Enterprise Risk Management

ERM: A game changer?

Brokers can provide clients with an independent educational perspective

By Michael J. Moody, MBA, ARM

Advances being made by enterprise risk management (ERM) are beginning to appear throughout the entire risk management community. And this is evidence of a much more robust ERM landscape. Unlike the early years, where the majority of interest and adoption was centered within the financial service sector, ERM has now begun to appear in most major industry sectors.

Even a casual review of the major risk publications will reveal that ERM is finally gaining some traction from non-financial service corporations. This involvement, while still in its infancy, should serve notice for those organizations that have failed to see the strategic value associated with ERM.

Significant progress noted

Obviously, there are a number of reasons for this growth, but many believe that a key to its upward rise has been the involvement at a board level. Certainly, setting the right tone at the top is important for any sustained approach, and board involvement is much better than it was just a couple of years ago. However, according to several major studies that have been introduced recently, work still remains in this critical board involvement category.

One of the most widely anticipated studies was recently introduced by APQC, a leading benchmarking and best practice research organization. The study, Managing Risks Across the Enterprise, provides an analysis by leading risk professionals as well as survey results on a number of related topics. Finally, the study also features in-depth case studies from five pioneering organizations on sound ERM strategies and practices. The case study firms include Caterpillar, Marathon Oil, Intuit, the University of California and Novo Nordisk, an EU-based pharmaceutical manufacturer.

The APQC study is a treasure trove of information for anyone who is interested in ERM. The report documents the evolution of ERM from fledgling concept into "a critical, must-have discipline that companies should adopt to protect themselves from major negative events, whether strategy-related, operational or financial in nature." The overall finding is that "risk should be perceived as a set of potential outcomes that can be understood, measured, monitored, mitigated, and ultimately leveraged." Further, the study found that "best-practice ERM programs allow decision-makers to make well-informed decisions about the inherent trade-offs between risks and rewards."

As would be expected, the 97-page study documents that best practice companies "treat the management of major risks as a strategic responsibility, with visible CEO and CFO involvement," regardless of the type of risks. More CEOs and CFOs are seeing that a well-designed ERM program is like a lever that "allows them to compete with confidence."

The survey also noted several other encouraging signs of ERM maturity:

• ERM is a nascent trend, with more than 90% of the participants stating they either have or are building an ERM program to manage strategic risks.

• Seventeen percent of participants reported that they have "greatly integrated" ERM with the strategic planning process.

• Organizations will seek to more tightly integrate the management of risk and enterprise performance by establishing closer linkage between risk management and strategic planning.

Bigger fish to fry

Certainly there is ample evidence that corporate management is on board with the whole concept of ERM; however, what about the board's involvement and oversight? Here, several recent studies would suggest that further work needs to be done. A new study by BDO USA, LLP, indicates that board involvement in ERM lags. Certainly, the board realizes the importance of its responsibilities in this area. For example, "When asked what topics board members would like to spend more time on, the majority (55%) cited risk management more than any other area. However, the active involvement is lacking."

The 2011 BDO Board Survey provided additional insight into the ERM function when it examined the responses of more than 100 corporate directors of public boards. Participants indicated that 47% of the group had chief risk officers (CRO) and that most of them reported to either the CEO (42%) or the CFO (38%) rather than the board.

Further evidence of this lack of critical support comes from independent management consultant Greenwich Associates. Its new study indicates that "directors of many large U.S. companies are still not fully engaged in critical enterprise risk management efforts." While most of the study participants note that ERM has "become a widely accepted concept within their organizations," the majority of participants also note that "their boards of directors have, to this point, failed to provide the leadership in establishing effective ERM practices."

The study, which was reported in the July issue of Greenwich Market Plus, says that less than 20% of the respondents say "their boards of directors fully agree that enterprise risk management is a real strategic imperative for their companies." They note that for the most part, the boards accept the validity of ERM in theory, and thereby are engaged in the issue only at an intellectual level, thus not allowing the board to become actively involved in establishing ERM in the company's day-to-day operational practices. Illustrating this lack of involvement at the board level, the study shows that about 70% of the participants' companies do not have chief risk officers with ERM as a primary focus. Greenwich notes this is quite surprising since the "establishment of a CRO position is one of the first and most important steps in institutionalizing ERM as a core corporate function."

Next steps

It is now apparent that ERM is beginning to make meaningful inroads into the corporate environment. And for the most part, upper management has accepted the concept and is beginning to help advance the profession. But one of the major roadblocks to true integration within the strategic planning process remains the lack of full support of the boards of directors.

Several of the studies have alluded to the fact that this suggests a lack of urgency on this matter on the part of the boards. CROs will need to find a better way to engage and educate the board on the advantages of ERM. Specific educational endeavors will need to be developed and introduced to the board in order to shore up this critical shortcoming.

Another surprising finding was the lack of insurance expertise involved with the ERM programs. For example, the Greenwich study points to this issue as a major failing of some corporate ERM programs. One of the report's recommendations is that the board should take full advantage of their company's own insurance risk professionals. They say this is needed because more than half of the participants say they never meet with the boards of their companies to discuss risk issues.

Greenwich believes that this is an opportunity lost, since most insurance risk professionals have valuable and essential information that should be shared.

Further, the board should also be taking advantage of external industry resources such as insurance brokers and carriers. Brokers and carriers could be invaluable in helping to educate the boards about best practices as well as provide practical advice about how to best manage enterprise risks. As ERM is currently practiced at many organizations, the board must rely on regular reports and briefings from the CFO for information about risk management-related issues. It would appear that the time is right for brokers/carriers to take an even more active part in their insureds' risk management programs. Brokers can provide an independent viewpoint that can be valuable in providing boards with an overview of both the insurance industry as well as risk management-related issues. Brokers/carriers must realize that this role will be provided by someone, and it will either include their involvement or will not. This is not the time to play coy.

Conclusion

While ERM has not been adopted at the corporate board level yet, it has made progress and is gaining support from top management. Certainly providing the board with sufficient information is needed in the short-term to continue the advances ERM has already made. Without adequate support at the board level, regardless of what top management believes, ERM will turn out to be nothing more than a flash in the pan.

Given the current situation with regard to ERM, this would appear to be the ideal opening for brokers to begin to provide value-added services that include the education of corporate boards of directors. Brokers and, for that matter, corporate risk professionals are in jeopardy of missing the boat altogether with regard to ERM. Failure to take action now could result in a return to the days when agents and brokers were simply purveyors of insurance and risk managers were just buyers of insurance, rather than what their name implies. That would be an unfortunate turn of events from which no one would benefit.