Making ERM happen: a few simple rules can empower champions of enterprise risk management to make it happen at their firms.

When I first left academe and entered the business world, I was an intellectual optimist. I believed that good ideas would eventually triumph simply because they were good ideas. Two-plus decades of experience later, I am a lot less naive. Here is what I've learned about making good ideas succeed.

As an example, let's consider enterprise risk management. The core of ERM is a set of concepts, methods and techniques that enables a firm to understand, measure and manage its overall risk so as to maximize the firm's value to shareholders and policyholders. ERM is innovative in three important ways. First, it focuses on risk, in contrast to the typical single-minded focus on return. Second, it focuses on measuring and managing the total risk of the firm. In the past, different types of risk have been measured and managed in separate functional departments that think about risk in entirely different ways and seldom communicate with one another. Third, ERM attempts to maximize shareholder value by making sure that the firm's capital (surplus and reinsurance) is appropriately suited to its overall risk exposure.

My enthusiasm for ERM is no secret. But I know that changing an organization depends at least as much on politics as on intellectual merit. Here are some principles that, in my experience, can help supporters of ERM make it happen:

Make sure that ERM has solid support from the C-Suite: the chief executive officer, chief financial officer, chief investment officer, chief actuary, and the board. Without their support ERM is futile. There is little point in being chief risk officer without the crucial support necessary to do one's job.

Ensure that ERM has adequate resources. Candidate for the position of chief risk officer at a firm with $250 billion in assets: "What kind of staff resources will support this position?" Answer: "We were thinking of a secretary and a part-time actuary." Inadequate resources are one of the most effective ways to kill ERM.

Overcome hidden resistance among middle management. Change can be threatening to people whose career success depends upon organizational skills rather than professional skills: "I've spent years learning how to play the game, work the angles, and tweak the financials here. And now they want to change the rules?"

Make sure that corporate incentives are aligned with ERM. Improper incentives undermine ERM: "In our division we're rewarded for sales volume. And this ERM person is telling us that our product pricing is too low relative to the risk we're supposedly taking? If we don't make sure he's out of here our compensation is going to suffer!"

Don't mistake controls (as in Sarbanes-Oxley) for ERM. "Our auditors tell us that our controls are good, if not superb. So why do we need ERM?"

Changing an organization depends at least as much on politics as on intellectual merit.

Don't let managers substitute experience for analysis. Underwriter: "You're saying we have a 1% chance of losing $100 million? That's ridiculous. We've never had a loss anywhere close to that big in my 20 years here at the firm! Let's face it--our underwriting here is good!" Chief risk officer: "But didn't you have a loss just about that big only a couple of years ago?" Underwriter: "That was strictly a one-off situation, and besides, we fired the guys who were responsible."

Make certain that everyone understands what ERM is all about. ERM is about managing risk and capital, to maximize the value of the firm. It's not about managing returns. But it's hard for managers to give up the historic emphasis on return. CFO: "I told our chief risk officer that we needed three more percentage points of return on surplus this year, and she said that wasn't the goal of ERM. So why bother with ERM if it can't give us what we need?"

Demonstrate the results of ERM--quantitatively, if possible. Skeptic: "Show me that our investment in ERM has been worth it."

Finally, capitalize on compelling external forces that support ERM. Be sure to point out that market leaders are adopting it, that rating agencies are focusing on it, that regulators are discussing it, and that extreme events like Katrina are making executives question whether they truly understand their firm-wide risk exposure and have managed it properly.

In making ERM happen, it is crucial to have a well-placed champion who is enthusiastic about ERM. But making it happen also requires, as these rules suggest, political savvy, an awareness of organizational pitfalls, and the ability to persuade others of its merits.

William H Panning, a Best's Review columnist, is executive vice president at Willis Re Inc. He can be reached at [e-mail].