Keeping Score: Best Practices for Risk Management Reporting

Transcription

1 Keeping Score: Best Practices for Risk Management Reporting 1/4 Keeping Score: Best Practices for Risk Management Reporting John Schaefer Risk Management Information Systems (RMIS) are designed to capture, analyze and share information easily. However, many companies beginning to develop RMIS make the mistake of starting with technology rather than beginning with the end in mind. In developing an RMIS it is necessary to know who your audiences are and how they process the information you are presenting. This paper discusses considerations and best practices for risk management reporting, and presents the concept of a using risk management scorecard to effectively collect and process information. What Needs to be Measured? One of Stephen Covey s seven habits of highly successful people is, Begin with the end in mind. This is especially applicable when designing a scorecard. The activities that you are measuring need to be important to the viewer of the scorecard. Start by considering what you, as a risk manager, are being held accountable for. Ideally, this is known through a systematic process that begins with the organization s vision, mission and strategy, and progresses to individual departments through clear objectives, performance plans, department charters and job descriptions. To determine the appropriate end to reporting activities it is also important to define the scope of your risk management activity. Do you want to be a leader in measuring and reporting on risk throughout the company or do you want to focus on a subset of those risks such as hazard risks or insurable risks? Within the Enterprise Risk Management Metrics Derivation defined scope, do you want to report only on your activities or would you like to include other areas that affect you, such as safety violations, number of property insurance recommendations pending with facilities and OSHA reports? What is important to your manager and his or her manager?

2 Keeping Score: Best Practices for Risk Management Reporting 2/4 Activities and Results The measures you choose may be based on results ( I saved $1,000,000 ) or on activities ( I went to 15 meetings ). Results speak more clearly to management, but not every item will lend itself to this type of measurement. When using activity measures (e.g. number of contracts reviewed) it is important to be able to make at least a verbal connection to the results. For example, if you are measuring contract review activity, you should also include a statement describing the assumption. For example, the statement may read something like this: Risk Management reviews contracts to ensure that our company does not assume any unnecessary liability. This will control insurance costs and reduce uncovered losses. Following are examples of activities and corresponding results measures: Sample Activity Measures Number of driver training classes Number of property inspections Number of contracts reviewed Sample Results Measures Dollars paid out Number of auto accidents Percentage compliance with standard terms Audience Considerations Knowing the audience for the report(s) helps to ensure that your message is well received. First, consider your objective. Is it to demonstrate to your immediate boss what you have accomplished, or is the report meant to be a voice for risk management that reaches your company s most senior officers? Does the audience have a short attention span or a longing for details? Do they want information monthly or annually? Answering these questions will help to set the stage for a useful report. To illustrate this, let s consider three different audiences, each being funneled a report based on the same information about insurance risk. Consider what different types of audience member needs to know: Message for the Treasurer The treasurer will be interested in details such as claims activity by line of coverage, open engineering recommendations, premiums by line of coverage, and the total cost of risk.

3 Keeping Score: Best Practices for Risk Management Reporting 3/4 Message for the CFO The CFO does not need this much detail. The CFO needs to know, generally, where things stand ( Things are stable ) and a few highlights that support that measurement. For example: premiums are down, claims are down everywhere except in workers compensation. Message for the President The President does not need the details (although the President should be able to easily obtain the details when red flags are up). The message to the President might be, simply, Things are stable. Telling the Story Few executives are willing to spend a long time reading a scorecard. Assuming that your end goal is to get management to act upon the information you present, you must make it easy for them to understand the story. Some people learn best through words and numbers, others through pictures. If you know how your audience best responds, structure and present the message accordingly. If you are unsure, or if there are multiple preferences within the audience, include both aspects in the story. In any case, most executives value brevity, so your report should be no more than five pages. Be Transparent Facts aren t always black and white, and your report shouldn t be, either. Follow these three tips to ensure that your story is transparent, to avoid misunderstandings or worse: 1. Report opinions as opinions rather than facts. 2. Don t avoid reporting because some information is missing make mention of what is missing instead. 3. If there are conflicting views or interpretations of the information, report both and offer an informed opinion. 4. Make the presentation of information interesting. The higher up you go in the organizational structure, the more noise your message will have to cut through. Answer, So What? Risk management reports should always answer the question, So what? This includes reporting on what happened as well as analyzing what it means. Your analysis may include forecasts and it may be qualitative or quantitative. When answering So what?, always try to answer the question at a minimum of three layers. To anticipate the question, try some role-playing in your mind. For example: The number of open recommendations is high. So what? This increases our potential for loss. So what it s insured, isn t it?

4 Keeping Score: Best Practices for Risk Management Reporting 4/4 If we are insured, the price goes up; if we are not insured then we pay. People may get hurt and shareholders may suffer So what? You won t get your bonus Oh... now I get it. Use Exception Reports An effective way to present your story, especially to managers, is through the use of exception reports. This filters out all details except those that exceed or fall below preset thresholds. With so much information competing for the attention of decision makers, exception reports help focus on the critical details. Choose the Best Tools for the Task It is easy to become overwhelmed by the technology options for a RMIS. Consultants and complicated systems may be necessary to gather information from multiple source systems and to integrate with other operating systems such as claims databases, financial systems and even enterprise systems such as SAP or Oracle. There are software programs that facilitate the integration and display of large amounts of information from multiple sources and systems. (PureShare is a good example: But, in many cases Microsoft Excel and Word provide a good starting point. By starting with a simple approach, you can assess the data that is required as an input and the preferred approach for displaying the information. Scorecard Examples The three examples on the following pages offer very different approaches to risk management scorecards based upon the purpose and scope of the reporting activity. The first two were prepared using Excel, while the third was prepared using PureShare ActiveMetrics. They show a range of detail and approaches to visually presenting risk management information in various environments. John W. Schaefer President, Global Risk Advisors John Schaefer is the President of Global Risk Advisors, an independent risk management consulting company. Prior to joining Global Risk Advisors, John was Senior Vice President - Risk Management at ABD Insurance and Financial Services. In addition to having been a member of Intel's risk management department and serving as risk manager for two Fortune 500 companies, John has held a number of senior positions in finance and information technology. These experiences provide John with a unique perspective on managing and financing a wide range of risks. He can be contacted at or at jschaefer@grariskconsulting.com

5 Keeping Score: Best Practices for Risk Management Reporting Samples Sample Scorecard for Insurable Risks This example is based upon the assumption that risk management is primarily interested in controlling insurable risks. It is also oriented to readers who favor text and numerical data over visual displays. This type of report would probably be issued quarterly at most. Risk Management Objective: Efficiently and effectively identify, analyze, control and finance risks related to property exposures, lawsuits and employee injury. CHART 1: The following chart compares the actual insurance cost to the budgeted cost and includes the change in the cost of insurance and the exposure versus the prior year. Type of Insurance Policy Period Budgeted Cost Actual Cost Exposure change versus prior year (%) Cost change versus prior year (%) Property 1/1/04-1/1/05 1,000,000 1,100,000 5% 8% Workers Compensation 1/1/04-1/1/05 500, ,000 10% 12% CHART 2: This chart shows the number and severity of events related to our insurance coverage Event Number of claims at beginning of period Number of new events submitted to insurer Number of closed claims Number of open claims at end of period Estimated cost of all claims at beginning of Estimated cost of all claims at end of period Change in estimated cost versus prior period period Property , ,000 50,000 Work.Comp , , ,000 CHART 3: This chart shows risk control activities and intended results Activity Expected to Affect Occurrences Notes Contract review Liability Reviewed 12 contracts Reduced insurance requirements on four contracts Driver Training Classes Vehicle accidents 25 people trained Salespeople are resisting

6 Keeping Score: Best Practices for Risk Management Reporting Samples Sample Scorecard for Enterprise Risk Management This sample assumes that the preparer has collected information from multiple sources throughout the company and is reporting for senior management using a simple and visual style that can very quickly be understood. Key Corporate Risks: Results from the latest enterprise risk management review indicated three areas for primary focus during this fiscal year. This table summarizes the status in those three areas. Risk Leader Status Direction Notes Lack of business continuity plan resulting in extended business interruption Declining quality control resulting in increased claims and higher cost Employee turnover resulting in increased cost and loss of corporate knowledge Bob We are still on target but IT portion is stalled Sally Error rate decreased but exceeds goal Joe Major losses in finance department Event Summaries: We have elected to track adverse events in three areas: product defects, workers compensation losses and negative customer satisfaction scores. Results from those areas are shown below. Defects per Million Units Neg. Satisfaction Scores Workers Comp Cost January February March April May June Defects per Million Units July August September October November December 14% 12% 10% 8% 6% 4% 2% 0% January February March April Neg. Satisfaction Scores May June July August September October November December 30,000,000 25,000,000 20,000,000 15,000,000 10,000,000 5,000,000 0 January February March April May Workers Comp Cost June July August September October November December

7 Keeping Score: Best Practices for Risk Management Reporting Samples Sample Scorecard for Insurance Risk Management This sample combines a variety of data from multiple sources into a single dashboard that provides both high-level risk status and drill-down detail (via roll-overs and clicks). Source: PureShare Inc.