What your CEO wants to know about managing risk.

A decade ago, the CEO's involvement with a firm's insurance and risk-management program rarely went beyond the risk manager's annual presentation to the board of directors about the directors' and officers' liability coverage. Today, however, insurance and risk-management issues are clearly at the top of the CEO's agenda.

If your CEO calls you into his or her office for an update on your firm's risk-management program and the changing risk environment, be prepared. To help you plan ahead, here are five questions your chief executive might ask - and some suggestions for how you could candidly answer those questions.

THE CEO: What risks could put us out of business?

THE CFO: In the aftermath of huge asbestos, products-liability and derivative exposures, as a business we need to be concerned about the next time bomb that could threaten our existence. We could now face a number of potentially huge risks, including class-action lawsuits, employment practice lawsuits and dramatic reductions in market share from a product recall or natural disaster.

The widely reported Year 2000 problem could expose us to a myriad of lawsuits and huge costs from damages. It may require a costly and complex technical fix as well as a strategy to deal with potentially disastrous legal and financial exposures. Even if we do everything right, our systems can be contaminated by outsiders that aren't 2000-compliant and whose faulty data can cause costly business interruptions.

The widened use of just-in-time inventory systems and tightened interdependencies up and down manufacturing and distribution chains have enlarged operating risks for many businesses. In a large-scale natural disaster, critical alternatives such as computer "hot sites," which are fully equipped data centers available for emergency use, may not be available to all the firms that need them. In a regional disaster, demand for these sites could exceed capacity, so it is important for us to have alternatives tested and ready.

Social responsibility issues also represent an emerging business challenge. For example, "sweatshop" liability laws may imperil overseas production for some companies. Will failure to belong to the "No Sweat" Apparel Industry Partnership Agreement affect our sales, reputation and, ultimately, market share? Organized boycotts are another danger if large consumer groups decide not to buy our products or services.

Regulatory risks also pose potentially devastating problems. Marketplace regulatory changes have had broad effects on the financial services, telecommunications and utilities industries. Regulatory authorities also have affected product roll-outs, notably in the pharmaceutical and automotive industries. And compliance with new regulations poses other challenges. For instance, the plans of the Securities and Exchange Commission and the Environmental Protection Agency to accelerate the pace of environmental restoration could force us to fully recognize cleanup liabilities on our balance sheet.

Some serious risks may not be so obvious or dramatic. At a major financial institution, for example, recruiting, training, motivating and retaining employees is a crucial risk-management challenge. The firm's leadership feels its competitive position ultimately depends on the quality and performance of its employees. Devising strategies to address this issue has proved far more difficult than developing and managing the risk of unauthorized trading or the improper use of derivatives.

THE CEO: How does operating in the global business environment affect our risk profile?

THE CFO: Operating in the global arena can affect our risk profile dramatically. Essentially there are four types of serious risk questions to ponder: financial, operational, political and natural hazards. In emerging countries, these risks are magnified. Take the financial side. Can we take our earnings out of the country, or must our profits remain there instead of being used anywhere in the world, which would benefit our company overall? A large investment bank making a loan in Argentina for a major infrastructure project would want to have currency inconvertibility coverage to make sure it can get loan payments out of the country.

Credit risk is another issue. For example, a manufacturer with growing export sales in an emerging country protected its receivables using credit insurance.

Operational considerations can present all kinds of problems, too. Language and cultural barriers and human-resource questions can be significant. In some countries, there are severe restrictions regarding terminating employees that can result in huge costs for employers. Workers may require extensive occupational and safety training. In many countries, our competitors will aggressively recruit effective local managers, so we must carefully structure our compensation and benefit packages to retain exceptional employees.

Power-generating capacity is an issue in some countries. A plant location may appear to be ideal, but manufacturing equipment moved to the site may not be able to operate on the local electric current. Manufacturers venturing into the former socialist countries may face significant environmental risks. Crime and corrupt business practices also can affect nearly all businesses operating in certain regions.

And, of course, political difficulties are commonplace. If we require products immediately, we could encounter unanticipated legal and border restrictions. We might also confront technology complications should we want to import our products from elsewhere. Confiscation and nationalization of property can happen, especially in nations at war. Kidnappings are another worry.

I know of one corporation that derived approximately 40 percent of its seasonal sales from products manufactured in an emerging country. The country is susceptible to political turmoil, which could shut down production. Ultimately, the company established multiple production sources in different countries.

Finally, there are natural hazards. Earthquakes and floods are common in many areas of the world. So we have to plan construction, transportation and business activities to minimize the damages caused by these phenomena.

THE CEO: What are we doing to cut our cost of risk?

THE CFO: We can start by examining our organization's total cost of risk. This evaluation should encompass traditional insurable and self-insured exposures as well as all the uninsured, unbudgeted, hidden and unforeseen aspects of risk. We cannot overlook indirect costs, including loss of market share, because these may be far more significant than direct costs. In one case, a $300-million fire resulted in a total loss of more than $1 billion from "domino effects," such as business interruption and liability lawsuits.

Computer modeling and other new analytical techniques are being developed to help businesses identify cost drivers and quantify the impact of indirect exposures and unexpected losses on a firm's market capitalization and earnings. These new approaches could provide us a more effective framework for developing risk-containment strategies - reducing, managing or transferring our risk more cost effectively.

We can avoid some risks altogether. For instance, when we are involved in a merger or acquisition, we could specify contractually the amount of risk we will assume. These contracts use hold-harmless agreements and other clauses to limit risk. Because risk could affect an acquisition price, if we are making an acquisition we should carefully examine the target company during the due-diligence process to identify hidden liabilities.

When we cannot avoid risks, we must try to reduce them. Disaster planning and crisis management are simple examples of risk-reduction strategies we can use to protect our brand reputation and market share. This includes identifying potential bottlenecks that may affect production, and developing appropriate strategies to prevent or manage them. Managing communications is critical in a crisis. Misinformation released to the public may seriously compound the effect of a loss.

Even when we reduce our risks significantly, disasters can happen and we have to manage them through business-continuation planning. I understand that one beverage manufacturer, concerned about protecting its market share, has established far-reaching procedures to respond to any incident that might cause public concern about its product. These approaches are essential now in the global economy.

We also can manage exposures through risk transfer and alternate means of financing risk. In addition to commercial insurance, sophisticated self-insurance techniques have evolved, and many corporations use them. Among the new risk-transfer approaches are comprehensive, long-term insurance arrangements developed recently to address a company's specific needs. These arrangements involve integrating self-insurance, profit recapture clauses and special coverage terms - including insurance for currency fluctuation in one case. These are a prime example of how businesses are beginning to tear down the wall that once separated traditionally insurable risks from business and financial risks.

There is also the danger that we will overlook new ways to cut the cost of managing traditional risks. A growing number of corporations are re-examining their cost-containment programs for property, product and occupational liability risks. And they are developing innovative, new techniques to reduce their losses and cut costs. For example, one Fortune 500 company uses employee councils to create a risk-management program that has practically eliminated its workers' compensation losses.

THE CEO: Do we really need insurance?

THE CFO: While insurance is more affordable today and coverages are much broader, we have to view our use of conventional insurance from a strategic perspective. Of course, passing up a relatively inexpensive policy and facing a huge loss that could have been covered might result in shareholder suits or lead to bankruptcy. But inexpensive insurance is not of great value if it does not address our priorities. Therefore, we need to ask ourselves the following questions:

* Does the proposed insurance arrangement represent the most effective response to our corporate needs?

* Is the amount of insurance adequate?

* Can we be reasonably certain our insurance costs will remain constant over time?

* Is the current arrangement cost-effective and easy to administer?

* Are the principal underwriters suitable from a financial and operational standpoint?

Some traditional arrangements do not respond effectively to our overall corporate requirements, so we have to re-evaluate and re-engineer them. Conventional insurance, while competitive in cost, is generally underwritten on a year-to-year basis. A major corporation will typically have more than 10 and perhaps as many as 30 individual insurance policies, each with its own deductible, specialized reporting requirements, and terms and conditions that generally reflect the requirements of the insurer rather than the buyer.

Corporations are re-examining traditional insurance for three reasons. First, each corporate insurance policy has a retention amount. We have to view the total amount of risk retained from a broad perspective, rather than determining it piecemeal, policy by policy. Second, we have to customize the insuring terms to our corporate requirements. Finally, we have to evaluate the risk-management services provided by insurance companies for their true value since these services are reflected in the premium costs.

With all the alternatives to traditional insurance now available, we now can insure many previously "uninsurable" risks - product recalls, product tampering, boycotts, even financial risks such as currency fluctuations.

THE CEO: How can our firm capitalize on the convergence of the insurance and the capital markets?

THE CFO: A number of recent product innovations combine capital-market and insurance expertise and capacity to address unique and difficult problems. For instance, our foreign-exchange translation risk can combine with our standard property-and-casualty perils in a single insurance policy. Also, an insurance company bond can be issued with its return linked to hurricane activities in the United States; a new stock exchange is trading risks valued according to a third-party index; and joint ventures between banks and insurance companies are creating a new generation of insurance and risk financing tools.

All of this activity promises a new era of opportunity for us around the world. We will be able to tap into this combination of financial and human capital to solve problems that previously were either unsolvable or that did not fall clearly into either the insurance or banking arena. During the past 18 months, there has been a surge of activity in the development and implementation of new types of solutions to old problems.

Here are some ways I think we may be able to harness the power of this new convergence of the insurance and financial markets:

* Develop a consistent approach to risk management. Combining financial and operational risks into one program could ensure not only a consistency of treatment, but a single, definitive cap on the amount of risk we retain.

* Cover previously uninsurable exposures. New financial approaches expand the ability of insurers and bankers to assume risks they previously could not retain, or increase the amount of risk-bearing capacity they can devote to certain risks.

* Tailor our solutions to complex problems. Better financial modeling and a greater variety of risk- financing mechanisms allow us to customize programs to meet our precise requirements and comply with complex business and regulatory constraints.

* Take advantage of the increased creativity and cost-effectiveness that greater competition in the marketplace offers us. Since both insurance companies and banks are offering similar risk-financing programs, they are finding innovative ways to partner with each other while at the same time compete for new business.

Mr. Lawrence L. Drake is managing director with J&H Marsh & McLennan, based in New York City. You can reach him at [phone] or via e-mail at Lawrence. [e-mail].