Vive L'Entreprise! As the concept of enterprise risk management continues to capture the attention of many corporate boards, Aventis, a French global pharmaceutical firm, spent a year plotting its plan for enterprise risk management

Risk & Insurance, April 15, 2004 by Mindy W. Toran

When pharmaceutical giants Rhone-Poulenc Rorer of France and Hoechst AG of Germany merged in December 1999 to become Aventis, the new company's board saw it as a perfect opportunity to take a good look at their risk management practices and procedures to determine the firm's overall risk appetite and philosophy. Along the way, the company's various business units worked together to identify their most significant risks and develop potential solutions to mitigate those risks.

"Our corporate board was very supportive. They wanted to understand the risks of the company, going forward, and set up some kind of direction for addressing those risks," says Ken Krenicky, senior vice president, risk financing and insurance, at Aventis. Based in Strasbourg, France, the company is global in scope, serving major pharmaceutical markets in France, Germany, the United States and Japan. "While the company is based in France, many of our manufacturing and sales units are in Germany, and our greatest risks are in the United States. Working together, we developed a global management team of various nationalities."

During the process of determining how best to address the combined company's risks, Aventis sought the help of its broker and consultant, Marsh Inc., which presented the company with an overview of the enterprise risk management process.

"Aventis began the process as a means of addressing the risks of the newly formed company," says Mark Lynch, a managing director at Marsh in Philadelphia, who worked on the project with Krenicky. "The company's joint management wanted to make sure they were adequately addressing corporate governance issues and highlighting appropriate risk management concerns."

The company's first step was to interview senior managers, board members and other key executives to identify the combined companies' risk levels and tolerance issues. "Both companies were well-run firms with a lot of history," says Krenicky. "We went through a process of identifying the best practices between the two firms. We find somewhat of a cultural challenge because we wanted to have a global culture--not a German, French or American culture.

"As part of the ERM process, we started out with a lot of questionnaires and interviews with senior managers," explains Krenicky. "Through these interview and questionnaires, we developed a perception of our top 10 risks, then put together workshops highlighting each of those perceived risks to further drill down and validate those risks."

Throughout the process, the board and senior management was extremely supportive, says Krenicky. Members of the risk management department worked with the company's legal department, general counsel and head of audit. "Our focus was largely on developing good corporate governance," says Krenicky. "Long before Enron, WorldCom and the rest of the U.S. corporate scandals, there was already a movement in Germany, France and Europe to develop new laws and regulations to assure good corporate governance.

"Having a new supervisory and management board allowed us to review all major procedures that were already in place and identify the risk management procedures at both companies to make sure we weren't being redundant or allowing things to fall between the cracks," he explains. "We wanted to look at all the processes we had in place to assure that risk was being analyzed in a uniform way and that a good corporate governance philosophy was being practiced."

The process took more than two years to complete, but allowed the company to appropriately identify its risks, set up templates to report risks in particular functional areas, set up a cross-functional risk committee and validate its top risks through focused workshops. "It's obviously not something you can do overnight," says Krenicky.

"Aventis was looking to build a consistent and global risk management philosophy, which was difficult in the beginning due to the different corporate culture of the two companies, language barriers and the silo-driven approach to risk management taken in the past," says Lynch. "By identifying and communicating key issues of concern to top management, focusing on how best to address these issues and embedding risk management thinking into everything they do, the company was able to create a greater awareness of risk within the organization."

RISK IDENTIFICATION

"The biggest problem was to narrow the scope of some of the risks we identified," says Krenicky. "One of the biggest challenges with ERM is to learn how to focus and limit the scope of what you're going to look at. The process can be very difficult to manage if you allow it to continue to grow without focusing on the key issues of concern. Of the top risks identified, some of the major issues concerning the company were: product liability, protection of intellectual property, product launches and clinical trials and supply chain risk.

"Product liability is a major issue for many pharmaceutical companies today," says Krenicky. In today's increasingly litigious society, the cost of product liability insurance has increased dramatically, while limits of liability and availability continue to shrink. "We needed to determine which processes to continue to use from the merged companies, mid revisit many standard processes each company had in place for a long time." The company then had to determine how to build the necessary capacity for the combined firm.