Facing the facts

It sometimes seems the faith in risk management to solve the world’s problems is inversely proportionate to its success in tackling them. So, while the list of crises that it has neither prevented nor effectively mitigated piles up, the profile of the discipline continues to rise not just at the corporate level, but nationally and globally as well.

The contradiction is captured perfectly by the World Economic Forum’s annual Global Risks Report, which is itself evidence of the growing acceptance that risk management can be applied to identify, assess and ultimately mitigate risks of a national and global scale. However, while there’s increasing support for that argument, the report was founded five years ago partly in reaction to the increasing frequency with which disasters seemed to strike, despite risk management’s best efforts.

In the past major disasters with global impacts would strike perhaps once a decade; “now it seems to be every six months,” says Dr Erwann Michel-Kerjan, managing director of the Wharton Risk Management Center, which helps produce the report, and chairman of the OECD High Level Advisory Board on financial management of large-scale catastrophes.

“We seem to have entered a new era of catastrophes,” as he puts it.

Little and large

Of course, risk management is not to blame for that, and it’s clear that the skills in industry do indeed have a role to play in some of our biggest challenges. That is perhaps most obvious when it comes to risk transfer solutions for natural disasters – and, closely linked to that, climate change.

Insurance is already a big part of the debate for businesses and households adapting, but it is also increasingly playing a role at a national and even regional continental level as countries consider macro insurance solutions. It is, as Reto Schnarwiler, head of public sector at Swiss Re, explains, the result of a change in mindset: “Governments have traditionally dealt with natural disasters only after they happen,” he says. “Now, many are seriously looking at the risk landscape, trying to assess the risks they face, and in areas such as natural disasters and increasingly climate change, thinking about mitigation and adaption.”

There are numerous examples. In 2008, for instance, Swiss Re joined with the World Bank’s International Development Association to issue a weather derivative protecting farmers in Malawi against the loss of maize production due to drought. In Mexico, a US$290 million cat bond insures against earthquake and hurricanes, while state owned reinsurance company Agroasemex uses spectral analysis of daily satellite images to insure small cattle ranchers against feedstock lost from their pastures. And while it’s not just developing nations involved (it was, after all, the UK that saw the first cat bond covering peak flood), for poorer and emerging countries these schemes could be the beginnings, says Schnarwiler, of a major part in the fight for food security – what he terms “a risk reduction revolution for farmers” that in turn has the potential to attract more investments into the sector.

And so with the very large, also with the very small: micro-insurance is increasingly playing its part in the developing world – not just in terms of cover for crop production, but also, more commonly, with health and life cover. As Microinsurance Network coordinator Véronique Faber, explains, it is a tool focused on financial inclusion, not development, but by providing the protection for families to enable them to build up an asset base that unexpected shocks would otherwise destroy it serves a function there.

“In some ways it is a poverty alleviation device,” she says.

Crucially, though, it’s not just the cover insurance and ART provides. As Reto puts it, “Mitigation and adaption go hand in hand.” As both governments and individuals look to risk transfer mechanisms, the involvement of insurers necessarily reinforces the trend towards adoption of a risk management approach. Indeed, for some, the impact insurers have in changing attitudes in this way is one of their key roles.

Look back to the early fire codes, for instance, says David Thomson, director of policy at the Chartered Insurance Institute, and it was pressure from insurers that saw the push to assess and address the risk after the great fires that desecrated cities throughout the 17th century.

“That was very much an example of how the insurance industry can shake people’s behaviour in the interests of risk management,” he says. Today, pressure from insurers to avoid building on areas prone to flooding is simply a modern day manifestation of the same thing, he argues.

Whatever the case, governments are increasingly convinced of the approach. We are still, perhaps some way from the country risk officers the WEF report advocates: a single point of contact and coordination for managing big risks, but the evidence of high-level adoption of a risk management approach isn’t hard to find, from Britain’s National Risk Register, to the Department of Homeland Security in the US or the Risk Assessment and Horizon Scanning (RAHS) system in Singapore. Risk management has entered the popular consciousness.

“Ten years ago if you were in the insurance industry you were familiar with the term, but now everybody is talking about the role of risk management,” says Michel-Kerjan.

Winning the argument, losing the war?

There are, though, limitations.

For a start, not everyone is convinced how solid governmental commitment actually is. Look, for instance, says Thomson, at the struggle towards developing a European Systemic Risk Board. “The insurance industry has a lot to bring to the table, but I don’t think governments are really listening yet,” he argues. “They are only just coming round to this.”

But that is also partly a reflection of the limits of risk management’s development in the private sector. Among many companies, for instance, some big areas are still far from being well tackled. Demography, with a few exceptions, is one; energy price risks is probably another. Often that’s because private sector priorities are not always the same. Interestingly, for example, when the Federation of European Risk Management Associations (FERMA) asked its members a couple of years ago to identify the key risks for them from those the WEF identified at the time, very few actually named climate change.

Of course, that doesn’t mean risk management principles cannot be adapted to tackle these issues at a national and global level, but it does make it more difficult.

“The big advantage with areas such as natural disasters and to some extent climate change is that you already have developed solutions in the private sector that you can copy and paste into a public sector environment,” says Schnarwiler. “In other areas you really have to fundamentally re-engineer the whole process, which is much more challenging.”

Nor, it should be added, are private sector approaches, even where well developed, perfect. In fact, the WEF report is as much for companies as countries, points out Marie-Gemma Dequae, the former president of FERMA and now lecturer at Vlerick Leuven Gent Management School in Belgium.

It’s often easy enough to see how issues translate from the company to a national level, but dangers highlighted in the report such as the risk of under-investment in infrastructure can equally be scaled down to warn companies tempted to scrimp on maintenance of their own equipment while the economy is tough. One of the faults the report is designed to address, she points out, is the private sector tendency to look too much at the short term.

“In the daily life of a risk manager, the tool most often used is the annual financial report,” she remarks, “whereas the job of a risk manager is, in fact, to look more at the longer term and translate that into the short term for the financial managers.”

And certainly you don’t have to look terribly far for evidence that risk management to date has proved no panacea. Look to Haiti, for example, and there was good proof of the efficacy of macro insurance solutions, with a smooth payout from The Caribbean Catastrophe Risk Insurance Facility, but equal proof that risk management is often more an art than science, with fantastically inadequate coverage: an US$8 million payout for rebuilding that could cost US$14 billion.

With the financial crisis, meanwhile, it’s not just that risk managers were not able to avert it; it’s also that some doubt anything has really changed.

Look back to the proposal for a country risk officer for instance, and the benefit Dequae and others see in it is that it would facilitate an independent, unvarnished assessment of risk. But that’s not the case in the private sector, complains Paul Moore, the former head of group regulatory risk for HBOS, fired for warning that excessive risks were being taken in the company. The problem, he says, remains the imbalance of power between the executive and the risk manager.

“If risk managers are not able to speak up with impunity, without risk to their careers, then speaking truth to power remains a dangerous business,” he says. In fact, Moore favours the creation of a dedicated non executive director accountable for oversight, assurance and ethics that the risk manager would report to, and he points to experience elsewhere: the chief risk officer of Banco Santander, for instance, reports to the vice chairman, a non executive. Most risk managers, though, he says, continue to want to report to the board, because they don’t see the non executives as having real power.

A familiar problem

All this, though, can be seen as a more general problem.

It is true that risk managers can miss important dangers. Indeed one of the benefits of the WEF report, says Jeff Colburn, leader of Marsh's UK Risk Consulting Practice, is that it highlights “creeping risks” – those that emerge over a long period so that their implications are overlooked.

Similarly, Bill McGuire, director of the Aon Benfield UCL Hazard Research Centre and author of Global Catastrophes: A Very Short Introduction, complains that risk managers and insurers, just like governments, tend to be reactive rather than proactive. “The industry jumps from one thing to another depending on what last big loss was,” he says. “If it was a windstorm, then suddenly that’s what everyone is interested in and wants research for.”

More often, though, the risk is in fact foreseen. That’s true even of Haiti, where a scientific paper a few months prior identified that the strain on the fault line was sufficient for a magnitude seven earthquake. The difficulty there was the observation didn’t receive wider attention, and indeed McGuire has been pushing for a global scientific panel to identify and collate natural hazards risks at a central point, something the centre has made a start on with its inTERRAgate website.

But even where risks do receive widespread attention, getting anything done is invariably difficult. McGuire first came to public attention, for instance, with a BBC documentary warning of the potential for the Cumbre Vieja volcano in the western Canary Islands to cause a tsunami that would devastate the US east coast. Monitoring the volcano would cost about £50,000 a year, he reckons, but so far he’s had no takers.

“It’s extremely difficult to get people to spend money before an event,” he explains.

With the financial crisis, meanwhile, while Moore may be famous for recognising the risks, he’s never claimed to be alone. In fact, his consultancy conducted a survey of more than 560 risk managers in December that showed more than half saw the crisis coming, and half of those as far back as 2007. It’s hardly surprising, he reckons:

“If you lend money to someone who hasn’t got any income, assets or job and you’re assuming the assets securing that loan will go up forever it’s fairly obvious you’re going to have a problem.”

As Walter Stahel, head of risk management research at insurance and risk think tank the Geneva Association, says, it comes down to the fact that while there’s plenty of acceptance for the role risk management plays in identifying and evaluating risks, too often it stops there – whether because of money, vested interests or politics.

“The problem is that the pool of risk management expertise is there, but you can’t force people to apply it,” he says. And, since risk management is not simply the study of risks but the act of balancing them with opportunities, if it goes no further it’s not really risk management at all.