Risky business.

What do you get when you combine strategic planning with risk management? A new way to maximize risk capital.

More and more successful companies share a secret: risk management. And many financial executives charged with managing corporate risks do so using a new paradigm: enterprise risk management.

This system analyzes and manages an enterprise's risks within a consistent, comprehensive framework. It's comprehensive in that a company's diverse risk exposures - operational, hazard, financial and strategic - are considered from an enterprise-wide perspective that also looks at potential interrelationships.

It's consistent in that all risks - regardless of the type or the business unit handling it - are assessed in light of the enterprise's overall risk retention and capital allocation policies. Most important, the enterprise risk management approach yields new insights into the uncertainty a company faces, and new solutions for better utilizing its scarce capital and risk retention capacity to improve financial performance.

Towers of Babel 

Traditionally, companies have managed risk by discipline, or "silo." This works when risks can be parsed into distinct areas. But viewing different classes of risk as discrete and unrelated is no longer effective or prudent. And adopting a new vision of enterprise risk management requires overcoming the institutional reality that different views of risk are found at various organizational levels.

Boards of directors and top corporate officers often are most focused on identifying critical events that could blindside the company, and how risk management tools will mitigate them. Controllers and treasurers are often concerned with whether they should retain or transfer risk, and how to do so in the most cost-efficient manner. And while their roles are evolving, traditional risk management executives historically have been most closely involved in the insurance-buying decision and management of operational and hazard risk.

In addition, each risk management silo speaks a different language. To a treasurer, "risk management" most likely means managing the risk exposures of the corporation's assets and liabilities or hedging foreign exchange or commodity price exposures. It means something quite different on the hazard insurance side.

Today, these differences are less pronounced as insurance and financial markets converge and as firms recognize the need for more fully coordinated approaches to risk. Indeed, at a growing number of companies, the "chief risk officer" has assumed this coordinating role and drives enterprise risk management approaches. A chief risk officer, who often has a finance background, is key to ensuring that all risks are evaluated and properly addressed under a consistent analytical framework.

Enterprise risk management fosters the breakdown of outdated silos and provides a mechanism to assume risk prudently, maximize profitability and enhance shareholder value. By accounting for all facets of a company's operations, enterprise risk management can yield innovative risk-financing structures that enable significant cost savings.

Notably, by combining unrelated risks (certain hazard risks and financial risks, for example) in a single program, companies can take advantage of the low covariance among them. The combined risk package may be attractive to underwriters and lead to a reduced overall risk transfer cost.

Another way enterprise risk management helps firms achieve their objectives is through the recognition that a firm can retain a finite amount of risk. Thus, the amount of risk retention is a scarce commodity, like cash capital, that must be optimally utilized. More firms recognize this economic reality and seek to allocate their scarce risk retention capacity to areas where it can yield the greatest possible return.

It's virtually impossible for a firm to effectively use its risk retention capacity when that capacity is fragmented, spread thin and managed on a decentralized basis according to widely different protocols. However, when all of a firm's risk retention is coordinated under one function, and the same set of rigorous models and policies is applied across all risks, it frequently discovers it has significantly more risk retention capacity than it originally believed.

Enterprise risk management involves a comprehensive risk analysis that, by itself, can lead to a more strategic overall approach. For example, executives from all areas may learn how risk retention decisions are made both in their units and elsewhere. The development of consistent approaches to risks that may have been handled differently by various business units may follow - and may yield cost efficiencies.

Better Yardsticks

New analytical tools and methodologies enable firms to manage risk on an enterprise-wide basis. These range from techniques as prosaic as cross-company interviews to establish a baseline for the understanding of risk and risk management practices throughout the firm, to complex Monte Carlo simulation models that provide rigorous quantitative analysis of the exposure resulting from virtually any type of single or combination risk.

The development of a risk map - one sheet of paper that provides comparative evaluation of all operational, financial, hazard and strategic risks facing the firm - is deceptively simple. By comparing risks on a single matrix of severity and frequency, senior managers can, often for the first time, see a complete picture of all the risks facing the company and their interrelationship.

Surprising conclusions often result. For example, some firms have determined they've done an excellent job evaluating infrequent risks that, if they do occur, have a nonmaterial impact but a poor job managing or transferring those risks that, should they occur, could bankrupt the firm!

Another illuminating conclusion may be the lack of consistency on a relative exposure basis in handling different types of risk. For example, why will a company choose to bear little or no currency exposure, but decide to retain $50 million worth of liability for a product liability suit?

Provocative Questions

Determining and quantifying their financial impact on a company's income statement and balance sheet is the next, very important, step in the process.

Models to evaluate the likelihood and effects of natural perils, such as earthquakes or hurricanes, are becoming more reliable and, as a result, more prevalent. More generally, Monte Carlo simulation permits companies to evaluate a range of "what if" scenarios to determine the impact of a series of losses on financial performance.

Companies frequently use simulation to measure their financial risk exposure - their so-called "value at risk" - to underlying factors such as exchange rates, interest rates or commodity prices, and then consistently aggregate these exposures across risk factors, business units and geographic business location. The result is a measure of overall risk exposure that consistently and comprehensively aggregates individual risks into a single, enterprise-wide exposure. This analysis can combine financial and hazard risks in a single loss distribution and exposure estimate. And the process often involves asking provocative questions, including:

* What's the single greatest risk facing a company, and what's being done to protect against it?

* What will the company look like after a catastrophic event, such as a major natural disaster, financial shock or operational failure?

* After a catastrophic event, will the company be materially different from a financial or operational perspective? How will this affect investment decisions and capital structure?

* Will a shock to the firm's cash flows cause it to curtail profitable investments, or are alternative sources of funds in place as a result of its risk management strategy?

* How are the various risks facing the firm correlated with one another, and what's being done to exploit these correlations or their lack?

* What are the firm's key financial variables, and how do they influence risk management strategies and practices?

* How do outside analysts perceive the company's risk retention and risk management strategies? Will alterations improve analysts' views of the company's shareholder value?

Another measure compares the company's risk mitigation and retention initiatives to international best practices. Increasingly, financial executives want to know how their companies stack up against others in the same industries or against those with similar business practices. But finding an appropriate benchmark isn't always easy. Some companies define peers differently for these analyses, looking instead at firms with similar financial structure or strategic vision and corporate objectives. While benchmarking should not be viewed as the definitive evaluation tool, it's useful.

And while rigorous quantitative analysis is important, it can never replace the hands-on, human evaluation of risk and risk management processes. For example, risk audits involving site inspections and interviews are vital to an enterprise risk management approach. Such direct evaluations help determine whether risk management practice follows corporate policies and procedures. In addition, there are both positives and negatives you can discover only by going into the field.

Weather or Not

After evaluating a company's risk position, you've got to do something. Often, this means transferring risk through the insurance or financial marketplace. And new tools born of the convergence of insurance and banking can help mitigate and finance increased risk assumption.

Insurance companies now deal in swaps and other derivatives and combine foreign exchange, commodity and interest rate hedges in their property and casualty policies. Investment bankers are designing and underwriting bonds (a.k.a. "cat bonds"), whose performance is linked to whether a catastrophic event occurs, thereby providing "insurance" to the issuer.

One of the best examples of convergence is weather insurance. More firms recognize their dependence on weather (and few aren't affected somehow). For an electric utility, it may be how warm a winter or cool a summer is. A retailer's quarterly results could hinge on whether it rains or snows on weekends.

The number of institutions capable of offering some type of weather protection is noteworthy. Utilities write it for other utilities or businesses; energy-trading companies write "degree-day" options; investment banks offer weather swaps and options; and insurance companies issue policies against weather or related losses on a stand-alone basis. Thus, a new type of insurance coverage is being provided by three segments of the financial services community - insurance companies, commercial banks and investment banks - as well as non-financial institutions, notably utilities and energy-trading companies.

Insurance and financial markets also converge in the use of insurance to facilitate financing transactions. Many firms now view insurance as "surrogate equity capital." They look to insurance companies to assume specific risks attendant with various projects or securities offerings to allocate risk to the institution capable of providing the best pricing for assuming that risk.

At the same time, insurers recognize they can provide "equity" on a significantly leveraged basis, and seek to enter this new realm to capture additional revenue in what's otherwise a declining premium environment. The beneficiary is the company that recognizes this potential source of finance and is capable of accessing these markets efficiently. Examples include the assumption of political risk for new projects in emerging market countries; the assumption of residual value risk in sales-leaseback transactions; performance risk in building a new facility; and protecting against fluctuation in commodity, interest rate or foreign exchange risk in project finance.

The idea seems simple: Evaluate, analyze and treat risks consistently and comprehensively on an enterprise-wide basis. But only recently have firms seen a need for an enterprise risk management approach.

In addition, the ability of the insurance and financial markets to provide timely and cost-effective solutions for addressing risk will further solidify enterprise risk management as a forward-looking way to manage and allocate risk capital.

Enterprise Risk Management: What's Driving The Trend?

* Increased globalization. Firms competing on a worldwide stage are exposed to risks they never faced before. Countries and markets that didn't exist a few years ago now present unique opportunities and risks.

* New ways of doing business. Just-in-time inventory, sole-source suppliers, worker empowerment and total quality management are some models that dramatically change the way business is conducted. While most lead to major performance improvement, all, without question, provide new and different risk opportunities and threats.

* New technology. Powerful and low-cost communications and computing technologies alter the way companies conduct business. But these developments also bring risks.

* Greater risk assumption. Firms are retaining more risks of all types as part of their daily operations. Virtually all large companies retain more operational and hazard risk as they become more comfortable with their risk-control processes and as insurance markets encourage increased risk retention.

* The need to harness risk capacity to drive greater profits. Today's highly competitive markets increase pressure to retain risk and reduce costs. This can lead to learner and more profitable operations, but it can sometimes have negative consequences. Firms that curtail risk management strategies in a quest to cut costs - or those that ignore prudent risk management policies and permit the use of what were previously risk-hedging instruments for speculative purposes - chance catastrophic losses.

* Government scrutiny and shareholder activism. Auditors are held to an increasingly higher standard to ensure they evaluate all of a firm's risks and business practices. Many countries have even legislated a board-level requirement for monitoring and evaluation systems for proper risk management protocols. The trend toward greater outside scrutiny by auditors, regulators, legislators and shareholders is likely to continue, thereby pressuring boards of directors to more rigorously evaluate risk management policies and procedures.

Martin H. Scherzer is managing director at J&H Marsh & McLennan. Robert Mackay, Ph.D., is vice president of National Economic Research Associates.