European Unity

The last are risks that, until recently, companies did not even consider, and which insurance companies covered at very low cost.

Italy is close to the average of the companies covered by the survey, with two main differences: production processes are of greater importance (48%), but financial risks are seen as less important (11%). This shows that Italy still has a strong base in manufacturing, with production more important than the abstract financial dimension.

For British firms, the survey found that operational (35%) and financial risks (30%) were the most important, while French firms ranked financial and environmental risks joint second after operational ones (16%).

Looking ahead, 27% of companies see risks arising from complex rules and regulations (20%) and environmental risks (13%) growing in importance. In the UK, environmental risks come second to financial risks, which rank first (22% and 33% respectively). In Germany and Spain, financial risks predominate (37% and 36% respectively).

Projections for Italian companies, however, seem to go against this trend: operational risks rank first (50%), financial risks are increasingly downplayed (9%), while social-political risks are expected to increase (14%).

Adding Value
Corporate social responsibility (CSR) has a clear value to business, because intangible factors make up a substantial, even the majority, share of their value on the stock market, according to Bernard Giraud, director of sustainable development and corporate social responsibility for the multi-national food group, Danone.

At the forum, he explained: "More than half the group's market capitalisation consists of intangible assets, such as knowledge, trust, our people, and the way we use these resources to optimise our global performance. It is not possible to put a figure on the contribution of corporate social responsibility but it is part of the mixture."

This means, said FERMA president Thierry van Santen, that CSR is of critical importance to risk managers, because the social and environmental policies of their companies are not just a means of reducing problems, but also contribute to value creation. Throughout the conference, van Santen emphasised the role of risk management not just in reducing adverse developments, but in adding to the value of an enterprise.

He compared the position of CSR today with that of corporate governance a few years ago. "Then people were saying 'who cares?' about corporate governance, but now everyone has become a champion of corporate governance. Today, people have new expectations of business, and, as risk managers, we have to take account of them," said van Santen. "We need to anticipate where they may create problems and how they can be managed, but risk management also means more than this. It means working with our enterprises, with our suppliers and other stakeholders who share our views, to add value."

Business cannot remain aloof from the issues in a world in which 12% of the population own 86% of the wealth and consume 88% of the resources. "As global businesses, we cannot treat people differently because they are rich or poor."

Nichole Notat, the founder and CEO of VIGEO, a French agency for rating the CSR performance of business, told European risk managers that there is a growing demand from the investment community for an independent assessment of companies' performance, either as the basis of dedicated ethical investment funds or as part of an assessment of general management quality. In 2004, VIGEO expects to analyse the CSR performance of 600 European companies.

Uneven Reporting Standards
Faced with increasing demands to report their risks and risk management practices, major European companies have achieved reasonable levels of disclosure where their financial exposures are concerned, but their environmental and social management reporting performance is uneven, according to a report released at the forum.

Chris Lajtha and Pierre Bordage of the Schlumberger Risk and Insurance Management Team in Paris and students of the Institut de Management des Risques (IMR) at Bordeaux Business School, analysed the 2001 reports of 47 European public companies, with the aim of discovering how they communicate risk and their risk management activities.

Chris Lajtha explained that the companies were chosen on the basis that they had either raised capital on a European stock exchange during 2001, or that they were known to have had corporate risk management functions in the same year. Because risk reporting outside financial exposures is in its early stages, the students looked at social and environmental reports as an indication of the company's general approach, what is known in financial reporting as 'triple bottom line'.

"Managing waste and emissions, product stewardship, health and safety, human rights and so on, present significant exposures in terms of liability and potential impairment or enhancement to reputation. Such exposures, therefore, need to be included in any comprehensive or enterprise risk management profile," said Lajtha.

He emphasised the limitations of the study: it was only able to cover a restricted number of companies in each nationality and market segment, and was only concerned with the nature of risk reporting, not the underlying performance. However, it is intended to serve as the basis for further comparative analysis in future.

Companies were scored at zero where there was no mention at all of risk, uncertainty, or volatility, or where there was a perceived lack of credibility. The top score of 3 was given for extensive and/or highly credible reporting. Lajtha explained that the scoring method involved essentially subjective, qualitative assessments and has only limited use for making relative comparisons about reporting practices in 2001.

Financial reporting
The study looked at seven exposures: foreign exchange, interest rates, commodity prices, liquidity, credit exposure, employee benefit/pension fund adequacy and tax liability. The average total score on financial risk reporting was 1.8, with a range from 0.1 to 2.7. No companies scored 3 on all elements, but 11 were ranked 3 in at least five categories. No companies had zero in all categories.

Environmental performance
Eight criteria were considered: resource use, energy consumption, biodiversity, emissions, discharges to water, waste, environmental accidents and product cradle-to-grave stewardship. The average score was 1.3 and the range was from zero to 3. The Scandinavian airline SAS, scored 3 on all reporting criteria. Three companies had zero scores.

Social performance
For social performance, there were five criteria: labour practices (further broken down into health and safety, training and education, and diversity and opportunity), human rights, community impact and investment, political/charitable donations or sponsorship and product stewardship (consumer safety). The average score was 1.5 and the range was from 0 to 2.7. No companies had 3 for all criteria, two companies scored zero throughout.

Overall
In 2001, there was no clear relationship between the quality of financial, environmental and social risk reporting. Some companies provided excellent financial reporting but weak or negligible environmental or social reporting. A few disclosed little about their financial risks but had good ratings in the other categories. According to the team, this is likely to change as public companies come under increasing pressure to improve risk and risk management practice reporting.

PROTECTING THE BOTTOM LINE
A continuous process of risk management to assess and improve resilience can help companies manage their supply chain risks, according to David Ney, consultant, Willis. Speaking at a forum workshop on managing supply chain risks to protect your company's bottom line, Ney explained that 'full value' insurance is on the decline and that loss limited insurance requires better understanding of risk exposure. Availability of suppliers' cover, particularly for unspecified suppliers, has also reduced.

Ney suggested that risk managers ask the following questions:

POWER IS KEY
With increasing power consumption worldwide, vulnerability to a blackout is increasing, as demonstrated by recent incidents in the US and Italy. At the forum workshop on risk management strategies for privately financed power generation projects, Joachim Haaf, risk management director, RWE Utility, said that the main factors affecting risk management of power plants are: types of plants, phase of lifetime, size and dependencies, balance sheet strength, strategic targets, risk management as part of the business, and changing client needs. He stressed the importance for an overall risk management approach and saw this as an ongoing evolution from risk management towards integrated risk management or business continuity management, where integrated risk management is a systematic overall approach to all the risks a corporation and its business activities are facing.

RISK ENGINEERING - COSTS AND BENEFITS
How much should you spend in order to save? There is always a limit to the expenses and effort that it is worth putting into risk engineering, so decisions on implementing relevant actions may be reduced to a costs and benefit analysis, said Maurizio Castelli, director of group risk management, Pirelli, in the workshop session - Market uncertainties. Excellence in risk engineering and loss prevention is the answer. Costs are both direct (capital investments, manpower and materials for instituting and maintaining the process) and indirect (slowing of processes while installation takes place, interference with normal activities and possible disputes with trade unions). Direct benefits would be savings on insurance premiums, tax savings and other 'institutional' incentives, while indirect benefits could include reduction of the frequency or magnitude of non-insured and insurable losses, a contingent reduction of premiums in policies with a profit-sharing element, and 'softer' benefits in terms of productivity, trade union relations, public relations and image in the marketplace. Castelli described what Pirelli had achieved by its global property loss prevention programme.

At the same workshop, Martin Fessey, vice president, international operations, FM Global, gave a risk engineering perspective of underwriting. He said that there are two views. One is that all losses are inevitable, which is based on an actuarial approach focusing on past experience and assuming that what has happened will probably happen again. The other view - the risk engineering approach - is that most losses are preventable; that what has happened should not happen again; that the focus should be on future loss exposures. It depends whether you think that the past dictates the future or that the future can be changed. However, Fessey was able to point to major loss incidents in recent years where engineering solutions could have minimised losses. He said that a risk engineering perspective gives confidence to both insurers and clients in terms of risk information and quality, loss experience, retentions, transfer and control.

ADD VALUE TO EMPLOYEE BENEFITS PROGRAMMES
You need to define your objectives and ensure that your employee benefits programme is actively managed if you want to add value, stressed Livio Mocenigo of Watson Wyatt at a workshop on adding value to employee benefits programmes.

A pooling arrangement is an effective tool, on condition that good risk management principles are applied and that you deal effectively with the following issues :

THE RISK MANAGEMENT PARADOX
An interview with Roberto Bosco, president of the Italian association of risk managers and corporate insurance officers, and chairman of the 2003 FERMA Forum. He is also director, corporate risk management of Mediaset Group, the largest Italian commercial television network

It has been said that if the risk manager does the job well, the company appreciates him or her less, because either there are no problems or, if they do occur, they have limited consequences. How can we avoid this risk management paradox?

Bosco: The paradox does and will continue to exist because it is part and parcel of our job. But let me make a few distinctions. Historically, the risk management unit has been seen as a cost, not as a profit centre. Probably this is due to a lack of risk culture within companies. They have always perceived risk management as something related to insurance and, therefore, to the cost of insurance premiums.

Does this belief persist today?

Bosco: No. The most modern businesses, those following a real entrepreneurial approach, are gradually realising that risks are something to control before the crisis happens. Risk managers are frequently supervised by internal or external audit departments that ask them to show that the company has a risk planning policy that ensures a reasonable and balanced defence of the company's value to shareholders. In other words, risk management is gradually making its way into the corporate governance policy of the most advanced management models.

Risk managers are becoming increasingly specialised. Do you think this trend will continue?

Bosco: Yes. The complexity of the modern world and the development of competition are such that only highly specialised professionals can ensure a level of excellence. Risk management methodology has not changed. What changes, instead, is the typology of the risks and the tools to manage them. Imagine the difference between the management of risks in a pharmaceutical company and in a local authority.

You mention local authorities. How rooted is risk management culture in the public sector in Italy?

Bosco: Risk management is even less developed in the public sector than the private one. In Europe, the UK is the only country that has an association for risk managers in the private sector and one for risk managers in the public sector, and it has over 1200 members.

Despite the increase in natural catastrophes, September 11, the Enron and Worldcom scandals, Italian companies do not seem to be interested in risk-related issues. Why?

Bosco: Most companies lack a real risk culture. Moreover, the Italian economy is made up of mainly small and medium sized enterprises. In these organisations, entrepreneurs focus mainly on production and sales.

How are the technological revolution, climate change and social and political developments going to affect the way risk managers identify and assess risks?

Bosco: They basically mean constantly fine tuning, and searching for reliable calculation tools and mathematical methods to assess risks more scientifically.

Why, in your opinion, does a company choose to have a risk manager?

Bosco: Because it becomes aware of its vulnerability and has to adopt strategies aimed at maintaining its visibility without running the risk of damaging market share as a result of more or less unexpected events. The core business has to be protected from external factors, whatever they may be.

Do you think it possible that in the future it will become mandatory for companies to have a risk manager or at least a risk management consultant?

Bosco: I do not think so, at least in the short term. I am sure it will soon become indispensable to have a consultant, not just for the natural evolutionary process, but for competitiveness. If other firms have them and thanks to their work, they can tackle emergency situations of all kinds, those that do not are exposing their businesses to greater risk than others.