Rewards and risk: simple criteria can identify a corporate culture that focuses on risk as well as return.

According to recent surveys, a majority of financial and nonfinancial corporations have appointed chief risk officers or are considering doing so. While this may be a positive step, the more profound challenge lies in creating a corporate culture that truly embraces awareness, measurement and management of risk. Here are a few simple criteria that indicate how far a corporation has progressed toward this essential goal:

* Rewarding risk-adjusted performance. Does your firm measure and reward financial performance as adjusted for the amount of risk taken to achieve that performance? This is crucial. Bankers' Trust once fired a currency trader who had just made an enormous profit for the firm. His sin was to bet the firm on a single enormous trade. Although the trade was successful--hence the profit--risking the survival of the firm was unacceptable--hence his being fired. Unless risk becomes a component of the corporate reward system, it will be ignored.

* Risk reporting. How many memos, databases, e-mails, reports, spreadsheets and meetings at your firm focus on financial returns--short-term, long-term, relative to competitors, relative to the industry and so on? How many--if any--focus on measuring or managing the risks that the firm is taking? This simple comparison provides a direct measure of whether corporate culture focuses on risk.

* Risk measurement. Does your firm have reports that provide consistent quantitative measures of risk for the firm as a whole as well as for specific functions or lines of business? As every manager knows, measurement matters. Reports that quantify, risk invite questions concerning why risk has changed and whether some responsive action is appropriate. In many insurance firms, risk measurement is addressed by a formula for allocating the firm's capital among different lines of business. In most property/casualty firms, this allocation often is based on the underwriting volatility of different business lines, with little or no attention to potentially important components such as investment risk, the credit risk of receivables and reinsurance recoverables, or loss reserve uncertainty.

* Common risk vocabulary. Do executives--especially senior executives--in your firm use the terms "risk" and "return" to mean the same things? Consider a meeting in which the chief executive officer asks the chief investment officer, the chief actuary and the chief underwriting officer how much risk the investment, reserving and underwriting operations present to the firm as a whole. Would their answers rely on a consistent underlying concept of risk, or would they be incomprehensible to other members of the group? If their replies cannot be consistently compared to one another, what hope is there for sensible comparisons such as the trade-off between taking more or less investment risk and taking more or less underwriting risk?

* Consistent risk-management priorities. If your senior executives were to rank the firm's top five risks, would these be consistent from one year to the next? They should be, unless the firm and its industry are undergoing a sudden transformation. The problem is that, in the absence of quantitative risk measures, risk management priorities become subservient to the press coverage of recent events, which may have little relevance to the longer-term risk management issues facing the firm. Numerous studies show that perceptions of risk often deviate substantially from reality.

* Risk-appropriate incentives. Does your firm avoid creating incentives to ignore risk? This is an especially difficult criterion. I know of one firm that established aggressive revenue growth targets and simultaneously mandated, in a soft market, that every deal must be consistent with a 15% return on equity target, as verified by a spreadsheet analysis. In fact, however, bonuses were based on meeting revenue targets, while the true ROE would not be known for several years in this longer-tailed business. The behavioral results were absolutely predictable: the pricing analysts adjusted their loss picks to meet the ROE criteria. This was by no means a cynical act: they worked hard to find plausible reasons for making these changes. But their cleverness enabled them to persuade themselves that these bonus-maximizing adjustments were indeed justified.

The culture of a firm is established by its senior executives, particularly its CEO. Hiring a chief risk officer is unlikely to change the overall risk of the firm unless the CEO and CRO are together able to transform the firm's culture into one that focuses on both risk and return. This is a key challenge for risk management in the 21st century.

William H. Panning, a Best's Review columnist, is executive vice president at Willis" Re Inc. He can be reached at [e-mail].