Enterprise risk management (ERM) is a hot button in the boardroom. In the wake of the financial crisis, the Madoff arrest, the MF Global bankruptcy and other shocking spectacles on Wall Street, regulatory oversight is intensifying, along with shareholder demands for managerial transparency.
All of this has led boards of directors at industrial companies, not just financial institutions, to ask their CEOs and CFOs to evolve their processes and capabilities that make up ERM. The goal is to identify, quantify, monitor and manage potential events that could seriously disrupt strategic intent and result in serious penalty or dismemberment of the organization.
Along those lines, senior executives are now analyzing major business risks using advanced statistical techniques in the context of a portfolio. What's involved? How to do this? Identification and measurement of risks that truly qualify as enterprise risks are foundational steps, according to Ward Ching, vice president of risk management operations at Safeway Inc., the giant grocery chain. He recently delivered a forceful presentation at RIMS' first annual conference on ERM.
Ching, a respected thought leader in his field, describes ERM as 'a structured analytical process that focuses on identifying and estimating the financial impact/volatility of a defined portfolio of risks. The volatility of your risk portfolio is the key issue.' I followed up with Ching to peel back the onion. This Q&A article is the result.
Mary Driscoll: How does the portfolio management approach work in the context of ERM?
Ward Ching: ERM is a framework that helps you do at least six things:- Highlight significant or 'material' risks using a structured and auditable process.
- Identify risk interdependencies/clusters.
- Establish baseline financial estimates of probable loss utilizing a variety of actuarial and financial modeling methods.
- Assist in setting operational contingency plans to reduce the impact of catastrophic loss.
- Establish a new and more comprehensive risk management discipline within the organization.
- Identify possible strategic competitive advantages.
Ultimately, what you get is a view of the risk profile of the organization. And that perspective is extremely valuable.
Driscoll: Why is it so valuable?
Ching: It is inherently risky to limit your view. For example, it's dangerous to assess risks simply on a downside basis or only in a single functional-silo view, such as property casualty or reputation. These days, you must be able to identify or 'sense' the material risks facing the organization as a whole.
Understanding and communicating the concept of materiality is also essential. Separating important financial and operational risks from 'background noise' is at times difficult, but it is an important part of modern risk management. In doing so, you are able to effectively respond to shareholders when they ask, 'What are the risk-adjusted calculations or implications associated with a particular strategy?'
Driscoll: So, non-financial companies are now using portfolio management techniques common among financial companies?
Ching:For the most part, yes. Leading industrial companies, who are largely aware of the value of ERM, are today applying techniques akin to what an insurance firm would use to evaluate its risk profile relative to its underwriting activities and capital base. Insurers do this to answer the critical underwriting question: Should I offer an insurance product in a certain area or build profitable underwriting capacity in another area? If so, how much capital should I allocate assuming specific financial returns and loss expectations? If not, how fast should I reallocate capital to more profitable lines of coverage?
Here's the analogy to an industrial company. The CRO [chief risk officer] evaluates his or her risk capacity and then helps the CEO, CFO and the board frame major moves such as new investments in operating capacity or market reach. ERM can help you to assess the risk-adjusted value of plan A versus plan B. ERM provides a holistic view.
Driscoll: What do you mean when you say risk is capital?
Ching: I urge people to think of 'risk as capital' because it should be accounted for as part of a company's production function. Decisions should be made on a risk-adjusted basis over time. When you do this you can concentrate on the issue of risk volatility as a key risk management problem. Moreover, when you think of risk as capital, there is both an upside and a downside to a risk-adjusted decision. When properly employed, ERM is about risk mitigation and advantage-exploitation. ERM is about developing and prosecuting a competitive advantage that is generated out of your risk management process and vision.
Driscoll: Safeway examples?
Ching: We understand we have risk, and we understand the frequency and severity elements that are part of our various businesses. We are concerned about risk volatility, or the amplitude of our risk profile across our entire risk portfolio. To do this we conceptualize risk as living in domains: hazard, market, operational, reputation, HR, etc. We calculate the conjoint risk volatility of these domains and then communicate the results to senior management and our insurance (actuarial) partners.
Here's one concrete Safeway example. We were looking to generate significant cost savings on the operational side in retail by reducing workers' compensation claims and the capital reserves that a self-insured company like Safeway must set aside. Building upon the classic view of the risk of claims -- looking simply at the costs to self-insure -- we saw that the risk of worker injury is a driver of other forms of risk that could impact our ability to service customers, our reputation and our overall financial performance. That holistic view underscored the need to drive a strong culture of safety.
The message to retail employees was loud and clear: If there is no safety, there is no service. When I speak with workers in stores, I emphasize that we do a tremendous job of serving customers. And I stress that when a worker is injured, he or she cannot contribute to our promise to customers. I also say, 'You came in here with 10 finger and 10 toes. What would be the impact on you or your family if you are injured?'
The essential message is that each individual has a responsibility to help teammates work safely and stay healthy. And if something is not going well, I tell them, 'Let's escalate the issue so we can prevent problems.' We bake into the culture the idea that being proactive about safety has implications that go far beyond the amount of claims we must pay.
Prior to implementing this strategy, which we labeled Safeway's 'Culture of Safety,' our employees said to us that they were prepared to take responsibility for safety at the retail level. In the workforce surveys that we did, they also indicated that our current emphasis on safety was a key positive attribute of the organization's culture. But when we dug a little deeper, we discovered that employees did not necessarily always feel that they had the opportunities or tools to exercise accountability for safety. So we created specific procedures for handling safety issues and concerns in the stores that they could take responsibility for.
Driscoll: How did this program generate a strategic benefit?
Ching: In the course of driving this injury prevention program over the past two years, we provided data to our external actuaries that showed the real financial returns generated by the framework we were using. The actuaries deemed our data and analyses credible as they looked at our risk profile, expected payout structure, and current and future capital reserves plan. The actuaries agreed with our outlook and said they'd give us credit ahead of schedule for our reserve analysis.
The actuaries believed that the way we transformed our approach to managing hazard risk was sustainable. They appreciated how we took discrete risks -- hazard, operational, market and to some extent reputational -- and analyzed them within the context of a portfolio framework and accomplished something significant.
Driscoll: And how did this impact the corporate bottom line?
Ching: Our senior leadership has recognized this approach to cost reduction as one of the most effective in the organization. Of course, the key is to translate all this 'operational stuff' into the language that senior management uses. That means you have to prove that your efforts really do boost profitability. You have to translate your results into metrics such as EVA, ROE, or ROI so that the CFO and others will find it meaningful.
Driscoll: How did you motivate store managers to play ball?
Ching: For a retail business, maybe more so than others, if there's improper alignment between goals, objectives and financial return, nothing happens and you wind up frustrated. In this instance, we had to make it attractive for store managers to embrace the Culture of Safety strategy. And we had to be able to increase their costs if they resisted.
So, our insurance premium incentive program is designed around clear performance expectations and also a clear view of the KPIs that the managers control and the behaviors they can influence on the store floor. The program monitors targets for the frequency and severity of safety issues and events. If a manager is able to meet his or her quarterly targets and adheres to our risk awareness and prevention process, he or she receives a predetermined P&L benefit. If they don't, then they don't get the financial return. Keep in mind, for many of our divisions, that financial reward can mean the difference between profit and loss.
Driscoll: What's next?
Ching: Are we perfect? Far from it. We've got to do more to explore the obvious and nuanced spaces of the risk portfolio.
Mary Driscoll is the senior research fellow at APQC, a non-profit business research firm based in Houston.
