April 27 2006 Excellence in Risk Management III

April 27, 2006 Excellence in Risk Management III The Changing Face of Risk Management

Excellence in Risk Management Series n n n “Excellence in Risk Management I” studied the risk management practices of 30 top-performing risk managers in North America (2004) “Excellence II” examined the characteristics and practices of organizations that are implementing an enterprise-wide risk management program (2005) Using “Excellence I” and “Excellence II” as a foundation of understanding, “Excellence III” examines the changes occurring in risk management in the face of a dynamic risk environment Marsh 2

Rapid Evolution of Risk Management Marsh 3

The Risk Manager—New Skill Set Risk managers need to navigate through an increasingly wide array of new risks, requiring broader skill sets. New risks like terrorism, pandemics, energy, and supply-chain shocks are coming out of the woodwork; and management is looking for answers. Ability to communicate in simple language across functions and cultures on the potential of nontraditional risks, as well as handle the traditional world of hazard risk and insurance, is the key to success. Marsh 4

Excellence in Risk Management Series n n n A quantitative study Interviews with 866 RIMS members of mid- to large-size organizations Interviews were conducted by Greenwich Associates from December 2005 through January 2006 – Greenwich Associates is a leading research-based consulting firm serving the insurance and financial services industries Marsh 5

Who We Interviewed: Annual Revenues Marsh 6

Who We Interviewed: Annual Revenues Marsh 7

Who We Interviewed: Industry/Sector Affiliation Transportation (34) Construction (22) Oil & Energy (21) Mining, Metals, & Minerals (18) Automotive (17) Aerospace & Defense (17) Hospitality & Gaming (17) Professional Services (15) Sports, Entertainment, & Media (13) Nonprofit/Charitable/Religious (12) Agriculture (11) Marsh 8

Who We Interviewed: Years of experience in the RM field AVERAGE: 19 YEARS Marsh 9

Strategic, Progressive, and Traditional Risk Management n n n Level of risk management was determined by responses to adoption of various practices Methodology for defining Traditional, Progressive, and Strategic: Using reported implementation of various risk management practices, we divided the sample into four quartiles – The bottom quartile represents traditional – The middle two quartiles represent progressive – The top quartile represents strategic Marsh 10

Correlation Analysis Strong correlation to advanced risk management n n n Risk management is a key priority for company Company formally reviews risk management issues on a regular basis Company allocates sufficient resources to manage risk effectively Less than expected correlation to advanced risk management n Size of company n Experienced a previous loss n n Years of experience in risk management Company revenue Impact of SOX on risk management Company understands the risks facing the company Marsh 11

Levels of Risk Management Traditional Risk Management Progressive Risk Management n Risk Identification Traditional + n Loss Control n Alternative Risk Financing n Claims Analysis n Business Continuity n Insurance and Risk-Transfer Methods n Total Cost of risk n Education and Communication Strategic Risk Management Traditional + Progressive + n Enterprise-wide Risk Management n Indexing of Risk n Use of Technology Marsh 12

Comfort, Current State, and Importance Measures n Reflect input from 866 respondents and are quantified using a normalized point score – Comfort: We measured relative comfort for 19 different risk areas – Current State: We measured the level of implementation of 11 key risk management practices – Importance: We measured the relative importance of 19 different risk areas Marsh 13

Risks that are high in importance and low in comfort represent key opportunity areas Comfort Level With and Importance of Risks Marsh 14

Comfort vs. Current State of Risk Management Program Industry View Comfort Level Versus Current State of Risk Management by Industry Marsh 15

Company size is not a strong determinant of risk management sophistication Company Size Versus Level of Risk Management Marsh 16

Sophistication is related to the experience of the risk manager Years of Experience Versus Level of Risk Management Marsh 17

“Strategic” enables more aggressive risk-financing approach Firms’ Orientation Towards Risk Financing Marsh 18

Organizational support is key to embracing a strategic risk management approach Strongly Agree & Agree “Our company will keep analyzing risk. There is no doubt about that. It is not our highest priority right now, but it is important. ” Marsh 19

A strategic approach is supported by strong communications with senior management Strongly Agree & Agree “It is crucial to have senior management buy-in and understanding for any risk management function to be successful. ” Marsh 20

Risk Management Practices HIGH FUTURE IMPORTANCE RATING MID-LEVEL FUTURE IMPORTANCE RATING Emergency response, crisis management, business continuity plans n Risk identification, assessment, prioritization n Risk mitigation and loss control Marsh n n n Claims analysis coordinated with loss control Process to evaluate insurance and other risk-transfer methods n ERM program n Technology platforms to facilitate the risk management function n Measurement of the total cost of risk (TCOR) and benchmarking n Benchmarking of risk n n Communications and education LOWER FUTURE IMPORTANCE RATING Alternative risk financing 21

Risk Management Practices Significant Gaps—Current vs. Future Importance HIGH FUTURE IMPORTANCE RATING MID-LEVEL FUTURE IMPORTANCE RATING n Risk identification, assessment, prioritization Risk mitigation and loss control Marsh n n n Claims analysis coordinated with loss control ERM program n Technology platforms to facilitate the risk management function n Measurement of the total cost of risk (TCOR) and benchmarking Benchmarking of risk n n Emergency response, crisis management, business continuity plans n n n Communications and education LOWER FUTURE IMPORTANCE RATING Alternative risk financing Process to evaluate insurance and other risk-transfer methods 22

Risk Management Practices Transparency Strongly Agree & Agree Request full disclosure of commissions paid to broker Increase reviews of correspondence to verify pricing integrity Place more emphasis on checking the price provided by brokers directly with insurers Increase the number of buying relationships Seek more quotes from multiple brokers Marsh 23

Emerging risks will drive risk management evolution Marsh 24

Outside Perspectives Chief Financial Officers CFO Challenges n n n n } Build trust with investors, risk competence as buy-side attraction Ability to respond to complex, rapidly changing risks before they emerge Translating pain of SOX to gains in risk understanding, organizational efficiency Address board interest in broader risk management understanding CFOs Looking for Strategic Risk Leadership Fill advisory vacuum due to changing role of auditor Increased risk-based decision making High certainty in command control of reporting of numbers and disclosures Marsh Source: Mercer & Russell Reynolds Associates study, How CFOs are managing changes in roles and expectations 25

Positive Impact of Sarbanes-Oxley There have been a lot of negatives, mostly related to the excess workload; but in the end, Sarbanes is all positive. Marsh 26

Positive Impact of Sarbanes-Oxley Marsh 27

Positive Impact of Sarbanes-Oxley SOX has had a positive impact because once people have gotten beyond the internal controls issues, they (CEO/board members) are asking questions about broader risk management issues of the company. Marsh 28

Outside Perspectives Institutional Investors n n n Risk management not “top of mind” with buy-side institutions, however… …When discussed, importance resonates strongly, and there is recognition that an effective risk management program can improve company performance and earnings Major opportunity to improve communications with buy-side investors Marsh 29

Excellence in Risk Management Series Risk Framework: Is the organization able to answer the following questions at all times? n n n Does the firm’s senior management level know how much it is prepared to lose from all sources of risk over a given horizon (often a reporting period, but also over shorter horizons) to achieve its overall long-term financial objectives? Does the firm’s senior management level know where the top exposures are (both in terms of measured risks and non-measured uncertainties)? Is there an adequate understanding of the profile and mitigation of the potential losses from the top exposures? Marsh 30

Enhanced Risk Communication Marsh 31

Enterprise-wide Risk Management Implementation Status Marsh 32

Conclusions n n n Risk management “demand curve” is driven by emerging risks, changing environments, executive and financial stakeholder interest – Profession is poised to fill this need or lose risk management market share to other functions…. Demand for leadership in nontraditional risk areas is recognized by the profession and by executive/stakeholder leadership. It will help define the risk management value proposition. The profession will continue to handle traditional hazard/insurance risks as well – e. g. , terrorism, brand, intellectual property, business-continuity plan, pandemics, human capital Strategic risk management—ERM—shows tremendous potential with great expected benefits, but it is still in its infancy of implementation Marsh 33

The Risk Manager New Skill Set Risk managers today are not going to be able to sit in that seat five or ten years from now unless they have a totally different educational and skillset background. The financial background will have to be much stronger. If they don't have the strategic and financial background, they are not going to make it because they won't fit in the boardroom. Marsh 34

Putting This Survey to Practical Use! n n n Use this survey as a discussion, education tool to draw out C-suite and board members on risk management direction and risk appetite Conduct a self-evaluation or internal focus group with risk management function and key partners to discuss the current state and direction of your risk management program relative to survey findings as part of your strategic-planning process – How is your company-specific “risk/demand curve” developed? – What are your emerging risks? – What are the gaps between current capabilities and likely future needs? Begin preparations for more inquiries by third parties (Moody’s, S&P, investors, boards) on risk profile and response capabilities – How well is your leadership prepared for these questions? Marsh 35

Thank You! RIMS and Marsh are proud to have sponsored the Excellence in Risk Management III Survey The Risk and Insurance Management Society, Inc. (RIMS) is a not-for-profit organization dedicated to advancing the practice of risk management, a professional discipline that protects physical, financial and human resources. Founded in 1950, RIMS represents nearly 4, 000 industrial, service, nonprofit, charitable, and governmental entities. The Society serves over 9, 600 risk management professionals around the world. Marsh is part of the family of MMC companies, including Kroll, Guy Carpenter, Putnam Investments, Mercer Human Resource Consulting (including Mercer Health & Benefits, Mercer HR Services, Mercer Investment Consulting, and Mercer Global Investments), and Mercer specialty consulting businesses (including Mercer Management Consulting, Mercer Oliver Wyman, Mercer Delta Organizational Consulting, NERA Economic Consulting, and Lippincott Mercer). Copyright 2006 Marsh Inc. All rights reserved. Compliance # MA 6 -10322 36