The Evolving Role of the Risk Manager ( ) The Changing Roles and Responsibilities of Risk Management. Sponsored by FM Global

Transcription

1 The Evolving Role of the Risk Manager ( ) The Changing Roles and Responsibilities of Risk Management Sponsored by FM Global

2 2010 marks the 60 th anniversary of the Risk and Insurance Management Society (RIMS) and the 30 th anniversary of the RIMS Benchmark Survey. The risk management profession has changed in many important ways over the decades, and the milestone anniversaries this year present an opportunity to reflect on those changes and to look ahead to the coming years. To better understand the current stateof-the-art in risk management, and how that differs from years past, Advisen surveyed nearly 1,400 risk managers about their roles, responsibilities, reporting relationships and perspectives on important risk and insurance issues. A similar survey was conducted in 1980 and published in the 1981 RIMS Cost of Risk Survey, the predecessor to the RIMS Benchmark Survey. Comparing the 2010 responses to the 1980 responses highlights some of the ways the risk management role has evolved. As compared to 1980, about 12 percent more companies today have at least one full time risk manager, and senior risk managers are now far more likely to report to high level positions such as chief financial officer, general counsel and even the president/ceo. Many survey respondents noted progressively greater responsibility over the course of their careers in areas such as captive insurance companies, managing retained losses and workers compensation cost mitigation activities. However, comparatively few survey respondents are involved in some of the newer, widely-discussed areas of risk management such as supply chain risk management and enterprise risk management. As the risk management profession has evolved over the past 30 years, so has the RIMS Benchmark Survey. Originally, data from the paper survey were compiled and analyzed using punch card technology. The next generations used a database programmed in Basic, with the output retyped for publication. Over the years the methods for collecting data became more sophisticated, but it was only when Advisen took over administration of the Survey in 2003 that there was a quantum leap in the use electronic tools to collect, compile and analyze the data, and to enable users to conduct real-time analysis of the information. These changes are parallel to the changes in industry as well as the role of risk management. The requirements of information for risk management decision-making now include making it available faster as well as with greater flexibility, depth and precision. The survey and the survey respondents In response to 13,000 invitations send to risk managers and commercial insurance buyers, 1,396 risk managers visited the survey website and completed at least a portion of the survey a very strong 11 percent response rate. About 41 percent of respondents are from organizations with more than $1 billion in revenue. Almost exactly 90 percent of survey participants are from companies with at least one full-time risk manager. More than half of respondent companies have three or more full-time risk management employees. Slightly more than 60 percent of respondents have 11 or more years of experience. Risk management department size Overall, 90 percent of respondents said their company has at least one full time risk manager. This compares to 80 percent from the 1980 survey. Large companies are more likely than smaller ones to have at least one full-time risk manager, though not by a large margin: of survey respondents, 93 percent of companies with revenue greater than $1 billion have a full time risk manager as opposed to

3 88 percent of smaller companies. By industry, telecommunications companies are the most likely to have a full time risk manager, while companies in professional services are the least likely. (Exhibit 1) Almost 57 percent of companies participating in the survey have three or more full-time employees in the risk management department, with about 14 percent having more than 10 employees. Companies in the consumer staples sector have the largest risk management departments, with 54 percent having more than three employees. Professional services firms have the smallest risk management departments, with no participating companies having risk management departments larger than three employees. 100% 95% 90% 85% 80% 75% 70% 65% 60% Exhibit 1 -Percent of Companies with Full Time Risk Managers Risk manager roles and responsibilities Excluding those who responded Not Applicable, three-quarters of survey participants are responsible for purchasing property and liability insurance, and 72 percent are responsible for purchasing workers compensation insurance. The remaining respondents either recommend or review the purchases of these coverages. About half of respondents are responsible for purchasing property loss prevention services. Only about a quarter of respondents are involved in any capacity with employee benefits, and only 15 percent have a role in pensions/profit sharing. Approximately 60 percent of respondents are involved in some capacity in merger and acquisition due diligence. More than 90 percent of respondents said that cost of insurance is a key criterion for evaluating the performance of the risk management department. (Exhibit 2) Cost of insurance is a slightly more significant criterion for companies with revenue greater than $1 billion than for smaller companies. By industry, cost of insurance is most important for telecommunication companies (100 percent) and banks (97 percent). It is least important for professional services firms (88 percent). At 53 percent, workers compensation lost time performance was the least significant of listed criterion for evaluating risk management department performance. However, the significance of that factor

4 varied widely by industry. While only 31 percent of respondents in the utilities industry listed it as an important criterion, nearly 75 percent of consumer staples company respondents said it is an important factor % 90.0% 80.0% 70.0% 60.0% 50.0% 40.0% 30.0% 20.0% 10.0% 0.0% Exhibit 2 - Performance Evaluation Criteria Cost of insurance Retained loss costs RM department costs WC lost time performance A key objective of the survey was to discover how risk managers roles and responsibilities have changed over time. Respondents were asked how various aspects of the risk management function had changed over the course of their careers. Survey participants have seen the risk management department s responsibilities grow in most categories over the years. (Exhibit 3) More than half of respondents said their responsibilities have increased in managing retained losses, workers compensation cost mitigation and property loss control (excluding Not Applicable responses). Respondents in the consumer staples industry were the most likely to have seen their responsibilities increase in most categories. Exhibit 3 - Change in Risk Manager Responsibilities Industrial Hygiene/ Employee safety Property loss control WC cost mitigation Managing retained losses Charging risk costs back to operations Captive Insurers Increased Decreased Remained Same Not a responsibility 0% 20% 40% 60% 80% 100%

5 One interesting exception to the overall trend of increasing responsibilities far exceeding decreasing responsibilities is in the use of captives in the information technology sector where 24 percent of respondents said their responsibilities had decreased as compared to 21 percent that said their responsibilities had increased. Survey participants were invited to submit written comments. Some comments highlighted the changing roles and responsibilities of risk managers: RM has dramatically changed and is being infused into a company s culture and is the responsibility of everyone. The RM department ensures the business understands this and provides knowledge and support. We are moving from Risk Management and shifting our role into Risk Leadership putting the day to day ownership of risk management back on the operational stakeholders, providing training, and resources to further risk knowledge. Changes for risk managers have been significant in the type of job skills needs - move from analytic to consultative; move from compliance to intervention; move from insurance risk transfer to strategic risk management; etc. Risk management has moved well past the point of Insurance Risk Management and is now truly responsible for the enterprise-wide risk framework that facilitates "risk-informed" decision making. Some respondents noted that risk management departments are being given greater responsibility, but they have fewer resources to fulfill those responsibilities. While my department has not necessarily increased (in fact decreased by one FTE), this does not reflect the fact that the responsibilities are greater and spread across several business units within the organization (Security & Safety, HR/Benefits, Legal). This is not ERM but rather a reflection of where the skill sets are best suited as we adapt to a changing universe of risk. Increasing expectations with less resources - budget cuts result in no support staff to assist with increasing demands. Still doing more with less. Reporting relationships Responses indicated little consistency as concerns where risk management departments fit within organizations. About 28 percent of senior risk managers report to the chief financial officer, 18 percent report to the treasurer, 13 percent to the general counsel or other position in the legal department, and 11 percent to the president/ceo. Other responses were widely spread among roles such as chief operating officer, controller, head of human resources, head of finance and chief risk officer. (Exhibit 4)

6 30.0% 25.0% 20.0% 15.0% 10.0% 5.0% 0.0% Exhibit 4 - Risk Manager Reporting Relationship Over the course of 30 years, changes in reporting relationships suggest the risk management function has assumed a higher profile role in many organizations. Comparing the current survey results to the 1980 survey results, fewer senior risk managers now report to the treasurer, while more report to the CFO or the general counsel. Almost no risk managers said they report directly to the president/ceo in 1980, as compared to nearly 11 percent in Risk management reporting relationships vary significantly by industry. Senior risk managers for utilities are significantly more likely to report to the chief financial officer than are risk managers in any other industry. Nearly half of senior risk managers in information technology companies report to the treasurer as compared to only 5 percent of bank risk managers and 10 percent of healthcare risk managers. Fully one quarter of professional services senior risk managers, and nearly 20 percent of energy and non-bank financial senior risk managers report directly to the president/ceo, while no telecommunications and only 4 percent of utilities senior risk managers report directly to the top. Government/nonprofit was the sector most likely to have risk management reporting to human resources. Conclusions Risk managers generally agree that their responsibilities have increased, and in many cases their roles had changed, over the years. However, the nature and degree of change varied widely. Some survey participants commented that the survey did not go far enough in capturing the breadth of change in the risk management function. On the flip side, others noted that change was coming only very slowly to their organizations. Generally speaking, the survey revealed that risk managers have more responsibility for a broader range of activities, and now are reporting to higher level officers in their respective organizations. This is the first of a two part paper series. The entire paper originally appeared as a chapter within the 2010 RIMS Benchmark Survey