Risk Manager Focus

ERM: Concept to Reality

Risk managers share hard-learned lessons on implementing enterprise risk management.
By: | October 15, 2016 • 13 min read

Ask risk executives about the challenges of implementing an enterprise risk management program and they will tell you it’s no easy task.

“It’s definitely an uphill battle,” said Morgan Keane, general manager, enterprise risk management division, Port Authority of New York and New Jersey.

Advertisement




Michael Liebowitz, senior director of insurance and enterprise risk management at New York University, said it is “extremely” difficult.

“I had a lot more hair when I started,” he joked.

But for all of the difficulties, the rewards are immense. A study commissioned by RIMS found that companies with mature ERM programs boast a 25 percent higher shareholder value than those that do not.

The study by researchers at Queen’s University Management School and the University of Edinburgh Business School looked at the maturity of risk management efforts at companies from 2006 to 2011.

“For those entities that have not yet embraced ERM, the arguments to do so are compelling,” the researchers wrote in “Testing Value Creation Through ERM Maturity.”

Yet, it’s not an easy argument to make.

Michael Liebowitz, senior director of insurance and enterprise risk management, New York University

Michael Liebowitz, senior director of insurance and enterprise risk management, New York University

“How do you show the value of something that is not happening?” asked Keane.

“Mostly, I think of ERM as a cultural change within an organization in that I am trying to win hearts and minds of people, not just produce a great process,” she said.

When she began at the Port Authority, enterprise risk management was mostly an ad hoc process. And even though ERM began as a board-driven initiative, she focused on a bottom-up approach “because the culture of our organization does well with a grass-roots approach.”

She worked with every department to identify risks that “are usually within their ability to manage.” When there were successes, she shared them with other departments to demonstrate the value of ERM, until the word spread and her input was sought.

One of the lessons she learned along the way was the need to build relationships. “You have to talk to people in language they understand,” she said. “Language that resonates with them. One message for everybody does not work.”

Not everyone understands risk management from the perspective of a risk executive, she said.

Creating a risk library, she said, helps give business leaders a standard vocabulary. “When you identify the risk, you identify the root cause. That’s a standard language and everybody uses the same terms to describe the situation.

Making it as easy as possible for employees to discuss the likelihood and impact of a risk is important, Liebowitz said. He likes to use photos and plain language to share the complex ERM and risk management frameworks created by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and ISO 3100 by the International Organization for Standardization.

Gaining Buy-In

Making changes to an organization requires an understanding of the social systems within it, according to the “Harvard Business Review.” That involves letting employees at all levels of the organization propose solutions based upon “their own logic and clear pathways for change execution.” It requires making allies of key influencers and encouraging conversations about execution of the change.

Liebowitz said that “getting buy-in from strategic people [will] … help you advance a particular program or idea. First, you identify who those people might be. You get them to buy into the idea that ERM is something that an organization can find value in.

“Mostly, I think of ERM as a cultural change within an organization in that I am trying to win hearts and minds of people, not just produce a great process.” — Morgan Keane, general manager, enterprise risk management division, Port Authority of New York and New Jersey

“If there is value, then there’s a need and a want for it, and those people are easier to convince that maybe they want to take a chance,” he said. “What I am saying is, start small.”

Instituting ERM is increasingly a board-driven process. Nearly three-quarters of business leaders surveyed by the Enterprise Risk Management Initiative at North Carolina State’s Poole College of Management, said that boards of directors are asking for increased senior executive involvement in risk oversight. For large or public companies, the percentage is 88 percent.

Implementing ERM, however, needs to be a slow process, said Jack Hampton, professor of business at St. Peter’s University in New Jersey and former executive director at RIMS. It’s a common error, he said, to push too hard.

“What you see is, if you try to sell ERM across all departments, eyes really glaze over. … It doesn’t gain any traction,” he said. “The mistake risk managers make in-house is they talk about the big picture of all risks being managed without silos, in one comprehensive viewpoint,” he said. “That’s not how to explain it. You explain it by illustrating a story of how one group of people can do something.”

Hampton added, “The starting point is to find out what operating managers need to know in terms of information to manage what they perceive to be the key risks affecting their areas. If you approach it as a colossal task, it doesn’t work very well. You don’t put the system together by bringing everybody to the table at once.”

That’s what Liebowitz of NYU learned along the way to creating an ERM program that credit rating agencies have called best in class, he said.

After an initial attempt to convince the executive vice president of finance to implement an ERM program — who responded that it was a passing fad — Liebowitz cut back his focus to just one department, with the idea of using his success there as a selling point.

He chose the finance and treasury departments and worked with directors and managers to identify risks and mitigation strategies that “either brought efficiencies or identified potential exposures for the organization. And we fixed them,” he said.

That got the EVP’s attention, but it wasn’t until nearly two years later when the board’s audit committee approached the EVP to ask whether NYU had an ERM program, that the initiative really took off.

“Now, it looked like the greatest thing since sliced bread,” Liebowitz said.

Advertisement




“We put together a plan and began to roll out ERM throughout the operations division of the university,” he said. “It was about building traction to get this running.”

After successfully focusing on operations for about 18 months, the academic side invited him to develop an ERM strategy for a new academic site in China.

“We continue to roll out our program in the operations division and we rolled out ERM to a third of our other international [academic] locations,” he said, as the program reaches the 5-year mark.

Mistakes Will Be Made

John Phelps, director, business risk solutions, Blue Cross and Blue Shield of Florida, began his ERM program 17 years ago “before ERM was a household word. … I have made every mistake you can make with this,” he said.

“That’s the best instructor I have had, the mistakes I have made.”

John Phelps, director, business risk solutions, Blue Cross and Blue Shield of Florida

John Phelps, director, business risk solutions, Blue Cross and Blue Shield of Florida

A few of the lessons he has learned: “If certain levels of management are not ready for the ERM thing, they are just plain not ready. Sometimes it takes an end run or for them to observe successes in another area to bring them around.

“Another is without upper management endorsement of what you are doing, you can go nowhere. You are just having a nice exercise. To be sustainable, it has to be cultural.”

Phelps said he also learned that senior leaders give “much higher deference … to identifying and evaluating risk at a strategic level than at the operational level. That’s also where the greatest value of the ERM program can be exposed.”

He said that he unsuccessfully tried to “integrate risk-taking criteria into annual performance planning and the organization just would not do it. I tried it twice. … Me trying to turn a chicken into a duck isn’t going to get the job done. I backed off.

“It was two steps forward, one step back, in implementing something both conceptual and tactical within the organization in order to move up to the strategic level where the greatest value of ERM can be exploited,” he said.

Phelps said it took four or five years to convince his senior leaders to move to a rudimentary form of ERM 17 years ago. His persistence combined with a market event caused the leaders to endorse the initiative, he said.

Now, the ERM program includes a scorecard for the 10 most critical strategic risks over a one-to-three-year period. Each risk scorecard has key risk indicators on it, and each is owned by a senior vice president. He updates his board three times a year and updates the VP ranks quarterly.

“We are pretty focused at the strategic level trying to find the greatest value for our organization as we continue to work on supporting strategy development and strategy execution at the company. We are doing this in a post-Affordable Care Act environment, and a pretty dicey and dynamic market,” Phelps said.

“There is also the other side: It’s not just preventing something bad from happening. It’s understanding a project or an organization at a strategic level so you can be more successful. … We come along with ideas to help improve chances for success.

“I have made every mistake you can make with this. That’s the best instructor I have had, the mistakes I have made.” — John Phelps, director, business risk solutions, Blue Cross and Blue Shield of Florida

“No one will ignore you when you explain that we are trying to make them more successful,” he said.

Keane said one of the biggest lessons she learned was to “try things out. Fail fast and course correct.”

Liebowitz said the two biggest mistakes he made were “biting off more than I could chew and thinking that more was better. Now, I have a card on my desk that says, less is more.”

Answering the Call

Risk managers know their ERM initiative is built into the organization when their advice is sought, experts said.

“I’m getting calls instead of me calling people,” Keane said. “I’m getting invited to meetings instead of inviting myself.”

Liebowitz agreed: “You know you are successful when people want to come together to discuss risk.”

NYU’s program began as “an island in a vacuum,” he said. “Today, we collaborate at a very high level with internal audit. We exchange ideas back and forth. We do the same with our compliance department.”

He sees ERM as “a three-legged stool,” with ERM as the seat, atop the legs of compliance, internal audit and operational risk.

Morgan Keane, general manager, enterprise risk management division, Port Authority of New York and New Jersey

Morgan Keane, general manager, enterprise risk management division, Port Authority of New York and New Jersey

“That’s when you know the program is working right and you can identify risks and share risks and we’ve come to the point now where we jointly work on risks together,” he said. “This year, for the first time, we are going to provide to our governing body a combined risk map that will have compliance risks and operational risks together, instead of reporting separately,” he said.

Liebowitz noted, however, that some risk manager colleagues prefer not to work as closely with internal audit.

Succeeding at ERM is grounded on the achievements of traditional risk management, Liebowitz said. His risk management team has eight employees, including him. Two are focused on ERM.

The team places all insurance for the university and its medical center, except for some employee benefits. It has self-insured workers’ compensation, a captive, an extensive international program including construction, as well as other coverages.

“None of this [implementing an ERM program] could have happened unless there was trust in what the traditional risk management department was doing,” he said. “The organization needs to trust you and your expertise to identify what are the right risks.”

That means being able to differentiate between challenges at the organization, such as employee retention or recruiting, and issues that present real risks. It also means differentiating between risks that can be mitigated within a set period of months or years, and those continually on the risk register, such as cyber security or geopolitical risk.

Advertisement




“It’s just being one step ahead of the bad guys,” Liebowitz said.

As traditional risk management evolves into an ERM program, some risk managers use the RIMS Risk Maturity Model to measure their progress.

“It’s very helpful,” said Keane of the Port Authority. “It focuses the efforts of the [risk management] team so we don’t get pulled into so many different directions. It shows progress and can increase buy-in.”

The model characterizes the five-step evolution of ERM maturity — from ad hoc, initial, repeatable, managed and leadership — taking into account the degree of formality and effectiveness of the processes.

The RIMS research on linking shareholder value to ERM maturity found that two attributes of ERM maturity create the most value for organizations: performance management and ERM process management. They contribute 23 percent and 20 percent, respectively, to a firm’s valuation, according to the study.

ERM process management addresses both the downside of risk and the potential upside or opportunity, while performance management is the degree to which the organization is able to execute on the ERM vision and strategy.

“The maturity model is a tool,” Phelps said. “It’s not going to develop a program for you. It gives you a way to map out where the enterprise risk management program for a particular company is, and … where it should go.

“It takes ERM from abstract to tangible.”

Phelps, a former president of RIMS, said Blue Cross and Blue Shield of Florida used the RIMS model as a base to create its own framework that adds in some additional factors important to the organization.

Robust ERM Programs

Mature ERM programs are fairly rare. Even though most executives believe risks are becoming more complex, only one-quarter of business leaders say their organization has a “mature” or “robust” ERM program, according to the 2016 NC State study.

“This year we observe that the maturity of enterprise-wide risk oversight processes remains relatively stable at levels consistent with the past few years … ,” the report stated. “Most notably, organizations continue to struggle to integrate their risk oversight efforts with their strategic planning processes.”

It noted that large organizations, public companies and financial services companies were “significantly more mature” than other entities, but even there, only one-third of such companies say their programs are mature.

Nearly half of the companies targeted “insufficient resources allocated to ERM” and “other priorities that compete with ERM” as the main barriers to success.

Organizations have scarce resources, Keane said. That’s why it’s important to present a business case on the need for mitigation activities. “It must have a connection to the budget,” she said. “If you do a good job in the ERM risk register, you can use that to advocate for resources for further risk mitigation.”

Scarce resources and budgetary pressure make it an uphill battle to advocate for the purchase of technology — and that is a crucial element to ERM success, said Hampton.

Jack Hampton, professor of business, St. Peter’s University

Jack Hampton, professor of business, St. Peter’s University

“You need technology,” he said. “You can’t do ERM without it. … Managers need real-time access to the status of risks that are actively being monitored or managed. A risk management information system (RMIS) is a tool that is both efficient and cost-effective. It is silly to implement ERM without building on the right technology foundation.”

Liebowitz said NYU has a traditional RMIS system as well as an ERM system that houses all the data around the risks and shows historic changes in risk scoring and mitigation efforts. It also allows “risk owners” to self-monitor risks.

“It takes a lot of the human element out of a lot of things,” he said. “Instead of people sending emails or making phone calls, we let the system do it so we can spend more time doing the analysis work than the ‘chasing for information’ work.”

Creating a reporting structure for ERM is also important, he said.

NYU has several risk management and compliance committees at the operating level that funnel information into committees at the risk management, compliance or audit level. Those committees, in turn, report to a senior risk and compliance steering committee that reports to the board of trustees.

Advertisement




“Having the structure keeps everything orderly,” Liebowitz said.

“If someone is just starting out, the best thing I could say to them is, be organized. Be forward-thinking. Show value to your organization and just keep trying.

“There is a need, not only within our profession, but within your company and it will take time for them to realize what you are doing and then they will say, why weren’t you doing this before?” &

Anne Freedman is managing editor of Risk & Insurance. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Exclusive | Hank Greenberg on China Trade, Starr’s Rapid Growth and 100th, Spitzer, Schneiderman and More

In a robust and frank conversation, the insurance legend provides unique insights into global trade, his past battles and what the future holds for the industry and his company.
By: | October 12, 2018 • 12 min read

In 1960, Maurice “Hank” Greenberg was hired as a vice president of C.V. Starr & Co. At age 35, he had already accomplished a great deal.

He served his country as part of the Allied Forces that stormed the beaches at Normandy and liberated the Nazi death camps. He fought again during the Korean War, earning a Bronze Star. He held a law degree from New York Law School.

Advertisement




Now he was ready to make his mark on the business world.

Even C.V. Starr himself — who hired Mr. Greenberg and later hand-picked him as the successor to the company he founded in Shanghai in 1919 — could not have imagined what a mark it would be.

Mr. Greenberg began to build AIG as a Starr subsidiary, then in 1969, he took it public. The company would, at its peak, achieve a market cap of some $180 billion and cement its place as the largest insurance and financial services company in history.

This month, Mr. Greenberg travels to China to celebrate the 100th anniversary of C.V. Starr & Co. That visit occurs at a prickly time in U.S.-Sino relations, as the Trump administration levies tariffs on hundreds of billions of dollars in Chinese goods and China retaliates.

In September, Risk & Insurance® sat down with Mr. Greenberg in his Park Avenue office to hear his thoughts on the centennial of C.V. Starr, the dynamics of U.S. trade relationships with China and the future of the U.S. insurance industry as it faces the challenges of technology development and talent recruitment and retention, among many others. What follows is an edited transcript of that discussion.


R&I: One hundred years is quite an impressive milestone for any company. Celebrating the anniversary in China signifies the importance and longevity of that relationship. Can you tell us more about C.V. Starr’s history with China?

Hank Greenberg: We have a long history in China. I first went there in 1975. There was little there, but I had business throughout Asia, and I stopped there all the time. I’d stop there a couple of times a year and build relationships.

When I first started visiting China, there was only one state-owned insurance company there, PICC (the People’s Insurance Company of China); it was tiny at the time. We helped them to grow.

I also received the first foreign life insurance license in China, for AIA (The American International Assurance Co.). To date, there has been no other foreign life insurance company in China. It took me 20 years of hard work to get that license.

We also introduced an agency system in China. They had none. Their life company employees would get a salary whether they sold something or not. With the agency system of course you get paid a commission if you sell something. Once that agency system was installed, it went on to create more than a million jobs.

R&I: So Starr’s success has meant success for the Chinese insurance industry as well.

Hank Greenberg: That’s partly why we’re going to be celebrating that anniversary there next month. That celebration will occur alongside that of IBLAC (International Business Leaders’ Advisory Council), an international business advisory group that was put together when Zhu Rongji was the mayor of Shanghai [Zhu is since retired from public life]. He asked me to start that to attract foreign companies to invest in Shanghai.

“It turns out that it is harder [for China] to change, because they have one leader. My guess is that we’ll work it out sooner or later. Trump and Xi have to meet. That will result in some agreement that will get to them and they will have to finish the rest of the negotiations. I believe that will happen.” — Maurice “Hank” Greenberg, chairman and CEO, C.V. Starr & Co. Inc.

Shanghai and China in general were just coming out of the doldrums then; there was a lack of foreign investment. Zhu asked me to chair IBLAC and to help get it started, which I did. I served as chairman of that group for a couple of terms. I am still a part of that board, and it will be celebrating its 30th anniversary along with our 100th anniversary.

Advertisement




We have a good relationship with China, and we’re candid as you can tell from the op-ed I published in the Wall Street Journal. I’m told that my op-ed was received quite well in China, by both Chinese companies and foreign companies doing business there.

On August 29, Mr. Greenberg published an opinion piece in the WSJ reminding Chinese leaders of the productive history of U.S.-Sino relations and suggesting that Chinese leaders take pragmatic steps to ease trade tensions with the U.S.

R&I: What’s your outlook on current trade relations between the U.S. and China?

Hank Greenberg: As to the current environment, when you are in negotiations, every leader negotiates differently.

President Trump is negotiating based on his well-known approach. What’s different now is that President Xi (Jinping, General Secretary of the Communist Party of China) made himself the emperor. All the past presidents in China before the revolution had two terms. He’s there for life, which makes things much more difficult.

R&I: Sure does. You’ve got a one- or two-term president talking to somebody who can wait it out. It’s definitely unique.

Hank Greenberg: So, clearly a lot of change is going on in China. Some of it is good. But as I said in the op-ed, China needs to be treated like the second largest economy in the world, which it is. And it will be the number one economy in the world in not too many years. That means that you can’t use the same terms of trade that you did 25 or 30 years ago.

They want to have access to our market and other markets. Fine, but you have to have reciprocity, and they have not been very good at that.

R&I: What stands in the way of that happening?

Hank Greenberg: I think there are several substantial challenges. One, their structure makes it very difficult. They have a senior official, a regulator, who runs a division within the government for insurance. He keeps that job as long as he does what leadership wants him to do. He may not be sure what they want him to do.

For example, the president made a speech many months ago saying they are going to open up banking, insurance and a couple of additional sectors to foreign investment; nothing happened.

The reason was that the head of that division got changed. A new administrator came in who was not sure what the president wanted so he did nothing. Time went on and the international community said, “Wait a minute, you promised that you were going to do that and you didn’t do that.”

So the structure is such that it is very difficult. China can’t react as fast as it should. That will change, but it is going to take time.

R&I: That’s interesting, because during the financial crisis in 2008 there was talk that China, given their more centralized authority, could react more quickly, not less quickly.

Hank Greenberg: It turns out that it is harder to change, because they have one leader. My guess is that we’ll work it out sooner or later. Trump and Xi have to meet. That will result in some agreement that will get to them and they will have to finish the rest of the negotiations. I believe that will happen.

R&I: Obviously, you have a very unique perspective and experience in China. For American companies coming to China, what are some of the current challenges?

Advertisement




Hank Greenberg: Well, they very much want to do business in China. That’s due to the sheer size of the country, at 1.4 billion people. It’s a very big market and not just for insurance companies. It’s a whole range of companies that would like to have access to China as easily as Chinese companies have access to the United States. As I said previously, that has to be resolved.

It’s not going to be easy, because China has a history of not being treated well by other countries. The U.S. has been pretty good in that way. We haven’t taken advantage of China.

R&I: Your op-ed was very enlightening on that topic.

Hank Greenberg: President Xi wants to rebuild the “middle kingdom,” to what China was, a great country. Part of that was his takeover of the South China Sea rock islands during the Obama Administration; we did nothing. It’s a little late now to try and do something. They promised they would never militarize those islands. Then they did. That’s a real problem in Southern Asia. The other countries in that region are not happy about that.

R&I: One thing that has differentiated your company is that it is not a public company, and it is not a mutual company. We think you’re the only large insurance company with that structure at that scale. What advantages does that give you?

Hank Greenberg: Two things. First of all, we’re more than an insurance company. We have the traditional investment unit with the insurance company. Then we have a separate investment unit that we started, which is very successful. So we have a source of income that is diverse. We don’t have to underwrite business that is going to lose a lot of money. Not knowingly anyway.

R&I: And that’s because you are a private company?

Hank Greenberg: Yes. We attract a different type of person in a private company.

R&I: Do you think that enables you to react more quickly?

Hank Greenberg: Absolutely. When we left AIG there were three of us. Myself, Howie Smith and Ed Matthews. Howie used to run the internal financials and Ed Matthews was the investment guy coming out of Morgan Stanley when I was putting AIG together. We started with three people and now we have 3,500 and growing.

“I think technology can play a role in reducing operating expenses. In the last 70 years, you have seen the expense ratio of the industry rise, and I’m not sure the industry can afford a 35 percent expense ratio. But while technology can help, some additional fundamental changes will also be required.” — Maurice “Hank” Greenberg, chairman and CEO, C.V. Starr & Co. Inc.

R&I:  You being forced to leave AIG in 2005 really was an injustice, by the way. AIG wouldn’t have been in the position it was in 2008 if you had still been there.

Advertisement




Hank Greenberg: Absolutely not. We had all the right things in place. We met with the financial services division once a day every day to make sure they stuck to what they were supposed to do. Even Hank Paulson, the Secretary of Treasury, sat on the stand during my trial and said that if I’d been at the company, it would not have imploded the way it did.

R&I: And that fateful decision the AIG board made really affected the course of the country.

Hank Greenberg: So many people lost all of their net worth. The new management was taking on billions of dollars’ worth of risk with no collateral. They had decimated the internal risk management controls. And the government takeover of the company when the financial crisis blew up was grossly unfair.

From the time it went public, AIG’s value had increased from $300 million to $180 billion. Thanks to Eliot Spitzer, it’s now worth a fraction of that. His was a gross misuse of the Martin Act. It gives the Attorney General the power to investigate without probable cause and bring fraud charges without having to prove intent. Only in New York does the law grant the AG that much power.

R&I: It’s especially frustrating when you consider the quality of his own character, and the scandal he was involved in.

In early 2008, Spitzer was caught on a federal wiretap arranging a meeting with a prostitute at a Washington Hotel and resigned shortly thereafter.

Hank Greenberg: Yes. And it’s been successive. Look at Eric Schneiderman. He resigned earlier this year when it came out that he had abused several women. And this was after he came out so strongly against other men accused of the same thing. To me it demonstrates hypocrisy and abuse of power.

Schneiderman followed in Spitzer’s footsteps in leveraging the Martin Act against numerous corporations to generate multi-billion dollar settlements.

R&I: Starr, however, continues to thrive. You said you’re at 3,500 people and still growing. As you continue to expand, how do you deal with the challenge of attracting talent?

Hank Greenberg: We did something last week.

On September 16th, St. John’s University announced the largest gift in its 148-year history. The Starr Foundation donated $15 million to the school, establishing the Maurice R. Greenberg Leadership Initiative at St. John’s School of Risk Management, Insurance and Actuarial Science.

Hank Greenberg: We have recruited from St. John’s for many, many years. These are young people who want to be in the insurance industry. They don’t get into it by accident. They study to become proficient in this and we have recruited some very qualified individuals from that school. But we also recruit from many other universities. On the investment side, outside of the insurance industry, we also recruit from Wall Street.

R&I: We’re very interested in how you and other leaders in this industry view technology and how they’re going to use it.

Hank Greenberg: I think technology can play a role in reducing operating expenses. In the last 70 years, you have seen the expense ratio of the industry rise, and I’m not sure the industry can afford a 35 percent expense ratio. But while technology can help, some additional fundamental changes will also be required.

R&I: So as the pre-eminent leader of the insurance industry, what do you see in terms of where insurance is now an where it’s going?

Hank Greenberg: The country and the world will always need insurance. That doesn’t mean that what we have today is what we’re going to have 25 years from now.

How quickly the change comes and how far it will go will depend on individual companies and individual countries. Some will be more brave than others. But change will take place, there is no doubt about it.

Advertisement




More will go on in space, there is no question about that. We’re involved in it right now as an insurance company, and it will get broader.

One of the things you have to worry about is it’s now a nuclear world. It’s a more dangerous world. And again, we have to find some way to deal with that.

So, change is inevitable. You need people who can deal with change.

R&I:  Is there anything else, Mr. Greenberg, you want to comment on?

Hank Greenberg: I think I’ve covered it. &

The R&I Editorial Team can be reached at [email protected]