Enterprise Risk Management: time to shift gear Enterprise Risk Management: time to shift gear

Chief Risk Officers of (re)insurance companies are presented with a long awaited opportunity to reposition the profile of their function and create value for customers, shareholders and the public at large but their departments need to evolve rapidly to cope with the challenges this entails.

Up until not many years ago, most (re)insurance companies were struggling with the idea of building a centralized organizational unit in charge of establishing, promoting and monitoring the enterprise wide risk management system.

After all, if risks are managed by the exact same people who take them, what’s the purpose of a dedicated Risk Management function other than fulfilling a regulatory requirement?

Such skepticism was due to a limited understanding of a few concepts, e.g.:

• risks need to be measured to ensure they do not exceed the overall capacity of the company, this is particularly important when long tail liabilities and financial markets’ volatility come into play
• risks vary significantly in terms of reward and capital requirements, therefore risk selection and prioritisation criteria are key to meeting business objectives
• risks are interconnected and may influence each other, no adequate response can be designed without understanding the full picture
• appropriate performance metrics and incentive systems are preconditions to “healthy” risk taking
• building generous capital buffers is not sufficient as some risk types are impossible to quantify and require a highly specialized analysis of root causes and appropriate mitigating measures

Just to make things worse, most Risk Management functions have been established as a spin-off of existing functions or shortly before/after other control functions (e.g. Compliance) without investing sufficient time in the clarification of respective accountabilities, alignment of agendas and coordination of processes and resources, thus generating confusion at Board and executive management level.

Over time, with different paces and levels of maturity, learning from errors and thanks to a more consistent and better understood set of regulations across geographies (Solvency 2 being a game changer in this respect), all (re)insurance companies have been moving away from the naive notion of risk management existing in the aftermath of the 2008 financial crisis.

Whereas, on one hand, this presents all CROs a long awaited opportunity to reposition the profile of their function and create value for customers, shareholders and the public at large, on the other hand, Risk departments need to evolve rapidly to deliver on their mission.

In fact, if earning the “seat at the table” was difficult, meeting all the expectations this entails is going to be way more demanding.

Successful Risk Management functions will show a clear understanding of the challenges their business is coping with and won’t hesitate to step outside their comfort zone to augment quality and impact of their contribution.

Whilst questioning the status quo may be uneasy, the end result is worth the effort: superior business outcomes and a more fulfilling career for all risk professionals.