Microscope or binoculars: traditional risk managers are being divided into those who focus on insurance and those who oversee a company's entire risk, even risks for which insurance isn't available. (Cover Story: Risk Management).

As the definition of risk has evolved to include problems that can't be solved by simply purchasing insurance, the role of risk manager also has evolved in some cases into a position with more authority and influence in many corporations.

Companies have responded to new corporate governance requirements and market changes by expanding the definition of risk beyond property and liability risk to include anything that could hamper a company's future growth or performance. Many companies have tapped a leader, often called chief risk officer, to handle their enterprise risk. While insurance remains a key component of enterprise risk, most companies with a CRO have not promoted their traditional risk manager to fill the position, but rather, have looked to those with financial or accounting backgrounds to fill the role.

While some traditional risk managers will ascend to these new higher-profile positions, others will continue to be viewed as the insurance specialists who will report to the new CRO. The result is two levels of risk managers: those who will be responsible for all of a company's risks and those who will handle just the risks that insurance can cover.

To become a CRO, risk managers will have to show they are savvy in areas other than traditional insurance. They'll also have to be excellent communicators. But both traditional risk managers and those who become CROs will continue to play key roles in the current hard market, experts said.

Taking the Helm

Several years ago, if someone called Ellen Vinck's office and asked to speak to the "insurance manager," the person would not have received a call back.

"I changed the name of the department, changed the name in the phone directory. I forced the name--risk management--down everyone's throat," said Vinck, vice president of risk management and benefits for United States Marine Repair. "I would not respond to people if they called me the insurance manager. For years, everyone called it insurance, but that is only part of what we do."

Beyond insisting that the company deal with "risk" not just "insurance," Vinck also lobbied to be included in strategic discussions within the company. Her hard-line approach worked. "Now they come to us for advice to reduce the risk Overall," she said.

Vinck first captured the spotlight at United States Marine Repair, which specializes in repairing large Navy ships, by affecting the company's bottom line. She began by tackling the company's workers' compensation program, which "had a huge impact to the profitability of the company, but everyone considered it just the cost of doing business," Vinck said.

By introducing a formalized return-to-work program and stepping up the company's safety program--including adding incentives for employees when the company met safety goals and instituting an employee-review board where coworkers could take administrative action against employees whose behavior put them all at risk--Vinck was able to reduce the company s workers' comp spending to 1% of annual revenues, down from 3% to 4%. "That got attention at the corporate level," Vinck said.

While Vinck is most proud of the safety program, she said the biggest financial impact the risk management department may have had on the company relates to mergers and acquisitions.

"We've been acquired twice in the last six years, and we have also acquired other companies in the last six years. I was never really happy with the understanding that outside consultants have in respect to risk management. When they go out to evaluate a company for acquisition, they look at revenue and liabilities. The prime role we do is look at potential risk," Vinck said.

In the longshore business, hearing loss is a major concern because workers are exposed to loud noises from metal-working machines. As a result, companies without a strong hearing-loss prevention program could face expensive workers' comp claims, Vinck said. "That could bankrupt a company after you bought it. The risk manager has an acute role to play because only the risk manager knows the business. M&A people understand mergers, but they don't understand shipyards like I do. They don't understand risk; they don't understand problems in the long term," she said.

At first, Vinck hesitated to speak up about the risk exposure she saw in potential mergers. "The first time I did it, I was a little timid. I spoke up on one issue, and one issue only--the one I thought was most important. After I did that, they said, 'We'd like to listen to everything you have to say.' A good risk manager can't be afraid to speak up and push themselves."

In addition to taking a larger role in the company's strategy, United States Marine Repair's risk management department also works much more closely with the finance department than it used to. For instance, when it comes to submitting billing rates for government contracts, the risk management can make or break a deal. Being closer to what's going on in the insurance world, and knowing what claims trends are, can give a company an edge, Vinck said.

"In the past, accounting would try to estimate things, but didn't know what renewal rates were. I remind them that I don't have a crystal ball, but take after Sept. 11th--we knew the property market had gone to hell in a handbasket," Vinck said.

The risk management department now handles all audits, including payroll, and workers' comp--which used to be handled by accounting. "Under longshore workers' comp, you have certain codes based on what someone does. Separating liabilities for government contracts vs. commercial contracts isn't easy--it can be a government entity, but a commercial operation. We saved a lot of money by making sure it's all extremely accurate," she said.

The change in her role since 1984 dramatic, said Vinck, who is also vice president of finance for the Risk and Insurance Management Society Inc. "There's no comparison whatsoever. Our risk management is now at the top level of decision making at the company, where it needs to be. We now have input on contracts. We are involved in strategic decisions. For some risk managers, they complain they don't have enough of a presence, then it's up to them to make that presence and force it."

More on Their Plates

Like Vinck, risk managers used to be mainly concerned with property and liability risks. Now many are dealing with a myriad of risks, said David Mair, an independent consultant who is the former director of risk management for the U.S. Olympic Committee.

"What was historically the operational hazard-based, often insurance-based, perspective of risk management is expanding dynamically into a new model of risk that includes the full range of corporate risk--both opportunity and adversity," said Mair, who also is vice president of international development for RIMS.

Mair breaks down companywide, or enterprise, risk into five main categories:

* Corporate governance--directors and officers coverage as well as new rules being considered by the stock exchanges that may require companies' audit committees and boards to engage in a comprehensive risk evaluation.

* Operations--traditional property and liability risk.

* Finance--balance sheet risks such as currency exchange and interest rate fluctuations.

* Brand and reputation--the hard-to-measure impact on a company should something go awry with a product or service.

* Knowledge and intellectual property--a hard-to-measure risk of protecting a company's intellectual capital.

Those risk managers who ascend to the position of CRO are capable of dealing with all of those risks.

"The biggest issue, or change, for me on a personal level is 18 years ago, you were an insurance buyer. Today you have to be a generalist in business with a speciality in insurance," said Chris Duncan, chief risk officer for Delta Airlines. "It's a very different animal. Today you have to be able to hold your own with issues such as capital markets, attorneys, operations, marketing people, government staffers."

The evolution is not that different from what happened to treasurers, Duncan said. "They used to be mostly cash managers, but now they play an essential role in the economic fabric of a company. They're involved with mergers and acquisitions, and overall Strategy," he said. "For those that manage insurance, perhaps some are losing some prestige. But those that manage risk are being enhanced in terms of value to the company. It depends on the company's culture. Some companies appreciate the value of a solid risk manager, but other companies do not. It doesn't mean either company is right or wrong; it's just a divergency going on."

In some companies, a CRO may be the point person heading up a committee devoted to consider the company's risks. Delta Airlines is one such company to establish that form of committee.

Duncan said as companies move to consider risk throughout the enterprise, they must include leaders of various aspects of the operations. "It's ludicrous to think any one person can have the handle on all of the risk in any one company. We try to work with our business units and leaders to help identify the things that we should be worrying about, then provide a process and spark plugs."

Operational risk isn't necessarily something that can always be controlled by buying insurance, said Mario P. Vitale, chief executive officer of Willis North America, a brokerage. "It's not just what happens to you, but what could go wrong with key clients, key distributors, trucking, and how you need to control, manage and even insure that risk. A lot of that is falling more and more on the risk manager's desk. Today and tomorrow's risk manager has to be a much more sophisticated risk manager than the ones we've seen in the past."

Traditional insurable risk has been expanded to include strategic and political risk, Duncan said. "In the past, the question would have been What is our insurance status?' Now the question is 'What else should we be doing?'"

Risk managers in both the public and private sector have been asking that question. For instance, Wayne Salem, who is in charge of risk management for Niagara County, N.Y., recently attended a county meeting on utility procurement risk.

"Ten years ago, I wouldn't have been invited to the meeting. Now they are calling it 'risk management,"' Salem said. The meeting was held by municipalities, including villages, townships, and school districts, that are looking to stabilize the cost of utilities.

"Buying on a wholesale basis--oil, gas, or electricity--removes the volatility by locking in a certain price window. If the price skyrockets, we'll be locked in at the lower price. We'll also lose money if the price bottoms out, but it maintains budget stability. It's difficult for us to manipulate revenue, and we have many mandates, so we can't cut expenses too much Salem said.

Expanded Traditional Role

Keeping an eye on utility rates isn't something a traditional risk manager might have been concerned with, but it's typical of the types of risks on the plate of CROs. But even traditional risk managers have more to contend with today, experts said.

"Risk managers have a lot more to worry about right now," said Jean Stalcup, senior vice president of Employers Reinsurance Corp. "People didn't even think of terrorism two years ago, but now it is front and center. On top of that, we have a hard market, so even their traditional niche--buying insurance--isn't easy for them."

"The real challenge is that there were too many risk managers who took credit for the soft market in terms of creating an insurance cost savings for their organization. Now that the market is hardening, those risk managers are finding themselves in an environment where they are being held accountable for the increase. I've spoken with some risk consultants who say some of those risk managers are beginning to lose their jobs today because they are viewed as not being very effective in the market," Mair said.

"Communication is the biggest tool," said Joel Hardy, director of risk and insurance for Hudson's Bay Co., a Toronto-based retailer. "If you have not been preparing your senior team for the hit that has happened, most risk managers would have to justify their position today. That comes from poor, poor communications."

Salem noted it's easy for risk managers to get so caught up with their duties that they don't adequately communicate with senior management.

"We are probably our own worst enemies. We tend to be reactive. When the hard market swings, we are reactive in talking to senior management. Sure, I saw it coming and if you'd asked, I'd have told you so, but the CEO doesn't want to hear that now," Salem said.

Also, Salem said a good risk manager "isn't going to win a popularity vote. If you do your job well, you will create, well, maybe not adversity, but you'll be bringing problems to the surface. We don't tend to bring good news to the table. If you've been with a company five or six years, you'll probably have irritated everyone you've worked with, because you make them take another look at what they're doing. But that's part of our process."

Hardy said he sees risk managers continuing to take an important role within companies.

"This is the tip of the iceberg," said Hardy. "Risk managers are going to be in the board rooms and they are going to be senior executives. Every other professional is trying to steal the term risk manager-accountants, attorneys, board members. It would behoove us not to get on the whole issue of who brought risk management to the community. It's the RIMS voice that you will now hear loud and clear."

Even if a risk manager doesn't rise to become a CRO, he or she still plays a vital role in a company, said Christopher Mandel, current RIMS president and assistant vice president of enterprise risk management for USAA.

"What we do has become that much more important," Mandel said. "We're getting more access to the top when we need it. The bar has been raised on expectations, and it is an opportunity for us to be recognized in a way that says for you to be more effective, we're going to push you up the chain."

RELATED ARTICLE: Who Is a Chief Risk Officer?

Chief risk officers are still a fairly new concept, but have gained popularity in the past several years, especially in the energy and financial services sectors.

According to a survey by Tillinghast-Towers Perrin and the Conference Board of Canada, about 45% of companies with CROs to respond to the survey were insurance, banking or financial services. Another 40% were energy or utility companies.

About 50% of the respondents had created the CRO position since 1999. About 48% said they created the position to centralize the coordination of integrated risk-management activities, while 29% said they did so to introduce an integrated risk-management position.

The function of an enterprise risk manager is being elevated in many companies to a CRO, gaining the clout of other "C-level" positions, such as chief executive officer, chief financial officer, and chief information officer. Many times, however, the person being promoted to that position is not the risk manager, said Jerry Miccolis, a principal with consulting firm Tillinghast-Towers Perrin.

"A lot of risk managers are being bypassed. Someone else in the organization, or someone else outside of the company, is being picked. Their backgrounds vary from financial, operations, audit and others, such as in insurance, actuaries. But in most cases, they don't have an insurance background," Miccolis said.

According to studies by Tillinghast, only 13% of insurance companies with CROs promoted a risk manager to the position. Outside of insurance companies, only 11% named their CRO from the ranks of risk manager.

According to Tillinghast's "Enterprise Risk Management in the Insurance Industry: 2002 Benchmarking Survey Report," about 56% of insurance companies with CROs filled the position with someone from an existing internal position. Of those internal promotions, 47% came from the actuarial department and 16% from the finance department. When companies recruited their CROs from outside the company, actuarial was the leading source discipline cited by 33%; followed by banking with 27%; risk management with 13%; and another 27% from a variety of sources including finance and accounting.

Other industries, however, find their CROs in slightly different sources. According to a study the consultant did a year earlier, when noninsurers selected a CRO from an internal source, 21% looked to their audit departments, while 18% drew on finance. Insurers tend to look first to their actuarial departments.

But like noninsurers, the insurance industry joined others in the relatively low use of risk management as the department/discipline to lead enterprise risk management. It makes sense that companies would tap those from other disciplines to take the lead in enterprise risk, Miccolis said.

"The risks that are most important to an organization are survival and value creation. These are nontraditional risks--strategic risks, financial risks, operational risks. By and large, you cannot buy insurance for these risks," Miccolis said.

While companies can employ various financial hedges for strategic risks, there's no standard "off-the-shelf" insurance product to cover them. The key to analyzing these different risks and how they relate to each other is probabilistic modeling, which is not just a tool for the insurance industry.

"They've taken lessons from banking, from the audit profession, from operations and engineering research," Miccolis said. He suggested the new CRO may take authority or power away from the traditional risk manager.

"A C-level executive will typically report to the CEO or in some cases, the CFO. This is a new breed of risk manager, one with broader horizons, a broader set of skills and plays much higher in the organization," Miccolis said.

That's not to say that traditional risk managers won't be considered. "If a chief risk officer career is something of interest to anyone and they have the requisite skills, and a broad enough world view and what you might call 'boardroom presence,' then the opportunity is available to anybody, whether they are a traditional risk manager or not. But a CEO looking to appoint a chief risk officer doesn't automatically look to the traditional risk manager," Miccolis said. "There's still a place for the traditional risk manager and a continued need to manage that silo of risk, but some of them, with CRO ambitions, will step into that role."

According to Tillinghast's survey, 50% of CROs had a master's degree, 20% had a doctorate and 20% had a bachelor's. About 45% of the CROs in the survey report directly to the CEO; 35% report to the CFO and 20% report to someone else in the organization.

When it came to continuing education, the survey found CROs rely on a variety of sources. At the top of the list, with 26% of the survey, was professional associations, followed by 21% for consultants and service providers and 21% also for networking groups. Commercial education vendors captured 15% of the survey, followed by own reading/research with 11% and university-based programs with 6%.

The position of CRO is still evolving. About 53% of the survey respondents said the position is poised for continued growth, while 26% said it would fade into the CFO's responsibility. Just 16% of the respondents thought it would decline, and 5% thought it would stagnate.

[GRAPH OMITTED]

Most Important Training/ Experience and Skills for a CRO

Although survey respondents indicated a chief risk officer needs a
spectrum of business and technical training and experience,
math/quantitative skills and finance skills received the most support.


Math/Quantitative skills  24%
Finance                   22%
Communication             18%
Accounting                15%
Risk Management           13%
Managerial                 8%

Source: Survey results from The conference Board of canada; the
University of Georgia's center for Enterprise Risk Management;
Tillinghast-Towers Perrin.

Note: Table made from pie chart

Risk Brings Opportunity

On the wall of Chris Duncan's office hangs the Chinese symbol for "risk," which is actually a combination of two symbols, "danger" and "opportunity"

"At the heart of each crisis lies great opportunity," said Duncan, chief risk officer for Delta Airlines. "A great blessing lies ahead for the one who knows the opportunity in the crisis. Risk managers tend to focus on the downside of risk--on protecting the company. They may not spend 50% of their time on money-making opportunities of risk, but there is a certain element of taking advantage of risk. You end up being a little more entrepreneurial. The days of a risk manager whose primary job is to say no are gone. Today the answer needs to be yes, but in such a way that the company is not unduly burdened by risk."

Part of finding the opportunity in the risk is turning a risk management department from a cost center into a profit center, said Joel Hardy director of risk management and insurance for the Hudson's Bay Co., a retailer in Canada and owner of Canadian department stores Zeller and the Bay.

Hudson's Bay has two captives, one in Barbados that handles its retail credit-card risk and life insurance and another based in British Columbia, which handles property and casualty. Hudson's Bay has been able to lure some of its vendors into the captive, which has improved the company's insurance coverage while bringing in additional revenue.

"We are very careful when we invite a vendor to use our captive--but we are very careful when we select our vendor anyway. If they agree to use the captive, it's a nice workable partnership," Hardy said. In some cases, an offshore vendor may not have adequate product-liability coverage, which it can purchase through Hudson's Bay's captive.

"It reduces our risk," Hardy said. "Before, we were bare, but now we have some transfer of risk there."

Even risk managers in the public sector have found ways to bring in revenue through risk management. In the case of Niagara County N.Y., Risk Manager Wayne Salem said he realized several years ago that health-care premiums were on the rise and for a county with just 3,000 employees and 2,000 retirees, negotiating favorable rates would be difficult. So the county formed a self-insurance pool, and opened it to their municipalities and nonprofit, private groups. The membership has grown to 22,000 covered lives, and the county earns revenue from the other participants.

"We needed to be able to bundle better services and drive down our costs, and to spread the risk among more participants. Because our rank-and-file employees don't make as much as they would in the private sector, having strong benefits is important," Salem said.

In addition to seeking ways to bring in revenue, managers are looking to save premium dollars and cut expenses, which ultimately fatten the bottom line.

"In the past, a company may have wanted a deductible a low as it could get, with a high limit," said David Mair; former director of risk management for the U.S. Olympic Commit tee and now an independent consultant and vice president of international development for the Risk and Insurance Management Society Inc. "But now we are seeing companies willing to have a higher deductible in return for lower premiums. Companies that understand their level of acceptable risk are certainly focused more. They look at their balance sheet and potential impact on earnings per share and decide where they want their insurance to kick in."

Risk managers also are being asked to weigh in on company decisions that can affect future profitability.

"Strategies run the gamut from growth strategies: Should we get into this market, explore this new distribution channel? To investment strategies: Is this the right allocation of assets? To insurance and reinsurance strategies, including captives: Are we holding too much capital? Should we return more in dividends? Do a share repurchase program? What underlies them is a desire to make the company more efficient and more profitable and have a more stable earnings profit. All of which is value creating, not simply cost savings," said Jerry Miccolis, principal at the consulting firm Tillinghast-Towers Perrin.

There is no reward without risk, and companies need a means to evaluate that balance, Mair said. For instance, a risk manager could team with the research and development wing of a pharmaceutical company and look at the impact of side effects.

"We're applying a risk model to business risk," said Christopher Mandel, current president of RIMS and assistant vice president of enterprise risk management for USAA. "We're looking at new products and services related to risk. We identify if the risk is worth taking. Now that we've considered all the risks, is it a prudent thing to do and will it make us more money?"

An effective risk manager would look not only at the financial impact, but at brand and reputation, Mair said. He cited the Tylenol tampering incident in 1982 as an example of how Johnson & Johnson responded quickly to protect its brand image.

Part of a risk manager's duties may be to create a contingency plan or crisis-response protocol, similar to those many companies developed to deal with a potential crash from the Y2K bug, when many feared older technology would fail as the calendar year turned from 1999 to 2000, Mair said.

"Many risk managers are incorrectly branded in their companies as the guy who buys insurance. While that may have been true, it's the case today that insurance is much more the tool rather than the trade for the successful and effective risk manager," Mair said.