What's your number? How an executive's simple question spawned a revolution in thinking about risk.

The insurance industry thrives by getting paid to assume risk. But until recently it has focused far more on its revenues than on quantifying the risks it assumes. Here's the story of a little-known key event that launched the current emphasis on Enterprise Risk Management.

In 1989, Sir Dennis Weatherstone, then chairman of investment banking firm J.P. Morgan & Co. (now JPMorgan Chase & Co.), decided something crucial was missing from the information he routinely received. J.P. Morgan managed its risks in a decentralized fashion, so each trading desk--for equities, corporate bonds, Treasuries, municipal bonds, mortgage-backed securities, foreign exchange, commodities--had corporate-imposed limits on the positions it could take on, and therefore on the losses it could potentially experience.

What was missing, Weatherstone decided, was the answer to a deceptively simple but revolutionary question: How much could J.P. Morgan lose if tomorrow turns out to be a relatively bad day?

What was so great about this question? Several things:

* First, it is remarkably short and clear and anyone could understand it.

* Second, contrary to risk measures such as standard deviation, this question focuses on the potential for loss.

* Third, the question specifies a time horizon--one day--that is appropriate for an investment banking firm that can quickly change its market exposures.

* Fourth, it focuses on the firm or enterprise as a whole.

A crucial point was the exposures of different trading desks are imperfectly correlated, so firmwide risk is less than the sum of the risks being taken at the trading desk level.

Weatherstone's report was called the 4:15 Report, because it was produced by that daily p.m. deadline--early enough to permit transactions that would alter Morgan's risk profile if necessary. The objective was to measure risk at an enterprise level, and to focus on managing that risk: hence, the birth of Enterprise Risk Management.

Today, rating agencies focus on ERM as an indication of the quality of management. (They recognize there are important differences between insurance firms and investment banks, so the way in which risks are measured and managed are necessarily different.) Many firms are tempted to respond by asserting "ERM is what we actually do every day, although we don't call it by that name."

Firms that make that assertion tend to fall into one of two categories. There are a few typically small closely-held firms that focus on very specialized niche businesses. Their managers have their net worth tied up in the firm. They know their business, despite being unable to quantify the risks they are taking. On the other hand, there are firms that are simply in denial. They want to believe they have a handle on risk, but are hard pressed to demonstrate that this is so.

How much risk is your firm taking? Nearly two decades ago Dennis Weatherstone had a specific numerical answer to that question and could explain what it meant. Can you match that? If not, better reconsider how you describe what you do. Numbers aren't everything, but having them sure beats the alternative. What's your number?

William H. Panning, a Best's Review columnist, is executive vice president at Willis Re Inc. He can be reached at [e-mail].