WHENCE COMETH THE CRO?

Rough Notes, Jul 2005 by Moody, Michael J

Actuaries prepare for the board level position while RIMS provides little guidance to its members

It has taken several years, but enterprise risk management (ERM) finally appears to be gaining traction in the inner circles of corporate America. A growing number of firms are seriously considering the implementation of this holistic approach to risk management. Tangible evidence of ERM's increasing importance has been noted within the past few months. For example, rating agency Standard & Poor's has established a separate ERM division within the agency to analyze how insurance companies approach risk management. This information is then incorporated into the data that is used to assign a rating to an insurer. Additionally, mega insurer Allstate specifically refers to their ERM program in their annual report.

Evidence mounts

The Economist Intelligence Unit (EIU), a research and advisory firm that provides country, industry, and management analysis, recently completed a study titled, "The Evolving Role of the CRO," which sheds some new insight into the chief risk officer position. Worldwide, 137 organizations-representing the financial services sector, professional services, IT and technology firms, and manufacturers-participated in the survey on which the study was based. The survey found that 45% of the participating organizations had already appointed a CRO or equivalent. Another 24% indicated that they planned to appoint a CRO in the next two years. The majority of those organizations (51%) were in the financial services sector.

Further, respondents to the survey identified the main priority for a CRO was to ensure full compliance with all regulations. This emphasizes the critical nature of regulatory risks and reinforces why regulatory compliance is perceived as one of the top threats to business today. It also reflects the importance that corporate America is placing on new regulatory constraints such as the Sarbanes-Oxley Act of 2002 and the corporate governance rules for the New York Stock Exchange approved by the SEC in late 2003. The study also pointed out that over the next three years, increasing importance will be placed on monitoring emerging risks and extending risk principles into wider corporate strategies.

Other interesting findings in the EIU study include:

* CROs can expand risk management to address more risks.

* CROs help organizations make better investment decisions by bringing a more effective approach to measuring and comparing risks and rewards.

* Integrating risk systems and processes will be the CRO's single greatest challenge. Integration is important to a firm's ability to capture data on various risks.

In general, the EIU study provides further evidence of the growing role of the CRO and importance that organizations are now placing on ERM.

Expanding horizons

While early adopters of the ERM concept have been principally in the financial services sector, we are beginning to see a number of other industry segments start to develop ERM programs. Recently, one industry that has come to the forefront of ERM has been the energy sector, because risks in this sector can be easily quantified. Additionally, according to a recent PricewaterhouseCoopers report, the ERM concept is also moving forward in the automotive and chemical sectors. The PwC report indicates that some of the key reasons for this growth are that the corporate cultures in the automotive and chemical sectors are more attuned to quantitative measurements and migration is ongoing.

History has shown that growth of the CRO function is heavily dependent on identifying appropriate candidates to assume the role. Typically, organizations sought candidates with a strong background in financial management. However, the EIU study dispels this notion. It says that the majority of executives interviewed felt that the best CROs tend to have broad business backgrounds and excellent communication skills-necessary skills to have in order to marshal active support for the ERM effort. An additional trait that many felt was beneficial was the ability to measure and compare risks and rewards. Only 31% felt that a strong background in finance was needed to be an effective CRO.

Headed in opposite directions

Over the past several years, the Risk and Insurance Management Society (RIMS) has talked about the opportunities that ERM can provide for its members. However, in addition to supporting this ERM concept vocally, an organization must have the ability to provide support through educational efforts. RIMS periodically does have an ERM class on a limited basis. However a more visible venue may be the annual convention that is attended by upwards of 10,000 insurance and risk management professionals. This year's annual event was held in the city of brotherly love, Philadelphia, Pennsylvania. It is always interesting to see what the hot topics are each year, and this year's winner was clearly the buyer/broker relationship. However, one would still expect to see some opportunity to gain additional knowledge about ERM at a broad-based learning experience like the RIMS annual conference. Sadly, however, there were few opportunities to do so. RIMS had only a handful of specific ERM sessions out of the hundreds that were offered during the four-day conference. And in what could only be described as a scheduling snafu, two of these sessions were presented at the same time.