ERM and the Art of War: Tactics
Part IV of a series exploring phrases and tactics from Sun Tzu’s* The Art of War to develop strategies for implementing ERM programs. This installment delves into Chapter IV: Tactics.
MAKE ERM, NOT WAR
Chapter IV: Tactics
- What is our current reputation?
- Do we have weaknesses in our current program?
- Do we have good news we can publish?
Art of War Key Principal: Inherent Advantages and Disadvantages: Understand, and guard against, the inherent disadvantage in every advantageous situation. (If it sounds too good to be true it probably is). Likewise, be alert to capitalizing on advantages that occur in distressed situations (Never waste a crisis).
If it sounds too good to be true it probably is, even if it is your own truth. We can be so impassioned about our ERM program, that we don’t recognize that it might have flaws and that our approach might be harming our reputation. What is your team’s reputation? Are you seen as problem solvers who efficiently deliver value? Or is your program overcomplicated and time consuming? I recommend that not only in the planning process, but that you regularly conduct a SWOT Analysis. Get the team together and some post-it-notes …
We will assess our organization, team and program — SWOT:
- Strengths: characteristics of the business or project that give it an advantage over others.
- Weaknesses: characteristics that place the business or project at a disadvantage relative to others
- Opportunities: elements that the project could exploit to its advantage
- Threats: elements in the environment that could cause trouble for the business or project
Out of this exercise you might come up with the following solutions: Expand our ERM panel to include a representative that is leading Strategic Planning, or produce a one page executive report that highlights how ERM would have prevented or mitigated unwanted events, or integrate ERM into one or more of the more high-profile initiatives.
But, no matter what good work you do, if others don’t know about the value you are delivering, you will never win the war!
Our Good News Plan:
While you’re building your program, begin to publish even the smallest of “victories”. It may be a positive result that your team has had outside of the ERM program – “we reduced the injuries in the foodservice group by 10 percent in the last year by conducting weekly meetings with line workers who led discussions on safety…” Get one of the workers to give a testimonial.
The idea is to publish often, tell real stories about how lives are impacted, and build your teams’ reputation as problem solvers. Then as you progress with delivering your “good news” messages about your ERM Program you will already have people’s attention and respect.
Publish often and in many forms: website, small posters, handouts, internal publications, and external publications.
Key Takeaway: Develop tactics that consider the advantages and disadvantages of your organization, your team, and your ERM program. Claim even the smallest victories and communicate them out often and through as many channels as possible. Focus your team on positively impacting people and solving problems.
Remember — it’s not Risk Management, it’s Change Management!* Sun Tzu was a Chinese military general, strategist and philosopher who lived in the Spring and Autumn Period of ancient China. _____________________________________________ Grace in the Workplace: How to gracefully bring together traditional risk management and change management techniques, and enterprise risk management concepts. Read more of Grace’s Sun Tzu series.
Risk Management Effectiveness: What Matters Most
People are always trying to glean the keys to success in risk management. Well, here’s what I know: No two successful practitioners are doing exactly the same thing. Nor are they following a template based strategy. What you can take away from that is that a) there’s no one right way to practice risk management, and b) the best risk strategies are those that are aligned with, if not custom designed to fit, the needs and priorities of the organizations for which they are intended.
What matters most in achieving risk management success? For starters, a thoughtfully cultivated risk culture is prerequisite to long term success. Keep in mind that your employees’ risk taking and risk-managing behaviors — without a specific design and strategy for your intended risk culture — will not likely be the behaviors or culture you most need and ideally desire. Therefore, communicating your expected culture is a pursuit of great value to your long term risk management effectiveness.
Here are 10 other items that, in my opinion, matter most in effectively managing risk. If you operate with these elements in place, you will be more likely to have an effective strategy that other leaders will both contribute to and enable through resources.
Downside Protection Job 1: The first priority is to make sure reasonably preventable loss is addressed through both mitigation and financing tactics. Management and governance rightly assume this is under foot.
Influence and Gumption: Every senior risk leader must have the respect to be heard and the gumption to push back on risk owners and stakeholders with whom they may disagree.
Consistency: With risk process and sub-processes being the way in which the work gets executed, it is essential that their use be consistently applied by all users.
Process Rigor: Processes that produce results and have impact require a rigorous approach to how they are designed, measured for effectiveness and continuously improved.
Data Interpretability: Reporting actionable information is a must for showing results and impact.
Communication Clarity: Beginning with a clear definition of risk itself, an entire sub-strategy for communicating your messaging will ensure you reach the right recipients at the right time with the right message.
Reliable Measurability: Not every risk can or should be quantitatively measured but when you do, make sure it is as believable as possible.
Value Creation: Recognizing and leveraging risk for gain is the necessary evolution of the discipline’s practitioners if they ever hope to move beyond the tactical.
Managing to Appetite and Capacity: Risk cannot be effectively managed without a clear view into how much risk you are taking, want to take and have the capacity to take or assume.
Aligning Risk and Performance: The penultimate outcome for risk professionals is they manage risk relative to performance. Alignment, if not integration, between these disciplines is essential to achieving short and long term goals.
Sure, there are other tactical elements of a good risk strategy and framework, but I believe they will naturally flow out of these elements when put into practice with the proper senior level mandate and regular reinforcement of strategy.
Read all of Chris Mandel’s Risk Insider contributions.
3 + 3: Theory of Risk
Anthony Valsamakis doesn’t just practice risk management, he wrote a book about it. And he doesn’t just consult with quants, he is one.
“Risk management has been in my blood for so long that I have to stop myself, otherwise I could go into a two-hour monologue,” said Valsamakis, whose career in the discipline goes back almost 35 years, to his first job with the Standard General Insurance Company.
In 1990, the London-based chairman of the Eikos Group received a doctorate in Business Economics. In 1992, “The Theory & Principles of Risk Management” was published, with Valsamakis the principal author, and is now in its 4th edition.
Valsamakis worked first with a carrier, then as a commodities broker, before taking up an academic post. The company he started in 1999, the Eikos Group, has a risk consulting arm, with clients in most industrial sectors, including the food, mining, forestry, industrial paper and packaging and banking industries. The group also includes a transportation risk brokerage and a Bermuda-based carrier.
“I think the idea of having a secure data base that everyone can access and can update at any moment is by far the best innovation that I can see happening in the information game.”
– Anthony Valsamakis, Chairman, Risk Financing Strategy, Eikos Group
For as long as he can remember, Valsamakis sought ways to get better information on the risks he underwrites, brokers or consults on.
“Over many years we’ve tried hard to increase the quality and timeliness of the information that enables us to do just that,” Valsamakis said.
Finally, it looks like Valsamakis has found a risk management information systems platform that enables him to do just that.
For the past year and a half, Valsamakis has been using a system developed by Riskonnect.
“What’s useful for me is that the platform basically resides within the client’s systems,” he said.
The information he needs to prioritize, depends on which client he is working with.
“By definition, depending on where I am working and what I am doing, risk management priorities are very different,” Valsamakis said.
The Riskonnect platform provides the necessary flexibility.
A mine, for example, could be in a location in Africa or South America with a high degree of political risk. A key risk for a furniture maker might be around trade secrets, the possibility that a disgruntled employee would leak a pricing catalogue to competitors. For a packaging manufacturer, their material supply chain is of the utmost importance, and so on.
For each client, Valsamakis can use Riskonnect platform and work with the client to compile the information that is most relevant to that client and its industry and enter that into a secure system.
“All of these are template facts that you can easily put into the Riskonnect system,” Valsamakis said.
The Riskonnect platform is housed within the client’s information technology system, and it is transparent enough, to give Valsamakis and his client access to the same sets of data.
“I think the idea of having a secure data base that everyone can access and can update at any moment is by far the best innovation that I can see happening in the information game,” he said.
Whose System Is It?
Valsamakis has been around long enough to know a few things about data and risk transfer. He’s seen a number of risk information management systems put out by brokers, for example, that he thinks are set up more for the broker’s business model than for the sharing of information.
Generally speaking, information about an insured’s risks come from the broker and the insured. The Riskonnect system works, according to Valsamakis, because it is designed to be adapted to the client, not the broker.
“I have seen efforts by brokers, for example, over the years to produce a type of risk information platform that becomes theirs,” Valsamakis said.
“It’s been a perennial problem in the industry, where depending on which broker you end up with, you’ll end up with system A, B or C,” he said.
The Underwriter Needs to Know
Using Riskonnect, Valsamakis encourages clients to be as transparent as possible, in order to give the most complete information to underwriters.
“For me the question is, ‘What is the volatility around the asset and can there be an impact on the balance sheet of our clients?’” he said.
“We need to describe this exposure in various contexts so that the underwriters know what they are covering,” he said.
It’s basic human psychology. If an underwriter doesn’t feel they are getting enough information about a particular risk, they will take a negative view of that risk.
The more accurate the information Valsamakis has about a client’s exposures, the better the pricing he gets from underwriters.
“If you were an underwriter putting your capital and risk and I gave you little information, you would actually be less inclined to look at the risk in favorable terms. There will be a natural inclination to downgrade it,” he said.
Where Valsamakis sees enormous value is in the Riskonnect system ability to tag which can be revisited at a later stage.
“It’s amazing how clients forget, in the passage of time, that there are profiles that have changed for better or worse.”
A Long-Term Investment
The Eikos Group invested significantly in the Riskonnect product and are taking it to a number of clients. The transparency of the system and the advantage it gives the Eikos Group and its clients with underwriters is in itself a business advantage over the competition.
“We made a decision as a small company, relatively speaking, to invest a lot of money in Riskonnect and be very proactive about it,” Valsamakis said.
“When I talk to executives I say we invested in it because it’s going to save our clients money. Better information will lead to a lower cost of risk,” he said.
“If I’m talking to someone at a high level, that’s fairly easily understood.”
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Riskonnect. The editorial staff of Risk & Insurance had no role in its preparation.