ERM: embracing a total risk model; Enterprise risk management (ERM) is fast joining the business lexicon for more and more companies as increasing regulatory, legislative or stock exchange rules demand that senior executives and corporate boards certify their knowledge of current and future risks and the programs in place for managing those risks.

Don't tell Mike Gardner that enterprise risk management (ERM) shouldn't be a major "do-or-die," board-sanctioned effort at corporations worldwide. Vice president of Audit Services at Providence, R.I.-based Textron Corp., Gardner had already structured a major ERM effort at his former employer, Hillebrand Industries Inc. in Indiana. When he subsequently was hired by Textron as Vice President of Internal Audit and it became more interested in ERM, he was asked to evaluate the applicability of ERM for Textron as well. He advises other companies to follow suit--as quickly as possible.

[ILLUSTRATION OMITTED]

Never mind that the evolution of ERM, in both theory and practice, is in its infancy--with nay-sayers who believe there's no need for it, and many senior executives and board members who still believe effective risk management need be nothing more than what it has been traditionally: keeping hazard and financial risks under control.

Never mind, too, that there are plenty of executives who would simply think no more about risk management under any name or title--now that they've dealt with the Section 404 compliance requirements of The Sarbanes-Oxley Act of 2002.

A Global Sprint Toward ERM

Gardner is not alone in his keen interest in ERM. Fueled by new exchange rules, regulatory initiatives around the globe and a bevy of reports that link good corporate governance with effective risk management, attention is turning to ERM. Some are entering the ERM arena reluctantly, while others view it as something of a "second coming"--much like the total quality programs of yesteryear--that will save companies from any number of current and future ills while providing significant competitive advantages along the way.

No hard numbers exist for all industries, but Rick Funston, a managing director at Deloitte, estimates that somewhere between a third and half of the Fortune 500 companies are looking at or have launched ERM initiatives. Not surprisingly, financial services firms have long led the way, and it's not just investment and commercial banks; the insurance industry, too, is widely and increasingly embracing ERM, according to successive annual reports from Tillinghast Towers-Perrin. Abroad, Australian, Canadian and British companies have led the way.

"Already everybody feels safer," says Craig Raymond, who was appointed chief risk officer (CRO) for The Hartford Financial Services Group last October to promote a more holistic approach to managing risk across its three operating units, which include the life side (Hartford Life), Hartford Fire, the property and casualty (P & C) side and the business and investment management company, Hartford Investment Management. At the same time Raymond was hired, the company created new CRO positions for each of those units.

"As we started looking at things from more of an enterprise level, we realized that they needed to be rolled up together," Raymond explains. "In contrast, prior to 9/11, we viewed the life and P & C risks as independent."

Board members are demonstrating interest as well. Says Barbara Colwell, a member of the audit committee at Mutual Trust Life Insurance Co. and on the audit and compensation committees at Publishers Clearing House: "ERM is a good concept, and I think all intelligent risk managers and board members should concern themselves with it."

Why Be Concerned with ERM?

At its most basic, ERM is a means of determining all the risks a company faces, both currently and in the near and long-term future--regardless of whether those exposures have been historically insurable or able to be hedged through the financial markets.

That description may sound too "mid-management" and technical to attract the interest and attention of boards and senior management, but nothing is further from the truth. Companies should and must care about ERM, for a variety of reasons.

First, increasingly, regulatory and legislative requirements, as well as a boatload of rules being issued by stock exchanges globally, require or strongly suggest that corporate boards and senior executives certify publicly that they are aware of all of their current and future risks, and that they have effective programs in place for managing those risks. Indeed, Sarbanes-Oxley asks a variation of this, as do new NYSE rules now coming into effect.

Among the countries pressing companies to "tell all" about their risk management strategies--due either to legislation or exchange rules--are Canada, the United Kingdom, Germany, the Netherlands, Australia and New Zealand. In some cases, requirements have been legislated; in others, like Australia and New Zealand, they are simply recommended.

Requirements aside, corporate executive proponents of ERM cite a number of expected--but by no means guaranteed--benefits. Those benefits derive broadly from a rejection of the traditional backward-looking approach to corporate risk: that it has only a downside that can cost the company hard dollars, its reputation and shareholder value, and that managing risk is limited to protecting physical assets already on the books.

Instead, with ERM, forward-looking companies are focused on the upside as much as the downside of risk. Now, the company is also focused on thinking of risks it may take, both now and in the future, and how to possibly contribute to overall financial performance in positive ways and ultimately add shareholder value. Bottom line, proponents of ERM are driving a sea change in thinking about how corporations manage risk with a positive focus on risk management, rather than a negative one.

Explains Hubert Mueller, a principal at Tillinghast-Towers Perrin in Hartford: "There are always two sides to ERM. One involves the benefits side, where you're creating value by being able to exploit situations. Here, if you can manage a particular risk you can, for instance, bring out new products that others can't because they're not managing the same risk as well. You might, for instance, be exploiting a natural hedge that they're not."

In the second situation, Mueller notes, ERM creates value by avoiding losses. This is, of course, still the biggest area of ERM, "avoiding insolvency risks or earnings volatility, for instance. If you can use ERM to reduce your GAAP (generally accepted accounting principles) volatility, you will have a better standing in the analyst community," he argues.

The upshot of this two-sided approach is evident. Mueller says, "Four or five years ago, companies would blindly follow the competition, if someone did something. Today, through ERM, managers might say, 'Maybe we should explore that, but we shouldn't do it until we have explored the risks.' They'll ask, 'Can we afford it?' or, 'Will it jeopardize the future of the company?'"

Others describe how crucial ERM is in different ways. To John R.S. Fraser, ERM "really boils down to being a process for how a company allocates its resources." As vice president of internal audit and CRO at Hydro One Inc. in Ontario, Fraser established the company's ERM process in late 1999. "I'm talking about things like the dollars and time needed to achieve the organization's agreed-upon business objectives, based on a common understanding of the risks to those objectives," Fraser explains.

For ERM to be effective, companies need to have a systematic way of providing the board with the top 10 risks to the company's business. "Without ERM," Fraser says, "most [boards] do it on an ad hoc or reactive basis. But in the end, you have to ask: 'Do the board, management and staff share a commonly agreed-upon definition and tolerance for risk?'"

Ultimately, proponents say that a properly administered program can help companies better utilize capital and reduce its costs. "People ask how strategic risk management can really add value," says Dr. James Verbrugge, until recently director of the Center for Strategic Risk Management, created about 18 months ago at the Terry School of Business at the University of Georgia in Athens. "What you're really trying to do is organize systems and processes that increase the firm's risk-adjusted return on capital," he says, noting, "That's the hard-core economics of it." Verbrugge also says that successful risk management allows you to have a lower cost of capital, and if you do that, it allows you to add value to the firm. "If you reduce the chance of financial stress, you add value."

[ILLUSTRATION OMITTED]

A laundry list of other benefits may accrue as well. Among them: Creating companies whose component parts work more cohesively; enabling companies to better manage and protect their reputations as they face man-made and natural disasters ranging from product tampering to hurricanes and terrorism; helping companies fend off additional regulatory and legislative assaults on how they run their businesses; and providing a competitive advantage against those who simply manage risks the "old" way.

[ILLUSTRATION OMITTED]

Many proponents also believe that a well-designed ERM program will help corporate executives defend themselves against criminal lawsuits of the sort that have been filed against former Enron, Tyco and WorldCom executives. As such, simply stated, ERM may help board members and senior executives stay out of jail.

"Proposed new U.S. sentencing guidelines that were issued late last year may offer a lot of help to board members and senior executives," suggests Randy Nornes, a managing director at Aon Risk Services, the Chicago-based consulting arm of insurance brokerage Aon Corp. These guidelines propose "that companies be required to conduct a formal risk assessment. If companies do this, their boards and senior executives may be able to defend themselves better in court. Now they can't just ignore this and say, 'I didn't know that this was going on,'" he explains.

Program Construction Problematic

Even with rapidly growing enthusiasm for ERM, issues abound around concerns important to both selling the concept and then shaping an effective program that will be successful long term. Among the issues:

* Making board members aware of what it is, why they need to be involved and how it can benefit the company financially and strategically remains a work in progress. Without effective top-down, ongoing board support, no ERM initiative can be successful, either short- or long-term, particularly if sufficient ongoing resources aren't provided.

* Stressing that ERM is neither a "program du jour" or consultant "flavor of the day." It is, indeed, a long-term investment that needs involvement of board members, executives and employees at all levels. A major potential issue in accomplishing this goal is that in light of Sarbanes-Oxley and other post-Enron developments, companies may likely view ERM as simply another regulation being imposed on them rather than new "ground rules" that, if followed enthusiastically, have the potential to provide global competitive advantage and enhance shareholder value.

* Some board members aren't convinced of the need for ERM, arguing that it is simply a new nom de guerre for what they've always done: run their companies well. "Well-run companies have been doing ERM all along, it just hasn't been called that," says Warren L. Batts. Batts is a retired CEO of Chicago-based Premark International, and now adjunct professor at the University of Chicago Business School who is also a former audit committee chair of Sears, Roebuck & Co., Sprint and Cooper Industries Inc. "Risk management should be imbued throughout the organization, and you don't need a name or a program called 'ERM' to make sure that's happening. The attitude and the culture starts with the CEO, and moves downward throughout the company," he argues.

[ILLUSTRATION OMITTED]

Nevertheless, even board members are being won over to a broader interpretation of ERM and its potential. For instance, board support clearly was important at Hillebrand, Gardner says. There, board member Ray Hillebrand "provided full-blown support and as a result it's up and running fairly well," he reports.

At The Hartford, Raymond says that the directive to create the CRO position and its ERM efforts "came from the office of the chairman, the president and his direct reports." He adds, "It went to the CFO as an initiative to address this year." That chairman-level support will remain crucial, he says.

[ILLUSTRATION OMITTED]

* In some cases, board chairmen have directly initiated a company's ERM efforts. That was the case at the Export Development Bank of Canada (Canada's equivalent of the U.S. Export-Import Bank), says Patrick Lavelle, its chair and a director from 1998 to 2002. "The real spur that got us into ERM was the fact [that] I saw we were a board asked to approve all kinds of transactions and insurance arrangements without having knowledge of the broader impact of those decisions on the corporation," says Lavelle. "This was a process that was totally unacceptable to me, particularly when we were doing large loans to the aerospace and computer industries and our biggest borrowers were companies like Bombardier Inc., which, of course, ran into tremendous financial difficulties."

* Also, companies involved with ERM are struggling to figure out what specific information they need to detail their specific exposures and to provide quantitative data that ERM will provide the financial payoffs that might turn the heads of shareholders, analysts and others.

Says Deloitte's Funston, who is a big ERM proponent: "We are at the same point with ERM as quality was in the 1970s. That is, people from the board on down are saying, 'Show me how quality makes a difference, show me the business case.' As a result of those questions, a lot of studies called 'cost of quality' had to be done. Boards had to be shown the cost of poor quality and the cost of good quality, and now you're seeing demand for the same type of information and data in the ERM arena."

Without those numbers, managers and employees--as well as boards--may not invest in the ERM process, thus, setting it up for failure. Referring to the quality movement, Funston notes, "Managers would say, 'My job is production, and now you're asking me to do quality on top of it. Where are the extra resources to go with it?' Of course, it ended up that the costs of poor quality were rework, customer dissatisfaction and higher costs. To deal with that, corporations finally learned that quality had to be built into everyone's job."

* The inability to provide specific possible savings or enhanced financial results--given the infancy of ERM--troubles some executives and board members, but doesn't bother those with programs already in the works.

"The argument that you can't offer specific financial numbers on ERM regarding cost improvements or improved financial results as a reason for not getting involved in ERM is nonsense," says Textron's Gardner. "Any astute person will say that companies face risks and that you're better positioned to manage and benefit from effective ERM, regardless of whether you can provide specific quantification."

* The recently issued framework for ERM by the London-based Treadway Commission's Committee of Sponsoring Organizations (COSO). There is no requirement to use the framework, but it carries weight because it is viewed by some as a major attempt to provide potential "best practices" for ERM.

* Some executives and board members think of ERM solely as a control and accounting issue--understandable, given Sarbanes-Oxley and COSO's new ERM model. That could be dangerous, since ERM covers a broad array of exposures beyond control and accounting issues, and corporate executives and board members may mistakenly think that they're covering all their ERM exposures if they implement the COSO model.

James Lam, president of Waltham, Mass.-based James Lam and Associates, a risk management consulting firm and author of Enterprise Risk Management: From Incentives to Controls, explains: "As a general management framework, COSO is useful in providing a set of standards for ERM, but its bias is more from a governance, compliance and audit perspective, covering things like authorization, documentation and monitoring activities. To that extent to audit committees and senior managers, say, 'Here's a list of standards and recommendations, how are we doing against this checklist?'

But, Lam says, it does not fully represent the full spectrum of ERM activities. "What's missing is coverage of ERM from a business and management perspective--for instance: how do we optimize risk/return tradeoffs, customer management, risk-adjusted pricing and product development? Those types are not fully fleshed out. So from an audit perspective, it might be exactly what they need, but audit is an episodic process--once a year. From a business perspective, you need to be more dynamic."

Many companies implementing ERM programs say they'd like to implement best practices and benchmark themselves both against competitors and companies in other industries. That's difficult to do, since there is presently no agreed-upon definition of what "best practices" means within the same industry or across different industries.

Companies need to benchmark if their ERM programs are going to survive long-term, Lam says. "It's important that you benchmark as a means of helping develop a vision and long-term plan for risk management," he says. "Very often, ERM programs don't work because they don't have these long-term plans. It's often a multi-year practice, but benchmarking allows you to see gaps and gives you an idea of how long it will take to close the gap for the company, how to prioritize and sequence those initiatives."

COSO's framework is ballyhooed as the best stab yet at establishing best-practices standards, but it falls short of what's needed. Deloitte's Funston calls COSO "a big step forward ... but the model is flawed, in some ways fatally. But it does give us our first lexicon."

He notes that there is "a tremendous interest in the market in finding out what works and what doesn't." The first request he says he gets from a company is wanting to know what other companies are doing, particularly at a point in time. "They don't know what best leading practices are now, and what kinds of presentations their boards need to have," he argues. "How do you assess the risks? What are the icebergs versus the ice cubes? The information simply isn't there," Funston comments.

"Sometimes I struggle with what is meant by 'best practices.' I am currently spending a lot of time networking with my peers about what best practices might be," says The Hartford's Raymond. "I'm not just interested in what's most commonly done, but what will make this an effective, impactful role. So I'm in the process of formulating an approach and what we want to do with this role."

Act ... Sooner, Not Later

Whatever the challenges of implementing an ERM program, it's clear that corporate boards and executive management need to address the issues now. A key reason: It's not just the NYSE and other regulators who will be looking at how well they manage risk.

"There are so many parties that will be keeping an eye on what companies do in the ERM area," says Mueller. "In some cases, the board itself will ask senior management challenging questions. And, if it's not the board, it will be external groups--like the ratings agencies and analysts. In the end, the ratings agencies will be all over them if they don't have a good ERM in place."

The good news: companies don't have to be on the defensive. If they're proactive now, they can turn the tables. Mueller points to The Hartford as an example. "They have a very good ERM process all the way up to the CEO, who can answer any analyst's question about risk management, and people have noticed," he says. "In their case, the agencies have taken parts of their ERM process and made that the industry standard."

The agencies took note of The Hartford's risk program for variable annuities. "They had a good program for hedging the downside of risk of their variable annuities program," Mueller explains. "They sat the analysts down, explained what they were doing, and the analysts turned around and said, 'Now we understand what a good company does.' So now, everyone else is trying to catch up with them."

RELATED ARTICLE: Hallmarks of Best-Practice ERM

1. Engaged senior management and board of directors that set "the tone from the top" and provide organizational support and resources.

2. Independent ERM function under the leadership of a chief risk officer (CRO), who reports directly to the CEO with a dotted line to the board.

3. Top-down governance structure with risk committees at the management and board levels, reinforced by internal and external audit.

4. Established ERM framework that incorporates all of the company's key risks: strategic risk, business risk, operational risk, market risk and credit risk.

5. A risk-aware culture fostered by a common language, training and education, as well as risk-adjusted measures of success and incentives.

6. Written policies with specific risk limits and business boundaries, which collectively represents the risk appetite of the company.

7. An ERM dashboard technology and reporting capability that integrates key quantitative risk metrics and qualitative risk assessments.

8. Robust risk analytics to measure risk concentrations and interdependencies, such as scenario and simulation models.

9. Integration of ERM in strategic planning, business processes and performance measurement.

10. Optimization of the company's risk-adjusted profitability via risk-based product pricing, capital management and risk-transfer strategies.

Source: James Lam & Associates Inc.

Lawrence Richter Quinn ([e-mail]) is a Washington, D.C.-based freelance writer who writes on business and financial subjects.