The race toward preparedness

If risk management were an Olympic sport, how would the three regions – the Americas, Europe and Asia/Pacific – finish? Aon's 2007 Global Risk Management Survey of more than 320 companies from 29 countries awards the medals.

What are firms' top 10 risks? Initially the most striking outcome of the ranking of top 10 risks is the consistency across regions. There was complete agreement about the No 1 risk – damage to reputation – with business interruption either second or third. Look further however, and regional variations do emerge.

The Americas, for instance, is the only region where technology failure and loss of data both made the top 10. This suggests a higher degree of reliance on computer technology, or at least more adverse experiences. Interestingly, natural disasters did not make the top 10 for companies based in the Americas, despite the impact of hurricanes on North American coastlines in recent years. Perhaps, in a highly connected society, virulent computer viruses are a more widespread concern than natural disasters.

Asia/Pacific firms included weather/natural disasters in their top 10, along with environmental risk and inadequate succession planning. However, firms here said they were much less worried about distribution or supply chain failure. And this was the only region not to list regulatory/legislative changes in its top 10. The region's geographical exposure to natural catastrophes explains the high ranking of that risk. Succession planning was a concern, but not attracting or retaining staff, which was listed for the other two regions. This may reflect different attitudes to employment, with the concept of employment for life being more prevalent in Asia.

The lack of concern about regulatory or legislative changes may reflect the relatively light approach prevailing in these firms' home markets. This may change as they become more heavily involved in more regulated areas. Europe's main distinction is that it is the only region where respondents included merger/acquisition/restructuring and physical damage on their list.

How prepared are they? We asked whether firms have a written plan in place to deal with each of their top 10 risks, or whether they have at least formally reviewed that risk. Taking their answers and weighting them depending on the importance of each risk gave an overall readiness score.

While the differences between Europe and the Americas were relatively small, the results suggest that firms in these regions are significantly better prepared to deal with their top 10 risks than their counterparts in Asia/Pacific. It also suggests that even large, sophisticated organisations have plans in place to deal with only about half of their most important risks.

Looking at the risks common to all three regions, firms in Europe were the best prepared overall in absolute terms – ignoring the weighting of how important the risk is to them. The overall pattern is predictable: The risks that lend themselves to most direct risk transfer are the ones in which a plan is most likely to be in place. It is surprising, however, that some 30% of firms have no written plan in place to deal with third party liability, business interruption or supply chain failure. As we move to the risks that are less easy to transfer, such as damage to reputation and market environment, the regional gaps widen, with firms in Asia/Pacific significantly less prepared than their counterparts in Europe.

How do firms identify major risks?

“Firms in Europe are two to four times more likely to be using board workshops or scenario planning

Regional variations in how firms identify the major risks were immediately evident, with the American firms much more reliant on senior management intuition and experience than those in either Europe or Asia/Pacific. The latter two made much more use of business unit risk registers, perhaps implying a more structured approach. Asia/Pacific firms also made much more frequent use of external service providers for this activity, with as many as one in five firms adopting this as their primary approach. While the outright level was low at 12%, firms in Europe are two to four times more likely to be using board workshops or scenario planning than those in the Americas or Asia/Pacific.

What is the board’s role? A surprising variation was that the Americas lagged significantly behind the other two regions, with only 72% of firms saying that their boards had either established or partly established risk management policies, compared to 87% each for Europe and Asia/Pacific.

Looking at the nature of the boards' involvement showed Europe again leading the way, with 78% of firms reporting a systematic approach or annual review, and only 15% saying that the board focused on specific risk issues – normally indicative of a less systematic approach. Asia/Pacific and the Americas were some way behind, with only 44% of boards in American firms involved systematically.

Which elements of total cost of risk are measured? Risk transfer costs were uniformly well tracked by virtually all respondents. The real variance appeared when considering the other cost categories, with Asia/Pacific firms in particular lagging behind Europe and America.

Use of captives Europe stands out as the home of the captive, with more than 70% of respondents saying they already had a captive or protected cell company. By contrast, less than 30% of firms in the Asia/Pacific region made use of these risk financing alternatives, and the vast majority of firms without a captive did not plan to introduce one in the near future.

So who wins? In our risk management Olympics, firms in Europe take the gold medal. They are the most systematic in identifying their top risks and the best prepared to deal with them. They are the most likely to have their board involved in risk management, are pretty thorough when it comes to understanding the different elements of cost of risk and are the most likely to have a captive.

The Americas beat Asia/Pacific to the silver medal – but only just. Firms there are reasonably well prepared to deal with their major risks, but their boards are relatively unlikely to be involved in the process. They are the most thorough when it comes to measuring the cost of risk, and are as likely to be using a captive as not.

That leaves Asia/Pacific with the bronze medal. Firms in this region are the most likely to use an external third party in identifying major risks, but they are the least well prepared to deal with them. It is relatively likely that their boards are involved in risk management, but they are the least thorough in measuring the different elements of cost of risk, and the least likely to have a captive.