Risk concentrations and ERM programs: some group life companies lag in assessing risks from a terror attack in a small area.

Has the boy who cried "wolf" cried too many times? Have some group life companies settled into complacency on the issue of managing concentrations of risk?

The group life industry has been relatively unscathed by terrorism, despite such high-profile attacks as those in New York and Oklahoma City. For example, the loss of life on 9/11 could have been considerably greater if the attacks had occurred later in the day; group life claims in Oklahoma would have been higher if the building had housed private companies instead of federal employees. Where these attacks have been felt, however, is in the reduced availability and increased cost of catastrophic reinsurance protection.

As a result, many companies continue to self-insure their catastrophic exposures, even though as underwriters we still face challenges in gathering sufficient data to adequately assess concentrations of risk down to the street address level. Although progress has been made, as an industry we still have a long way to go in this area, especially for self-administered business.

Historically, the industry collected risk concentration data to satisfy requests from reinsurers and to support internal risk management efforts. Now, there are even more good reasons to effectively manage this exposure: a company's A.M. Best rating may be at stake. Best raised the bar for companies by requiring additional details on risk management practices as part of the Terrorism Risk Assessment Section of its 2006 Supplemental Rating Questionnaire. The SRQ stresses the importance of tracking concentrations down to the street address level and requires companies with poor exposure tracking to disclose details on their exposure management practices.

Additionally, we have all heard the term enterprise risk management used more frequently around our offices. In fact, most companies have been very deliberate about integrating ERM into every aspect of their operations and business culture. Of course, much of this is the result of highly publicized lapses in business ethics at places such as Enron, WorldCom and others, leading to a whole new regulatory environment (Sarbanes-Oxley, etc.) in which we operate. Many companies (including this writer's) have made ERM a significant factor in rewarding individual performance. The ramifications of a regulatory violation or damage to brand reputation have justifiably been pushed to the fore of corporate behaviors to be avoided, yet a catastrophic group-life loss can be just as significant. Managing our risk concentrations should be a key component of a successful ERM program.

Here are some specific action steps to consider:

* Dedicate staff to gathering and aggregating risk concentration data.

* Make the collection of updated risk concentration data mandatory at every renewal.

* Consider making broker compensation dependent on the collection of risk concentration data.

Let's put this into perspective. Under the banner of enterprise risk management, we should put at least as much effort into protecting our company against a multimillion-dollar "front page" loss as we are expending to secure our laptops against our trusted office mates.

Contributor Eric Swanson is a marketing underwriter for ING Reinsurance in Minneapolis. He can be reached at [e-mail].