Presentation Title 1 Guiding Principles for Implementing Enterprise Risk Management (ERM) SEAC Conference New Orleans November 15-17, 2006 Hubert Mueller (860) 843-7079 ©Towers Perrin © Towers Perrin 0 IMPLEMENTING ERM ERM raises many implementation challenges for senior executives Stakeholders have challenged senior executives to ask questions with regard to integrated, enterprise-level risk analysis and their decision-making: How can we identify the key and emerging risks that deserve senior management attention? How do we measure and manage operational risks to the same degree as financial risks? How much capital do we need and what return should we get on it? How should we deploy capital to business segments and evaluate their performance? How do we select our growth strategies, given our risk environment? How can we maximize our return on capital, given our risk appetite? How do we best invest our assets, given the structure of our exposures? How much, and on what terms, should we insure and hedge? How should we report our risk management results and communicate with external audiences about our risk management programs? How do we build a risk culture within the organization? How do we coordinate all of this? And how do we get started? © 2006 Towers Perrin 1 Friday, October 20, 2006 Presentation Title 2 IMPLEMENTING ERM Enterprise Risk Management should address key management issues at each stage of the journey from compliance to value creation Internal/External Dimension Companies Need to Manage Risks from Many Interrelated Areas Marketing Economy Legal/social Regulatory/political Competition Insurance People Processes Hazards Other Financial/Operational Dimension ERM Stages Management Issues Compliance and Governance What are my risks? Diagnostics and Analytics What is their impact? Solution Options What can we do about them? Execution How do I take action? © 2006 Towers Perrin 2 IMPLEMENTING ERM Guiding Principles: ERM as a means to add value to an organization 1. ERM serves strategic purpose — not for audit ERM is more than an audit. Risk management optimizes the risk/return relationship not only the avoidance of risk 2. ERM generates economic value Create value by reducing the cost of capital and by increasing profits through better risk-based decision making 3. ERM is focused on managing risks in an integrated manner, as a portfolio of risks Analyze risks in combination to reveal systemic risks and interactions, and explicitly considers the interrelationships and correlations between risks 4. ERM considers both “downside” risks and “upside” opportunities Optimize the risk/return profile of the enterprise 5. ERM is best operationalized by making it part of the normal business process Coordinate with corporate planning and the allocation of capital and resources to fully integrate into the mainstream of business decision-making © 2006 Towers Perrin 3 Friday, October 20, 2006 Presentation Title 3 IMPLEMENTING ERM 1. ERM serves strategic purpose — not for audit All businesses must take risks to earn returns. Risk management should therefore be the optimization of the risk/return relationship and not only the avoidance of risk Audit examines whether specified procedures and processes are being followed. It reduces risk, but does not consider the risk/return tradeoff Audit strategically mitigates risk, however, what to audit and how much time and effort to invest in audit is determined through a risk management process Audit Approach ERM Approach Starts with a checklist of risks Articulates strategy and identifies risks to achieving strategic objectives Defensive: Focuses only on downside risks Considers unexpected upside scenarios; identifies opportunities for risk taking based on relative ability to manage risks vs. competition Analyzes risks in silos Considers interaction of risks to expose areas of concentration and diversification Supports monitoring and reporting Supports decision making 4 © 2006 Towers Perrin IMPLEMENTING ERM “Risk Triage” process filters strategic risks from tactical risks Strategic Risks Corporate Risk Filters Business Unit Organizational Unit Organizational Unit Business Unit Organizational Unit Organizational Unit Tactical Risks © 2006 Towers Perrin 5 Friday, October 20, 2006 Presentation Title 4 IMPLEMENTING ERM 2. ERM generates value: Risk-Capital-Value Framework Value Creation Maximize value by relating a firm’s decisions on the risks it takes to the decisions on the capital it uses to finance its business Return on Risk Portfolio of Enterprise Risks Risk Structure Capital Costs Value Management Capital Adequacy Portfolio of Capital Resources Risk and Capital Management How much capital do I need? What type of capital do I need? Capital Structure Economic Capital © 2006 Towers Perrin 6 IMPLEMENTING ERM 3. ERM is focused on managing risks in an integrated manner, as a portfolio of risks Why manage risks in an integrated manner? Systemic risks − Risks which in isolation are small within each organization, but because of common causes can in the aggregate across the enterprise pose a significant risk Concentration of risk − Separate risk events that have common consequences Correlation of risks − When companies fail, often it is because several related risks occur simultaneously. Important to understand the interactions among risks − The lack of perfect correlation of risks means that the aggregate financial risk is less than the sum of each individual risk — may be overspending on risk management if managing risks independently Exposure of risk − Understand relative exposure across all risks to optimally allocate resources (financial and human) to mitigate risks Use risk analysis to develop risk-adjusted performance of business units — a best practice in the financial services sector © 2006 Towers Perrin 7 Friday, October 20, 2006 Presentation Title 5 IMPLEMENTING ERM Risk identification should capture the “Anatomy of Risk” Benefits of recognizing the anatomy of risk: Illustrates interactions among causal factors and consequences across risks to identify systemic risks and risk concentration Consequence 1 Cause 1 Risk Event 1 Consequence 2 Systemic Risk Cause 2 Consequence 3 Risk Event 2 Consequence 4 Concentration of Risk Cause 3 Consequence 5 Cause 4 Risk Event 3 Consequence 6 © 2006 Towers Perrin 8 IMPLEMENTING ERM 4. ERM considers both downside risks and “upside” opportunities A fundamental objective of ERM is to optimize the risk/return trade-offs The “downside” of each business activity is the risk of financial loss, the “upside” is higher profitability When evaluating options to mitigate the “downside” of risks, need to also consider whether it reduces the “upside” Identify and embrace risks that the company can manage better than competitors An insurance company that believes it can better price auto risk pursues riskier (and more profitable) drivers and even identifies competitors who are offering lower prices Better management of political, foreign exchange and supply chain risks creates a competitive advantage in considering strategy to enter developing countries These are generally core business risks, such as risks directly related to the manufacturing and distribution of core products © 2006 Towers Perrin 9 Friday, October 20, 2006 Presentation Title 6 IMPLEMENTING ERM 5. ERM is best operationalized by making it part of the normal business process, fully integrated into the decision-making activities ERM Analysis Business Plan Insurable risks Assets Assets Liabilities Mortality Current Assets Current Liabilities Property/Casualty Long-Term Liabilities Fixed Assets Human Resources Equity Market risks Impact of RiskManagement Decisions Interest rate Equity markets Foreign exchange Expenses Revenues Costs Operating Income Taxes Other Net Income Other Income Credit risks Operational Risks Begin Business Risks Business interruption Corporate image, brands Economic cycles Cash Flow End Operation Operation Investment Investment Financing Financing 10 © 2006 Towers Perrin IMPLEMENTING ERM Use assessment method that reflects true nature of risks Probability This is what risks look like.. …but the traditional method of assessing risks distorts the picture Likelihood Expected loss High >y% $ Risks Med x% - y% Probability Low < x% Low < $x Expected loss Med $x - $y High >$y Impact $ Simplifies distribution of loss scenarios into a single scenario — which scenario? Probability Underemphasizes real risks: low likelihood of large losses Expected loss © 2006 Towers Perrin $ Likelihood x Impact represents expected loss — not risk 11 Friday, October 20, 2006 Presentation Title 7 IMPLEMENTING ERM Implementing ERM: A 4-stage process at any level of the firm Identify Execute Solve Quantify What are my risks? Who is watching them? How much do they weigh? What is their impact What can we do about them? How do we decide? How do I take action? What value does it create? 12 © 2006 Towers Perrin IMPLEMENTING ERM The ERM Framework links strategy to the organization and processes that drive risk-based decision-making ERM Framework Organization Governance Accountability: Roles and Responsibilities Risk definition Goals and objectives Risk tolerance levels and guidelines Tools Strategy Process Identify Quantify Solve Execute Monitoring and Reporting © 2006 Towers Perrin 13 Friday, October 20, 2006
