Parima annual conference 2015

View from the risk management bridge A survey of risk managers from across the Asia Pacific region conducted by Aon prior to Parima’s recent 2015 Annual Conference found that the top risk management priorities in the region are the creation of a risk aware culture across the business, cyber risk and failure to attract and retain top talent. In a session at the Parima event in Singapore entitled View From The Bridge–Risk Manager Survey, Aon staff, insurers, a leading risk manager and other experts discussed some of the reasons behind these concerns and potential solutions open to the risk profession. We bring you highlights of the debate below.hideTop priority/concern: Creating a risk-aware culture across the business Aon Risk Solutions’ chief executive officer–multinational clients and managing director, global and corporate, Jason Disborough, opened discussion on this topic by providing feedback from Aon’s Risk Maturity Index. The index, developed with the Wharton University of Pennsylvania, has run for the past four years, with the latest edition released in August 2015. Based on four pillars–governance and infrastructure, process, integration and culture, and communication–it provides organisations with feedback on how they fare in terms of risk maturity. It ranks organisations on an index between one and five, from basic to advanced. The index defines characteristics of risk maturity as: 1. Board understanding and commitment to risk management 2. Executive-level risk management stewardship 3. Risk communication 4. Risk culture: engagement and accountability 5. Risk identification processes and tools 6. Stakeholder participation in risk management 7. Risk information and decision-making processes 8. Integrating risk management and human capital processes 9. Risk analysis and quantification to understand risk and demonstrate value 10. Risk management focus on value creation. According to the Aon Risk Maturity Index, most companies rate as basic (20%) or defined (18.1%) in terms of risk maturity. Just 1.2% score as advanced. As Mr Disborough explained: “Most organisations fall into this basic or defined area of risk maturity, with very few at an advanced level. Some industries that tend to sit at the advanced end of the curve are energy, aviation and banking. You would expect them to be there because a lot of that is driven by regulation.” He also told delegates that a white paper released by Aon immediately prior to the Parima conference confirms a correlation between share price volatility and risk maturity. “Over the last four years that we have conducted this research with Wharton, when you look at these results there is a negative correlation between reducing share price volatility and higher levels of risk maturity. This tells us that the more an organisation is prepared to invest in risk maturity the more it reduces share price volatility,” said Mr Disborough. He suggested that risk managers should present this finding before boards or risk and audit committees by risk professionals when they make an investment proposal for more risk resource. The risk manager on the panel debate, Juliette Gelpi, VP risk and insurance manager at ContourGlobal, the global developer and operator of electric power and district heating businesses, said that although many organisations are mature in certain areas of risk management, this tends to be in silos. Rarely is this consolidated or combined to give a portfolio of risk across an organisation, she said. Fellow speaker Rudi Spaan, president and chief executive officer Hong Kong and head of client and broker engagement Asia Pacific at AIG, said a mature and risk-aware culture relies on the creation of a no-blame culture, practiced and preached by the c-suite. “We want to build a risk culture where it is everybody’s business to report something that they are not sure about…You then need stamina and the courage to go to a no-blame culture where you learn together from the experiences you have,” he said. “If you are worried about getting fired you are not going to have that conversation about risk. So this is a real dilemma for the c-suite–to create a culture where people can freely talk about their concerns and risks they face without feeling they are going to get in trouble for raising their hand. I think it starts from the top and if the top sets the tone and your management team practices what the top preaches, you create better companies over time. But this demands a cultural shift,” he added. Number two priority/concern: Cyber risk As well as featuring as a top concern in the survey of Asian risk professionals conducted by Aon, cyber risk featured highly in the broker’s recent Underrated Risk report based on a survey of c-suite executives and directors of captives. The Underrated Risk report revealed that nine out of ten people surveyed believe cyber risk is still not fully understood in their organisation and has the greatest potential for growth in the coming years. There were no significant differences in response by company revenue size or region. It also found that 78% of respondents believe that cyber risk readiness may have been vastly overstated. In other words, they feel that although they are telling Aon they are cyber risk-ready, in reality they do not fully understand their cyber exposures. Ms Gelpi of ContourGlobal and Parima, conceded that getting to grips with cyber risk is a complicated and long process. She called on risk transfer partners to offer risk managers more help with the assessment and management of the risk. Risk managers are not IT managers so cyber risk is difficult to grasp, she said. “We therefore need help from the insurance industry to understand and analyse the risk…We are asking insurers and brokers to help us through the process and give us access to basic tools to help us answer key cyber-related questions,” she added. Further education is also crucial when it comes to cyber insurance, she continued. “Many risk managers still don’t know what cyber insurance is and can deliver…so a lot of education is still needed,” she said. Fellow panelist Mark Lingafelter, managing director, QBE Asia Pacific, said that cyber risk management needs to become a board-level issue rather than being left in the hands of IT. But this is easier said than done, he added, suggesting that insurance solutions can play a crucial role in helping firms to bring in external experts to tackle the threat. “It really does have to get to the board level. There is an observation that you don’t want to leave this to the IT team. But the truth is that, at board level, a lot of people are generalists so there is a lack of comfort in delving into this risk,” he said. “An interesting takeaway is insurance may have less to do with dollars and cents and more to do with delivering a panel of experts that are qualified to take the risk out of the hands of IT,” added Mr Lingafelter. Aon Risk Solutions’ Mr Disborough said that organisations see insurance as the final stage in the cyber risk assessment and mitigation process. Aon is therefore spending a lot of time with clients in Asia to help them understand and profile their network security and privacy risk exposures in particular, along with the potential likelihood and financial consequences of certain scenarios. “From there we work out what the risk controls should be. But this is still not resulting in a lot of transactions on the insurance side,” said Mr Disborough. The insurers on the panel noted that of the $2bn-$3bn of cyber premium written globally, a tiny amount is being taken out in Asia. Part of this lack of takeup is caused by the failure of insurance solutions to address buyers’ needs or they fall short in terms of capacity, the experts agreed. “As an industry we need to learn from our clients and design policies for them rather than bolting things into an umbrella and hoping it works,” said Mr Spaan of AIG. Mr Disborough noted: “The real challenge for the insurance industry is to make sure it is offering these credible solutions with the capacity that clients want so that you will then get an increase in momentum in the uptake of these types of solutions.” The panelists also voiced concerns about the accumulation of cyber risk on insurers’ books. “The customer base is not there so it is difficult for insurers to start putting capacity to the risk. Of $3bn global market value for cyber, it is remarkable that the intangible values of these companies runs into trillions,” said Stephen Cross, chief innovation officer at Aon Risk Solutions and chairman of Aon Risk Consulting. Mr Spaan suggested pooling arrangements might be one way to tackle accumulation risk. “The problem with cyber cover is there are so many different angles…I don’t know if pooling solutions will have to be considered at some point because if a cyber attack hits a global network, on the cloud for example, there is no insurance company strong enough to take that risk…I think maybe in five to ten years we will have market pools for this risk,” he said. Number three priority/concern: Failure to attract & retain top talent Aon’s survey of Asian risk managers finds that a critical skill shortage and rising salaries are the key people and staff-specific challenges linked to an ability to attract and retain top talent. Only 40% of organisations feel they are prepared to tackle these risks. Aon has also conducted research with organisations across Asia Pacific to see how they are beginning to address these risks. It reveals that the best employers, and thus those most likely to attract and retain talent, have exceeded the market average across four key metrics during the past few years. The best employers have 83% high employee engagement, compared to a market average of 59%. Some 88% have a compelling employer brand, compared to a market average of 63%, while 83% of the best employers display effective leadership, as opposed to a market average of 57%. And 82% have a high performance culture, in comparison with an average of 56%. Ms Gelpi of ContourGlobal said there is a “critical” skills shortage within the risk management profession–particularly around softer skills such as communication. Beyond that, companies are also struggling to decide the exact risk manager background and skillset that best suits their need, she added. “One thing that is complicated is the wide range of backgrounds and skills needed for different risk management roles. So you need to work out what the key skills are you need for your company. Do you need an engineer because it will be easier to understand physical risk, or a lawyer because your risks are more from a legal perspective? So it is difficult to find out what might be the best profile for a risk manager,” she explained. Fellow panelist Piere Fel, principal at recruitment firm Heidrick & Struggles, said there are many areas of skills shortage within the risk management profession. This shortage is made worse by the battle between global and local companies for staff with the right skillset, he added. Mr Fell also noted that beyond traditional remuneration, the creation of the right culture is key to staff retention. “Companies need to take a long-term view of understanding and promoting the benefits of risk management to retain related staff,” he told delegates at the Parima conference. Mr Spaan of AIG said that he believes the ability to attract the right employees is dependent on the creation of an attractive value proposition. He also noted the different priorities between the generations. “You need to look from the top down at what your value proposition is, as a company, to the employee you are trying to attract. The older generations think differently to the younger generations. Many older people think they are going to join a company for life but the younger generations think I am going to do this for three years and then will do something else. It is very hard to know how to approach that. I think at first you need to come up with your social purpose to attract new talent. Younger generations want to understand what they are a part of as opposed to thinking it is a good industry to make a career in. So there are very different perspectives. Diversity and inclusion similarly—can people understand the values of the company they are going to work for? It is about a lot more than just a pay cheque,” he said. Ms Gelpi noted that risk managers themselves are struggling to decide and understand the exact skillset they need in a changing work environment. “What is the role of the insurance risk manager? Are we going to stay as insurance managers, are we going to become risk officers? We are on a trend where we have to be very cautious…do we want to become a strategic risk officer and manage all the risks, including insurable risks, or do we want to stay with insurable risks? I think we have a lot of opportunities but there are a lot of risks for us if we do not manage our skillset properly. We have to get prepared,” she said. Mr Spaan said that risk managers need to continually re-educate themselves, particularly on leadership skills. “When is the last time you went through a training programme on how to lead today?” he asked. “Because today it is probably very different from leading five to ten years ago—there are different requirements now. You need to continually reinvent yourself and stay current…you have to change to stay relevant as an organisation and as an individual,” he said. For his part, Mr Disborough of Aon said that the failure to attract and retain talent as a key risk concern is directly correlated to the economic prosperity of a particular region. “For example, right now in the US where the economy has recovered, failure to retain talent is a key risk concern whereas in Europe the risk is far lower. So you need to factor into account that as economic prosperity drives cycles in different regions, the HR agenda tends to move around for executives and risk professionals,” he explained. Risk managers need to embrace Internet of Things Risk managers are ideally placed to help their companies deal with the huge speed of change brought about by the Internet of Things (IoT) and prevent their firms falling by the wayside in a new technological era, according to Rudi Spaan, president and chief executive officer of AIG in Hong Kong. Mr Spaan, who is also AIG’s head of client and broker engagement in Asia Pacific, urged risk managers to act as “change agents” to mitigate IoT risks and work closely with research and development to know what is cooking in their companies’ kitchens. Giving a keynote speech at the Parima conference in Singapore, Mr Spaan said there are currently 10 billion to 20 billion devices connected to the IoT, with this number expected to rise as high as 50 billion by 2020. According to the International Data Corporation, spend on IoT will triple to $1.7trn by 2020. An AIG Whitepaper predicts that the economic impact of IoT could reach $14.4trn by 2020–the current GDP of the European Union. Mr Spaan noted that 90% of the world’s data has been generated during the past two years. Every second the equivalent of 50 million books of data is being created, he explained. Failure to engage with the IoT and tackle its inherent risks from disruptive technologies and new firms, as well as changing liabilities, will cause some companies to go out of business, said the insurer. He therefore urged risk managers to help their organisations tackle the changing risk landscape. “Risk managers are change agents and you are such a crucial part for your company to link the future, the exposures and the economic environment, and help decide what the IoT will mean for your companies’ products,” he told Parima delegates. “Will you [as companies] be innovators or will you slowly become extinct because something happens around you and your business model is no longer valid? You have to run with this race or someone else will run it for you,” he added. What’s cooking? Mr Spaan said risk managers must engage with research and development to know what technological developments are “cooking in the kitchen before they are rolled out”. It is best to discuss any potential problems early, he said. He warned that the IoT is creating a lot of new liabilities and it is not clear yet who is liable for what. But as daunting as the IoT is, it does bring opportunity and some companies will thrive, added Mr Spaan. There are real opportunities from the IoT to help businesses prevent losses, become more efficient and hopefully make the world a safer place, he added. “We see three potential areas that of particular interest. IoT can improve safety, improve efficiency as operators and producers, and improve productivity,” he said. The IoT will fundamentally change how we look at risk, how it is priced and the number of risks that can be priced for transfer, added the insurer. The IoT will have a big impact on insurance products and pricing, he said. “Insurance is not boring, it is moving really fast. We are usually catching up with where clients go…we really need to move with you on this [risk],” concluded Mr Spaan.

Parima annual conference 2015

Want to read this article?

Read Next

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Climate change could spread malaria risk to new countries, warns International SOS

Europe records 300% surge in farmer protests this year

London market to remain closed for construction SPPI cover

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Climate change could spread malaria risk to new countries, warns International SOS

Europe records 300% surge in farmer protests this year

London market to remain closed for construction SPPI cover

Want to read this article?

Read Next

European Parliament approves regulation to tackle forced labour

Absenteeism drops dramatically in France

Climate change could spread malaria risk to new countries, warns International SOS

Europe records 300% surge in farmer protests this year

London market to remain closed for construction SPPI cover

Related Articles