April 18, 2005

Excellence in Risk Management II

A Qualitative Survey of Enterprise Risk Management Programs

What Is ERM?

Respondents shared these definitions with us:

Assessing and addressing risk from all sources.

A process to manage all risks of the enterprise.

Managing your !usiness "ith a more deli!erate and systematic focus on risk.

#mplementing the infrastructure and culture "ithin the organi$ation to make good decisions on risk.
2

Marsh

Excellence in Risk Management Studies

E&cellence in Risk Management # studied the risk management practices of %' top(performing risk managers in )orth America. *indings presented at the 2''+ R#MS conference included the follo"ing,
- .he events of the past /' years have resulted in a dramatic shift in the the

importance of risk management and its practices.

- .here is an opportunity for risk managers to play a more strategic role in

their organi$ations.
- 0ompanies can recogni$e a significant financial impact !y controlling risk

and recogni$ing profit from risk(related strategies.

- Successful risk management relies on a ro!ust hierarchy of information

and integrated information systems.

1sing E&cellence # as a foundation of understanding2 E&cellence ## e&amines the characteristics and practices of organi$ations that are implementing an enterprise("ide risk management program.
%

Marsh

Excellence in Risk Management II Research Parameters and Methodology

Methodology,

Qualitative versus 3uantitative approach #n(depth intervie"s "ithin five large organi$ations that are implementing an ERM program #ndustries represented, #nformation services 425 *inancial services 425 0ommodity services 4/5 #ntervie"s "ith 26 individuals at these organi$ations2 including risk management at each company #ntervie"s "ere administered !y phone to o!tain insights on practices2 perceptions2 organi$ational dynamics2 and relationships #ntervie"s "ere supplemented !y a short closed(end 3uestionnaire covering !asic topics #ntervie"s "ere conducted !y 7reen"ich Associates
+

Marsh

Who We Intervie ed

Risk Management 485 9perations 4:5 Audit 465 0ompliance and ;egal 4%5 <usiness(1nit =ead 4/5 Safety 4/5

Marsh

!ey "akea ays

Recogni$e the fundamental !enefits of ERM

1nderstand ho" to implement ERM

1nderstand ho" to sustain ERM in your company

Marsh

>

Enter#rise Risk Management$##lying Risk Management %isci#line More &roadly

Objective Setting

Monitoring

Risk Identification

?All Types of Risk ?Broad Focus ?Continuous

Communication

Risk Assessment

Control Activities
Marsh

Risk Mitigation

8 Source: The Committee of Sponsoring Organizations of the Treadway Commission

Survey Results 'vervie

@hy ERMA

7etting Senior(Management Support

0reating a Process to Support ERM

<uilding ERM #nto the 0orporate 0ulture

Bey .akea"ays

Marsh

Why ERM?

ERM &ene(its

Im liberating people in our company about risk and uncertainty so that they can better achieve the ob ectives that they made to the board!" #$isk %anager

Marsh

/'

$s 'rgani)ations $do#t ERM* the Role o( Risk Manager &ecomes More Strategic
Strategic Risk Management

Impact On Organizations Bottom Line and Culture

Progressive Risk Management

Organizational Buy In

Traditional Risk Management

Technical !anagement
Marsh //

$s +om#anies %evelo# an ERM $##roach* Potential &ene(its Multi#ly

!RM Approac"

Optimizing Risk

" Support O#$ecti%es " Impro%e &arnings and Cash 'low " !anage (rowth " Capture Opportunities

Advanced Risk Management

Managing Risk

" Reduce Losses " Lower Insurance Costs

efensive Risk Management

Transferring Risk Marsh

" )urchase Insurance and Co%er Ris*s

/2

"he Role o( Risk Management in the ,irm

Agree#Strongl$ Agree

T"e role of t"e risk manager "as become muc" more strategic %it" implementation of !RM

Risk Manager

80%

Other

80%

T"e firm vie%s risk management as a ke$ strategic function

Risk Manager

80%

Other

73%

Marsh

&Risk Manager' n()* Ot"er' n(+),

/%

&ene(its o( ERM Im#lementation in Ma.or Risk $reas

Strategic
Risk Manager Other

-ig"l$ Significant .enefits &/ 0 ),

80% 75%

,inancial

Risk Manager Other

60% 88%

'#erational

Risk Manager Other

100% 81%

-a)ard

Risk Manager Other

20% 31%

Q2/. @ith the implementation of an integrated approach to risk management across the firm in all of the risk areas 4ERM52 ho" "ould you rate the !enefits accruingCor e&pected to accrueCin each of the maDor types of riskA Please rate on a scale of / to 62 "here / is )one and 6 is =ighly Significant.

Marsh

&Risk Manager' n()* Ot"er' n(+1,

/+

Present and ,uture &ene(its o( ERM

Agree#Strongl$ Agree

T"ere are tremendous future potential benefits in !RM t"at "ave not $et been realized

Risk Manager

100%

Other

80%

Risk Manager T"e firm is recognizing substantial benefits from !RM toda$

80%

Other

40%

Marsh

&Risk Manager' n()* Ot"er' n(+),

/6

Perceived &ene(its o( ERM

-ig"l$ Significant .enefits &/ 0 ),

Improved communications on risk taking to s"are"olders#board .etter3informed decisions

Risk Manager Other

100% 100%

Risk Manager Other

100% 94%

.etter allocation of capital and resources to address risk

Risk Manager Other

100% 88%

Improved corporate governance practices

Risk Manager Other

80% 94%

Marsh

&Risk Manager' n()* Ot"er' n(+1,

/>

Exam#les o( ERM &ene(its

Multimillion(dollar proDect undertaken once risk profile understood 9ffshore outsourcing program cancelled once high risk "as assessed )atural hedge discovered *acilitated MEA process Reduced insurance rates Fecided not to discontinue product once risk "as understood

Marsh

/8

ERM%riving ,orces

External Forces Sarbanes3O4le$

Si4 Sigma Corporate Scandals Regulator$ Initiatives September ++ 5atural isasters

Company Risk Management Focus

1nderstanding Risk 0ontrolling Risk 9ptimi$ing Risk

Internal Forces
Managing !arnings and Cas" 6lo%s Stake"older Accountabilit$ Meeting Objectives Regulator$ Compliance

Marsh

/:

/etting Senior0Management Su##ort

+onsensus "hat &oard and Senior0Management &uy0In o( ERM Is Essential to $cce#tance 1y the 'rgani)ation
Board & Alignment 'ith board ob ectives & (enior#level champion & )ontinued involvement Senior Management & (ets the tone & *ink to investors F n!tiona" Management

B siness #nits and O$erations

Marsh

2'

+ontinued Su##ort ,rom Senior Management Re2uires %irect +ommunication &y ERM "eam
&

Risk committees ? Senior(management risk committee ? <oard level, audit committee G separate risk committee ? #nternal audit

? 0ontinuous communications ? FonHt shoot the messenger attitude ? =elp from !rokers and consultants ? 0an Dump(start process
Marsh 2/

+reating a Process to Su##ort ERM

$ccounta1ility and Re#orting at $ll 3evels Is Re2uired to Su##ort the ERM Process

$isk )ommittee

+oard (enior %anagement )ross#.unctional ,$% /eam

$isk )ommittee

),- ).- %RO )-- )/-

Risk Management& ' dit& %om$"ian!e()ega"

+usiness 0nits

.unctional %anagement

-perations

Marsh

2%

'rgani)ation to Su##ort ERM!ey "akea ays ? Separate risk committees to !oard and senior management ? Risk management representation in senior management ? 0ross(functional ERM teamCrisk management2 internal audit2 legal2 and compliance form core team ? Representation from operationsG!usiness units and functional management ? =uman resources conspicuous in its a!sence
Marsh 2+

3ink to Strategic '1.ectives and Integrate ERM "hinking Into Regular &usiness $ctivities

ecisions

Objectives

6inancial Strateg$ Corporate Strateg$

Enterprise Risk Management Policies and Procedures Plans and .udgets

Marsh

26

Rein(orce the ERM Process With a +ommon 3anguage and "raining

& Esta!lish

a common language a!out risk

? Simple ? #n conformity "ith culture ? .ake a consultative approach to training !y using "orkshops ? 1se availa!le technology ? Beep it simple

Marsh

2>

&uilding ERM Into the +or#orate +ulture

ERM in the +or#orate +ulture

$isk management is everybodys ob! ,verybody 'ho does anything in the company is a risk manager to some e1tent!" #(enior %anager

/he most important thing is to get buy#in 2rom the most senior levels o2 the organi3ation 2irst! 0ntil you do that, youre going to have great ideas, but theyll never see the light o2 day!" #$isk %anager

Marsh

2:

Em1edding ERM in +or#orate +ulture

Agree#Strongl$ Agree

Implementation of Risk Manager !RM re7uires and results in a cultural c"ange in t"e organization Other

100%

93%

Marsh

&Risk Manager' n()* Ot"er' n(+),

2I

-o

to In(luence "hinking to Include ERM

)ommunications 7rooming" Internally )ompensation

*earning 5 6evelopment

'"" %om$an* +m$"o*ees

4er2ormance %easurement

*i2etime" %entality to ,$%

Marsh %'

!ey "akea ays

ERM Risk $nalysis Involves ,ive ,undamental Ste#s$##lied to $ll $reas o( Risk

1! Identi2y $isks

2! Assess Impact

8! Assess *ikelihood

9! :uanti2y 5 4rioriti3e

5! -ptimi3e

Marsh

%2

ERM %emands a Strategic Role (or Risk Managers

Strategi! Risk Management

+RM '$$roa!h

0raditiona" Risk Management

-e.ensi,e Risk Management

)o m

pa

ny

,$

,v o
%%

/rogressi,e Risk Management

'd,an!ed Risk Management

Marsh

lut i

1')#+

on

sk $i n %a

er ag ,v olu tio n

,or 3o 0,re2uency Risks* ERM +an Reveal -idden Risks Re2uiring $ction and -el# in Prioriti)ing Resources

;igh Impact

;igh Impact *o' *ikelihood

;igh Impact ;igh *ikelihood

*o' Impact

*o' Impact *o' *ikelihood

*o' Impact ;igh *ikelihood

Marsh

*o' *ikelihood

;igh *ikelihood

%+

+autions

? FonHt treat ERM as one(time proDect ? 9verkill can create !acklash ? )eed tangi!le accomplishments to keep momentum

Marsh

%6

Recommendations

Just do itK 7et started #dentify a champion 7et senior(management !uy(in Start prioriti$ing risks using .op/' approach Perform !usiness practice revie"s =old risk "orkshops ;everage e&isting initiatives - Sar!anes(9&ley - Si& Sigma - Audit and compliance initiatives - Strategic planning

Maintain sensitivity to seismic events in the company Employ team approach to the task of implementing ERM *ormali$e it, - Structured approach to organi$ing processes G lines of reporting Beep ERM technology simple and understanda!le Em!ed ERM in e&isting !usiness processes .reat ERM as a process2 not a proDect
%>

Marsh

,inal "hought

/he key to high#per2ormance risk management is aligning risk strategy among key risk stakeholders, obtaining and sustaining senior management engagement, and achieving e22ective integration 'ith strategic planning!"
#$isk %anager

Marsh

%8

"hank 4ou
RIMS and Marsh are #roud to have s#onsored the Excellence in Risk Management II survey

!arsh is part of the family of !!C companies+ including ,roll+ (uy Carpenter+ )utnam In%estments+ !ercer -uman Resource Consulting .including !ercer -ealth / Benefits+ !ercer -R Ser%ices+ !ercer In%estment Consulting+ and !ercer (lo#al In%estments0+ and !ercer specialty consulting #usinesses .including !ercer !anagement Consulting+ !ercer Oli%er 1yman+ !ercer 2elta Organizational Consulting+ 3&R4 &conomic Consulting+ and Lippincott !ercer0"

The Ris* and Insurance !anagement Society+ Inc" .RI!S0 is a not for profit organization dedicated to ad%ancing the practice of ris* management+ a professional discipline that protects physical+ financial and human resources" 'ounded in 5678+ RI!S represents nearly 9+888 industrial+ ser%ice+ nonprofit+ charita#le+ and go%ernmental entities" The Society ser%es o%er 6+:88 ris* management professionals around the world"

Copyright 2005 Marsh nc! All rights reser"ed!

0ompliance L MA>(/'+:'