WELCOME To all RMS’ Guests to our First Seminar Addressing Risk Management Techniques. Risk Management Services Risk Management - Removing the Mystery Agenda • “INSURANCE IS NO SUBSTITUTE FOR GOOD RISK MANAGEMENT. OUR APPROACH TO RISK MANAGEMENT IS THAT IF WE EVER HAVE TO MAKE A CLAIM UNDER AN INSURANCE POLICY THEN IN ALMOST EVERY CASE THE BUSINESS HAS FAILED IN SOME WAY” • Andy Kirby: Group Insurance Risk Manager Carillion plc. Risk Management Services Risk ManagementRemoving the Mystery A Practical Introduction to Risk Management and Enterprise Risk Management Ray Mattholie- CRM, FIIRM, FCII Oman, March 2015 Risk Management Services Risk Management - Removing the Mystery Agenda • The story of RM • The story of ERM • The story of REM Risk Management Services Risk Management - Removing the Mystery Agenda • The story of RM • The story and Overview of ERM • The story of REM – Case studies and anecdotes • Outlining a model ERM Program • Applying the principles of RM to insurance and risk financing • Conclusions and Q&A Risk Management Services The First Risk Manager? Risk Management Services The First Risk Manager? “It is not about predicting the future, but about being prepared for it.” Pericles, Greek statesman, ~500BC Risk Management Services Risk Management Services The First Risk Manager Douglas Barlow 1907-1998 Risk Management Services Hazard Risk Management Process Risk Financing Risk Control Risk Evaluation Risk Management Services The Total Cost of Risk • • • • Insurance Uninsured Losses Risk Mitigation Admin Costs Risk Management Services The Total Cost of Risk Risk Management Services Famous Risk Quotes- FRQs ‘All Management is Risk Management’ - Douglas Barlow Risk Management Services The 6 Decades of RM • • • • • • 60’s- The First Risk Manager 70’s- Captives blossom 80’s- Risk Management as a Profession 90’s- Wider adoption of RM 00’s- Enterprise Risk Management 10’s- Strategic Risk Management….? Risk Management Services FRQs • Jerry: ‘What makes them think you are a risk management expert?’ • George: I guess it’s on my resumé Risk Management Services The 5 decades of REM • Chemicals – 1972-1991 • Communications – 1992-2003 • Conglomerate – 2003-2007 • Consultant – 2008- ? Risk Management Services Definitions • Risk is: – something that impacts on objectives • Risk Management is: – “A logical and systematic method of identifying, analysing, assessing, treating, monitoring and communicating risks in a way that will enable organisations to minimise risk and maximize opportunities” 危 機 Risk Management Services ERM Defined • ERM is: – A comprehensive, organization-wide set of processes and procedures used to document and manage risk. This process takes into account an organization’s strategic goals as well as its operational goals including an understanding of the current internal control environment. Risk Management Services ERM Described • A risk-based approach to managing an enterprise, integrating concepts of internal control, (the Sarbanes Oxley Act) and strategic planning. ERM is evolving to address the needs of various stakeholders, who want to understand the broad spectrum of risks facing complex organizations to ensure they are appropriately managed. Regulators and debt rating agencies have increased their scrutiny on the risk management processes of companies. Risk Management Services The Holistic View of Risk Strategic Risk Financial Risk Enterprise Risk Operational Risk Hazard Risk Risk Management Services The Holistic View of Risk Strategic Risk Financial Risk Enterprise Risk Operational Risk Hazard Risk Risk Management Services Defining Enterprise 1. Project or undertaking, especially one that requires boldness or effort; 2. Participation in such projects; 3. Readiness to embark on new ventures; boldness or energy; 4. Initiative in business- the enterprise culture; 5. A company or firm Enterprise-Wide? Enterprise-wise? Risk Management Services FRQ • “People can dismiss enterprise-wide risk management but to our thinking, that’s just putting your head in the sand” – Rick Buy, EVP & Chief Risk Officer, Enron Risk Management Services Major steps in the growth of ERM • 2002- Sarbanes Oxley ('Public Company Accounting Reform and Investor Protection Act' )-response to major accounting scandals Enron, WorldCom, Tyco etc. • 2004- COSO (Committee of Sponsoring Organizations) issued ‘ERM- Integrated Framework’ • 2007- SEC Guidance ‘Top down’ risk assessment • 2007- S&P reviews RM in corporate debt ratings for financial companies, and in… • 2009- S&P begins to review in rating all companies • 2009- ISO 31000 International RM Standard Risk Management Services COSO Framework Risk Management Services ‘A structured approach to ERM and the requirements of ISO 31000’ • • • • Risk has an upside and a downside What RM involves How should it be implemented What it can achieve: – Compliance with governance requirements – Assurance to ‘stakeholders’ – Improved decision making (= risk taking!) Risk Management Services Risk Management Process7 Rs and 4 Ts • recognition or identification of risks • ranking or evaluation of risks • responding to significant risks – – – – • • • • tolerate treat transfer terminate resourcing controls reaction planning reporting and monitoring risk performance reviewing the risk management framework Risk Management Services Steps in Implementing ERM • Board mandate and commitment • RM Policy- updated regularly • RM Procedures- Risk assessment in all strategy papers and projects • Risk appetite and tolerances • Establishing a Risk Register Risk Management Services Risk Register ‘musts’ • • • • • • • • Reflects views of Executive Constantly reviewed and updated Every risk has an owner ‘Heat Map’ Impact and Likelihood ratings Clear definitions of ratings Mitigation measures identified Inherent and Residual Regular reporting to Board/Audit Committee Risk Management Services FRQs • ‘It takes about 20 years to build a reputation and 5 minutes to ruin it…’ – Warren Buffett Risk Management Services Risk Register ‘desirables’ • • • • • Reputational Risk Risk appetite Risk tolerance Risk velocity Emerging risks Risk Management Services FRQ • ‘There are known knowns. These are things we know that we know. There are known unknowns. That is to say, there are things that we know we don't know. But there are also unknown unknowns. There are things we don't know we don't know.’ – Donald Rumsfeld Risk Management Services WEF Global Risks Review- 2015 results Likelihood • • • • • • • • • • Interstate conflict Extreme weather events Failure of national governance State collapse or crisis Unemployment or underemployment Natural catastrophes Failure of climate-change adaptation Water crises Data fraud or theft Cyber attacks Impact • Water crises • Weapons of mass destruction • Interstate conflict • Energy price shock • Failure of climate-change adaptation • Fiscal crises • Unemployment/underemployment • Biodiversity loss and ecosystem collapse • Spread of infectious diseases • Critical information infrastructure breakdown Risk Management Services FRQs • ‘A black swan is by definition a surprise. Nevertheless, people tend to concoct expectations for them after the fact’ – Nassim Nicholas Taleb Risk Management Services Creating a Risk Register • • • • Creating a greater awareness of key risks Worst case scenarios – specific, not generic Strategic focus - what could impact objectives Starting the risk mapping process Risk Management Services Risk Summary Report 11 October 2011 XYZ Inc Categories: All Risk Management Services Risk Summary Report 11 October 2011 XYZ Inc. Categories: All Risk Management Services Risk Summary Report 11 October 2011 XYZ Inc. Categories: All Risk Management Services RRR- Risk ‘Dashboard’ Likelihood 70% & >chance occurring in a year (occur once per year) Financial Reporting 50% - 69% chance occurring in a year (occurs once/twice every 2 yrs.) 30% - 49% chance occurring in a year (occurs once/twice every 3 yrs.) Failure to Uncompetitive Deliver Growth Cost Base Corporate Governance 10% - 29% chance occurring in a year (an event that occurs once/twice in a 10yr period ) Service from Outsource Providers Business Process Management Key Structure of Employees the Business Dependency Employee Engagement 4% - 5% chance occurring in a year (occurs once/twice of working life) Informatio n Security Loss of Site Misappropriation of Assets Less than 4% chance occurring in a year (an event that occurs once in life span of a human being) IT Infrastructure Control of Working Capital Loss of IT Employee Retention Change Management Major Litigation (excl. E&O) E&O Claims Management of Markets Bribery & Corruption Money Laundering Net Impact £0 - £0.1m of PBT Appetite Shell Key £0.11M £0.25M of PBT = Within Appetite = New/Emerging Risks £0.26m £0.75m of PBT £0.76M £1.5M of PBT = Below Appetite limits = Connected Risks £1.51M £5.0M of PBT = Outside Appetite £5.01M £10M of PBT £10.01M £25M of PBT = Significantly Outside Appetite >£25M of PBT = Appetite not Rated = Direction of travel Risk Management Services RRR- Risk ‘Radar’ Risk Register/Dashboard Impact Watching Brief STRATE GIC LEGAL & COMPLIANCE Failure to Deliver Growth Structure of Business Uncompetitive Cost Base SERVICE AND MARKETS Bribery & Corruption Major Litigation (excl E&O) Failure of Corporate Governance Money Laundering E&O Claims Information Security Business Interruption Management of Markets Service from Outsource Providers Inadequate Management of working Capital Change Management OPERATIONS Business Process Management FINANCIAL Financial Reporting Misappropriation of Assets Employee Retention Employment Engagement Key Employees Dependency IT infrastructure instability Loss of IT IT PEOPLE Risk Management Services Completing a Risk Tolerance Statement – the process flow 1. Current ranked risk register 2. Top risks selected 8. Reassess risks every 6 months and feedback into the risk register to repeat the cycle: - Residual risk - Tolerance - KRIs 7. Monitoring of KRIs 3. Identify owners of each top risk 6. At regular risk management meetings, management will present for discussion: - Completed Risk Tolerance Statements for top risks - The Risk Tolerance Summary 4. Tolerance Statements should be drafted by owners which include: - Business objective - Risk tolerance - KRIs - KRIs limit 5. CompletedNote1 Tolerance Statements must be discussed by BU management Note 1: This will also require CEO/CFO signoff on the relevant business objectives 41 Risk Management Services Appendix 2 Mock up Risk Tolerance Summary for the top risks (A hypothetical BU risk register) Risk Event Residual Risk Status (Insignificant, Minor, Moderate, Major or Catastrophic) Risk Tolerance Level (VH, H, M, L or VL) E.g. Interruption to systems and network services Moderate VL E.g. Mass scale food poisoning / foreign objects/ allergens in sold products Minor VL E.g. Major investment of competitors on store expansion, upgrade, store revamp plus investment on advertising may reduce our market share. Moderate L Description of Tolerance Level The risk tolerance level is Very Low. We expect compliance on all group IT policies and can only tolerate a minimal system downtime (at most no more than 4 hours / year for level 1 and 10 hours / year for level 2 IT systems) provided there is full data restoration upon system recovery. (See Appendix 4) The risk tolerance is Very Low as such events have the potential to result in fatalities. As such the BU focuses heavily on this to avoid the risk through full compliance with our containment measures at all times and through continuous test checking on ingredients / dishes. We will accept no more than 5 minor reported incidents provided these do not result in public concerns. (See Worked example #3 on page 33) Our risk tolerance is Low. Given that the competitors are backed by strong conglomerates, we will monitor them very closely. Our market share growth rate has been 10% over the last 5 years leading to our current share of 23%. Growth needs to be at 30% per annum to increase market share by our targeted 2%. We would not expect growth to be less than 20%. We will continuously monitor the 1) brand equity index, 2) the difference in the number of store openings / under re-modelings and 3) share-ofspending on advertising etc., and develop a response plan to achieve our objectives. (See Worked example #5 on page 35) 42 Risk Management Services The 5 decades of REM • Chemicals – 1972-1991 • Communications – 1992-2003 • Conglomerate – 2003-2007 • Consultant – 2008- ? Risk Management Services Risk Management Services Case Study #1 - Chemicals • • • • • • Captive formed in 1920’s Bermuda Captives in 1960’s Risk Engineering team Rating plan Responding to difficult to insure risks Insurance or Risk Management? Risk Management Services Case Study #1- Chemicals • • • • Insurance or Risk Management? 1983-1991 Risk Manager C-I-L inc 1988 President of Ontario Chapter of RIMS Risk Management ‘Evangelist’ Risk Management Services The 5 decades of REM • Chemicals – 1972-1991 • Communications – 1992-2003 • Conglomerate – 2003-2007 • Consultant – 2008- ? Risk Management Services FRQs “640k should be all, that any application will ever need” (Bill Gates, 1981) “The global demand for cars will never be above 1 million – simply because there are not enough chauffeurs” (Gottlieb Daimler, 1901) “Nobody will be able to rise into the air with a metal airplane within the next 50 years” (Wilbur Wright, 1901) Risk Management Services Case Study #2 - Communications • • • • • Privatization – Maggie Thatcher’s legacy ‘POTS’ to dot.com Global ambitions Risk management challenges 3G licence auction Risk Management Services Case Study #2 - Communications • Captive – Continuous development • Risk assessment is key – Business interruption – ‘e-Risks’ • Forming partnerships • Communicating Risk Management • Corporate governance - Turnbull Risk Management Services 3G - Risk and Opportunity Risk Management Services Corporate Governance in the UK • • • • UK’s “Enrons” were in the 80’s ‘Turnbull’ / The Combined Code Code of Practice v Legislation “Effective Risk Management ….. Key component of Corporate Governance” Risk Management Services Embedding Risk Management in BT • • • • Board Audit Committee driven Risk culture RM as core competence Group Risk Register Finding the next 3G Risk Management ‘Champion’ Risk Management Services BT Group Risk Manager’s Role • Job Description agreed with BAC – To create a risk aware culture – To develop a Centre of Excellence for managing risks – To establish and maintain an effective process for identifying, evaluating, managing key risks • Reporting to Finance Director • Access to Main Board Risk Management Services BT Group Risk Register Risk Review Panel Members • Group Risk Manager (Chair) • Group Chief Internal Auditor • Company Secretary • Director, Group Financial Control • Group Treasurer • Director, Human Resource Strategy • Chief Information Officer • Manager, Strategic Planning • Manager, Corporate Finance • Director of Security Risk Management Services BT Group Risk Register Risk Panel Management Council Board Board Audit Committee Risk Management Services FRQ’s The willingness to take risk is essential……..(if all) invested only in risk-free assets, the potential for business growth would never be realized” Alan Greenspan, 1994 Risk Management Services The 5 decades of REM • Chemicals – 1972-1991 • Communications – 1992-2003 • Conglomerate – 2003-2007 • Consultant – 2008- ? Risk Management Services Risk Management Services Risk Management Services Risk Management Services Jardine Matheson Group Jardine Lloyd Thompson Group plc Risk Management Services Risk Management Services Risk Management of Jardine • “Risk Aware, not Risk Averse” Risk Management Services Quote from the Taipan… • “We have the ability to identify and nurture the right people with the skills to build our businesses; and we are ready to take calculated risks and make bold decisions.” – Anthony Nightingale, 2011 Annual Address to Senior Executives of JM Risk Management Services The Holistic View of Risk Strategic Risk Financial Risk Enterprise Risk Operational Risk Hazard Risk Risk Management Services Role of Group Risk Management in JLT Championing “best practice” Risk Management Strategic Risk Financial Risk Enterprise Risk Operational Risk Hazard Risk Coordinating Group Risk Financing Risk Management Services Championing “Best Practice” Risk Management • • • • • RM Committees Report to Board ERM Steering Group Captive Audit and Risk Risk Forum Championing “best practice” Risk Management Strategic Risk Financial Risk Enterprise Risk Operational Risk Hazard Risk Coordinating Group Risk Financing Risk Management Services Risk Management Services ERM in JM • Is Not: – Regulatory driven – Bureaucratic – “One size fits all” • Is: – Business owned – Emphasis on “Enterprise” – Work in progress Risk Management Services The 5 decades of REM • Chemicals – 1972-1991 • Communications – 1992-2003 • Conglomerate – 2003-2007 • Consultant – 2008- ? Risk Management Services Case Study # 4- Consultant • RM Risk Management Limited – Independent consultancy – Risk Management reviews • Non executive Directorships – JLT Canada – Lockhart Insurance, Bermuda • Chair of Audit and Risk Committees Risk Management Services Case Study # 4: NED =‘Creative Contributor’ • Role of the Non-Executive Director • Cadbury Report 1992 ‘they should bring an independent judgment to bear on issues of strategy, performance, and resources including key appointments and standards of conduct’ • Functions of the NED – – – – – Independence Impartiality Wide experience Specialist knowledge Personal qualities Risk Management Services Case Study # 4: Audit & Risk Committee • Composition: – Depends on corporate status and jurisdiction, but common theme is requirement of independent nonexecutive directors • Responsibilities and roles: – – – – – Oversight of financial reporting and accounting Oversight of the external auditor Oversight of regulatory compliance Monitoring effectiveness of internal control process Oversight of risk management Risk Management Services Case Study # 4: Audit & Risk Committee • Composition: – Depends on corporate status and jurisdiction, but common theme is requirement of independent nonexecutive directors • Responsibilities and roles: – – – – – Oversight of financial reporting and accounting Oversight of the external auditor Oversight of regulatory compliance Monitoring effectiveness of internal control process Oversight of risk management- incl Risk Register Risk Management Services Developing a Risk Management Strategy • Gaining consensus with internal partners – The Virtual Team • Aligning with strategic objectives – Emphasis on Enterprise • Implementing as part of overall ERM • Communicating internally & externally Risk Management Services Developing a Risk Management Strategy • Gaining consensus with internal partners – The Virtual Team • Aligning with strategic objectives – Emphasis on Enterprise • Implementing as part of overall ERM – Keep it simple! • Communicating internally & externally Risk Management Services Developing a Risk Management Strategy • Gaining consensus with internal partners – The Virtual Team • Aligning with strategic objectives – Emphasis on Enterprise • Implementing as part of overall ERM – Keep it simple! • Communicating internally & externally – Championing ‘best practice’ Risk Management Services FRQs • “The policy of being too cautious is the greatest risk of all” – Jawaharlal Nehru Risk Management Services Why Enterprise Risk Management is Important • Company policy? • Corporate governance? • Stakeholder expectations? • Reducing insurance costs? • Avoiding uninsured losses? • Taking the right risks Risk Management Services FRQs • ‘Only those who risk going too far can possibly find out how far one can go’ – T.S. Eliot Risk Management Services Conclusions – Cultivating the Culture of ERM • Command • Collaborative • Continuity • Communication & Clarity • Customization • Contribution • commitment from the top • committee or Steering Group, the ‘virtual team’ • ongoing development & refinement • Avoiding ‘Risk Fatigue’ • keep it simple and clearly understood • fitting with the corporate culture • to Strategic Focus and Planning Risk Management Services Risk Management Services Risk Management- Removing the Mystery Agenda • The story of RM • The story and Overview of ERM • The story of REM – Case studies and anecdotes • Outlining a model ERM Program • Applying the principles of RM to insurance and risk financing • Conclusions and Q&A Risk Management Services Exercise Consider what you have heard so far on RM and ERM, and think of ways it could support your approach to risk financing and insurance purchase, including: • making decisions on risk retention • Marketing insurance renewals • Choosing insurers, brokers and consultanants Risk Management Services FRQs • ‘There are worst things in life than death. Have you ever spent an evening with an insurance salesman?’ – Woody Allen Risk Management Services (Consider introducing a break-out exercise at this stage during Day 2 event for clients and prospects). Possible topic: Consider what you have heard so far on RM and ERM, and think of ways it could support your approach to risk financing, insurance purchase and risk retention. Risk Management Services Hazard Risk Management Process Risk Financing Risk Control Risk Evaluation Risk Management Services Coordinating Group Risk Financing • • • • Informed risk retention Long term relationships with insurers Strategic partnership with brokers/consultants Proactive approach to claims Strategic Financial Championing “best practice” Risk Management Risk Risk Enterprise Risk Operational Risk Hazard Risk Coordinating Group Risk Financing Risk Management Services Informed risk retention • Risk evaluation – Effective risk identification, quantification and control provides confidence to retain risk • ‘Swapping $’ with insurers is short-termism • Corporate cover should be aimed at significant balance sheet damage • Those who understand and are prepared to retain their own risks are preferred customers • Building a data base of losses to focus risk control Risk Management Services Long term relationships with insurers • Benefits: – Building their confidence in quality of your risks – Lower admin costs = preferred customer status – Minimising impact of market volatility- more predictable cost – Loyalty will be rewarded in claims negotiations • Key ways to build: – Know your underwriters – Invite to visit your risks (beyond risk engineering) – Consider annual renewal ‘Roadshow’ Risk Management Services Strategic partnerships with brokers/consultants • Thinking long term enables: – Investment in time and effort to build a true understanding of your business, its risks and culture – Development of effective long term risk financing strategies – Creation of innovative solutions – Tailoring of policy wordings to your needs – Exploring wider services- e.g. risk management – Strong support in major claims or disputes Risk Management Services Strategic partnerships with brokers/consultants • Separate reviews/RFPs for broker appointments from marketing to insurers – – – – Don’t just choose on price Look for range of services offered and innovation Think 5 year terms (3 yrs minimum) Do they have the expertise in Oman? • Managing the relationship – Clear understanding of role and timelines – Consider a ‘Service Level Agreement’ (SLA) – Carry out stewardship reviews at least annually Risk Management Services Proactive approach to claims • An often neglected aspect of insurance- this is after all why you buy it! • If you can, choose your loss adjuster • Establish a claims process- for major or minor • Educate your organisation on claims reporting • Track/monitor all claims (incl ‘near misses’) • Share experiences to drive future loss control Risk Management Services Conclusions • RM should be about maximising opportunities – Be Risk Aware, not risk averse • Keep it simple and relevant to the organisation – Avoid complicated processes and bureaucracy • Remember the origins of RM responded to Hazard or Insurable risk – Don’t take a short-term view – Understanding your risks enables creative, stable and long term risk financing solutions Risk Management Services Conclusions • RM should be about maximising opportunities – Be Risk Aware, not risk averse • Keep it simple and relevant to the organisation – Avoid complicated processes and bureaucracy • Remember the origins of RM responded to Hazard or Insurable risk – Don’t take a short-term view – Understanding your risks enables creative, stable and long term risk financing solutions – Choose your Risk Partners wisely! Risk Management Services Thank you! Ray Mattholie ray@rm-rm.com Risk Management Services Suggestions for Further Reading • A structured approach to ERM and the requirements of ISO 31000 – Airmic publication • Against the Gods- the remarkable story of risk – Peter L Bernstein • The Black Swan – Nassim Nicholas Taleb • Enterprise Risk Management for Dummies – RIMS Bookshop • Taipan – James Clavell • World Economic Forum Global Risk Review – www.weforum.org/docs/WEF_Global_Risks_Report15 Risk Management Services