Enterprise Risk Management
Discussion Document
July 30, 2003
“Meeting objectives, with consistency”
Perspective on ERM
 Conceptual framework
 ERM issues in the health industry
 Overview of methodology and process
 Turning risk to advantage
ERM conceptual framework
What is Enterprise Risk Management?
 ERM is a rigorous approach to assessing and addressing the risks from all sources
that:
 Threaten the achievement of key enterprise objectives (I.e., financial, market
penetration, customer service)
 Present opportunities to exploit for competitive advantage
Objective: Enhance enterprise value by...
Improving capital
efficiency



Providing an objective
basis for allocating
resources
Reducing
expenditures on
immaterial risks
Exploiting natural
hedges and portfolio
effects
Supporting
strategic
decision-making


Uncovering areas of
high potential adverse
impact on the drivers
of stakeholder value
Identifying and
exploiting areas of
“risk-based
advantage”
Building
enterprise-owner
confidence


Establishing a process
to help stabilize results
Demonstrating
proactive risk
stewardship
Minimizing earnings volatility has a significant impact on enterprise value
12
10
8
6
4
2
0
4.48
1.43
Market Value Added
High
Return
Companies
Market Value Added
 The effect of earnings volatility can be seen clearly by first stratifying the industry
according to return and growth, thereby normalizing those effects
12
10
8
6
6
4
2
0
3.62
1.39
High
Low
Earnings Volatility
Market Value Added
Market Value Added
Low Return
Companies
10
8
6.26
4
2
0
High
Low
Earnings Volatility
12
10.14
12
10
8
6
4.90
5.94
4
2
0
High
Low
Earnings Volatility
High
Low
Earnings Volatility
Low Earnings Growth
Companies
High Earnings Growth
Companies
Source: Tillinghast – Towers Perrin analysis of 1989-1998 performance of 86 publicly traded companies in the financial services industry, based
on data from Compustat and ValueLine. Details available on request.
ERM issues in the health industry
The risks are real
There are several current and significant sources of unmanaged risk
 Court rulings
 Consumerism
 State and Federal political environment
 Compliance with regulations and statutes
 BBA
 Medicare
 HIPPA
 State regulations
Unmanaged risk and litigation damages MCOs
More than short-term financial impact, this environment strikes at the heart of managed
care, and threatens an MCO’s core business
Quality
Care
Reputation
Financial
Results
Relationships
Core Business Foundation
Sales
Overview of methodology and process
Assessment of Organization Capabilities provides focus and priorities for a
comprehensive ERM initiative
Better Than
Competitors
ILLUSTRATIVE
EXAMPLE:
PHARMACEUTICAL
ORGANIZATION
Surpluses
Product
Consistency
Budget and
Operations
Planning
Performance
Technical and Product
Support
Global Supply/
Distribution
Equal to
competitors
Manage Industry
Cycles
Managed Care
Marketing
Customer
Responsiveness
Influence Regulatory
Process
Worse Than
Competitors
Speed-toMarket
Needed
To Play
Cost
Leadership
Needed
To Compete
Importance
Sustain
Customer
Relationships
Gaps
Needed
To Win
The ERM approach to risk is straightforward
II. Shape
Risk
 Quantify impacts
I. Assess
Risk
 Mitigate
 Finance
 Identify risk factors
 Prioritize risk factors
 Classify high priority
risk factors
III. Exploit
Risk
 Analyze opportunities
 Develop plan
 Implement
IV. Keep
Ahead
 Monitor change:
- Risk factors
- Environment
- Organization
 Re-enter prior steps as
necessary
A more detailed view of risk assessment and shaping
Phase I - Assess Risk
Strategic
Risk Factors
Identify
Risk
Factors
Prioritize
Risk
Factors
Classify HighPriority Risk
Factors
Manageable
Risk Factors
Phase II - Shape Risk
Strategic
Risk Factors
Risk Factors
That Can Be
Mitigated
Model and
Quantify
Mitigate
Manageable
Risk Factors
Residual
Risk Factors
Finance
When identifying risk factors...
…start with the business, not a checklist of risks
THE BUSINESS
RISKS
Human
Capital
Physical
Busines
s
Financial
Legal
Market
Capital
Business
Processes
Political
Infrastructure
Capital
Financial
Capital
When prioritizing risk factors...
…qualitative scoring is appropriate at this stage
Risk Factors
“NPV” Scale
1 - Low
Controls
5 - High
Likelihood
Severity
H
H
L
4.5
H
L
L
3.0
B. GROWTH
1. Infrastructure is increasingly strained; will be difficult to retain culture
and values with the changes that growth demands
H
H
L
4.5
2. Increased size creates more opportunity for mistakes
M
L
M
2.0
M
H
H
3.5
L
H
H
2.5
A. STRATEGY
1. Informal planning, process and communications allow surprises
2. Market share and earning objectives are not aligned
.
.
.
.
C. COMPANY REPUTATION
1. Pressure to make numbers may prompt behavior that will impair
company’s credibility with financial markets
2. Adverse publicity (e.g., business practices, ethics) can affect image
across multiple brands
D. HUMAN RESOURCES
.
.
.
J. SYSTEMS
.
.
When classifying risk factors...
…use a scheme that implies action
“Manageable” Risk Factors
“Strategic” Risk Factors
 Known environment
 Unfamiliar territory
 Capabilities and
resources on hand to
address
 Capabilities or resources
may not be in place
 Fell between the cracks?
 Just get on with it
 Major change in market or
business
 Requires allocation of
capital or shift in strategic
direction
When modeling/quantifying risk factors...
…link to relevant
financial measures
Cumulative Policyholder Equity
Net Income
Underwriting G/L
Premium Revenues
Invest Income
Medical & Admin. Expenses
Members
Bonds/stocks
Taxes
Subsidiaries
Price
Business & risk management
strategies
Underwriting Risk
Financial Risk
Distribution Channel
Competitor Risk
When mitigating risk factors...
…strike the appropriate balance
Total
Strategic Risk
Advantage
Stifling
(excessive control)
Conventional
Risk Controls
Balanced
risk
program
Vulnerable
Gambling
(excessive delegation)
Little
Weak
Risk Culture
Strong
When financing risk...
…exploit the “portfolio effect”
PROBABILITY
Risk
A+B
Risk A
Risk B
$ LOSS
If you understand risk, it can be a competitive advantage
Two strategic questions:
Can we manage the risk
better than competitors?
Is the risk more dangerous
to competitors?
THEM
High
No
THEM
THEM
Impact?
THEM
Low
Have the
capabilities to
handle it?
THEM
US
THEM
Yes
US
High
Low
Predictability?
Yes
No
Understand the risk?
Turning risk to advantage
Applying ERM to Health Plans
Where does risk reside?
While each MCO is unique, the basic business functions create a framework for mapping actionable risks
Organization
and strategy
Marketing,
sales and
customer
service
Operations
Medical/
Clinical
Finance
Cases to date have focused on these four areas
Risk management happens through leadership and people
People and
Performance
Management
Risk Types
The risk is compounded by the tension created when mitigating one risk potentially exacerbates another
Point-of-Sale
(Misleading Sales Practices)
Point-of-Service
(Quality of Service)
 Financial incentives
 Adverse medical outcomes due to
 Undisclosed care management
negligence (medical malpractice)
 Inflated reimbursements recoveries
 Discrimination in peer review/ratings
of doctors
decision (doctors, vs. nurses and
other)
 Discrimination
 Unfair trade practices
Managed Care
(Quantity of Service)
Physician Lawsuits
 Harmful cost saving protocols
 Financial ruin due to “fraudulent”
 Breach of fiduciary responsibility
representations of financial risk
 Interference with care
 Slow pay
 Discrimination/exclusion from panel
(economic gain)
 Application of inconsistent protocols
 Improper denial of benefits
An illustrative risk map
The assessment identifies and then prioritizes the risks, based on the size of risk, and its “impactability”
Business
Function
Point-of-Sale
Point-of-Service
Managed Care
Physician Litigation
 Lack of direction
 Lack of clarity
 Lack of consensus and consistency
Organization and
Strategy
Marketing, Sales
and Customer
Service
 Accuracy of disclosures
 Fairness of sales
practices
 Quality of customer
service responsiveness
 Sufficiency of
disclosures about care
management processes
 Fair/Equitable exclusion
from network
Operations
 Accuracy of provider
membership information
 Accuracy of policy/
coverage documents
 Consistent application of
policy restrictions and
exclusions
 Effective use of data to
assess quality, improve
operations
 Value-added administrative
requirements
Medical
Management
 Sufficiency of disclosures
about physician relations
and incentives
 Access to emergency care
 Access to specialists
 Quality of network
management
 Data-driven utilization
management
 Fair application of profiling
tools
 Effective peer review
 Fair network contracting
and management
 Non-interference in
effective care delivery
Finance
 Fairness of pricing
 Regulatory compliance
 Deductibles, co-pays and
coordination of benefit
provisions applied
correctly
 Appropriateness of
capitation models
 Fair risk pools
 Prompt, accurate
reimbursement
People and
Performance
Management
 Whistleblower
 Discrimination
 Consistency
An illustrative action plan
Business
Function
Point-of-Sale
Organization and
Strategy
Point-of-Service
Managed Care
Physician Litigation
 Broad oversight
 External assessment
Marketing, Sales
and Customer
Service
 Have disclosures
reviewed by legal counsel
 Improve training of sales
force
 Transfer risk by
outsourcing customer
service
 Mitigate through improved
sales communication
training
 Ensure admission rules are
appropriate
Operations
 Avoid risk by outsourcing
data management
 Train/monitor nurse lines
 Audit claims processing,
coding and compliance
 Effectively manage
network and credentialty
process
Medical
Management
 Avoid risk by eliminating
utilization management
 Eliminate unnecessary
emergency care
restrictions
 Develop measures of
quality network
management
 Re-consider delegated
medical management
tactics
Finance
 Test equity and
compliance of pricing
 Transfer risk by
outsourcing benefit
payments
 Structure appropriate stop
loss or reinsurance
 Create captive to fund
defense and losses
 Provide insurance to help
physicians finance risk
 Audit credit worthiness
of practices
People and
Performance
Management
 Internal audit
 HR Assessment
Representative Case Studies
Case Study #1
 Client Profile: $2 billion Health Plan in the Northeast
 Issue/Context: they lost $90 million in the prior year; heavy turnover of senior staff;
long-term viability questions by public, Board
 Scope of Service: review all factors regarding financial results and projections;
evaluation of risks and likelihood of achieving projections; interviews with Board,
insurance executives and insurance commission
 Recommendations/Outcomes: provide report as to financial impact of changes on
organization for two-year period; recommend additional actions to enhance
financials and public image; report was accepted; $20 million surplus in the next
year; PR was positive
Case Study #2
 Client Profile: Publicly traded healthcare provider that owns/manages integrated
health systems in most of the 50 states
 Issue/Context: Company successfully emerged from bankruptcy court protection, reorganized and overcame significant regulatory, financial and public relations issues.
Organizational structure and leadership processes that served well during the “crisis
days” were now getting in the way of executing new business strategy
 Scope of Service:
 engaged by CEO to assess risks in existing organization structure, management
team and processes
 worked with CEO and each direct report
 conducted a series of management off-sites to work through outcomes of
assessment
 Recommendations/Outcomes:
 simplified organization structure
 clarified and reached consensus on business strategy
 analyzed management decision making process
 provided CEO and direct reports individual feedback and coaching on their
management style and effectiveness
Case Study #3
 Client Profile: $4 billion market-leading manufacturer and distributor of prestige
consumer products with 40-year track record of uninterrupted growth and
profitability
 Issue/Context: Client desired a comprehensive, enterprise-wide risk review, driven
by their expansion into new areas, increasing business complexity, recent IPO and
corporate philosophy of anticipating problems before they arise
 Scope of Service:
 Development of key performance measures and risk thresholds
 Rank-ordering of risks from all sources (hazard, financial, political, regulatory,
operational, etc.) and cross-validation
 Development of strategies for risk factor mitigation and financing
 Creation of “Business Risk Self-assessment Toolkit”
 Recommendations/Outcomes:
 Product diversification underway
 Domestic and International operations have begun consolidation
 Formal succession planning undertaken
 Business contingency planning underway at key facilities
 Senior Risk Oversight Committee not yet established due to management
turnover