk management as part of the organizational infrastructure. The Sarbanes-Oxley legislation and new regulations from the securities exchanges in the U.S. require a formal corporate risk assessment as a part of corporate governance. Risk management standards have been adopted in Australia and New Zealand, by the International Standards Organization, and more recently in the U.K., which attempt to define risk management and its related processes. While the standards recognize the need for risk management and attempt to effectively define and establish the scope for risk management, none yet rises to the level of being able to stake the value proposition well.

FRAMEWORK BUILDING

As a beginning point toward meeting the challenge for companies today of determining value, we need to start with a framework (see chart). There is significant benefit to looking at enterprise risk management as such a model. ERM recognizes three fundamental principles which contribute to corporate value:

Risk management influences both positive achievement of corporate opportunity as well as minimizes adverse outcomes;

There are a broad set of factors which converge to influence degrees of risk; and

That any of those factors, either singly or in combination with others, can impact the expected outcome of a business process.

It is worth noting that for many of these, the traditional evaluative tools of operational, insurable, hazard risk taken alone have little real meaning. This approach is a step beyond the traditional risk management approach which has focused on a narrow set of risks with insurance as the primary tool for mitigating the damage from adverse outcome, and it is one which will require a broadening of the risk management professional’s knowledge and skills.

With this opportunity also arises a new challenge for risk management departments to demonstrate their value, and for those to whom risk management reports to be able to evaluate it meaningfully. For many this has been a more difficult question, and one which has too often found answers inside risk financing costs alone.

BACK TO BASICS

The tenets of an effective risk strategy are a means of moving toward the answer to the risk management value question. Firstly, risk management must be effectively associated with corporate strategy. Managers of risk must be strategic thinkers, not simply tactical or logistical. Technical excellence of risk managers is a fundamental expectation, but it is not the ultimate driver of value. At the RIMS Canada Conference last September, risk managers in one session were asked if they had a strategic plan for the risk management department. Approximately, 80% of the participants said “yes”. However, to the follow-up question about whether they were aware of and had integrated those strategic plans with the strategy of the board, only about 10% responded affirmatively. To be an effective support function, risk managers must know their corporate strategy and be integrated within it.

Also, effective risk strategy requires the existence of corporate commitment and support for a formalized structure. The commitment to risk management may be implemented at a management level, however, it must be instituted at the governance and executive levels. Looking at the chart, effective risk strategy operates in a bandwidth in which executive leadership must make decisions based on information that often involves assessment of risks that could affect the desired outcome.

Effective risk management provides for integrity of an organization’s dynamic natural attributes. Like the human genetic code, corporate DNA fails with significant damage to any element. The value of risk management lies in its ability to determine what elements are faced with risk, assess the degree of risk, report that risk to appropriate business unit and corporate decision makers so that the organization is prepared for outcomes other than those desired.

Risk management requires a defined focus of responsibility. While each aspect of a corporation’s activities can be individually managed, risk management must be placed in a respected and supported position, integrated within the corporate decision structure so that information is readily available. The risk management team should also have a responsible leader in place as with any critical business function. The function must be able to carve out a respect with leaders at both the corporate and business unit levels as an evaluator of issues and a collaborative developer of solutions.

EFFECTIVE EVALUATION

Risk management engages in active effort to create, maintain, monitor and measure value and performance, including:

Service agreements with providers which focus on service, cost and quality;

Risk assessment and evaluation tools to determine the key risks to the organization;

Risk tolerance measures adopted with the participation of executive and board leadership; and

Risk finance measures that focus on proper targets, including strategic cost of risk, expected cost of risk and actual cost of risk (time adjusted).

This approach to risk strategy requires development of effective evaluation. Where once cost of risk was able to serve as a reportable, albeit often illusory, means of evaluation – illusory because it was a cash flow formula that measured results several years past the decisions that led to a loss and the strategic decision regarding loss financing and because it failed to incorporate the fluctuations of the insurance market cycle – more is required today. The question about getting the most from your risk dollar must now be answered using a combination of elements. There should be a consensus on key risks affecting the organization. They should be developed in collaboration between risk management and other information-assessing and decision-making units and reported to executive and board leadership.

Board and executive leadership must be aware of risks and the steps being undertaken to address them. This may be assigned to audit or risk management committees who are responsible for ensuring that status and progress reports are periodically provided. The risk management function should be valued as a resource by corporate and business unit leadership. One business leader long ago declared he felt that risk management was the place good ideas went to die. This is obviously the opposite of the desired response. Risk management must be seen as a resource that assists effective decision making.

Risk management should consistently operate within agreed parameters for risk tolerance, risk financing (not solely focused on insurance costs), and has an awareness of and utilizes benchmark, best practice, trend, market and industry data for purposes of enabling fact-based decision making.

As discussed earlier, risk management needs to be integrated into and provide support for corporate strategy. This will often be best seen in how well risk financing associates with corporate risk tolerance decisions and the degree to which risk management is able to contribute to corporate direction.

Risk management must engage multiple risk financing strategies. Many new insurance and loss financing strategies today are aimed at smoothing the corporate balance-sheet within acceptable tolerance levels. The risk management function should be able to coordinate with financial institutions, insurance brokers, insurance companies and others to determine effective practices. Risk management must also be consistently able to identify potential actions required and able to develop options for leadership consideration. Routine assessment of status and progress in the management of identified risks and reports to leadership which lead to effective decision making ultimately result in more effe ctive corporate performance. Reaching these heights will not be swift or simple for many organizations. They will need to commit time, personnel, financial and leadership resources to making these steps. However, the rewards stand to far exceed the cost.