ERM: an indispensable tool: enterprise risk management is essential for life insurers seeking to grow shareholder value without taking undue risk.

Life insurers today are operating in a rapidly changing and unpredictable environment. As the competitive environment gets tougher and tougher, stakeholders have become ever more demanding. Shareholders insist on exceptional performance without adding risk to the business. Regulators are scrutinizing insurers' governance processes, the effectiveness of their financial controls, and their ability to manage operational risks. Rating agencies, too, increasingly are probing issues such as the quality of a company's disclosure policies and governance practices.

In the face of these often-irreconcilable demands, enterprise risk management has emerged as an effective way for a company to simultaneously improve its financial performance and manage its risk profile.

The industry's traditional approach is finally giving way to a more effective approach to risk management. The ERM approach is both more comprehensive, in that it addresses all significant risks, and more integrated, in that it recognizes and measures the interactions and correlations between risks, products, geographies and businesses. ERM processes tightly link risk management with capital deployment strategies that both protect and drive value creation for shareholders. These new processes are built on:

* Explicitly defined corporate risk strategies. ERM strategies seek to identify and quantify risks, define the company's risk tolerance, and pursue effective risk mitigation strategies.

* Robust risk infrastructure. Once identified, risks must be measured, controls and mitigation strategies must be put in place, and companies must report on the effectiveness of their risk management strategies.

* Effective oversight. Oversight ensures that companies follow stated policies and that their disclosures to the board and the market provide the transparency that everyone seeks.

Paradoxically, almost all of the industry's energy is focused on financial risks, such as asset/liability management and market, credit, and underwriting risks. These are the risks that the industry knows the best and has managed most effectively in the past. Left largely unaddressed are the most dangerous risks: the nonfinancial strategic, compliance, and operational issues that can destroy a company's reputation overnight.

Clearly, the industry must dedicate more resources and energy to understanding and controlling risks such as sales force practices, including compensation disclosure; product suitability issues; regulatory compliance; and the overall fairness of dealings with customers.

Critical to accomplishing ERM's key objectives is a strong central function to oversee risk measurement and reporting about risk within the organization. This core group, headed by the chief risk officer, assures the comprehensive, consistent measurement of all risks across the organization, including the more qualitative risk and control assessments of operational, business, and compliance risk. This eliminates the silted approaches common today.

The CRO also supports senior management and board assessments of the company's desired risk profile, their setting of risk tolerances, and the adequacy of the company's regulatory compliance. Working with business management, the CRO helps businesses select and implement risk mitigation strategies and embed the use of risk-based information in business functions such as pricing, reserving, the establishment of underwriting guidelines, reinsurance program design, evaluation of merger and acquisition opportunities, and other key business decisions.

The challenging competitive environment in which insurers operate is not going to abate anytime soon. In this climate, ERM is an indispensable tool for establishing an effective control environment, and for supporting informed decision-making to both protect the business and to grow shareholder value. Companies without such a process will be left further and further behind their competitors.

But for ERM frameworks and processes to be effective, the industry needs to move rapidly toward a common approach to quantifying risks so that relative evaluations among companies can be performed. It must deal more effectively with operational, business, and strategic risks--first by identifying critical risks, and then by assessing their potential for loss and the effectiveness of management controls over the business processes that give rise to these exposures.

Perhaps most important, stronger, more formalized governance processes are crucial if insurers are to move beyond the isolated measurement of selected risks to create a risk-aware environment. This, after all, is the ultimate goal, and it will not be achieved without the integration of the risk and control information produced by ERM into the day-to-day decision-making process.

Robert W. Stein, a Best's Review columnist, is chairman of Global Financial Services for Ernst & Young. He may be reached at [e-mail].