Today's European risk manager

In March and April of 2008, StrategicRisk conducted a pioneering study of 150 risk managers in European business. Respondents from 19 countries – ranging from Ireland to Bulgaria and Portugal to Finland – completed a 28-point online questionnaire. To encourage plain speaking, all responses were treated on an anonymous basis.

One aim was to get risk managers’ comparative ratings for – and frank comments on – the brokers, insurers, ERM consultants and other service providers they used. But we also wanted to explore some crucial issues for today’s European risk manager, including key sources of frustration; time spent on risk financing as opposed to risk management; risk management’s influence at board level; risk managers’ powers in appointing service providers; worries over topical risk management issues; the use of different risk management standards; and companies’ key vulnerabilities.

What did Europe’s risk managers have to say on these themes? The full report – Today’s European Risk Manager – gives an analysis of the entire study, complete with a wealth of structured, verbatim comment from the 150 risk manager-respondents. This article, however, provides a brief overview.

Who responded?

From which countries and industries were our respondents drawn? A shade under half of them worked in the UK, with a further 11% from the Benelux countries, nine per cent from Scandinavia, six per cent from Austria or Switzerland and five per cent from France. Practically all of western Europe was represented.

Respondents’ industries reflected the UK’s heavily service-oriented economy. Risk managers from financial services, the media, business services, leisure and retail or property made up 41% of the UK respondent group. The figure from the rest of Europe was 22%. Manufacturing and engineering, by

contrast, accounted for 29% of non-UK respondents, but just 11% of UK ones. In most other sectors, however, the UK and non-UK splits were roughly comparable in size.

We also asked respondents to explain their reporting lines. Here, hardly any two companies were alike. While some risk managers had had to deal with near-continuous structural change, often under the influence of international M&A, others had had the same framework for years.

Sources of frustration

“Several said that there was too much meaningless risk assessment form-filling going on.

What frustrations are risk managers commonly experiencing in their work? We asked respondents: ‘What is your single biggest source of frustration as a risk manager?’ There was no shortage of comment here.

Many complained that they were not regarded as strategic advisers within their organisations and said that senior management had little apparent awareness of risk management and its long-term contribution to the health and performance of the business. One, for instance, spoke of the ‘failure of senior management to understand the links between expenditure on risk management and what we spend on insurance and claims. ‘Many felt isolated, sensed that they lacked the corporate prestige of other specialists and said they could get little time with senior management.

Even where the board did understand the value of risk management, often they still prioritised this year’s profit and loss figure. Getting resources for risk management was a battle and required an “irresistible, quantifiable” business case. One respondent specifically highlighted the operating profit-related incentives for senior management, which, in his view, ultimately increased the cost of risk.

Some were also upset at their inability to get middle managers and shop-floor personnel to genuinely engage with risk management. In too many companies, it seems, people just mechanically tick the boxes. Several said that potentially invaluable risk management data from within their company was ignored.

Relations with insurers and, to a lesser extent, brokers were also a source of friction. Several respondents said there was too much of a focus on this year’s pricing, to the exclusion of stability and long-term relationships. Others said their management was far too focused on insurance – particularly its price. The most common theme of all was frustration at the lack of a rational, coherent approach to risk throughout the organisation. In all, 119 risk managers commented on their frustrations. The following are some typical perspectives.

“That you are not accepted as a part of real strategic management… Open communication and thrust about strategic risk management is light years away. As the risk manager population, we have many battles to win.” – Risk Manager, Business/Professional Services.

“Lack of understanding by senior management of the contribution risk management can make to enhancing business performance. Accepting that risk exists is perceived by some as an admission of weak management, so risks are something to be avoided rather than actively managed.” – Director of Risk and Control, Outsourcing (IT and BPO).

“Lack of risk management data. A business will rarely agree to a risk management project without a cost-benefit analysis: eg what is the financial benefit of a formally-funded rehabilitation programme if the cost of that programme is £100k? Will it reduce injury claim values by £50k, £200k or some other figure?” – Group Insurance Manager, Construction.

“The title Risk Manager is a misnomer. Risk managers do not manage risk. Everyone in the organisation manages risk. The frustration – and the challenge – is the countering of the abdication of responsibility by senior managers, just because there is a ‘Risk Manager’ on the payroll.” – Group Business Risk Analyst & Internal Auditor, Construction.

“Continental risk managers said their risk management received less boardroom attention.

Financing, Standards

How much of their working week are Europe’s risk managers spending on risk financing, as opposed to risk management? We asked respondents to give their average weekly risk financing workload. There was a great deal of variation. While 21% spent four days or more of each working week on risk financing, 30% spent half a day or less. The average figure was two days a week. There was no noticeable difference between UK and continental respondents on this point.

What are we to make of this? On the one hand, almost 40% of respondents were spending a day a week or less on risk financing. On the other hand, 35% were spending three days a week or more on it. Within the broad umbrella of the ‘risk manager’ title, it seems, two types of risk managers – one concerned with financing/insurance and the others very much less so – are emerging.

But has the balance of these activities been changing? We asked respondents who had been in the same job for a year or more whether the amount of time they spent on risk financing had increased or decreased in the past 12 months. Only six per cent said that the amount of time they spent on risk financing had increased significantly in the past 12 months, while five per cent said it had decreased significantly. Almost half of respondents said it had stayed the same. Overall, 29% said it had increased, against 23% saying it had decreased. If the risk manager time spent on risk financing has increased in the past year, then, the increase has certainly not been uniform.

How, though, are companies’ boards relating to risk management and risk financing? We asked respondents whether risk management – as opposed to risk financing – was a board-level issue in their company. Answers revealed a distinct difference between UK and continental companies. Thirty-four per cent of British-based risk managers, but only 15% of continental ones, said that genuine risk management was a high priority at board level in their organisation. More than twice as many continental risk managers as UK ones said that their boards gave risk management marginal or no attention.

Part of the difference was probably down to industry groupings. A close look at the results showed the boards of financial services companies giving more attention to risk management, on the whole, than those of manufacturing companies – at least so far as their risk managers perceived it. But that did not account for all the difference. Comparing industry with industry, continental risk managers consistently said their risk management received less boardroom attention. However, analysing responses from countries as diverse as Turkey, Sweden, Poland and France as a single group has, of course, clear limitations. Of the 22 continental respondents reporting marginal or no board-level attention to risk management, four came from Belgium, four from Switzerland or Austria, four from Scandinavia – and none from either Germany or the Netherlands.

Burning issues

What topical issues are of genuine concern to risk managers? We asked respondents how worried they were about compliance issues, effectiveness of claims service, the insurance underwriting cycle, insurer service capabilities, broker transparency, the extent of their coverage, insurer solvency and insurer capacity. Options were ‘very worried’, ‘quite worried’, ‘slightly worried’ and ‘not at all worried.’

There was remarkably little consensus on any of these issues. Overall, the biggest concerns were the effectiveness of claims services, about which 45% of respondents were very or quite worried, and extent of coverage, about which 44% were very or quite worried: on extent of cover, only 21% said they were not worried at all.

“Potenitally invaluable risk management data from within their company was ignored.

The next most vexing issues were insurers’ service capabilities, compliance issues and broker transparency. Brokers and regulators alike could find ammunition in the responses: 37% of risk managers said they were very or quite worried about broker transparency, 30% said it worried them slightly, and 33% said they weren’t worried about it at all. The lowest overall levels of concern were for the underwriting cycle, insurer capacity and insurer solvency. Even in these three areas, however, 30-32% declared themselves very or quite worried, against 27-34% not worried at all, with anything from 37-40% ‘slightly worried’.

Calling the shots

While few risk managers have the boardroom influence they wish they had, they do seem to have the whip hand with another group: external service providers. We asked respondents: ‘In each of the following areas, how much influence do you feel you have on which company is selected: brokers, insurers, captive managers, claims consultants, risk management consultants, and risk management software providers?’ Options were ‘complete authority’, ‘a major influence’, ‘a moderate influence’, ‘a minor influence’; ‘no influence at all’; and ‘not applicable’.

Forty-four per cent of our respondents said they had complete authority over which brokers their company used, a further 34% a major influence. Where insurers were concerned, the figures were 39% and 31%. On the appointment of claims consultants, captive managers and risk management consultants, the proportions claiming complete authority or a major influence ranged from 77% to 68%. Across the board, only seven per cent (risk management consultants) to 21% (captive managers) said they had a minor influence or no influence at all. In many cases, these were risk or insurance managers whose responsibilities were limited by their place in the organisational structure.

Gaps in the armour

To get a sense of where risk managers felt their companies’ vulnerabilities lay, we asked: ‘In what area of risk management, above all, do you feel your company could be doing more?’ Some said their companies needed to do more on risk identification, loss prevention and the gathering and use of relevant data. Others believed they lacked the right systems and tools – particularly risk management software – to do their job. Several said that there was too much meaningless risk assessment form-filling going on – and that more needed to be done to convert employees to the true gospel of risk management.

Several said that their seniors just did not grasp the intimate link between risk management and risk financing. “We have not made the quantum leap that recognises that insurance is a method used to finance risk,” said one. Quite a few lamented their organisations’ failure to establish an accepted risk tolerance, or appetite for risk, and some felt they should be engaging with risk transfer and ART more effectively. One interesting suggestion was that companies should publish a standard risk management index, equivalent to their audited accounts. The following are some typical examples of the 97 comments risk managers offered here.

“Driving control self-assessment through the organisation, so that

people understand why the controls in place to manage risk are there and how good they are at it. I contrast this with declaratory of self-attestation exercises, which fail to engage and become form-filling.” – Head of Risk Assurance, Media

� risk managers in European business completed the questionnaire.

“Taking more interest pro-actively in major threats and giving more weight to defensive measures, e.g. pandemic. Escalation of global warming, natural threats and terror events have knock-on implications to business and day-to-day life.” – Insurance & Risk Manager, Healthcare/Pharmaceuticals.

“Moving from low-level operational risk management, focused largely on financial impact, to an ERM approach, implemented consistently across the organisation.” – Director of Risk Control, Service Outsourcing.

‘Value-added exercises such as contract management and investment in IT infrastructure that would assist the development of global risk management.’ – Risk & Insurance Manager, Manufacturing/Engineering.

Most comments related in some way to enterprise risk management (ERM), business continuity management (BCM) or crisis management. Many respondents seemed to be struggling to get risk integrated into key business processes, aligned with corporate strategy and reported on to executive management – in other words, to make ERM a reality. Risk managers, it seems, long to get away from reactive fire-fighting and go on the offensive with risk, preparing their organisations to deal with emerging threats. But until they can get a coherent ERM system in place throughout their companies, actively supported by senior management, that is liable to remain just an aspiration.

Tomorrow’s European risk manager

We would like to thank the 150 risk managers who participated in this study. Their input has provided penetrating insights into the realities of risk management in corporate Europe.

It has also exposed the relative performance of the insurers, brokers and consultants that compete for their custom. Respondents rated – and commented extensively on – 56 different well-known service providers, scoring FM Global the best insurer for overall product and service quality, Locktons the best broker and Oliver Wyman the best ERM consultant. This sort of frank, front-line feedback will, we hope, push service standards up the agenda.