Drawing on Risk Management Practices from the Insurance Industry to Build Corporate Resilience
The COVID-19 pandemic has warned companies to address potential impacts on cash flow and operations. Due to strict regulation, the insurance industry's ERM framework serves as the best reference. This article, authored by Jim Toole, Senior Managing Director at FTI Consulting, details the definition of ERM, a six-step management process, and insurance industry practices, emphasizing that through risk quantification, integration, and proactive management, companies can reduce volatility, improve capital efficiency, and enhance stakeholder confidence.
This article is a contributed piece by Jim Toole, Senior Managing Director at FTI Consulting, and the views expressed are solely those of the author.
The COVID-19 pandemic has shown that businesses can overlook factors that can have a catastrophic impact on cash flow and operations. This is not the first pandemic, nor will it be the last. Companies typically use enterprise risk management (ERM) frameworks to assess risks and prepare responses. For small and medium-sized enterprises lacking a chief risk officer, the CFO is often responsible for developing the ERM plan.
For CFOs needing to build an ERM plan, examining how insurance companies apply risk frameworks to their operations is an excellent starting point. Few businesses have their financial stability monitored as closely as insurance companies, making them a natural model for other enterprises. Insurers rely on ERM frameworks to demonstrate their soundness and safety to insurance regulators, policyholders, and rating agencies.
Equally important, insurance companies manage risk not only to preserve assets but also to leverage their risk-pricing capabilities to convert specific types of risk into revenue streams.
What is ERM?
Every business has different risks and risk tolerances. ERM is a structured assessment and management process designed to help organizations effectively address these risks in the short and long term based on their risk exposure and appetite.
Six Steps to Managing Organizational Risk
If you are responsible for developing and executing an ERM strategy, you should focus on two goals: protecting existing assets and growing future assets. The process can be summarized in six steps:
- Identify risks.Comprehensively review internal and external factors that could impact the achievement of business objectives.
- Analyze and quantify risks.Use qualitative and quantitative techniques to assess the likelihood and impact of risks.
- Integrate risks.Aggregate various risks into an overall risk profile, presenting results in terms of impact on the company.
- Evaluate and prioritize.Determine each risk's contribution to the overall risk profile, prioritize them, and assist executives in deciding response strategies.
- Mitigate and exploit risks.Adopt strategies such as avoidance, retention/financing, transfer, or exploitation, and even proactively pursue new risks with value-creation potential.
- Monitor and review.Continuously monitor changes in the risk environment and adjust response strategies as appropriate.
ERM Practices in the Insurance Industry
For insurance companies, ERM is not a perfunctory compliance exercise but a core culture embedded in employees' daily operations. Insurers understand that ERM aims to maximize the benefits of their risk profile—focusing on risks they are adept at managing and avoiding, hedging, or insuring against other risks. They measure and manage risks through an integrated approach to optimize their risk-return profile.
Cross-disciplinary team collaboration is the best way to build an enterprise risk profile. First, apply root cause analysis to identify high-risk areas. Through this process, enterprise risk management shifts from reactive to proactive, even eliminating the possibility of certain events occurring.
On this basis, assess the level of risk acceptable to the organization and stakeholders. After determining the appropriate risk appetite, implement relevant strategies to control and address high-risk areas. Most critically, once an ERM plan is established, the strategy and its decision-making logic must be communicated through the "tone at the top." In the post-pandemic era, effective communication of business resilience will be highly valued by stakeholders.
Enhancing Business Performance
ERM is not just about risk minimization; it is about effectively managing risk to optimize the risk-return trade-off and control volatility in business performance. By clarifying the risk-return trade-off at the enterprise level, ERM ultimately becomes a tool for identifying and appropriately pricing risk, thereby influencing product pricing and capital investment choices.
A deep understanding of risk helps improve investment decisions, optimize capital allocation, and maximize shareholder value. A well-designed and well-communicated ERM plan can also help companies raise capital at a lower cost by demonstrating effective risk management to investors, rating agencies, and the market.
The benefits of ERM are clear: while reducing volatility in corporate earnings (and stock prices) caused by unpredictable events and external variables, it creates value from risk.
Companies with an ERM plan can recognize risks, quantify and manage them in plan development, and use this as a cost-effective mechanism to control downside risk and increase opportunities.