ERM: Concept to Reality
Ask risk executives about the challenges of implementing an enterprise risk management program and they will tell you it’s no easy task.
“It’s definitely an uphill battle,” said Morgan Keane, general manager, enterprise risk management division, Port Authority of New York and New Jersey.
Michael Liebowitz, senior director of insurance and enterprise risk management at New York University, said it is “extremely” difficult.
“I had a lot more hair when I started,” he joked.
But for all of the difficulties, the rewards are immense. A study commissioned by RIMS found that companies with mature ERM programs boast a 25 percent higher shareholder value than those that do not.
The study by researchers at Queen’s University Management School and the University of Edinburgh Business School looked at the maturity of risk management efforts at companies from 2006 to 2011.
“For those entities that have not yet embraced ERM, the arguments to do so are compelling,” the researchers wrote in “Testing Value Creation Through ERM Maturity.”
Yet, it’s not an easy argument to make.
“How do you show the value of something that is not happening?” asked Keane.
“Mostly, I think of ERM as a cultural change within an organization in that I am trying to win hearts and minds of people, not just produce a great process,” she said.
When she began at the Port Authority, enterprise risk management was mostly an ad hoc process. And even though ERM began as a board-driven initiative, she focused on a bottom-up approach “because the culture of our organization does well with a grass-roots approach.”
She worked with every department to identify risks that “are usually within their ability to manage.” When there were successes, she shared them with other departments to demonstrate the value of ERM, until the word spread and her input was sought.
One of the lessons she learned along the way was the need to build relationships. “You have to talk to people in language they understand,” she said. “Language that resonates with them. One message for everybody does not work.”
Not everyone understands risk management from the perspective of a risk executive, she said.
Creating a risk library, she said, helps give business leaders a standard vocabulary. “When you identify the risk, you identify the root cause. That’s a standard language and everybody uses the same terms to describe the situation.
Making it as easy as possible for employees to discuss the likelihood and impact of a risk is important, Liebowitz said. He likes to use photos and plain language to share the complex ERM and risk management frameworks created by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and ISO 3100 by the International Organization for Standardization.
Making changes to an organization requires an understanding of the social systems within it, according to the “Harvard Business Review.” That involves letting employees at all levels of the organization propose solutions based upon “their own logic and clear pathways for change execution.” It requires making allies of key influencers and encouraging conversations about execution of the change.
Liebowitz said that “getting buy-in from strategic people [will] … help you advance a particular program or idea. First, you identify who those people might be. You get them to buy into the idea that ERM is something that an organization can find value in.
“Mostly, I think of ERM as a cultural change within an organization in that I am trying to win hearts and minds of people, not just produce a great process.” — Morgan Keane, general manager, enterprise risk management division, Port Authority of New York and New Jersey
“If there is value, then there’s a need and a want for it, and those people are easier to convince that maybe they want to take a chance,” he said. “What I am saying is, start small.”
Instituting ERM is increasingly a board-driven process. Nearly three-quarters of business leaders surveyed by the Enterprise Risk Management Initiative at North Carolina State’s Poole College of Management, said that boards of directors are asking for increased senior executive involvement in risk oversight. For large or public companies, the percentage is 88 percent.
Implementing ERM, however, needs to be a slow process, said Jack Hampton, professor of business at St. Peter’s University in New Jersey and former executive director at RIMS. It’s a common error, he said, to push too hard.
“What you see is, if you try to sell ERM across all departments, eyes really glaze over. … It doesn’t gain any traction,” he said. “The mistake risk managers make in-house is they talk about the big picture of all risks being managed without silos, in one comprehensive viewpoint,” he said. “That’s not how to explain it. You explain it by illustrating a story of how one group of people can do something.”
Hampton added, “The starting point is to find out what operating managers need to know in terms of information to manage what they perceive to be the key risks affecting their areas. If you approach it as a colossal task, it doesn’t work very well. You don’t put the system together by bringing everybody to the table at once.”
That’s what Liebowitz of NYU learned along the way to creating an ERM program that credit rating agencies have called best in class, he said.
After an initial attempt to convince the executive vice president of finance to implement an ERM program — who responded that it was a passing fad — Liebowitz cut back his focus to just one department, with the idea of using his success there as a selling point.
He chose the finance and treasury departments and worked with directors and managers to identify risks and mitigation strategies that “either brought efficiencies or identified potential exposures for the organization. And we fixed them,” he said.
That got the EVP’s attention, but it wasn’t until nearly two years later when the board’s audit committee approached the EVP to ask whether NYU had an ERM program, that the initiative really took off.
“Now, it looked like the greatest thing since sliced bread,” Liebowitz said.
“We put together a plan and began to roll out ERM throughout the operations division of the university,” he said. “It was about building traction to get this running.”
After successfully focusing on operations for about 18 months, the academic side invited him to develop an ERM strategy for a new academic site in China.
“We continue to roll out our program in the operations division and we rolled out ERM to a third of our other international [academic] locations,” he said, as the program reaches the 5-year mark.
Mistakes Will Be Made
John Phelps, director, business risk solutions, Blue Cross and Blue Shield of Florida, began his ERM program 17 years ago “before ERM was a household word. … I have made every mistake you can make with this,” he said.
“That’s the best instructor I have had, the mistakes I have made.”
A few of the lessons he has learned: “If certain levels of management are not ready for the ERM thing, they are just plain not ready. Sometimes it takes an end run or for them to observe successes in another area to bring them around.
“Another is without upper management endorsement of what you are doing, you can go nowhere. You are just having a nice exercise. To be sustainable, it has to be cultural.”
Phelps said he also learned that senior leaders give “much higher deference … to identifying and evaluating risk at a strategic level than at the operational level. That’s also where the greatest value of the ERM program can be exposed.”
He said that he unsuccessfully tried to “integrate risk-taking criteria into annual performance planning and the organization just would not do it. I tried it twice. … Me trying to turn a chicken into a duck isn’t going to get the job done. I backed off.
“It was two steps forward, one step back, in implementing something both conceptual and tactical within the organization in order to move up to the strategic level where the greatest value of ERM can be exploited,” he said.
Phelps said it took four or five years to convince his senior leaders to move to a rudimentary form of ERM 17 years ago. His persistence combined with a market event caused the leaders to endorse the initiative, he said.
Now, the ERM program includes a scorecard for the 10 most critical strategic risks over a one-to-three-year period. Each risk scorecard has key risk indicators on it, and each is owned by a senior vice president. He updates his board three times a year and updates the VP ranks quarterly.
“We are pretty focused at the strategic level trying to find the greatest value for our organization as we continue to work on supporting strategy development and strategy execution at the company. We are doing this in a post-Affordable Care Act environment, and a pretty dicey and dynamic market,” Phelps said.
“There is also the other side: It’s not just preventing something bad from happening. It’s understanding a project or an organization at a strategic level so you can be more successful. … We come along with ideas to help improve chances for success.
“I have made every mistake you can make with this. That’s the best instructor I have had, the mistakes I have made.” — John Phelps, director, business risk solutions, Blue Cross and Blue Shield of Florida
“No one will ignore you when you explain that we are trying to make them more successful,” he said.
Keane said one of the biggest lessons she learned was to “try things out. Fail fast and course correct.”
Liebowitz said the two biggest mistakes he made were “biting off more than I could chew and thinking that more was better. Now, I have a card on my desk that says, less is more.”
Answering the Call
Risk managers know their ERM initiative is built into the organization when their advice is sought, experts said.
“I’m getting calls instead of me calling people,” Keane said. “I’m getting invited to meetings instead of inviting myself.”
Liebowitz agreed: “You know you are successful when people want to come together to discuss risk.”
NYU’s program began as “an island in a vacuum,” he said. “Today, we collaborate at a very high level with internal audit. We exchange ideas back and forth. We do the same with our compliance department.”
He sees ERM as “a three-legged stool,” with ERM as the seat, atop the legs of compliance, internal audit and operational risk.
“That’s when you know the program is working right and you can identify risks and share risks and we’ve come to the point now where we jointly work on risks together,” he said. “This year, for the first time, we are going to provide to our governing body a combined risk map that will have compliance risks and operational risks together, instead of reporting separately,” he said.
Liebowitz noted, however, that some risk manager colleagues prefer not to work as closely with internal audit.
Succeeding at ERM is grounded on the achievements of traditional risk management, Liebowitz said. His risk management team has eight employees, including him. Two are focused on ERM.
The team places all insurance for the university and its medical center, except for some employee benefits. It has self-insured workers’ compensation, a captive, an extensive international program including construction, as well as other coverages.
“None of this [implementing an ERM program] could have happened unless there was trust in what the traditional risk management department was doing,” he said. “The organization needs to trust you and your expertise to identify what are the right risks.”
That means being able to differentiate between challenges at the organization, such as employee retention or recruiting, and issues that present real risks. It also means differentiating between risks that can be mitigated within a set period of months or years, and those continually on the risk register, such as cyber security or geopolitical risk.
“It’s just being one step ahead of the bad guys,” Liebowitz said.
As traditional risk management evolves into an ERM program, some risk managers use the RIMS Risk Maturity Model to measure their progress.
“It’s very helpful,” said Keane of the Port Authority. “It focuses the efforts of the [risk management] team so we don’t get pulled into so many different directions. It shows progress and can increase buy-in.”
The model characterizes the five-step evolution of ERM maturity — from ad hoc, initial, repeatable, managed and leadership — taking into account the degree of formality and effectiveness of the processes.
The RIMS research on linking shareholder value to ERM maturity found that two attributes of ERM maturity create the most value for organizations: performance management and ERM process management. They contribute 23 percent and 20 percent, respectively, to a firm’s valuation, according to the study.
ERM process management addresses both the downside of risk and the potential upside or opportunity, while performance management is the degree to which the organization is able to execute on the ERM vision and strategy.
“The maturity model is a tool,” Phelps said. “It’s not going to develop a program for you. It gives you a way to map out where the enterprise risk management program for a particular company is, and … where it should go.
“It takes ERM from abstract to tangible.”
Phelps, a former president of RIMS, said Blue Cross and Blue Shield of Florida used the RIMS model as a base to create its own framework that adds in some additional factors important to the organization.
Robust ERM Programs
Mature ERM programs are fairly rare. Even though most executives believe risks are becoming more complex, only one-quarter of business leaders say their organization has a “mature” or “robust” ERM program, according to the 2016 NC State study.
“This year we observe that the maturity of enterprise-wide risk oversight processes remains relatively stable at levels consistent with the past few years … ,” the report stated. “Most notably, organizations continue to struggle to integrate their risk oversight efforts with their strategic planning processes.”
It noted that large organizations, public companies and financial services companies were “significantly more mature” than other entities, but even there, only one-third of such companies say their programs are mature.
Nearly half of the companies targeted “insufficient resources allocated to ERM” and “other priorities that compete with ERM” as the main barriers to success.
Organizations have scarce resources, Keane said. That’s why it’s important to present a business case on the need for mitigation activities. “It must have a connection to the budget,” she said. “If you do a good job in the ERM risk register, you can use that to advocate for resources for further risk mitigation.”
Scarce resources and budgetary pressure make it an uphill battle to advocate for the purchase of technology — and that is a crucial element to ERM success, said Hampton.
“You need technology,” he said. “You can’t do ERM without it. … Managers need real-time access to the status of risks that are actively being monitored or managed. A risk management information system (RMIS) is a tool that is both efficient and cost-effective. It is silly to implement ERM without building on the right technology foundation.”
Liebowitz said NYU has a traditional RMIS system as well as an ERM system that houses all the data around the risks and shows historic changes in risk scoring and mitigation efforts. It also allows “risk owners” to self-monitor risks.
“It takes a lot of the human element out of a lot of things,” he said. “Instead of people sending emails or making phone calls, we let the system do it so we can spend more time doing the analysis work than the ‘chasing for information’ work.”
Creating a reporting structure for ERM is also important, he said.
NYU has several risk management and compliance committees at the operating level that funnel information into committees at the risk management, compliance or audit level. Those committees, in turn, report to a senior risk and compliance steering committee that reports to the board of trustees.
“Having the structure keeps everything orderly,” Liebowitz said.
“If someone is just starting out, the best thing I could say to them is, be organized. Be forward-thinking. Show value to your organization and just keep trying.
“There is a need, not only within our profession, but within your company and it will take time for them to realize what you are doing and then they will say, why weren’t you doing this before?” &
Bodily Injury Definition at Crux of ‘Pill Mill’ Suit
In June 2012, West Virginia sued H.D. Smith and other pharmaceutical companies, accusing them of contributing to the state’s prescription drug abuse epidemic that costs it hundreds of millions of dollars each year. The state asked for a court order barring them from distributing controlled substances.
West Virginia accused H.D. Smith of distributing “huge quantities” of opioids and other drugs to “pill mills” — pharmacies that distributed the drugs “to fuel and profit from the citizens’ addictions,” according to court documents.
H.D. Smith sought defense and indemnification from its general commercial liability insurer, Cincinnati Insurance Co., saying the policy was triggered “because of bodily injury” coverage.
The insurer sought a judicial determination that the policy did not cover the claim, and the U.S. District Court for the Central District of Illinois agreed, saying the state was seeking “economic damages” resulting from the drug epidemic.
On July 19, the U.S. 7th Circuit Court of Appeals, reversed the decision, ruling that West Virginia’s allegation that it spent money caring for drug-taking citizens who suffered bodily injury is no different than the claim of a mother seeking payment on a claim relating to her taking care of her son’s drug-induced injuries.
The state, it said, alleged that H.D. Smith “ ‘interfered with the right of West Virginians to be free from unwarranted injuries, addictions, diseases and sicknesses.’ H.D. Smith’s actions caused West Virginia to spend money ‘addressing and combating the prescription drug abuse epidemic.’ ”
Scorecard: Cincinnati Insurance must provide a defense to H.D. Smith on the state’s lawsuit.
Takeaway: The court said the policy’s phrase “because of bodily injury” provided broader coverage than if the policy covered damages “for bodily injury.”
Court: Broker Lied About Investigations
In 2014, executive professional insurance consultants (executive) was sued by AZ Air Time, an indoor trampoline park, after finding out it had no liability insurance following three personal injury lawsuits, although it had paid premiums for the coverage. Executive sought a defense from Admiral Insurance Co., which had issued a professional liability insurance policy.
The insurance company denied coverage, contending that Executive lied in its application when asked whether any agency personnel had been the “subject of complaints filed, investigations and/or disciplinary action by any insurance or other regulatory authority or convicted of criminal activity.”
In fact, Cynthia Rose-Martin, co-owner of the brokerage, voluntarily surrendered her license and was fired from another brokerage in 2010 after an Arizona Department of Insurance investigation on allegations of fraud and embezzlement. She was accused of enrolling clients in AFLAC supplemental coverages without their consent or knowledge, according to court documents.
In 2012, the DOI investigated another claim that Rose-Martin asked a client to provide a “blank check that could not include the word ‘void’ on the check.” She later agreed to a consent judgment that she engaged in “fraudulent, coercive or dishonest practices” as well as forged another’s name to a document relating to an insurance transaction. She was fined $2,500.
On Aug. 10, the U.S. District Court for the District of Arizona granted Admiral Insurance Co.’s request to rescind the policy for the firm, whose owners reportedly fled to Mexico after AZ Air Time filed suit against them.
Scorecard: Admiral Insurance does not have to provide a defense to the brokerage.
Takeaway: The policy to the brokerage would not have been issued if it had disclosed the Department of Insurance investigations.
Court Rules on Defective Product Coverage
In the spring of 2010, three customers of phibro animal health corp. reported to the company that its Aviax II feed additive, which was designed to prevent a parasitic disease in chickens, stunted the growth of their chickens. Phibro filed notice of a potential liability claim with Chartis Insurance Co., an affiliate of National Union Fire Insurance Co., which had issued commercial general liability and umbrella insurance policies. Phibro eventually settled the claims of the three customers.
On June 24, 2014, the court dismissed the case, concluding that the losses did not constitute “property damage” caused by an “occurrence,” because the chickens “were not physically injured and were subsequently sold for human consumption,” albeit at a lower price because of their smaller size.
The Superior Court’s appellate division reversed, in part, noting that “an accident” was part of the policy’s definition of “occurrence.”
“A manufacturer naturally would not have wanted to market this feed additive if it knew in advance its customers’ chickens would experience such an undesirable reaction,” the court ruled on July 14.
It rejected the insurer’s argument that the adverse side effects could have been foreseen and that the incident resulted in only economic losses. “The term ‘physical injury’ under the policies does not require that the property that is damaged be unsalable,” it said.
The court returned the case to the lower court to determine whether the chickens could have been “restored to use” if given more time before slaughter, which could exclude coverage under the “impaired property” clause.
Scorecard: Depending on additional proceedings, Phibro may be covered for losses associated with its feed additive.
Takeaway: The ruling casts doubt on the state’s prior rulings that a policyholder’s defective products are excluded from coverage. &
$1 Million Theft Excluded from Coverage
In July 2012, John Moon, one of the owners of Alphacare Services Inc., which performed payroll services for Construction Contractors (Contractors), told Contractors that AlphaCare did not have enough assets to pay payroll, taxes or benefits expenses for Contractors’ subscribers.
Eventually, auditors informed Contractors that Moon (who was charged in May 2016 by the U.S. Attorney’s Office and is awaiting trial for wire fraud) had wire-transferred about $930,000 from Construction Contractors’ funds to use for personal and AlphaCare expenses, leaving the company with substantial unpaid tax liabilities, according to court documents.
On Jan. 10, 2013, Contractors purchased a crime insurance policy, which included coverage for employee theft, from Federal Insurance Co. It advised the insurer there was still about $1 million that was unaccounted for.
Contractors later discovered the missing $1 million was stolen by check, and it submitted a claim for that amount with the carrier, according to court documents.
Federal Insurance denied the claim, saying all of the losses were a single loss under the policy because the insured had already discovered there was a loss prior to taking on the policy.
After a hearing in the U.S. District Court for the Northern District of Ohio at Toledo, the court agreed.
On July 11, the U.S. 6th Circuit Court of Appeals upheld the decision.
“Because Construction Contractors discovered the wire fraud prior to the policy’s execution and the check theft and wire fraud constitute a single loss, the check-theft loss is excluded from coverage under the policy,” the court ruled.
Scorecard: The insurance company does not need to pay the $1 million theft claim.
Takeaway: The insured was aware of the loss “even if ‘the exact amount or details … are unknown.’ ”
Ruling Modifies ‘Care, Custody and Control’
In January 2013, Texas Trailer Corp., under the direction of the American Bureau of Shipping (ABS), tested a container designed by EPMP Ltd. and SandCan LLC to store and deliver sand from a mine to a well site.
Applying excess weight to the container deformed the corner castings and subsequent tests deformed the container, eventually causing a crack in the corner casting weld. The crack constituted a failure of the certification test.
EPMP and SandCan sued both Texas Trailer and ABS for damages. Texas Trailer (TTC) sought a defense from National Union Fire Insurance Co., but the insurer said the policy did not cover the damage.
After a jury found that only ABS had been negligent, not Texas Trailer, TTC sued National Union for reimbursement of litigation costs in excess of its $100,000 per occurrence retained limit, and breach of contract. The carrier sought a summary judgment on the trailer company’s claims.
On June 28, the U.S. District Court in the Northern District of Texas ruled in favor of National Union.
At issue was whether an exclusion for damage of property in the “care, custody or control” of the insured excluded coverage of the claim. The insured argued the container was only within its “physical control,” and not its “care, custody or control.”
The insurer “need only show that the property was ‘under the immediate supervision of the insured and [was] a necessary element of the work involved,’ ” the court ruled. “ABS may have designed the tests, but TTC actually performed them.”
Scorecard: National Union was not required to pay Texas Trailer’s litigation costs.
Takeaway: TTC’s argument that it acted under ABS’ guidelines was not sufficient to prevent the court from ruling that TTC had “care, custody or control” of the container.
The Meaning of ‘Collapse’
In 2014, renovations at the Masters Apartments revealed “substantial structural impairment” due to decayed rim joists.
CHL LLC, owner of the Seattle apartment complex, submitted a claim to American Economy Insurance Co., which had issued commercial property insurance from 1999 to 2005. An engineer hired by the insurer said the structural damage occurred between 1999 and 2002, and that a building inspector would classify it as a “dangerous” building.
American Economy denied CHL’s claim, saying the damage did not trigger coverage, as “collapse,” as defined by the policy from 2002 to 2005, required the building to fall down or be in imminent danger of falling down for a claim to be paid. (Prior to 2002, the term “collapse” was undefined.)
The insurance company filed a lawsuit in the U.S. District Court for the Western District of Washington at Seattle seeking a judgment that it did not need to indemnify the claim.
On July 7, the court ruled in favor of the insurance company and dismissed the case.
Given that Masters Apartments remained upright for 12 years after the apparent decay occurred, the court ruled, the building did not reach a state of collapse between 1999 and 2002, when American Economy provided coverage.
Scorecard: The insurance company did not need to pay for renovations to the apartment complex.
Takeaway: Depending on the state, interpretation of “collapse” can range from a building that has a non-imminent substantial impairment of structural integrity to a building that has actually fallen down.