Results of Lockton s 2018 risk management survey

Results of Lockton s 2018 risk management survey Risk managers spending more time on emerging risks, claim issues, and contract reviews Ryan Brown SVP, Client Advocate 314.812.3241 rbrown@lockton.com According to the results of Lockton s 2018 Risk Management Survey, the challenges facing the risk management community continue to evolve. Risk managers must not only must keep up with the increased complexities of existing risks but are also facing difficult questions from senior leadership around emerging global risks. These challenges are demanding new skill sets, including an increasingly nuanced understanding of operations, finance and technology. More importantly, the techniques and approaches that worked in the past will not necessarily be sufficient to address today s challenges. Risk managers need new tools, ideas and coverages as well as a broker willing to act as a true extension of their team. Lockton Companies 2018 Risk Management Survey gathered responses from a broad cross-section of risk managers, representing publicly traded companies, privately held organizations, non-profits and public entities. While risk managers are being challenged to support strategic initiatives, develop a broad range of skill sets, and work across many internal disciplines, most respondents state day-to-day activities such as claims management and contract reviews still consume considerable bandwidth.

Where are risk managers focusing? WHAT KINDS OF ISSUES LAND ON YOUR DESK FREQUENTLY? WHAT SKILLS ARE YOU EXPECTED TO HAVE TO PERFORM YOUR DUTIES? Uninsurable risks Due diligence 14% Other 8% Contract reviews 45% International experience 9% Actuarial 11% Safety 13% Finance/ accounting 26% Claims 23% Claim resolution Legal/contracts 25% Conclusion Some of the tasks that risk professionals indicate are taking up more of their time also require new or improved skill sets. For example, risk managers are being asked to solve increasingly complex business issues dealing with supply chain, technology, brand impairment and business interruption. Many of these challenges fall outside or between the traditional coverage silos and require unique approaches or strategies. Contract reviews, accrual discussions and M&A due diligence also require risk managers to improve their finance, accounting and legal acumen. Additionally, claim resolution has become increasingly complex and time consuming. Other issues that respondents cited include loss control, safety, security, and cyber security. The survey found several trends. For example: Risk managers from all companies emphasized the need for continuing education. Risk managers with oversight or responsibility for their organization s enterprise risk management are 3X more likely to deal with uninsurable risks. Among respondents from publicly traded companies, risk managers are spending an equal amount of time dealing with claims and uninsurable risks. Privately held companies were most focused on due diligence. Risk managers from public entities emphasized safety as a necessary skill about twice as often as risk professionals from other organizations. 2

Results of Lockton s 2018 risk management survey Observations of a risk manager s role Where would you spend more time in your risk management program? Increase knowledge of business operations. Administrative excellence. Building relationships internally and externally. Conclusion When risk managers were asked where in their risk management program they would spend more time if they had it, the length of their experience made a difference. The majority of those with more than 15 years of experience said they would spend more time on administrative excellence like written processes, procedures, and well-defined key performance indicators. They also would spend more time building external relationships with underwriters, brokers, and other risk managers. The majority of those with less than 15 years of experience, said they would spend more time building internal relationships. On relationship building, those respondents with more than 15 years experience said they would spend more time or resources on building external relationships with underwriters, brokers, and other risk managers. Respondents who had more experience tended to be more likely to have oversight over workers compensation claims. 72% of respondents with at least 15 years experience reported oversight for workers compensation claims. Among risk managers with less than five years experience, only 43% had workers compensation claim oversight. Larger companies responding to the survey tended to have larger risk management departments. Among those with $8 billion or more in revenues, 43% had at least six risk management department staff. Among those with less than $1 billion in revenues, 58% had a risk management department with no more than two staff members. More than of respondents use year-overyear comparative results as a key metric for managing risks. Respondents most often citing TCOR as their key metric were privately held, had 15 or more years in risk management, and had revenues exceeding $1 billion. 3 Lockton Companies

45% of respondents used the word more when describing how risk management function will evolve 15+ years experience: ERM, strategic, become, proactive, analytics. <15 years: cyber, proactive, focus, ERM, company. Private co s: cyber, integrated, proactive, becoming, business. Publicly traded: ERM, strategic, focus, company, analytics. Cyber and risk top the list of topics respondents would like to discuss more While many of these topics are not new, some, such as cyber, political risk, and and supply chain, continue to change and evolve. Claims, insurance, management. Emerging, business, technology, coverage, liability, more. Political, issues, ERM, trends, supply, related, development, contractual, workplace. 4

Results of Lockton s 2018 risk management survey Decisions on protecting the balance sheet What resources do you rely on to protect your balance sheet? What areas of insurance buying are the most difficult for you? What criteria are most important in selecting an underwriting partner? Historical claim activity. Broker analytics/advice. Peer benchmarks. Worst-case scenario events. Board/C-suite mandates. ERM committee. Coverage. Limits/protection. Pricing. Retention. Carrier selection. Financial strength. Customization. Stability. Price. Brand. Conclusion In order of priority, survey respondents indicated that the most important resources they rely on to protect their organization s balance sheet were: historical claim data, broker advice and analytics, peer benchmarks, and worst-case scenarios. Internal guidance, such as C-suite and board mandates and the ERM committee, ranked below these. This may suggest, in part, a disconnect between the Board or ERM committee and risk management. Among the top challenges in insuring risk were coverage and limits/protection. For public companies, coverage was identified as more difficult to buy than limits. For privately held companies, coverage and limits were cited as equally difficult. Large companies, or those with $8 billion or more in revenue, had the most difficulty with coverage and the least difficulty with carrier selection. Variables which respondents deemed most important in selecting an underwriting partner were, in descending order: financial strength, customization, stability, and price. Across organizations of all sizes, brand was the least important variable. When selecting an underwriting partner, respondents deemed financial strength, customization, stability, and price the most important variables. 5 Lockton Companies

Mix of respondents by revenue and company type <$500M $501M-$1B $1B-$4B $4B-$8B $8B+ Nonprofits 46% 15% 15% Privately held 43% 17% 8% 11% Public entity 39% 19% Publicly traded 4% 31% 18% 35% 3 5 6 7 8 9 10 Companies with less than $1 billion in annual revenue made up just over half of the responses for nonprofits, privately held, and public entities. Companies with more than $1 billion in revenue make up 84% of the publicly traded companies. 6

Results of Lockton s 2018 risk management survey Risk management is most likely to report to the finance department Finance Legal Operations Other 53% 18% 8% 21% 3 5 6 7 8 9 10 Highest other category is CEO. When split by company size based on revenue, larger companies are more likely to select finance than other categories. Finance Legal Operations Other <$500M 45% 11% 34% $501M-$1B 53% 22% 8% 17% $1B-$4B 57% 26% 3% 14% $4B-$8B 63% 22% 6% 9% $8B+ 55% 15% 9% 21% 3 5 6 7 8 9 10 Larger companies have larger risk management departments 1 2 3-5 6+ <$500M 21% 32% 35% 11% $501M-$1B 19% 33% 39% 8% $1B-$4B 17% 17% 36% 29% $4B-$8B 6% 53% 25% $8B+ 6% 8% 43% 43% 3 5 6 7 8 9 10 As expected, larger companies generally have larger risk management departments. The relationship, however, is not always strictly linear. Staffing levels remain between two to five people and are generally evenly distributed for companies up to about $5B in annual revenues. Companies above $5B in annual revenues tend toward larger departments (greater than six), given their complexity of risk. It should be noted, however, risk managers at all companies look to their broker partners to significantly expand their backroom capabilities. Larger staffs also tend to be functionally aligned and offer more specialization while smaller teams are typically responsible for a wider variety of tasks. 7 Lockton Companies

Those with 15+ years of risk management experience were much more likely to have responsibility for workers compensation claims 10 9 8 7 6 5 3 No Ye s 43% 53% 63% 72% 57% 47% 37% 28% 1-4 years 5-9 years 10-15 years 15+ years Most risk managers reported that claims management still takes up a significant portion of their time. While there has been a trend toward more complex litigation, routine Workers Compensation claims continue to account for the bulk of claims activity. Seventy-two percent of respondents with at least 15 years experience reported that they had oversight for workers comp claims. Further, in an era of expense management, risk managers are also being asked to justify WC resources such as safety and claims management staff. Analytics and benchmarking offer new tools to highlight improvements and opportunities C-Suite s primary question which wasn t being asked 1-2 years ago: How does our insurance program respond to a cyber event? Risk managers with 15+ years experience were primary selectors of the other category. 5 3 21% Are we taking too much/too little risk? How do we know if we are spending too much time on insurance? 44% How does our insurance program respond to a cyber event? 7% Is our executive liability program world-class? Other A few interesting recent questions from other. z How do we reduce volatility for accrual adjustments? z Impact of diabetes on workers compensation claims? 10 9 8 7 6 5 3 51% 51% 25% 31% 9% 8% 15% Are we taking too much/too little risk? 1-4 years 5-9 years 10-15 years 15+ years How do we know if we are spending too much time on insurance? 45% 5 17% 17% 21% How does our insurance program respond to a cyber event? 28% 74% 17% 19% 3% 6% 3% Is our executive liability program world-class? Other z Why have our claim costs become unpredictable? z Captive and tax jurisdictions? z How are our fine arts holdings protected? 8

Results of Lockton s 2018 risk management survey Contract reviews are the most common issue for respondents, followed by claims 5 44% 3 22% 14% 8% 11% Claims Contract reviews Due diligence Other Uninsurable risk matters Respondents which have oversight/responsibility for ERM are almost three times more likely or less likely to deal with uninsurable risk matters as those without ERM oversight. 10 8 6 5% 18% 38% 7% 8% 6% 11% 8% 11% 13% 15% 46% 55% 38% 19% 23% Ye s Claims Contract reviews Due diligence Other Uninsurable risk matters No, but my function does participate in our ERM efforts No 3 N/A my company does not have a formal ERM program Private versus publicly traded Privately held companies were least likely to select uninsurable risk matters, and selected due diligence as the third most frequent issue. Publicly traded selected claims and uninsurable risk matters about the same. 10 8 6 Claims Contract reviews Due diligence Other Uninsurable risk matters 6% 6% 5% 9% 3% 13% 45% 41% 46% 19% 42% 29% 27% 15% Publicly traded Public entity Privately held Nonprofits 9 Lockton Companies

If given the opportunity, respondents with more experience would spend their time and resources differently than those with less Perhaps unsurprisingly, responses here varied by type of company and the respondents experience level. Among those with 10+ years of experience, the majority said they would spend more time or resources on administrative excellence, including the development of written processes, procedures and KPIs. Conversely, those with <10 years experience said they would focus on increasing their knowledge of business operations and risk identification. Administrative excellence (written processes, procedures, well-defined KPI's) Building relationships externally (underwriters, brokers, other risk managers) Building relationships internally Increased knowledge of the business operations (risk identification, etc.) Other 1-4 years 35% 11% 11% 41% 3% 5-9 years 27% 3% 7% 57% 7% 10-15 years 24% 9% 18% 45% 4% 15+ years 36% 13% 13% 31% 7% 3 5 6 7 8 9 10 Those with >4 years experience meet with senior management more frequently to discuss risk/insurance Annually (typically only around the renewal process) Infrequently (as questions/claims arise) Routinely (i.e., communication process in place) 1-4 years 8% 36% 56% 5-9 years 3% 28% 69% 10-15 years 6% 34% 6 15+ years 25% 63% 3 5 6 7 8 9 10 10

Results of Lockton s 2018 risk management survey 48% say risk management is on the due diligence team for mergers and acquisitions and 3 are at least aware and involved at some point before closing Around responded We just bought WHAT? 5 45% 35% 3 25% 15% 5% 48% 3 Risk management is on the due diligence team Aware of M&A activity, but not actively involved until at/near closing Other "We just bought WHAT?" Most of the Other answers state their entity is not involved in mergers and acquisitions activity. 10 8 6 Risk management is on the due diligence team Other Aware of M&A activity, but not actively involved until at/near closing "We just bought WHAT?" 51% 9% 31% 6 4% 3 9% 6% 39% 26% 19% 35% 19% 35% Privately held Publicly traded Public entity Nonprofits Year-over-year and TCOR are the top two measurements for managing risks. Who selects TCOR as the most important metric for measuring risk management success? Year-over-year comparative results z Privately held. z Associates with 15+ years experience. z Risk management reporting structure: finance. z Companies with >$1B revenue. Other 5% Actual versus budgeted 15% Total cost of risk (fixed costs + variable costs + administrative costs) 11 Lockton Companies

Finance/accounting and legal/contracts are most needed skill sets to perform duties Public entities selected claim resolution as often as finance and legal. Public entities placed about twice as much emphasis on safety as other entities. Actuarial 11% Safety 13% Int'l 9% Claim resolution Finance/ accounting 26% Legal/contracts 25% 10 9 8 7 6 5 3 Finance/accounting Legal/contracts Actuarial International Claim resolution Safety 11% 14% 21% 8% 15% 18% 14% 24% 4% 3% 9% 31% 26% 24% 24% 25% 21% 28% 31% Publicly traded Public entity Privately held Nonprofits Coverage was selected as most difficult piece of insurance buying (with carrier selection as easiest) Carrier selection Coverage Limits/protection Pricing Retention Privately held 28% 29% 18% 15% Privately held companies find limits/protection to be just as difficult as coverage. Public entity Nonprofits 15% 23% 35% 27% 27% Publicly traded 8% 39% 22% 17% 14% 6 8 10 12

Results of Lockton s 2018 risk management survey Size of company influences which pieces of insurance buying are more difficult Large companies (>$1 billion revenue) select coverage to be most difficult. Companies with <$1 billion revenue spread choices out more. Top 3 resources for protecting balance sheet 1. Historical claim activity. 2. Broker analytics/advice. 3. Tie: Peer benchmarks and worst-case scenario events. In order of priority, survey respondents indicated that the most important resources they rely on to protect their organization s balance sheet were: historical claim data, broker advice and analytics, peer benchmarks, and worst-case scenarios. Internal guidance, such as C-suite and board mandates and the ERM committee, ranked below these. This may suggest, in part, a disconnect between the ERM committee and risk management. In many organizations, ERM is heavily weighted toward financial or strategic risks, with the committee run by internal audit or the General Counsel. The risk manager may only be involved on the periphery. Similarly, the responses suggest a potential communication gap between risk managers and a Board of Directors that is becoming increasingly concerned about risk. Both situations present a significant opportunity for risk managers to elevate their profiles within their 10 organization and explain / validate strategies to manage key exposures. 5 Carrier selection Coverage Limits/protection 17% 29% 17% Board/C-Suite mandates 9% Worst-case scenario events 15% 21% 21% 24% 14% 24% 31% 29% 26% 9% 9% 13% 14% 9% 24% 22% 18% 38% 43% 19% 2% <$500M $501M-$1B $1B-$4B $4B-$8B $8B+ ERM committee 6% Peer benchmarks Historical claim activity 28% Broker analytics advice 25% Financial strength and stability are most important variables sought in an underwriting partner Variables that respondents deemed most important in selecting an underwriting partner were, in descending order: financial strength, customization, stability and price. Across organizations of all sizes, brand was the least important variable. Given today s soft market conditions, most risk managers agreed that there is ample capacity for almost any exposure and carrier selection is not a major concern. 10 8 6 21% 21% 19% 19% 27% Brand 36% 29% Customization 32% 24% 9% 26% 21% 31% 28% 21% 11% 18% 3% 8% 6% For the largest companies ($8 billion + revenue), customization is ranked most important. Brand is the least important variable across all size categories. 38% 19% <$500M $1B-$4B $8B+ $501M-$1B $4B-$8B 13 Lockton Companies

Privately held companies selected price to be their most important underwriting variable 10 Brand Customization Financial strength Price Stability 9 8 23% 23% 27% 35% 7 6 5 27% 23% 14% 7% 35% 23% 35% 3 33% 21% 24% 23% 7% 4% 8% Privately held Publicly traded Public entity Nonprofits 47% of respondents feel critical risks their company has have not been evaluated appropriately Of these, cyber risk is overwhelmingly the top concern. z Other frequently used words include business, risk, exposure, and reputation. No 53% Yes 47% 14

Results of Lockton s 2018 risk management survey Privately held companies are slightly more likely to feel risk management has resources to be proactive versus reactive 10 No Ye s 9 8 7 56% 6 77% 74% 7 Nonprofits were less inclined to agree with this statement. 5 3 44% 23% 26% 3 Privately held Publicly traded Public entity Nonprofits No Ye s 10 9 54% of respondents feel their company has a significant business risk due to a cyber event. z Nonprofits were more likely than other company types to agree with this (65%). 8 7 6 5 3 68% 32% 51% 49% 57% 43% 53% 47% Nonprofits Privately held Public entity Publicly traded 15 Lockton Companies

65% of publicly traded companies said they had performed adequate testing for cyber scenarios 10 No Ye s 9 8 7 64% 44% 5 65% This is 44% for privately held companies. 6 5 3 36% 56% 5 35% Nonprofits Privately held Public entity Publicly traded 10 No Ye s 9 8 71% of publicly traded companies say they have a self-ready/tested plan to detect/ respond/recover to a potential cyber event. z This is 57% for privately held companies. 7 6 5 3 64% 36% 57% 6 43% 71% 29% Nonprofits Privately held Public entity Publicly traded 16

Results of Lockton s 2018 risk management survey 41% of respondents say risk assessment is global rather than US centric That such a large number of respondents indicated that risk assessment at their firm is US centric points to a significant opportunity for those risk managers to add value to their organizations. As the results below indicate, this opportunity is most significant within private companies. 7 6 5 59% 41% 3 No Ye s 64% of publicly traded companies agree with this, while only 33% of privately held companies agree No Ye s 10 9 8 24% 33% 17% 7 64% 6 5 3 76% 67% 83% 36% Nonprofits Privately held Public entity Publicly traded 17 Lockton Companies

57% of respondents say they do not have a RMIS (risk management information system) Many risk professionals are still relying on systems provided by their carrier partners.as shown below, the primary use of such systems tend to be for managing claims and certificates of insurance. Larger, more sophisticated companies, however, have expanded this usage to include policy management No Ye s Size of the revenue bin impacts results. <$500M 77% 23% z <$500M were 3 as likely to say no. $501M-$1B 58% 42% z $8B+ were more likely to say yes. $1B-$4B 54% 46% $4B-$8B 5 5 $8B+ 38% 62% 6 8 10 Primary activity being supported by RMIS is claims management Claims management Certificates Contracts Policy management Property values <$500M 56% 8% The largest companies have expanded use of their RMIS systems into policy management. $501M-$1B $1B-$4B 32% 49% 18% 14% 18% 2% 18% $4B-$8B 47% 19% 13% 9% 13% $8B+ 39% 8% 23% 3 5 6 7 8 9 10 18

Results of Lockton s 2018 risk management survey Frequent risk management pain points: risk, management, claims, better, insurance Feedback from companies <$1B highlighted data, resources, more, business, and RMIS. Feedback from companies with >$1B in revenue highlighted lack, safety, contracts, resources, and certificates. Top words used to describe how brokers help: claims, management, review, assistance, contract, risk, loss, control Common feedback from companies with >$1B in revenue:: benchmarking, industry, policy, knowledge, safety, and coverage. Common feedback from companies with <$1B in revenue: advice, consulting, coverage, insurance, safety, market, and trends. Feedback from Risk Mangers with >15 years experience: ccoverage, consulting, safety, benchmarking, and market. Feedback from Risk Mangers with <15 years: benchmarking, advice, safety, industry, and policy. 19 Lockton Companies

LOCKTON COMPANIES At Lockton, WE LIVE SERVICE! is more than a catchphrase it is the way we do business. It means we deliver risk management, employee benefits and retirement solutions that help make your business better. Risk management consulting services Risk management We are committed to delivering expert risk advice to help businesses become more successful. By providing clients with the best risk management strategies, we allow them to remain focused on growing their businesses. + Analytics + Property and casualty insurance + Professional indemnity + Executive risk + Cyber risk + Surety + Environmental + Dedicated industry experts + Risk finance + Claims consulting and risk control services Employee benefits Attracting and retaining top talent is key to any organization s success. Lockton works with clients to structure health and welfare programs that help achieve workforce goals. Actuarial services Compensation Compliance services Data analytics Executive benefits Global benefits Health Reform Advisory Practice HR technology Lockton Health Risk Solutions Pharmacy consulting Mergers and acquisitions Voluntary benefits Retirement services Successful wealth benefits help employees stay focused professionally and form a cornerstone of effective workforce management. Lockton advises clients on how to protect themselves from fiduciary risk, create cost-efficient retirement plans and deliver positive employee results. Retirement strategy development Fiduciary oversight and governance Investment advice Defined contribution, defined benefit and executive benefits plan design Employee engagement Vendor management Executive benefits restoration 20

Results of Lockton s 2018 risk management survey Lockton by the numbers Producing more than a good deal The Lockton Advantage process provides significant benefits: Creates alignment and close links between insurance, risk finance, risk management strategies and your company s business strategy. Focuses all of the team s efforts on the right things and eliminates low-value activity. Improves your business through increased profitability and enhanced risk management. Setting Lockton apart Lockton Associates demonstrate a passion for delivering service. Our entrepreneurial culture rewards excellence. Private ownership allows more investment in our clients and our Associates. Marketing led by senior service team members. Senior-level relationships with the major domestic and international markets. Our Associates focus on making our communities better. 21 Lockton Companies

LOCKTON ADVANTAGE Connecting your business goals to risk management objectives The competitive demands and time constraints confronting your business today are unrelenting. These demands place an increased value on sound strategic advice. Change is occurring at an accelerated pace, and it is impacting your objectives and the spectrum of risks your company faces. Evolving your insurance, risk finance and risk management strategy and creating alignment with the overall business strategy is a clear differentiator and is imperative for any trusted strategic advisor. Lockton has designed a unique and valuable process, Lockton Advantage, that fosters a deep understanding of your business and industry segment. This understanding allows our team to design a coordinated and effective strategy that is aligned with your business. What is Lockton Advantage? Lockton Advantage combines the best set of analytical tools with a more systematic and consultative approach to serving our clients. Lockton Advantage is a collaborative process combining three critical exercises. Research and analysis Value proposition Strategic plan Includes operational profile, risk identification, financial analysis and review, and external landscape. Uniquely tailored proposal offering focused on how we can improve your profitability and overall business. Multiyear plan focused on team execution and delivery of results measured in metrics you value. 22

Lockton s approach Results of Lockton s 2018 risk management survey Step 1: Request, collect and clean data Descriptive (What) Step 2: Transform data It is crucial to select the right data. Lockton has a robust data collection and verification process. This step helps ensure a quality in, quality out result. Collect and clean data Transform data Digging through a wealth of data is where others often stop and make assumptions. Lockton takes it a step further by identifying trends or anomalies to uncover opportunities to get better. Lockton invests in a robust collection and verification process with direct access to third-party administrator (TPA) and carrier systems. This step delivers a quality in = quality out approach. Step 5: Achieve better results Achieve better results Prescriptive (How) Proprietary tools + Dedicated experts = ACTIONABLE RESULTS Apply wisdom Gain knowledge Predictive (Why) This information depicts only what has happened, but it cannot stop here. Lockton makes our clients businesses better by identifying trends or anomalies that create opportunities to answer their challenges. Step 3: Gain knowledge Accountability is established through defined roles and measurable objectives. This all adds up to help you achieve better results that specifically address your challenges. Step 4: Apply wisdom While the data describes what is happening, Lockton s process takes it further to understand why it s happening. We challenge perceptions and use information to uncover root causes. Our best practices and proven expertise help you achieve better results through strategies that are specifically designed for your challenge. Accountability is established through defined roles and measurable objectives, moving forward with a personalized action plan. It s not one size fits all ; it s one fits you. Lockton s experts apply the insights gathered to develop a tailored road map specific to your company s objectives and culture. Lockton s team of experts develops a tailored road map specific to your company s operations and culture. The result: actionable strategies that lead to savings opportunities. Many charts and graphs can be overwhelming. Our goal is to provide clear and focused insights to develop actionable strategies with measurable outcomes. Engagement with the client is critical. Insights are gleaned from actual observations in the business through collaboration between you, Lockton and your other partners. We challenge perceptions and use the data and analytics to uncover the real causes to achieve more favorable outcomes. 23 Lockton Companies

RISK MANAGEMENT EMPLOYEE BENEFITS RETIREMENT SERVICES Our Mission To be the worldwide value and service leader in insurance brokerage, risk management, employee benefits and retirement services Our Goal To be the best place to do business and to work LOCKTON.COM 2018 Lockton, Inc. All rights reserved. [Rev 06/06/18] STL Internal\Pro\Brown\Complex Risk Symposium\2018-9541\Survey\2018 Risk Management Survey 14245.pdf