Immediate Vault Immediate Access

Putting Risk Management on the Front Line

Businesses in India expressed an overwhelming desire to approach risk management more strategically in this year’s Excellence in Risk Management India report, with 68% of respondents deeming “integrating risk management into strategic planning” their top priority. Today, managing risk intelligently is everyone’s responsibility—not just the company’s executives—and the question of how to enable risk management at the front line of defense (FLoD) was a key theme for Marsh’s “Enabling the First Line of Defense” panel discussion at the RIMS Risk Forum India 2019. Consistently taking the initiative is key to risk management, and panelists discussed a number of proactive strategies for enabling front-line employees to address risk.

Enabling the First Line of Defense

As risk responsibilities move to the front line, organizations will need to review how their risk framework can be adapted. To equip everyone to confidently handle risk, risk management needs to be more intuitive. Data and analytics can also play a significant role in making the process more collaborative, measurable and strategic. Backed by technology, many firms are now not only able to prevent downside risks, but have capitalized on new markets, opportunities and changes in demand.

Panelists expressed that risk management was not a priority for frontline staff like sales executives, who are more likely to be encouraged to meet sales KPIs. Reflecting on his time within financial services, panelist Sudip Basu, Hinduja’s group head of risk, said that during peak times, risk was not an important consideration, and rarely outweighed more immediate profit and success motivations. Of course, self-examination happens during down-turns, which the sector has experienced over several tumultuous decades, both in India and globally. Basu said that this was definitely the case after the global financial crisis.

Bake Risk Management into KRAs

One key activity that the panelists flagged was baking risk management into key responsibility areas (KRAs) so that risk management messaging cascades down to the front line and into business activities. However, the panelists also expressed concern about the level of monitoring being implemented alongside these KRAs, stressing the need for follow-through on good intentions and highlighting this as an area of development needed for success.

Celebrate Successes

Celebrating success is far from an unfamiliar concept, though firms may need to address how success is measured and at what level. According to panelist Jyotsna Sharma, Bridgestone India’s chief financial officer and head of IT, firms are very good at celebrating risk management successes at the senior levels, but not as good at recognizing it for front-line teams. Sharma said that it would be beneficial to build in small acknowledgements for front-line teams and employees who have done exceptional work, have been proactive or have demonstrated risk management best practices.

Acknowledge Incremental Gains

The panelists also stressed the importance of incremental gains. A  change in the front line’s perception of risk management is not likely to happen overnight. If only key milestones or large events are recognized, it could be harder to gain buy-in and ongoing support from teams on the ground. Much like celebrating wins achieved by the FLoD, acknowledging incremental gains helps the team to view the journey to success as a process, and could help FLoD initiatives to more easily gain momentum.

While the FLoD is traditionally associated with operational management, as risks grow increasingly complex and interrelated, risk management is no longer only the purview of control functions, particularly when major influences from regulatory and broader economic environment exist. Ensuring that there is adequate awareness of risks—while rewarding successes across various levels of the organization—is critical for organizations to cope with risk in the current business environment.

Marsh Tracks Top Captive Trends

The number of captive insurers continues to increase globally, from 5,000 in 2006 to more than 7,000 in 2016. Once formed primarily by large companies, the captive market has opened up to mid-size and small businesses. The industry is also seeing a trend in companies forming more than one captive, using them for cyber, political risk and other exposures, according to a recent Marsh report, Captives at the Core: The Foundation of a Risk Financing Strategy.

Organizations are seeing disruptions in a number of areas and are relying more on their existing captives, Marsh said. Because of their flexibility, captives are also being used to respond to market cycles and organizational changes such as mergers and acquisitions.

While North America and Europe still dominate in numbers of captives, other regions have shown more interest in the past three years. In Latin America, captive formation increased 11% in 2016, the study found.

Within the United States, there is more competition among domiciles and some of the newer domiciles are experiencing growth. The top-growing U.S. domiciles in 2016 were Texas, Connecticut, Nevada, New Jersey, Tennessee, and New York. Domiciles outside the U.S. seeing the most growth include Sweden, Guernsey, Singapore, Malta, and the Cayman Islands.
As organizations’ exposures increase in number, complexity and severity, shareholder funds generated by captives are becoming more important. According to Marsh:

For many clients, captives are at the core of their risk management strategy, going beyond the financing of traditional property/casualty risks.

Specifically, we are seeing an increase in parent companies using captive shareholder funds to underwrite an influx of new and non-traditional risks, including cyber, supply chain, employee benefits, and terrorism, as well as to develop analytics associated with these risks and fund other risk management initiatives.

Risk management projects funded by captive shareholder funds in 2016 included initiatives to determine capital efficiency and optimal risk retention levels in the form of risk-finance optimization; quantify cyber business-interruption exposures; accelerate the closure of legacy claims; and improve workforce and fleet safety/loss control policies.

For example, Marsh-managed captives used to address cyber liability increased by 19% from 2015 to 2016. Since 2012, in fact, cyber liability programs in captives have skyrocketed 210%.
“We expect to see a continued increase, driven in part by companies that are already strong captive users and by those that may have difficulty insuring their professional liability risks,” Marsh said.

Disruptive Technologies Present Opportunities for Risk Managers, Study Finds

PHILADELPHIA–Disruptive technologies are used more and more by businesses, but those organizations appear to be unprepared. What’s more, companies seem to lack understanding of the technologies and many are not conducting risk assessments, according to the 14th annual Excellence in Risk Management report, released at the RIMS conference here.

The study found an apparent lack of awareness among risk professionals of their company’s use of existing and emerging technologies, including the Internet of Things (IoT), telematics, sensors, smart buildings, and robotics and their associated risks. When presented with 13 common disruptive technologies, 24% of respondents said their organizations are not currently using or planning to use any of them. This is surprising, as other studies have found that more than 90% of companies are either using or evaluating IoT technology or wearable technologies and that companies in the United States invested $230 billion on IoT in 2016.

Another finding was that despite the impact disruptive technology can have on an organization’s business strategy, model, and risk profile, 60% of respondents said they do not conduct risk assessments around disruptive technologies.

“Today’s disruptive technologies will soon be — and in many cases already are — the norm for doing business,” said Brian Elowe, Marsh’s U.S. client executive leader and co-author of the report said in a statement. “Such lack of understanding and attention being paid to the risks is alarming. Organizations cannot fully realize the rewards of using today’s innovative technology if the risks are not fully understood and managed.” According to the study:

Organizations generally, and risk management professionals in particular, need to adopt a more proactive approach to educate themselves about disruptive technologies — what is already in use, what is on the horizon, and what are the risks and rewards. Forward-leaning executives are able to properly identify, assess, and diagnose disruptive technology risks and their impact on business models and strategies.

This lack of clarity presents opportunity for risk professionals. In fact, previous Excellence reports have indicated that C-suite executives and boards of directors want to know what risks loom ahead for their organizations and increasingly rely on risk professionals to provide that insight.

“As organizations adapt to innovative technologies, risk professionals have the opportunity to lead the way in developing risk management capabilities and bringing insights to bear on business strategy decisions,” said Carol Fox, vice president of strategic initiatives for RIMS and co-author of the report. “As a first step, risk professionals are advised to proactively educate themselves about disruptive technologies, including what is already in use at their organizations, what technologies may be on the horizon, and the respective risks and rewards of using such technology.”

One thing companies can do to manage risks associated with disruptive technologies is facilitate discussions through cross-functional committees—yet fewer companies, only 48%, said they have one, a drop from 52% last year and 62% five years ago.

Whether discussed in weekly, monthly, or quarterly organization-wide committee meetings, emerging risks — including disruptive technologies — need to be examined regularly to anticipate and manage the acceleration of business model changes. When risk is siloed, too often the tendency can be toward an insurance-focused approach to risk transfer rather than an enterprise approach that may lead to pursuing untapped opportunities.

The Excellence survey, Ready or Not, Disruption is Here, is based on more than 700 responses to an online survey and a series of focus groups with leading risk executives in January and February 2017.

Findings from the survey were released today at the RIMS 2017 Annual Conference & Exhibition. Copies of the survey are available on www.marsh.com<http://www.marsh.com> and www.rims.org<http://www.rims.org>.

Plan Now for the Political and Risk Landscape Ahead

With a new president in office in 2017, there are sure to be changes ahead for businesses in the United States. Yet of risk professionals surveyed, fewer than half are actively preparing. Organizations are expected to see impact in areas including regulation and enforcement strategies, a new national trade policy, and a potential rollback of Affordable Care Act (ACA) provisions, according to Marsh.

Speakers on Marsh’s webcast, The New Reality of Risk, noted that the new administration appears to favor deregulation across several industries including financial services, although a complete repeal of the Dodd-Frank Wall Street Reform and Consumer Protection Act is unlikely, said Arthur Long, a partner at Gibson, Dunn & Crutcher LLP. The Trump administration is also expected to reduce regulation in the energy industry and others.

Areas to watch, according to the webcast:

  • Regulation and Taxes
    Less regulation and lower taxes are the most significant changes that are expected next year, both of which are expected to benefit businesses, said Michael Poulos, president of Marsh Risk Consulting. A stronger dollar could also help larger companies with extensive operations overseas, while others could benefit from changes in credit and monetary policies.
  • Trade Policy
    Changes in trade policy — including a move away from free-trade agreements — could alter the trade credit market, said Michael Kornblau, Marsh’s US Trade Credit Practice leader. These changes could lead to balance-sheet pressures — including reductions in sales and working capital — on companies with more than half of their revenues outside of the US.
  • Health Care
    Meanwhile, the future of the ACA (commonly referred to as Obamacare) remains uncertain for health care organizations and employers, said Mark Karlson, Marsh’s US HealthCare Practice leader, as transition officials have made sometimes conflicting statements about whether they will pursue repeal, replacement, or amendment of the existing law. If any changes are made to the law, it may be some time before they take effect.
  • Cyber Risk
    The election also highlighted cyber risks for businesses, including the potential threat of hackers and the need to encrypt corporate emails, said Tom Fuhrman, Cybersecurity Consulting and Advisory Services Practice leader at Marsh Risk Consulting. Generally, cyber regulations are expected to focus more on ensuring effective risk management for businesses rather than the existence of specific controls.

Although uncertainty remains about many specific policy changes to be made under the new administration, businesses should be thinking about the potential effects of new policies on their operations. Among other steps, businesses should:

  • Stay up-to-date on policy and regulatory proposals from transition and administration officials and develop a post-election game plan that includes actions and strategies that can be taken in preparation for regulatory changes.
  • Assess how reliant they are on global economic models that could become further strained.
  • Plan to reassess their risk more frequently than they have in recent years, according to Marsh.
  • marsh-polling-questions-12-2016