Excellence in Risk Management IV

Excellence in Risk Management IV

May 2007

Turning Risk Into Opportunity

Marsh 2

Agenda

Introduction

Are firms moving toward strategic risk management?

What drives firms to more strategic risk management?

360-degree view: Are risk managers in alignment with the C-suite?

Beyond risk management—turning risk into opportunity

Takeaways

Panel discussion

Marsh 3

Introduction

Marsh 4

Excellence in Risk Management Series

“Excellence in Risk Management I” studied the risk managementpractices of 30 top-performing risk managers in North America (2004).

“Excellence II” examined the characteristics and practices of organizations that are implementing an enterprise-wide risk management program (2005).

“Excellence III” examined the changes occurring in risk management in response to a wide array of new risks (2006).

“Excellence IV” is the latest in the series.

Marsh 5

Excellence III raised interesting questions, which led us to…

The objectives of “Excellence IV”:

Is there a continued trend toward strategic risk management?

Are the views of risk managers aligned with those of the C-suite when it comes to key risks?

Who, within an organization, is the leader of the risk management effort?

Are organizations seizing one of the key benefits of strategic risk management—turning risk into opportunity?

Marsh 6

Excellence in Risk Management IV

A quantitative study

Interviews with 391 RIMS members of mid- to large-size organizations

Interviews with 77 C-suite executives (CEO, CFO, board members, general counsels) of mid- to large-size organizations

Interviews conducted by TNS from February 14 through March 23, 2007

– TNS is one of the world's leading market information companies, with $2 billion in revenues, operating in 56 countries.

– TNS Finance Sector Group is a global leader in providing research-based insight to firms in the financial services industries.

Marsh 7

Who we interviewed

47%53%

Under $1 Billion $1 Billion andOver

Annual Revenues

55%

35%

10%

Service Manufacturing Retail

Industries

Marsh 8

Are firms moving toward strategic risk management?

Marsh 9

Risk Management

Self-assessed level of risk sophistication

TRADITIONAL

• Risk Identification

• Loss Control

• Claims Analysis

• Insurance and Risk-Transfer Methods

TRADITIONAL

• Risk Identification

• Loss Control

• Claims Analysis

• Insurance and Risk-Transfer Methods

PROGRESSIVE

• Alternative Risk Financing

• Business Continuity

• Total Cost of risk

• Education and Communication

PROGRESSIVE

• Alternative Risk Financing

• Business Continuity

• Total Cost of risk

• Education and Communication

TRADITIONAL +

STRATEGIC

• Enterprise-Wide Risk Management

• Indexing of Risk

• Use of Technology

STRATEGIC

• Enterprise-Wide Risk Management

• Indexing of Risk

• Use of Technology

PROGRESSIVE +

TRADITIONAL +

Marsh 10

Overall, few companies consider their risk approach strategic

Q2a. Based on our 2006 risk management study, companies fall into three categories with regard to risk management. How would you categorize your firm's approach to risk management?

51%

34%

15%Strategic

Progressive

Traditional

Marsh 11

Most companies believe they need to take a more strategic approach to risk management

25%

75%

My firm should take a morestrategic approach to risk

management

Agree

Do Not Agree

Agreement With Statement

BASE: Firms that have a traditional or progressive risk management approach Q1b. Please indicate the extent to which you agree or disagree that “My firm should take a more strategic approach to risk.”

Marsh 12

Larger firms are more sophisticated in their management of risk

Q2a. Based on our 2006 risk management study, companies fall into three categories with regard to risk management. How would you categorize your firm's approach to risk management?

In 2006, firms with more than $1 billion revenue were 50% more likely to be strategic than firms under $500 million. In 2007, they were 320% more likely.

50%35% 32%

15%

43%55%

51%

56%

7% 10% 17%29%

Under $500 Million $500 Million to $1 Billion $1 Billion to Under $5 Billion $5 Billion and Over

Traditional Progressive Strategic

Company Size

Marsh 13

What drives firms to more strategic risk management?

Marsh 14

Financial services firms—certainly driven by regulation—are the most likely to characterize themselves as strategic

Industry

21%38% 36% 33% 33% 40% 32%

47%

59% 55% 57% 55% 49%52%

32%

3% 9% 10% 12% 11% 16%

FinancialServices

Construction Health Care Manufacturing Technology Retail Chemicals


Marsh 15

Traditional Strategic

Hazard Risk

Property

General Liability

Auto

Terrorism

Workers Compensation

Operational Risk

Regulatory/Compliance Risk

Technology/E-Risk

Absenteeism/Total Absence Management

Environmental Risk

Employment Practices Liability

Business Continuity/Crisis Management Risks

Intellectual Property

Products Liability

Strategic Risk

Human Capital

Political Risk

Brand/Reputation

Enterprise Risk

Financial Risk

Credit Risk

FX/Commodity Risk

0%

23%

16%

20%

14%

19%

2%

33%

27%

10%

19%

30%

30%

45%

9%

16%

6%

1%

14%

A broader view of risk is associated with strategic risk management

Q4a. Please indicate the level of importance this risk area represents relative to your firm's operations and financial performance.

% Difference in PerceivedImportance of Risk

Marsh 16

Traditional Strategic

Improving management of cross-organizational interrelated risks

Improving communications/articulation on risk taking to shareholders/board

Improving risk-response decision process

Increasing ability to meet corporate strategic goals

Improving corporate governance practices

Increasing management and business-unit accountability

Increasing shareholder value

Minimizing operational disruption

Improving allocation of capital and resources

Improving responsiveness to natural or other disasters (contingency planning)

Leveraging risk as a competitive tool

Reducing earnings volatility

Increasing ability to be more agile and entrepreneurial (to seize opportunities)

Improving earnings per share

Enhancing quality/increasing overall productivity

While all firms acknowledge the benefits of enterprise-wide risk management (ERM), those with a strategic approach to risk management have a greater understanding of the benefits

38%

35%

33%

29%

27%

25%

24%

22%

20%

18%

16%

15%

13%

12%

11%

% Difference in Agreement With ERM Benefits

Q1b. Please indicate the extent to which you agree or disagree that an ERM program contributes to meeting the following objectives.

Marsh 17

The use of ERM has nearly doubled in just one year—those saying they were in the planning stage last year went ahead with implementation

27%

47%

22%

4%

31%24%

35%

10%

No Plans Planning Partially Fully

2006

2007

ERM Implementation

Q1a. To what extent has your firm implemented an ERM program?

Marsh 18

And ratings agencies are starting to push firms to strategic risk management

My firm's senior management knows how much it is willing to lose from all sources of risk over a selected time horizon in order to

achieve its overall long-term financial objectives.

My firm's senior management knows how much it is willing to lose from all sources of risk over a selected time horizon in order to

achieve its overall long-term financial objectives.

My firm's senior management knows where the top exposures are, both in terms of measured risks and unmeasurable uncertainties.

My firm's senior management knows where the top exposures are, both in terms of measured risks and unmeasurable uncertainties.

My firm's senior management understands the company's risk profile and the mitigation strategies being used to manage its major risks.

My firm's senior management understands the company's risk profile and the mitigation strategies being used to manage its major risks.

Marsh 19

Just over half know where the top exposures are


44%

56%

My firm's senior managementknows where the top exposures are,both in terms of measured risks and

unmeasurable uncertainties

Agree

Can't Agree

Marsh 20

And half understand their company’s risk profile


50%

50%

My firm's senior managementunderstands the company's risk

profile and the mitigation strategiesbeing used to manage its major

risks

Agree

Can't Agree

Marsh 21

Only about one-third know how much they are willing to risk


65%

35%

My firm's senior managementknows how much it is willing to lose

from all sources of risk over aselected time horizon in order to

achieve its overall long-termfinancial objectives

Agree

Can't Agree

Marsh 22

Only one-fourth of firms can successfully pass the ratings agencies’ risk challenge

Only 25% agree with all three ratings agency statements

My firm's senior management knows how much it is willing to lose from all sources of risk

over a selected time horizon in order to

achieve its overall long-term financial objectives

My firm's senior management knows

where the top exposures are, both in terms of measured risks and

unmeasurable uncertainties

My firm's senior management

understands the company's risk profile

and the mitigation strategies being used to manage its major risks

Marsh 23

Agreement With All Three Ratings Agency Statements

A strategic approach to risk management helps with ratings agencies

Approach to Risk

11%

25%

57%


Marsh 24

360-degree view: Are risk managers in alignmentwith the C-suite?

Marsh 25

Risk managers are slightly ahead of the C-suite in pushing for strategic risk management


58%66%

C-Suite Risk Managers

My firm should take a more strategic approach to risk management

Marsh 26

The C-suite and risk managers have similar views on the ratings agency challenge statements

Q2d. To what extent do you agree or disagree with the following statements?

58% 55%

39%

56%49%

36%

My firm's seniormanagement knows where

the top exposures are

My firm's seniormanagement understandsthe company's risk profile

My firm's seniormanagement knows how

much it is willing to lose fromall sources of risk

C-Suite

Risk Managers

Agreement With Ratings Agency Statements By Job Title

Marsh 27

Risk ManagersC-Suite

Risk managers place more importance on risk than their C-suite counterparts—especially hazard risks

Q4A. Please indicate the level of importance this risk area represents relative to your firm's operations and financial performance.

% Difference in Importance

Hazard Risk

Property

General Liability

Auto

Terrorism


Operational Risk

Regulatory/Compliance Risk

Technology/E-Risk

Absenteeism/Total Absence Management

Environmental Risk


Business Continuity/Crisis Management Risks


Products Liability

Strategic Risk

Human Capital

Political Risk

Brand/Reputation

Enterprise Risk

Financial Risk

Credit Risk

FX/Commodity Risk

25%

10%

22%

10%

22%

16%

4%

16%

4%

3%

3%

2%

4%

1%

6%

14%

5%

7%

1%

Marsh 28

Brand and regulatory compliance are rated top exposures by both the C-suite and risk managers

Views diverge for human capital and technology risks.

Q4d. What do you feel are the top three exposures in terms of measured risks and unmeasurable uncertainties?

C-Suite Risk Managers

Brand Reputation 1 1

Regulatory Compliance 2 3

Human Capital 3 8

Business Continuity 4 2

Technology/E-Risk 5 7

Property 8 4

Workers Compensation 9 5

Exposure Risks Ranked

Ranked Above 5 (Not Top 5)

Marsh 29

Risk managers and the C-suite are in reasonable alignment on what’s important and what’s well-managed

Q4a. Please indicate the level of importance this risk area represents relative to your firm’s operations and financial performance.Q4b. Please indicate how comfortable you are that this risk is being managed appropriately in terms of the company's exposure to loss.`

Comfort With How Risks Are Handled

C-SUITEC-SUITE

Dis

co

mfo

rt R

isk

is

Be

ing

Ma

na

ge

d

Ap

pro

pri

ate

ly

Risk Importance HIGH IMPORTANCE/LOW DISCOMFORT

LOW IMPORTANCE/HIGH DISCOMFORT

LOW IMPORTANCE/LOW DISCOMFORT

HIGH IMPORTANCE/HIGH DISCOMFORT

0%

25%

50%

25% 35% 45% 55% 65% 75% 85%

Enterprise Risk

Technology/E-Risk

Human Capital

Business Continuity/ Crisis Management

Risks

Brand/ Reputation


Regulatory/ Compliance

Risk

General Liability


Credit Risk

Absenteeism/ Total

Absence Management

FX/Commodity Risk

Terrorism

Political Risk


Property

EnvironmentalRisk

AutoProducts Liability

Marsh 30

The pattern of importance versus discomfort for risk managers in 2007 was nearly identical to that in 2006

Comfort With How Risks Are Handled

RISK MANAGERRISK MANAGER

Dis

co

mfo

rt R

isk

is

Be

ing

Ma

na

ge

d

Ap

pro

pri

ate

ly

Risk Importance HIGH IMPORTANCE/LOW DISCOMFORT

LOW IMPORTANCE/HIGH DISCOMFORT

LOW IMPORTANCE/LOW DISCOMFORT

HIGH IMPORTANCE/HIGH DISCOMFORT

0%

25%

50%

25% 35% 45% 55% 65% 75% 85%

EnterpriseRisk

Technology/E-Risk

Human Capital

Business Continuity/Crisis

Management Risks

Brand/ Reputation


Regulatory/ Compliance Risk

General Liability

Workers CompensationCredit

Risk

Absenteeism/ Total Absence Management

FX/Commodity Risk

Terrorism

Political Risk Intellectual Property

Property

Environmental Risk

AutoProducts Liability

Q4a. Please indicate the level of importance this risk area represents relative to your firm’s operations and financial performance.Q4b. Please indicate how comfortable you are that this risk is being managed appropriately in terms of the company's exposure to loss.`

Marsh 31

While risk managers and the C-suite are generally in alignment, there are differences…

Risk managers think workers compensation is more important, but are also more comfortable with it.

Risk managers are considerably more comfortable with FX/commodity and regulatory/compliance risk.

Enterprise risk is much more important to the C-suite.

Marsh 32

Who’s on first? Everyone sees himself/herself as the risk management leader

Q5c. Which two people take the top leadership roles in determining your organization's overall approach to risk?

CEO CFORisk

Manager

CEO 1 2 2

CFO 2 1 3

Risk Manager 3 3 1

Importance Rank for Risk Leadership by Functional Area

Marsh 33

Beyond risk management—turning risk into opportunity

Marsh 34

A third of companies are actively looking to turn risk into opportunity

66%

34%

My firm's senior management looksfor opportunities to use risk to the

firm's competitive advantage

Agree

Do Not Agree


Marsh 35

Risk-into-opportunity exploration Preliminary work led to 10 state-of-the-art techniques that can turn risk into

opportunity.

We asked if they were being used, if they worked, and if usage would grow.

Minimizing business interruption due to climate change/

catastrophic property loss

Managing people risk by developing a corporate responsibility program

Leveraging technology

Strengthening vendor relationships

Leveraging regulatory compliance to create competitive advantage

Restructuring via acquisitions and divestitures

Creating new risk management products

Use of captives to transfer risk and generate revenue

Accepting risk to increase profit

Altering the company's risk management profile

Marsh 36

Managing people risk

Minimizing business interruption


Leveraging regulatory compliance






Use of captives

Emerging use of risk-into-opportunity techniques

56%

43%

39%

38%

33%

28%

25%

17%

15%

14%

Using Fully/Extensively

Q3a. To what extent are you using this technique at your firm?

Marsh 37










Use of captives


56%

43%

39%

38%

33%

28%

25%

17%

15%

14%


“Redundancy in our warehouse locations was minimized to create a more lean structure. Our risk of not being able to service a given geography due to a catastrophic loss is increased, but we believe our control efforts adequately minimize that particular risk.”

Marsh 38










Use of captives


56%

43%

39%

38%

33%

28%

25%

17%

15%

14%


“Our IT department is very cutting edge when it comes to security, innovation, and responsiveness. Several of our electronics vendors have been so impressed that they’ve asked us to consult to their IT departments.”

Marsh 39










Use of captives


56%

43%

39%

38%

33%

28%

25%

17%

15%

14%

Using Fully/Extensively“The university…is lined with over 1,500 olive trees. Not only were the fallen olives a constant and costly cleanup, but their greasy, slippery residue was the cause of accidents and a lawsuit. Due to the inspiration of the campus groundskeeper, today the olives are picked and pressed into a product that has won gold medal honors at the Los Angeles County Fair.”

Marsh 40

A handful of firms are currently using five or more techniques for turning risk into opportunity

15%

31%

37%

17%

Number of Risk-Into-Opportunity Techniques

Used

More than 5

3-5

1-2

None

Average = 3.1

Marsh 41

Large firms and those who consider themselves to be strategic risk managers are most actively trying to turn risks into opportunities

2.13.0 3.3

4.4

Under $500Million

$500 Millionto $1 Billion

$1 Billion toUnder $5

Billion

$5 Billionand Over

Number of Techniques Fully Implemented or Using Extensively

Company Size

2.3

3.8

5.2


Risk Approach in Companies $1 Billion +

Me

an

Nu

mb

er

of

Te

chn

iqu

es

Usi

ng

Me

an

Nu

mb

er

of

Te

chn

iqu

es

Usi

ng

Marsh 42

35% 34%

C-Suite Risk Manager

Risk managers and the C-suite agree on turning risk into opportunity


My firm's senior management looks for opportunities to use risk to the firm's

competitive advantage

Marsh 43

Two techniques for turning risk into opportunity seem to offer near-term potential

Risk-Into-Opportunity Techniques

25% 28%

62%58%

Leveraging technology Altering the company's risk managementprofile

Using Fully/Extensively Likelihood of Future Use

Q3a. To what extent are you using this technique at your firm?Q3c. How likely are you to increase usage of this technique in the future?

Marsh 44

Takeaways

Marsh 45

Research takeaways

The focus on strategic risk management continues

– Use of enterprise-wide risk management up sharply

Multiple drivers of strategic risk management

– Size and industry matter

– Ratings agencies driving change

Alignment on risk assessment

Disconnect on leadership

Marsh 46

Putting this survey to practical use

Use this survey as a discussion tool with your C-suite to determine alignment in your firm on views of key risks.

Determine whether your C-suite can/cannot answer “Yes” in response to all three ratings agency questions.

– If not, discuss how you can help your C-suite find the answers.

Gain clarity about the C-suite view of your role as the company moves toward more strategic risk management.

Conduct internal discussions to:

– identify ways in which risk is currently being turned into opportunity; and

– get others in your firm to consider new ways of turning risk into opportunity.

Marsh 47

Our Panelists

Laurie J. ChampionVice President, Risk ManagementCoca Cola Enterprises, Inc.

Jackie Hair, ARMCorporate Director, WW Risk ManagementIngram Micro Inc.

Janice OchenkowskiManaging DirectorJones Lang LaSalle

Marsh 48

Appendix

Marsh 49

Opportunities

1. Leveraging regulatory compliance to create competitive advantage.

– Some companies take a strategic approach to compliance by implementing technology to automate internal controls, reporting, and testing and by establishing a centralized repository for this data to lower administrative costs and ensure a higher degree of confidence in the compliance process.

2. Minimizing business interruption due to climate change/catastrophic property loss.

– Some companies have enhanced the reliability of power systems, upgraded fire protection, and increased redundancy in coastal and earthquake-prone areas to mitigate the effects of catastrophes by reducing property damage and business interruption risk. Such efforts will slow the pace of rate increases and allow the company to publicize its ability to continue operating in the face of a disaster.

3. Strengthening vendor relationships.

– Some companies have brought strategic vendors in as full business partners to assure that they understand the future strategy of the company and are operating to optimize risk taking, sharing, and transfer. This may result in a company's having more loyal vendors that will service the company ahead of its competitors in a widespread crisis situation, such as Hurricane Katrina, providing the company with a competitive advantage.

4. Altering the company’s risk management profile.

– Some companies have undertaken efforts to identify areas where risks are over- or under-managed to create a more financially sound organization that will generate confidence with a variety of stakeholders, including employees, investors, and the general public.

5. Managing people risk by developing a corporate responsibility program.

– Some companies view people risk and corporate social responsibility holistically. They are addressing both risks together by developing a corporate responsibility program to mitigate unethical or inappropriate behavior, fraud, or other forms of individual malfeasance. Such programs can have a direct positive effect on business results and company image.

Marsh 50

Opportunities

6. Restructuring via acquisitions and divestitures.

– Some companies use acquisitions and divestitures to improve risk profile and/or eliminate high-risk areas. For example, a manufacturing company used its corporate aircraft fleet to transport passengers for a fee when the fleet was not in use by the company. The cost of its insurance program was much higher than the profits from the transportation operations. The company divested itself of the aircraft operations and began using commercial jets and charters for its own transportation needs. This improved its risk profile, lowered risk-transfer costs, and freed up funds to use on other projects.

7. Creating new risk management products.

– Since a risk is rarely unique to one firm, innovative risk management solutions can result in salable new products. For example, a technology company identified information security as a potential risk, developed a proprietary data protection solution, and then recognized the opportunity to offer data security as a managed service to its clients.

8. Leveraging technology.

– Technology can be used for more than compliance and reporting. Using ERM tools and techniques leads to identification of knowledge needs, implementation of analytic and actuarial frameworks, and better decision-making. This improved access to information and faster decision-making allows the company to be more nimble in responding to changing customer needs.

9. Use of captives to transfer risk and generate revenue.

– The increased use of captives demonstrates their cost-effectiveness in managing risk. Some firms now take this farther, using their captives to accept third-party risk and underwriting it profitability so that the captive becomes a revenue-generating subsidiary.

10. Accepting risk to increase profit.

– With a broader understanding of risk and better tools to evaluate it, some firms are now purposefully increasing risk in order to lower costs or increase revenues. For example, creating a leaner supply chain increases risk, but lowers costs.

Marsh 51

RIMS and Marsh thank you for your ongoing support of the Excellence in Risk Management series

The Risk and Insurance Management Society, Inc. (RIMS) is anot-for-profit organization dedicated to advancing the practice of riskmanagement, a professional discipline that protects physical, financial,and human resources. Founded in 1950, RIMS represents nearly 4,000industrial, service, nonprofit, charitable, and governmental entities.The Society serves more than 10,000 risk management professionals around the world.

Marsh is part of the family of MMC companies, including Kroll, Guy Carpenter, Putnam Investments, Mercer Human Resource Consulting (including Mercer Health & Benefits, Mercer HR Services, Mercer Investment Consulting, and Mercer Global Investments), and Mercer specialty consulting businesses (including Mercer Management Consulting, Mercer Oliver Wyman, Mercer Delta Organizational Consulting, NERA Economic Consulting, and Lippincott Mercer).

Copyright 2007 Marsh Inc. All rights reserved. Compliance # MA7-10168

Excellence in Risk Management IV

Documents

Transcript of Excellence in Risk Management IV