Sr nov11 lr by Nathan Hambrook-Skinner

VIEWPOINTS [ PEOPLE ] Coca-Cola’s director of supply chain risk and Abengoa’s chief risk officer share their views

RISKS [ THREATS ] Asia risk: With the emerging markets growing in popularity, we explore the key risk management issues in the East

European risk and corporate governance solutions

www.strategic-risk.eu [ November 2011 ] Issue 74 €25

GOVERNANCE [ ERM ] Credit rating agencies are taking an interest in your company’s ERM programme. Here’s how you can impress the judges

THEORY & PRACTICE NEWS & ANALYSIS » Cyber risk insurance » Conﬂict risk on the rise » European sovereign downgrades

[ BEST PRACTICE ] Risk appetite is a popular concept but do you know what it means for your organisation?

Risk Atlas Global risk map charts the likelihood of company defaults Presidents’ Roundtable Europe’s top risk managers discuss the issues that matter to them Environmental risks Our special report tackles the big issues in-depth

FANCY A DIP?

The economic crisis is threatening to swallow some of Europe’s biggest economies. Who will be next and what will happen if the crisis spreads?

LEADER [ NOVEMBER 2011 ]

Issue 74 November 2011

Nathan Skinner, EDITOR, STRATEGIC RISK

www.strategic-risk.eu WELCOME

Editor Nathan Skinner Editor-in-chief Sue Copeman Market analyst Andrew Leslie Group production editor Áine Kelly Deputy chief sub-editor Laura Sharp Group sales director Tom Sinclair Business development manager Donna Penfold +44 (0)20 7618 3426 Production designer Nikki Easton Group production manager Tricia McBride Senior production controller Gareth Kime Head of events Debbie Kidman Events logistics manager Katherine Ball Publisher William Sanders +44 (0)20 7618 3452 Managing director Tim Whitehouse Cover image Jamie Sneddon Email: ﬁrstname.surname@ newsquestspecialistmedia.com ISSN 1470-8167 Published by Newsquest Specialist Media Ltd 30 Cannon Street, London EC4M 6YJ tel: +44 (0)20 7618 3456 fax: +44 (0)20 7618 3420 (editorial) +44 (0)20 7618 3400 (advertising) email: strategic.risk@newsquest specialistmedia.com StrategicRISK is published eight times a year by Newsquest Specialist Media Ltd., and produced in association with Airmic (the Association of Insurance and Risk Managers). The mission of StrategicRISK is to deliver the latest risk and corporate governance solutions to key decision-takers in UK and European companies. StrategicRISK is BPA audited with a net average circulation of 10,046, June 2010. For all subscription enquiries please contact: Newsquest Specialist Media, PO Box 6009, Thatcham, Berkshire, RG19 4TT, UK tel: +44 (0)1635 588868 email: customerservice@strategicrisk.eu Annual subscription (incl P&P) £249 €399 $499 Two-year subscription £449 €649 $849 Three-year subscription £427 €663 $821 Printed by Warners Midlands Plc © Newsquest Specialist Media Ltd 2011

Rough guide to the world O NE OF THE SUBJECTS WE DECIDED TO FOCUS ON THIS ISSUE WAS

economic risk. The European sovereign debt crisis is probably the biggest story

in the headlines at the moment. Somehow, several of Europe’s biggest economies have managed to massively over-extend themselves. Analysts believe it will cost the EU at least €2 trillion to sort out its problems – that includes €800bn each to rescue Italy and Greece, two Mediterranean economies teetering on the brink. So with Europe in crisis, multinational companies are looking further aﬁeld to places such as China, India, Latin America and Africa, which are beginning to look like much less risky bets. Venturing overseas,

‘It’s no good running for the hills’

whether dealing with local suppliers or

Julia Graham, Ferma

establishing your presence, requires a whole

new skillset. Risk managers need to make sure they’re ready for these challenges. As Ferma vice-president Julia Graham says: “It’s no good running for the hills.” You’ll discover plenty of insight and advice in this issue of StrategicRISK to help you on your way. Coca-Cola knows a thing or two about international supply chain management, so we asked John Brown, its director of supply chain risk, to share some thoughts with our readers (page 18). Similarly, as more than half of Spanish energy, telecoms and transport group Abengoa’s business is overseas, Rogelio Bautista Guardeño, its head of risk management, is ﬂuent in managing crossborder risks. Find out what he has to say in Viewpoints (page 15). Also this month, in the ever-popular Risk Atlas series, we’ve turned our attention to counterparty credit risk. Check out the risk map on page 24. Q It would be a dereliction of duty if I didn’t mention our fantastic new website www.strategic-risk.eu. I can’t do it justice in a few lines, except to ask you to make sure you pop along and sign up to our weekly risk management news alert. SR [CONTACT THE EDITOR] Email nathan.skinner@strategic-risk.eu or follow me at twitter.com/StrategicRISK

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

CONTENTS [ NOVEMBER 2011 ]

Rogelio Bautista Guardeño – at the vanguard of change

Presidents’ Stockholm 2011

Risks

[ THE LATEST BUSINESS ROUND-UP ]

[ THREATS ][ OPPORTUNITIES ][ MANAGEMENT ]

Most read stories 08 ENERGY

09 CORRUPTION

Keeping the lights on Political risk focus rises Energy has become more of a top-level concern in recent years, owing to increasing legislative requirements, growing volatility in energy prices and the tough economic climate. The npower Business Energy Index revealed that energy risk is now placed higher than health and safety, credit and security. Fundamental elements of energy risk are: Q credit risks; Q increasing regulatory and technological complexity; Q new price and reputation risks from carbon regulation; and Q continued upward trend and increased volatility in energy prices. web. goo.gl/HprUL

An anti-money laundering report by KPMG shows a greater focus on politically exposed persons (PEPs) since the Arab Spring began. Financial bodies associate PEPs with vulnerability to corruption due to their public position. Greater awareness is a positive sign, but there are no controls yet to manage that risk. The number of institutions with processes to identify and monitor PEPs has risen from 71% in 2007 to 88%. web. goo.gl/YmP9C

Ferma Forum: full coverage web. goo.gl/v2ARL Bad corporate citizenship web. goo.gl/9ul79 A season of discontent web. goo.gl/G2h6Z What’s in my head: Jorge Luzzi web. goo.gl/EyqfE Absolute power corrupts web. goo.gl/Ra8w1

Online analysis Greek debt is Europe’s biggest worry The eurozone countries have had to throw Greece a lifeline more than once in the past year as the EU member can’t pay back its mountain of debt on its own. This has turned Greece into the biggest risk of the European sovereign debt crisis, threatening the very survival of Europe’s common currency. web. goo.gl/dV3FD

www.strategicrisk-.eu [ NOVEMBER 2011 ] StrategicRISK

RISK INDICATOR [ VISUALISING DATA AND TRENDS ]

The price of a repu

Top 10 reputation events in 2010 BP was not the only company to face major reputation challenges in 20 of the most prominent examples from the year, along with the value eac CRISES

Opportunity knocks

Allied Irish

Foxconn

Acino

Banking crisis

Suicides

Product recalls

-80%

-49.5%

-49.3%

A badly handled crisis can put a signiﬁcant dent in a company’s value, but there are silver linings to be had

here is an 80% chance of a company losing more than 20% of its value at least once over a five-year period as a result of a badly handled crisis, according to new research. The study by Oxford Metrica, which looked at more than 1,000 companies, reinforces the need for good crisis planning and management, and notes that organisations that handle a crisis well actually stand to gain a valuable reputation boost. All crises are ultimately a “nexus of opportunity”, according to the report. They can be used to reinforce a company’s values and prove to stakeholders that the business can handle complications and come out of them even stronger than before. Businesses failing to grasp the opportunity will leave behind disappointed stakeholders and revise downwards their expectations of future performance. Consequently, their share price or market value will fall. Oxford Metrica research leader Deborah Pretty said that the lost value is not just temporary but in fact a “sustained, seismic shi ” in the value of a company. “Most chief executives will experience one of these events during their tenure,” she said. “The more prepared they are, the more well placed they will be to respond and recover.” The key factor driving value recovery is a good communications strategy, according to the study. Strong leadership, rapid response and sensitive communication during a crisis can shape a company’s reputation. According to Pretty, risk managers could benefit significantly from educating their board about these matters. In fact, buy-in from the top is critical if the organisation is going to respond and recover a er a crisis. “Chief executives really need to understand what’s at stake if a major crisis occurs,” she said. SR

-$4.1bn

-$1.42bn

HewlettPackard

Goldman Sachs

Chief executive resignation

Fraud allegations

-18.5%

Rolls-Royce

Product recalls

-12.6%

-9%

-7.7%

-$13.82

-$1.76bn

-$12.64bn

-$20.01bn

Johnson & Johnson

Engine failure

The impact of reputation crises on shareholder value While the initial impact on all companies is a drop in value, the market rapidly begins to make its judgment and there emerges a clear distinction between the winners and the losers

Making the most of a crisis

1 2 3 4 5 6

Preparation is the key to recovery. The Deepwater Horizon disaster showed that the oil industry’s loss prevention and control techniques were not up to scratch. Heed the warning signs. If organisations ignore the early warning signals, then they have nobody else to blame but themselves. Post-crisis investigations reveal this is o en the case. Expectations need to be managed with care. The ultimate scale of the BP/Gulf spill was vastly underestimated, meaning subsequent developments became a dripfeed of bad news. Know your role. Chief executives need to focus on the strategic, not the operational. Chief risk officers, meanwhile, need to understand how operational risks can affect the business’s strategic goals. Appreciate the cultural/political context. The USA accounts for a huge portion of BP’s proﬁts, yet a er the spill it didn’t respond with a communications strategy that resonated with Americans.

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

Reaction value (%)

-5

-10

-15

-20 0

Winner portfolio Loser portfolio

100

120

140

Event trading days

160

180

200

220

tation

RATINGS

The likelihood of reputation damage This chart shows that there is an 80% chance of a company losing more than 20% of its value at least once during a ﬁve-year period

010. These are 10 ch company lost

Toyota

Explosion and oil spill

Safety recall

-29%

-20.2%

997

1.000

Top ﬁve [ CREDIT RATING DOWNGRADES ] BY STANDARD & POOR’S

832

1. 2.

-$31.36bn

-$53.5bn

-$248m

402

4. Apple iPhone4 antenna

156

-2.4% -$5.97bn

2bn

Number of companies

50 14 3 -30% -50% -60% -70% -40% Number of sudden drops in value greater than

-10%

-20%

USA (AAA to AA+) The USA lost its AAA status in August, an embarrassment for the Obama administration. Greece (B to CCC) Europe’s weakest state was le just two notches from default in June. The agency said the EU’s rescue plan will amount to a default. Italy (A+ to A) Italy’s rating was slashed in September, underlining growing concern about the eurozone’s third largest economy. Spain (AA to AA-) The downgrading of Spain’s longterm rating in October was proof of the country’s weak growth and high levels of private sector debt. BNP Paribas (AA to AA-) The slashing of French banking giant BNP Paribas increased concerns over a possible signiﬁcant downgrading of France’s top-notch AAA rating.

OVERHEARD

“Soundbites” Financial losses/ irregularities Operational hazards

Lawsuits and regulatory action

Allegations of business practices

Most common threats to a company’s reputation

‘Part of the beauty of the drinks industry is that most of the risk is distributed because products are made locally’ John Brown Coca-Cola director of supply chain risk >> see Viewpoints page 18

‘Five years ago, good security was a business necessity. Now it is a strategic advantage’

Service disruption

Arnout van der Veer Reed Elsevier chief risk officer >> see Presidents’ Roundtable pull-out

240

Leadership and governance issues

Product recalls ‘If the politicians and the banking sector continue to tell us things will go badly, then they will go badly. It’s a self-fulﬁlling prophecy’ Source: Oxford Metrica Reputation Review

Carl Leeman Katoen Natie chief risk officer >> see News feature page 14

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

NEWS ANALYSIS [ CONTEXT & INSIGHT ]

CYBER CRIME

Data security is back on the agenda Ever since the Millennium Bug debacle at the end of the 1990s, cyber risk insurance has been largely ignored. But companies’ increased reliance on IT, and proposed EU legislation, has highlighted the need for protection

YBER RISK INSURANCE HAS TAKEN some years to get established as a cover worth considering by most European companies. Recent trends have pushed it up the risk management agenda. Cyber risk insurance received a boost at the end of the 1990s because of fears around the ‘millennium bug’. A er this didn’t happen, cyber risk insurance took a back seat. However, recent changes have highlighted the importance of the cover. ACE UK cyber risk underwriter Iain Ainslie says: “In the last 10 or 11 years, companies have come to rely more heavily on IT than before. As a consequence, an IT problem can be a major issue, affecting their revenues and balance sheets.” However, it is not just the growth in importance of IT that has alerted companies of the need for protection. Ainslie says that some European jurisdictions such as the UK are becoming far more litigious over data

‘Attacks can come from aggrieved individuals who consider a company has done something wrong’ Patrick Pouillot ACE 8

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

protection. Criminals too are becoming more aware of the value of data and, with so much held online, it can be easier to get to. “Hackers sell it on to other criminals who know what to do with it and commit the actual fraud,” Ainslie warns. Targeted attacks remain a serious issue for some companies – and ACE’s IT underwriting manager for Continental Europe, Patrick Pouillot, says that in some cases there is a change in motivation. “Attacks on data security now are not just coming from criminal or political organisations, but also from aggrieved individuals who consider that a particular company has done something wrong and want to punish it. This could mean that we will see some new viruses that specifically target one company, which would be difficult for traditional techniques to combat.” Pouillot cites Stuxnet, a worm that initially infects Windows PCs and goes on to seek out industrial control so ware made by Siemens. It reprograms the so ware to give machinery new instructions. There is likely to be even more attention on security and protection when proposed EU legislation comes to fruition. In an effort to harmonise approaches across member states, the European Commission looks set to impose mandatory notification of a data breach to potentially affected customers of all companies – not just those in high-risk categories. Notifications can be expensive if large numbers are involved, and companies o en have to pay legal advisers to ensure they phrase their message in the right way. However, even today when notification may not be mandatory in many European countries, Pouillot considers that, a er a major data breach, most insurers will respect the views of clients’ risk managers on whether to notify. “The notification costs may be huge, but quick notification could prevent liability claims. It’s a question of trying to prevent the impact of the incident on the customers in both the company’s and the insurer’s interests,” he says. SR

The Risk Index

€5.2m

The average cost to a business of exposing customer data.

€145

The average cost to a business per compromised record.

48%

The cost of malicious attacks rose by almost half in 2010 over the previous year. Attacks on data security do not just come from criminal or political organisations, but also from aggrieved individuals.

Third party Most organisations say breaches occur as a result of a contractor or outsourcer.

88%

of all data breach cases involve incidents of insider negligence.

Know more. Achieve more. Building the world’s largest passenger aircraft – the A380 – is a challenge that requires a trusted partner. That’s why Airbus, an EADS company, trusts in the expertise of Allianz Global Corporate & Specialty – covering the most complex business risks worldwide. www.agcs.allianz.com

With you from A-Z Ingo Zimmermann, Head of EADS Corporate Insurance Risk Management

NEWS ANALYSIS [ CONTEXT & INSIGHT ]

CONFLICT

Managing business in the line of ﬁre As war and conﬂict increasingly creep across the globe, organisations must reconsider how they do business in volatile countries and, indeed, as the situation in Libya demonstrates, just who they’re doing business with Reuters

“Conflict exponentially increases the risk of doing business within a country, as operations are disrupted and employees and assets are endangered,” comments Maplecro analyst Jordan Perry. “This threat was all too apparent to the oil majors in Libya, as they evacuated employees in response to the violence. Ongoing monitoring of political risk … is essential for companies to ensure business continuity.” Volatility in central Africa is also intensifying. “Civil war is spreading in Sudan, and concerted international action is needed to stem the violence and prevent it from engulfing the entire country and the wider region,” the International Crisis Group (ICG) has warned. Hundreds of thousands of people have been displaced by the conflict in Sudan – at least 20,000 of these people have fled into Ethiopia. “The situation will escalate if the international community is delayed or disjointed in its response,” ICG stated. Much of the Western media’s attention in recent months, however, has been focused on Libya. Businesses in the region are trying to get back to work as the interim government attempts to impose some form of stability. But the operational risk environment is challenging. Continuing political instability, problems with economic sanctions and widespread corruption are all hampering a return to business as usual.

Anti-Gaddaﬁ ﬁghters gesture to the crowds during celebrations for the liberation of Libya in Quiche, Benghazi, on 23 October 2011

AR RISKS IN SEVERAL PARTS OF the Middle East and Africa are intensifying, posing significant threats to international businesses in these regions, including probable asset damage and supply disruptions. A recently published conflict risk index warned that 12 countries in these volatile regions are rated ‘extreme risk’. The Arab Spring uprisings have accounted for an increase in violence in several parts of the Middle East. India, Afghanistan, Cote d’Ivoire, Libya, Iraq, Pakistan and South Sudan are the deadliest parts of the world, according to Maplecro ’s third annual Conflict Intensity Index, a tool developed to assess ongoing trends for conflict and potential risks to operations and investors. Libya, which rose from 120th in last year’s index to fourth this year, has a death toll running into the tens of thousands, making its civil war the deadliest conflict of 2011.

KEY Extreme risk High risk Medium risk Low risk No data

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

Source: Maplecro Conﬂict Intensity Index

Top 10 at-risk countries 1. 2. 3. 4. 5. 6. 7. 8. 9. 10.

Afghanistan Côte d’Ivoire Iraq Libya Pakistan South Sudan Syria Nigeria Somalia Yemen

Source: Maplecro

As every international business knows, political uncertainty makes long-term planning very difficult. The only thing that’s certain in Libya at present is that the interim government is prone to quarrelling and in-fighting, which, for business, can lead to postponement and delays. Foreign organisations that may have established working relationships with the former regime are now having to spark up fresh ones with the new order despite the fact that it’s still not clear who has the firmest grip on the levers of power. If foreign organisations are still dealing with business representatives that had links to Gaddafi and his regime, they should be prepared to see these people ousted. Economic sanctions also still pose a risk to foreign investors. “From a regulatory point of view, the EU continues to list sanctions on Libya,” says Maplecro ’s risk analysis specialist for Libya Jonathan Terry. The EU has begun to repeal some of the sanctions that it imposed on Libya, but sanctions still pose a serious reputational threat for companies. It’s likely to be some time before the picture is entirely clear. Another threat that’s common in lawless parts of the world is corruption and abuse of power, which will continue to be a major problem in Libya for some time to come. SR

XL Group Insurance Reinsurance

Properties, transport, energy, art, manufacturing, insurance, aerospace, contracts or people. Whatever your world is made of, weâ&#x20AC;&#x2122;re here to help your business move forward.

MAKE YOUR WORLD GO xlgroup.com and MAKE YOUR WORLD GO are trademarks of XL Group plc companies

NEWS FEATURE [ COVER STORY ]

109%

81%

Ireland

Netherlands

61%

Ireland €85bn 29.10.11 87%

106%

83%

Germany France

67%

Portugal

g Portu

£78bn

.11 16.05

Italy

Gov

debt as ernment

Financ

ial ratin

a % of G

DP 2011

Spain

EUROZONE

Contagion in the eurozone?

As the debt crisis worsens, Portugal and Ireland are struggling to regain their composure and Greece is in line for yet another bail-out. What will happen if the trouble spreads?

HE ESCALATING EUROZONE DEBT CRISIS COULD HAVE a big impact on European insurers and, if it does, it could put upward pressure on premium rates. Considerable uncertainty in the global economy, stock market volatility and talk of a double-dip recession has been a feature of the past year. At the time of writing, emergency meetings were taking place to approve a further €109bn for Greece after a €110bn bail-out a year ago. The failure to deal decisively with Greece has eroded conﬁdence and made a default on its debts seem all the more likely. In the rest of Europe, there are fears that the debt crisis that began with Greece, Portugal and Ireland could spark contagion to some of Europe’s bigger economies, in particular Italy and Spain. For the risk management community the macro-economy is a concern: it holds the more immediate prospect of premium rate increases in the insurance industry as a result of sovereign debt exposures that threaten businesses going forward. This was one of the key messages ahead of the Ferma conference in early October.

View from Ferma “We have a very difficult economic environment and the sovereign debt crisis will be of concern to risk managers as it is

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

121%

166%

Gr ee

ce £

Note: Within hours of StrategicRISK going to press, European leaders gathered at a summit in Brussels agreed in principle to boost the size of the European bailout fund to €1 trillion. These additional funds are not reﬂected in the inset chart on this graphic.

2.0

5.1

Greece

* Changes since April 2011. ** European Financial Stability Facility (EFSF). *** Away from centre signiﬁes higher risks, easier monetary and ﬁnancial conditions, or higher risk appetite. Sources: Fitch ratings, the IMF.

Key points 01: There are fears that debt problems will spread to the bigger economies of Italy and Spain. 02: Negative ratings changes can be expected if larger economies end up defaulting. 03: While the outlook for the ﬁnancial industry is bleak, the risk management sector stands to beneﬁt.

to us,” said Willis Group Holdings’ continental Europe operations chief executive, Adam Garrard. “The European Central Bank estimates that 17% of insurer assets are tied up in Portugal, Spain, Italy and Greece. “Obviously if we have a sovereign debt failure, that will impact on insurers’ ability to write at a price that risk managers will be comfortable with,” he continued. “We also have the issue of inﬂation. So if we have a joint issue with inﬂation and sovereign debt default, I think that all bets will be off and (re)insurance pricing will certainly rise.” Beyond the cost of insurance, there were mixed reactions from Ferma delegates to the debt crisis. It was not as dominant a topic at the conference as many had anticipated. There is a feeling that the eurozone problems are more an issue for banks, which the European Central Bank (ECB) has promised to bail out should they risk failure. It will step in and buy up to €40bn in covered bonds to make borrowing easier should the crisis escalate.

As the economies of the west stagnate and inch closer towards a second recession, it is clear there are no quick and easy solutions and there will be slow growth for years to come. This was the view of Deutsche Bank chairman Dr Josef Ackermann, who presented the keynote speech. “Many still think of the debt crisis as a short-term phenomenon, linked to the financial crisis,” he said. “However, it is more accurate to see it at least as a medium-term problem. Many have lived beyond their means for years, if not decades. The ageing of societies – with the ensuing consequences in terms of higher public spending on pensions and healthcare – will only compound the debt problem.” Many at Ferma felt this bleak economic outlook contradicts day-to-day business activities, with order books filling up and ongoing demand for risk management expertise. “At the end of the day it’s a self-fulfilling prophecy,” said president of IFRIMA Carl Leeman, speaking at Ferma. “If the politicians and the banking sector continue to tell us that

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

NEWS FEATURE [ COVER STORY ]

» things will go badly, then they will go badly and people will not spend anymore. “Although the economic outlook according to our friends in the ﬁnancial industry is not very bright, I think the future for risk management is very bright because there will be more and more need of risk managers, for experienced staff and people with fresh ideas.” Insurance representatives were quick to allay fears they would be unduly negatively impaired by the crisis, pointing out that they have spent the last 18 months de-risking their investment portfolios to reduce exposure to eurozone debt. With this corrective action, capital should not be overly impaired in the event of a default to the extent that the cost of insurance would need to go up.

166%

Gr ee

ce £

2.0

5.1

Greece

Rating agency view Fitch Ratings does not anticipate widespread insurance rating downgrades as a result of the debt crisis, unless it spreads and becomes systemic. The rating agency cut Italy’s sovereign credit rating by one notch (to A+) and Spain’s by two (to AA-) on 7 October, keeping both countries on negative outlook, suggesting there may be further downgrades in the future. At the moment, a Greek default or other ‘peripheral’ defaults might impact insurers operating in those countries, but it is unlikely to be felt across Europe, according to Fitch. This view is based on a number of assumptions, ‘Many still think of including the ultimate survival of the eurozone and regulatory forbearance. the debt crisis as a short“We are not expecting widespread rating term phenomenon, linked changes on the back of a hypothetical Greek, Portuguese or Irish default, but if Italy or Spain to the financial crisis. were to default I’d expect quite significant However, it is more accurate negative rating actions,” says Fitch managing director and head of EMEA insurance to see it at least as a Chris Waterman. “But ultimately I would medium-term problem’ expect that governments would step in to prevent the default of systemically important Josef Ackermann Deutsche Bank banks and sovereigns. “If we see contagion I would expect that it will materially impact insurance companies’ profitability and also capital,” he continues. “When capital starts being eroded, management don’t have too many levers that they can pull. That would be the key time when they would likely increase premium rates to support earnings and generate capital.” While a Greek default is more likely under Fitch’s current set of assumptions, there are several mitigating factors helping the insurance industry withstand such an event. Waterman confirms there has been widespread de-risking of balance sheets in the industry, particularly for insurers with cross-border exposures. Regulatory action should also shield insurers if there is a Greek default. In Italy, for instance, the regulator is not requiring insurers to report unrealised losses on Italian sovereign debt. And

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

insurance balance sheets are stronger than they were before the Lehman Brothers collapse in 2008, having seen a significant increase in shareholders’ equity over the past three years. Nevertheless, capital in the industry has been put under pressure in 2011, with a record $70bn of catastrophe losses in the first half of the year. The low interest rate environment means investment returns are low and reserve releases are becoming more difficult. New catastrophe model releases and anticipation of the Solvency II framework in Europe are also driving up capital requirements for some insurers. Solvency II has also put insurers under pressure to increase their holdings of sovereign bonds. “I think things could potentially move quite quickly,” says Waterman. “There are a number of factors impacting negatively on earnings, but at the end of the day it depends on how they all play out and whether capital is taken out of the market in sufficient volume to result in premium rate increases.” “Our analysis of insurance company balance sheets indicates that there has been some de-risking to peripheral eurozone countries and that exposure to Greece, Portugal and Ireland on average across the industry is low,” he continues. “It’s really Italy and Spain that are much more significant and while we view default of these countries as highly unlikely, given their relatively strong credit ratings, if that were to occur we would expect to see substantial capital erosion. That may ultimately impact the need to increase rates, among other things.” SR

Viewpoints

[ PEOPLE ] [ OPINION ] [ COMMUNITY ]

> In my opinion........................ 18 Is the debt crisis the catalyst we need to rethink our strategies? > Q&A John Brown ................... 18 Coca-Cola’s supply chain risk director considers best practice

PROFILE

Lone ranger Rogelio Bautista Guardeño was Spanish company Abengoa’s ﬁrst risk manager. Now he’s one of the few in Europe to really evolve his role beyond buying insurance. » Is it time the rest caught up?

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

VIEWPOINTS [ PEOPLE ][ OPINION ][ COMMUNITY ]

S THE PROBLEMS AND LIMITATIONS OF EUROPE’S economy become increasingly obvious, companies are looking to strengthen their presence in developing markets. With its links to South America and proximity to North Africa, Spain’s multinationals are particularly well positioned to increase their business in a variety of burgeoning economies. StrategicRISK spoke to Spanish company Abengoa’s senior risk manager, Rogelio Bautista Guardeño, to get an insight into risk management in Spain and doing business in developing economies. Bautista has been working for Abengoa, which is a large multinational with major interests in the engineering, telecoms and energy sectors, for the past 20 years, and in 1998 was given the task of setting up a risk management department at the company. “I think I was chosen because I had the right management experience but also because I had an education in law, was technically minded and understood the engineering industry,” he says. “From the beginning, our idea of risk management was not related to insurance, it was to analyse and understand our political, ﬁnancial and regulatory risks. The chief executive wanted someone who could analyse contracts, agreements, joint ventures, clauses, responsibilities and so on. “At the beginning it was me and me alone, but now we have 35 people working in the risk management department.” There is a strong community of risk managers in Spain: members of Spain’s risk management association Igrea include major companies such as Telefonica, Endesa and Ferrovial, as well as Abengoa. “It’s the same level as communities in other European countries,” Bautista says. “However, what we lack is the step towards having a chief risk officer [CRO] approach to the industry.” As in some other parts of Europe, risk management in Spain is still developing and Bautista believes that it has some way to go before it reaches US standards. “When we started in 1998, risk management was recognised in Spain’s business community. However, even nowadays the role of risk management in this country is mainly limited to insurance management. I think this is the same for most of Europe. For example, when I go to a Ferma forum the majority of my colleagues will have insurance management as their main activity, but when you go to North America there are a lot more risk managers who are working with the kinds of ERM [enterprise risk management] concepts that we use at Abengoa. My role is more akin to that of a CRO than a risk manager in the traditional sense of the term. I think that Abengoa is probably the only company in Spain where the risk management department engages in all these kinds of activities.”

Change from the top Throughout the interview, Bautista emphasises risk management as a means of improving business efficiency and proﬁtability, and not solely as a means of mitigating risk. He believes that business’s perception of risk management still needs to change. “It’s true that there are a growing number of people who understand that risk management is something that adds value to a company. However, only a few years ago it was still seen as a process that was there solely to protect assets and responsibilities, not to anticipate possible risks or improve the company.” Bautista obviously believes passionately in the tenets of ERM, but he realises that these cannot be achieved without the support of the board and an effective company-wide risk management culture. “The most important thing I’ve learnt is probably that you

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

CV 1977-82 Law studies at Granada University 1988-91 Manager at Vivendi 1991-98 Manager at Abengoa 1993-95 Postgraduate studies in business administration and human resource management at IEJ 1998-present Risk Manager at Abengoa 2010-2011 Programme for leadership development, ESADE – Loyola

cannot achieve real risk management if the executive branch of the company is not convinced; risk managers need the support of the board to do their jobs effectively. “The most important lesson for me is that risk management has to come from the top down and not from the bottom up. If risk management comes from the top down, 75% of the battle is already won,” says Bautista. For him, the board’s support is often the limiting factor in the development of the risk management industry. “When you talk with other risk managers they say that risk management is evolving and that’s a good thing. But, in reality, if the awareness and support of executive management is not increasing, risk management cannot develop effectively,” Bautista says. “There are many great people working in risk management, people who have great ideas and who have the intention of developing the discipline of risk management. But companies’ boards need to give more support to these kinds of individuals.” “The second valuable lesson that I have learnt,” he continues, “is that risk management has to be a function that forces the risk manager to understand all of the process, functions and staff of a company. Risk managers have to have a very broad perspective; you can’t simply be an expert in insurance. I often say that the risk manager should be an expert in how to not buy insurance – ideally they should know how to manage risks without paying for them. Of course, you need to know how to buy insurance, what kind of insurance policies there are in the market, what kind of risk you are able to protect with an insurance policy, but this is the second step. The ﬁrst step is to manage all other options.” In order to establish a risk management culture within the company, Bautista employs a variety of methods to educate his staff. “We have several internal procedures and we have an internal manual on risk management that is transmitted to all employees in the company. For example, for 10 years now I have been

organising training in risk management not only for the risk management or insurance team but also commercial people, technical people and the management team. “The important thing is that the entire company understands your philosophy and your practice of risk management. We have this kind of training online, so all the employees of Abengoa have to complete a test in basic risk management procedures. We do these tests with our staff here in Spain, but also in Brazil, China, Mexico and the USA.”

diversity of business activities – that’s to say that approximately 40% of business is in ‘Companies have to Spain and the rest of the activities are in other have a global vision, but countries. I think that diversified companies in terms of geography and activity are better they can’t forget the equipped to deal with this crisis.” importance of having a Although developing economies represent the future for many companies, local perspective’ breaking into new markets is fraught with Rogelio Bautista Guardeño Abengoa risk. “One of the most important risks in these kinds of countries is regulation; the second risk is financing because nowadays there are several restrictions in financial markets, and for this Staying ahead of the crisis reason companies need to be sure that they will have enough Like the rest of the business community, Bautista believes that the financial resources to carry out their project. Another risk can economic crisis presents risk managers with major challenges. come from working with local partners, so companies need “I believe we are in a critical time. I believe that we are in a time to choose the best, because if the deal falls through you will when dynamics are changing, there are lots of different pieces that assume the whole responsibility including the responsibility of are moving and changing place. For example, you have the Arab the local partner.” Spring and various economic convulsions. I think that risk For Bautista, the mistake many multinationals make is to managers are obliged to understand the implications of these manage their business in developing countries remotely. “In my events and also to raise themselves above, to have a more objective opinion, one of the mistakes a risk manager can make in this view of the situation. context is to make a decision in Brazil from their own office in, for “We have to be able to see the events from above so we can example, Spain. You have to travel to Brazil, you have to know anticipate the consequences and protect our companies. You have perfectly how to do business in Brazil, how people do insurance, to have a global perspective of the situation and be able to react how the government works. very quickly to changing factors. I think that this is the most critical “Companies have to have a global vision, but they can’t economic situation in my time as a risk manager.” forget the importance of having a local perspective. For this However, Bautista is confident that the diversity of Abengoa’s reason I travel a lot, because I need to know the situation in Brazil markets will allow it to insulate itself from the effects of the debt relating to brokers, regulation and authorities; the same goes for crisis threatening to engulf Europe, and southern Mediterranean the USA and China. We have to understand the situation perfectly countries such as Spain in particular. “Abengoa isn’t significantly and sustain our understanding, and this doesn’t happen if you just affected by the European debt crisis because we have a good sit in your office.” SR

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

VIEWPOINTS [ PEOPLE ][ OPINION ][ COMMUNITY ]

Nathan Skinner, EDITOR, STRATEGICRISK IN MY OPINION

Are we prepared for the storm that’s coming? D

EUTSCHE BANK CHIEF EXECUTIVE JOSEF Ackermann’s keynote speech at the Ferma conference in Stockholm received a great deal of attention around the exhibition. Risk managers themselves were left stunned by his dire economic warnings, which predicted low growth for many years, compounded by crippling public debt, and extremely high asset price volatility. “Sentiment indicators suggest the global economy is on the brink of a sharp slowdown. And uncertainty about sovereign debt lies at the heart of this market turmoil,” said the bank boss. “As long as this persists, it is almost inevitable that we will see tremendous asset price volatility.” His comments were made a day before Deutsche Bank reported that it would miss its targeted €10bn pre-tax proﬁt from operating businesses this year – mainly owing to a €250m impairment on Greek sovereign debt. The bank is also due to shed

500 jobs because of falling customer demand. But Europe’s risk managers will be more struck by Ackermann’s predictions on the state of the economy and the changing world dynamics, which he thinks will lead to a shift in economic might from the West to the East. “The share of emerging markets in global GDP will probably rise above 50% for the ﬁrst time this

‘We are facing probably the biggest crisis since World War II. This is the moment to rethink our position and to analyse the world that we are living in today’ Jorge Luzzi Ferma president

year, while Europe’s share of global GDP will be around 20%,” said Ackermann. Reacting to the news, Ferma vice-president Julia Graham told me: “I think what Ackermann said reflected the seismic shift our world is going through. These economic challenges are part of that seismic shift and we, as risk managers, have to be able to manage that.” “The economy is slowing in the West, but in other parts of the world clearly it is not,” she continued. In order to take advantage of these growth opportunities in the emerging markets, organisations and their risk managers will have to learn to work with other cultures, noted Graham, who is also chief risk officer of the international law firm DLA Piper. “We may see the flavour or mix of our companies change.” But now is not the time to “run for the hills” added Graham. “It is scary, yes. But you can’t put your head in the sand.”

Q&A

‘The better we spread best practices, the better our own companies will be protected’ Can you tell us about your role at the Coca-Cola Company? I joined in April 2008 with the charge to develop and deploy a risk management programme across the end-to-end supply chain – and that’s what I’ve been doing for the last three years. Supply chains have always been a rather complex part of risk management. What complications do they entail today? What happened in the past decade is that most companies have, in their effort to become as efficient as possible, established a more brittle supply chain with very little ﬂexibility. The interconnectivity among suppliers is so high that an event happening anywhere has consequences all over the world. We can see that very clearly in events after the Japan earthquake and resulting nuclear power problems – most speciﬁcally in the electronics industry. From what I understand, around 40% of the world’s capacity for making the silicon wafers that go into electronics were made in Japan, and that

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

John Brown, DIRECTOR OF SUPPLY CHAIN RISK MANAGEMENT, COCA-COLA COMPANY

plant was damaged severely during the earthquake. That had ripple effects for any industry that used electronic components. Are there any recent disruptions that you have had to struggle with? Part of the beauty of the beverage industry is that most of the risk is distributed because products are made locally. But, as with anyone in the food industry, we felt some impacts from the fear of radiation contamination of food that was being imported from, or exported to, Japan. You are a member of the Supply Chain Risk Leadership Council, which has recently launched its Best Practices Guide. How did you become involved in this project? When I started at Coca-Cola, a company with a complex series of supply chains, I felt that even though I had a very good foundation in risk management I would beneﬁt from seeing what other large global companies were doing. In my

investigation I saw that the Supply Chain Risk Leadership Council had, in my mind, the best vision – so I applied to become a member. I’ve had the honour of chairing this group in 2011. You have described the first version of the Best Practices Guide as “just a starting point”. What do you expect to achieve with the guide in the future? The Supply Chain Leadership Council is a fully voluntary organisation. People are in it because they want to be, and by the same token we are limited in the amount of time we can dedicate. So we realise that by putting together this first edition of the guide we have established what is probably 80% of what I would call a first-class document. As we get the document out, we want to learn from those who are using it. We know there are probably many best practices that we have not yet included in the document. Our plan is to continue to evolve this, hopefully with annual updates. Our underlying reason for doing this is of course selfish: the better we can spread best practices across

Community update “The economic crisis is adding to the professional demands on risk managers,” she said, so risk managers have to make sure they are ready to live up to the challenges ahead. This means making sure they have the professionals skills, expertise and ﬁnancial literacy to deal effectively with senior management. Ferma’s new president, Jorge Luzzi, who is group head of risk for Italian tyre maker Pirelli, also shared his thoughts with StrategicRISK. He said: “We are facing probably the biggest crisis since World War II. And you saw that, after the war, the world changed in immeasurable ways. This is the moment to rethink our position and to analyse the world that we are living in today.” Luzzi said that increased regulation and a move towards protectionism are going to be the major challenges facing businesses in the years ahead. But, on a more positive note, he added: “If it doesn’t kill you, it will make you stronger.” SR [READ MORE ONLINE] Read more opinion and comment from risk managers at www.strategic-risk.eu

all industries and across the world, the better our own companies will be protected from disruption. Do you see a high demand for such a document? There are a few books on supply chain risk management written by some esteemed professors, but they only focus on specific examples. We try to build an overarching framework for risk management and then combine it with the elements of business continuity planning, crisis management and emergency response and tie it into a nice package that anybody in any industry can use. As an expert in the field, can you offer any advice on what to look out for right now in supply chain risks? I think the biggest gap right now is to be able to see the physical flow of material through the supply chain from suppliers all the way to consumers. Most data systems in companies will identify the supplying company, but they don’t capture the ship-from and ship-to location. Can we expect any innovation in that area soon? There’s some really good work being done right now. The project I’m most familiar with is by MIT. They are working with companies to identify what data exists within their systems, figure out how they can pull that information out and then fill in the additional data points that they need, which are primarily going to be the ship-from and ship-to locations. Then they visualise that. It doesn’t matter so much what you have spent on an item, but more on what kind of value that item would affect if it were not available. This work is about being able to create a visual map of a supply chain and be able to see where value is affected. SR

The risk management associations of Malta (MARM) and Slovenia (SI.RISK) were accepted as new members of Ferma. Ferma now represents 19 different European risk management associations. Former Ferma president Peter den Dekker said: “I am thrilled to welcome these new members to Ferma. Their enthusiasm shows the recognition of Ferma as the voice for the European risk manager.”

Italian risk management guru Jorge Luzzi, also Pirelli’s group risk management director, has been elected as president of Ferma. He succeeded Peter Den Dekker on 5 October a er the Ferma Forum in Stockholm, and will continue in the role until 2013. In addition GDF SUEZ deputy chief risk officer Michel Dennery has been elected Ferma vice-president with a two year mandate until June 2013.

The bi-annual Ferma conference was held in Stockholm on 3 October. A record number of risk managers were among the 1,500 risk and insurance professionals in attendance. Full coverage of the event (including photos) is available online at goo.gl/v2ARL. Peter den Dekker said at the opening of the conference that solutions and coverage are more important to buyers than price alone.

HOT ISSUE

The focus at Ferma DEUTSCHE BANK CHIEF EXECUTIVE Josef Ackermann opened this year’s Ferma Conference with a talk about ﬁnancial regulation, before outgoing Ferma president Peter den Dekker followed with some words about Solvency II. Reinsurance companies are “talking up prices”, which could mean premium hikes for commercial insurance buyers, he said. The conference also looked at the growing appetite for catastrophe cover and the connection between the maturity of risk management frameworks and ﬁnancial performance.

Reinsurance companies are ‘talking up prices’, which could mean premium hikes for commercial insurance buyers

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

EUROPEAN RISK MANAGEMENT AWARDS

ENTRY DEADLINE: Friday 3rd February 2012 Have you done something exceptional in 2011? If so, you could be a winner in the ninth annual StrategicRISK Awards. Being shortlisted or winning a StrategicRISK Award is a fantastic opportunity to raise the proﬁle of your work. It can also help you to raise the awareness of risk management within your organisation and boost team morale. THE AWARDS CEREMONY WILL BE HELD ON

TUESDAY 8TH MAY 2012 INTERCONTINENTAL HOTEL, LONDON

CHOOSE FROM THE FOLLOWING TEN AWARDS CATEGORIES

• European Risk Manager of the Year • European Risk Management Team of the Year • Enterprise Risk Programme of the Year • Best Risk Communication of the Year • Most Innovative Use of IT or other Technology • Best Business Continuity Approach of the Year • Best Risk Training Programme • Best Risk Management Approach in the Public Sector

ENTRY DEADLINE: FRIDAY 3RD FEBRUARY 2012 FINALIST SHORTLIST ANNOUNCED: FRIDAY 2ND MARCH 2012

• Risk Management Product of the Year • Risk Management Young Achiever of the Year

For more information visit www.strategic-risk.eu/srawards or contact Katherine Ball +44 (0)20 7618 3492 | katherine.ball@strategic-risk.eu

SEE OUR QUICK GUIDE TO ENTERING THE AWARDS

“It was a great honour to win the StrategicRISK award. It helped demonstrate the achievements of our risk management programme across our business and was also a huge boost to team morale” Colin Campbell, Head of Risk Management, Arcadia Group Winner: Risk Management Team of the Year 2011

QUICK GUIDE TO ENTERING THE AWARDS Now it’s time to bring together all the information that you will need to substantiate your entry. At StrategicRISK we recognise how busy you are and that preparing an entry form may not be top of your to-do list. With this in mind, our entry system for you to tell us about your achievements is designed to be quick and easy. To help you submit an entry, here’s our ﬁve-step guide.

S T E P 1 – F I N D T H E R I G H T C AT E G O R Y Check each category definition to make sure you are entering the correct award. You can read the full criteria for each category online at www.strategicrisk.co.uk/awards2012 STEP 2 – READ THE QUESTIONS We’ve done away with the need to write lengthy submissions. To enter, simply complete our awards questionnaire comprising no more than eight questions, which make up your entry. Our judges want to compare the entrants’ answers against each set question. Make sure your answers are succinct, avoid wordy, vague explanations and remember, where possible, to back up your answers with facts and testimonials. STEP 3 – TIMESCALE AND TEAM Establish what data, evidence, testimonials and examples you will need to support your entry. Delegate to members of your team and make each responsible for completing a section of the form. Entering, and especially winning, awards is great for team building. S T E P 4 – D O YO U R H O M E W O R K Take a look at previous winners and find out what they did to gain their award. A list of recent winners and a summary of the entries can be found at www.strategicrisk.co.uk/awards2011 under Roll of Honour. S T E P 5 – S TA R T T O D AY Enter online at www.strategicrisk.co.uk/digital/srawards2012. All entries must be received by Friday 3rd February 2012. Shortlisted finalists will be announced on Friday 2nd March 2012.

CALL FOR NOMINATIONS Do you know someone who you think should apply for an award? If so nominate them now at www.strategic-risk.eu/srawards

Risks

[ THREATS ] [ OPPORTUNITIES ] [ MANAGEMENT ]

ASIA

East meets West Despite global misery, economies in Asia remain strong, making it attractive for new business. But with this come new considerations for risk managers who must rethink their strategies if they are to approach this area

Getty Images

UCKING A GLOOMY GLOBAL TREND, ASIAN economies are booming. Even when the threat of slowdown is discussed, it is done so in terms of growth ﬁgures that make managers and politicians in Washington, Berlin and London blush. The regional titans, India and China, are being driven forward by exports developed and marketed by an ambitious new middle class, which is in turn creating a buoyant domestic market for consumer goods and services. Upstart economies, including Vietnam, Indonesia and Papua New Guinea, are emerging as key suppliers for primary resources and new, cost-effective manufacturing zones.

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

> Risk Atlas ...........................24 This issue, we map out the probability of corporate default across the eurozone and beyond

Understanding the landscape But this huge, economically, culturally and geographically diverse region also faces substantial risks: there are political, environmental, demographic pressures – plus the threat of war (see box). Developing an understanding of how all these factors interrelate – both now and in the future – is crucial for success. “China and India will continue to be important alone because of their size, and the growth of their middle class,” Maplecroft principal risk analyst Julia Coym says. “That said, some Southeast Asian economies are competing with low production costs. Vietnam in particular is frequently mentioned as an alternative to China for manufacturing low-tech goods.” Changing demographics, principally a growing, more affluent population, mean new opportunities across the region. “While China is still the number one key market for many multinational companies, followed by India, Indonesia has in recent months been getting much more prominent,” says DLA Piper Asia head of regulatory compliance and investigation Yuet Ming Tham. “Private wealth management [is a growth area] as more Asians become affluent. [There are also opportunities for] companies that are in the consumables business, pharmaceuticals or medical devices, simply because of the population numbers here. Also, many governments in Europe are cutting drug prices due to problems managing their budgets, which puts pricing pressures on companies that rely mainly on governments in Europe for business. But look out for constantly changing laws and regulations. It is

important to be nimble enough to cope with these changes quickly and to change ‘Many organisations strategies if necessary.” are not paying enough Particular industries should also be aware that both the risks and rewards the attention to the legal and region presents are geographically speciﬁc. regulatory risks of doing “Get advice from experts who are out here in Asia,” Yuet Ming says. “Because it’s business in Asia’ crucial to get advice from people who Yuet Ming Tham DLA Piper know the lay of the land. Secondly, know that countries in Asia differ vastly from one another. Thirdly, do not expect to always understand all the laws and regulations, but certainly know enough to weigh the risks against any potential upside in the business.” “The question of key markets is quite sector dependent,” Coym says. “For example, Indonesia and Papua New Guinea are key locations for extractive companies. There’s a lot of interest and growth potential in Papua New Guinea at the moment, which despite its unstable political environment has a major LNG project coming online in the next few years.”

A different approach It’s a complicated picture, and in response, successful organisations are rethinking their attitude to risk, taking a more sophisticated, relativistic approach. “Companies are broadening their deﬁnition

The future’s bright: Hindu revellers throw paint as part of celebrations surrounding the Holi festival, which marks the end of winter

CONFLICT

War on Indian subcontinent? THERE IS AN ‘EXTREME RISK’ OF CONFLICT IN ECONOMIC giant India, according to analysis of three years’ data by global risks analysis firm Maplecro , with particularly strong threat posed by Islamist terrorism. “A particular source of concern is Lashkar-e-Taiba, a pan-Islamist terrorist group that desires the creation of a ‘caliphate’ across the Indian subcontinent and the withdrawal of India from Kashmir,” says Maplecro Political Risk Analyst Jordan Perry. “Lashkar-e-Taiba continues to launch attacks in Kashmir and India and is one of several groups suspected of the 13 July 2011 Mumbai bombings that killed at least 26 people.” There are also still substantial tensions between India and Pakistan, which in turn faces significant internal Islamist threats. “India is also enduring a 45-year-long Maoist insurgency from ‘Naxalite’ militants in the east of the country whose aim is to overthrow the current political system,” says Perry. “The danger of conflict means that the region poses significant risks for investors – but also opportunities, if those risks can be managed intelligently. Overall, out of 197 countries surveyed India is ranked 11, while fellow BRIC nations Russia (13) and China (29) are both rated ‘high risk’. Brazil comes in 60th, rated ‘medium risk’.

to move beyond financial and operational risks,” Coym says. “They are more aware of reputational risks and of how issues of governance, human and labour rights and even climate change directly affect their earnings and image as a company. “Most companies present in Asia have some form of operational risk management in place to deal with direct threats. But most Asian nations, including large markets like China, India and Indonesia, face longer-term structural risks, which will undermine growth. These risks can include lacking economic diversification or resource security, poor labour practices or insufficient infrastructure development. Businesses need to be aware that failure by governments to address these risks within their countries will in turn impact their operations.” “Many organisations are concerned with intellectual property rights, but are not paying enough attention to the legal and regulatory risks of doing business in Asia,” Yuet Ming says. “Even if they do so at the start of the expansion into Asia, some companies find themselves expanding so quickly they get caught out.” The picture remains challenging and frequently further complicated by the fact many Western firms are still learning about doing business in Asia – but this is already changing. “The links between different categories of risk will become easier to see,” Coym says. “This could be through protests over poor governance and management of environmental risks, as has been the case in China recently, leading to the closure of factories. Companies will need to think more strategically and more broadly about risk if they are to manage it successfully.” SR [READ MORE ON-LINE] For more global risk insights see StrategicRisk’s series of Risk Maps at www.strategic-risk.eu

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

RISKS [ THREATS ][ OPPORTUNITIES ][ MANAGEMENT ]

RISK ATLAS ECONOMIC RISKS

Facing up to the eurozone crisis Banks and taxpayers would need to stump up at least €2 trillion to sort out debt woes

S FAR AS ECONOMIC RISK GOES, THE BIGGEST STORY RIGHT now is the European sovereign debt crisis. And probably the biggest risk facing European banks and governments is Greece: years of profligacy have le the Greek state with a huge deficit (roughly €357bn as of October). It is so big it threatens the Eurozone’s survival. There’s no way Greece can repay that debt on its own: this has spurred other European nations, led by Germany and France, to throw Greece a lifeline, an EU bailout fund of around €500bn. But even that might not be enough. Risk analysts at Stratfor, a US-based global intelligence company, think Europe needs to stump up at least €2 trillion to sort the problem out. This fund would pay for three things, says Stratfor. First, roughly €400bn would create a “fire-break” between Greece and the rest of Europe. About €800bn is also needed to prevent a banking meltdown once Greece leaves the Eurozone (bankrupting it by definition). Finally, the fund would

Key Corporate default probability Very low on average Low on average Quite acceptable on average Still acceptable on average Appreciable High Very high

The price of Greece’s rescue is cheaper than the price of failure need another €800bn to bail out Italy, most in danger a er Greece. Without this safety fund, there’s no way Europe’s leaders can kick Greece out, says Stratfor. And it’s hard to see how European statesmen, particularly in the rich north, are going to convince voters to provide this cash, preoccupied as they are with national interests. A lack of strong cross-border leadership is one reason for all the delays, confusion and uncertainty around the crisis. Meanwhile, Europe’s biggest banks, including Commerzbank and Deutsche Bank, show worrying signs that they’d like to see the Greek rescue package killed. Deutsche Bank’s chief Josef Ackermann said recently that new plans for banks to take a greater burden of the aid package (by writing off old debts) would cripple the industry just as it is needed most as a pillar of stability. Germany’s secondbiggest bank, Commerzbank, and others, also warned that France’s and Germany’s impeccable AAA credit ratings could be downgraded because of their support of the Greek economy. It seems some bankers would risk a severe regional ﬁnancial crisis to avoid bearing the brunt of the costs now. But as Exclusive Analysis points out: “The price of rescue is cheaper than the price of failure.” A controlled, orderly default, with banks and governments both paying the price, is Greece’s only option. As the streets of Athens have borne witness to the last few months, the economies of southern Europe face enormous social problems as well as ﬁnancial ones. A broken economy threatens a breakdown in civil order. SR

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

Source: Coface Country Risk Assessment Map, October 2011

Amount invested in EU rescue fund GERMANY

€119bn

FRANCE

€90bn

ITALY

€79bn

SPAIN

€52bn NETHERLANDS €25bn BELGIUM €15bn

GREECE €12bn PORTUGAL €11bn OTHERS 0%

€37bn 10% 15% 20% % of commitment

25%

30%

[READ MORE ONLINE] Download a PDF of this risk map at www.strategic-risk.eu or goo.gl/joFlH

IN ASSOCIATION WITH

EXPERT VIEW

Dr Rolf Schneider is head of macro research at Group Economic Research & Corporate Development, Allianz SE

Keeping ahead of the risk curve 1

Spain On 13 October Standard & Poor’s 1 downgraded Spain’s debt rating from AA to AA-. The decision was based on the country’s weak growth prospects and doubts over its ﬁnancial strength. Further downgrades are expected, as Spain struggles to emerge from nearly two years of recession. The Spanish economy is the fourth largest in the eurozone and is expected to grow about 0.8% this year and 1% next year.

USA The Occupy Wall Street demonstrations

2 in New York City started on September 17th and had spread to over 70 cities by 9 October. The participants are protesting against social and economic inequality and corporate greed, demanding to see steps being taken to ensure the wealthy pay a fairer share of tax on their income and that banks are held accountable for reckless practices.

Greece The Greek debt crisis continued to grow.

3 On 13 June, Standard & Poor’s

downgraded Greece’s sovereign debt rating to CCC, the lowest in the world. The European Commission, the European Central Bank and the International Monetary Fund on 11 October agreed to release an €8bn loan, part of a €110bn bailout already extended to Greece. The country was hit by a new wave of strikes in October, as the strain of harsh austerity measures led to rising social unrest.

Coface lowers risk assessments Deteriorating economic and ﬁnancial conditions led Coface in October to lower the risk assessment on several countries in the eurozone in addition to the USA. The trade credit insurer dropped its risk assessment for Greece by one notch to C and Cyprus to B. The positive watches on A2 risk assessments for Germany, Austria, Belgium, France and the Netherlands were removed (an indication that the credit risk rating could change soon). The A3 risk assessments for Italy and A4 for Portugal were put under negative watch (indicating that the ratings could be about to deteriorate). Coface also removed the positive watch on the USA’s A2 risk assessment.

ECONOMIC RISK PERVADES EVERY part of our lives. In every decision we take, whether at the personal or business level, economic risk plays a role. Will our business partners be able to pay their bills? Will we able to pay ours? Will exchange rate developments wipe out prospective profits? Will a stock market slump erode our wealth? Will a spike in oil prices make gasoline unaffordable? In the shadow of the 2008 financial crisis and haunted by Europe’s ongoing sovereign debt crisis, we have all become acutely aware of economic risk. Will the austerity drives in many countries stoke social unrest and spawn political upheaval? What would be the repercussions of a break-up of the Eurozone, or indeed of moves to closer political union in Europe? Macroeconomic research attempts to weigh all the risks and, with the help of econometric models and a healthy dose of intuition, feed the results into economic forecasts and scenarios. Any forecast worth its salt contains a listing of the assumptions supporting the base case and an assessment of the risks that could blow the forecast off course. This entails keeping a close eye on market data worldwide, spotting trends, interpreting the results of third-party research and searching for telltale signs of developments that might affect our global operations. Risks lurk at every turn – what are the strategic implications of changes in consumer and investor behaviour, of new regulations or of shi s in the competitive landscape? To stay ahead of the curve, risks need to be identified, the interconnectedness of the global risk landscape unravelled and probabilities evaluated. In an increasingly complex world, the importance of identifying and understanding economic risks cannot be stressed enough.

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

11 TH -13 TH MA RC H 2 012 R I T Z CA R LTON, D O H A HOSTED BY

ORGANISED BY

Promoting thought leadership in (re)insurance BUSINESS PROGRAMME Incorporating a world-class international business programme, Multaqa Qatar 2012 brings together the leading minds in international insurance and reinsurance to examine the challenges and opportunities facing the industry.

NETWORKING PROGRAMME Meet with your peers and make new business partnerships through a series of networking and leisure events speciďŹ cally designed to facilitate business networking.

THE SIXTH ANNUAL MULTAQA QATAR CONFERENCE Hosted by the Qatar Financial Centre Authority and organised by Global Reinsurance, Multaqa Qatar is the Middle Eastâ&#x20AC;&#x2122;s leading insurance and reinsurance event.

APPLY FOR YOUR INVITATION Now in its sixth year, Multaqa Qatar promotes thought leadership in (re)insurance, providing an important platform for local, regional and

Attendance to Multaqa Qatar 2012 is by

international decision-makers to come together and shape the direction of the

invitation only.

industry.

To register your interest in attending visit

Combining a world-class business programme, structured networking, leisure

www.globalreinsurance/qatar

activities and a truly international audience, Multaqa Qatar is the perfect place

or call Debbie Kidman on

to do business.

00 44 (0) 20 7618 3094

For the latest speaker updates visit:

www.globalreinsurance.com/qatar

Special Report

INTRODUCTION

S THE WORLD’S POPULATION INCREASES, MORE OF THE NATURAL environment is being developed for residential and industrial purposes. This means more natural resources are being harnessed and there is more demand for established commodities such as metals and oil. There are more stakeholders in the environment than ever before and as a result of the Environmental Liability Directive (ELD), it is easier for the public to hold operators accountable for pollution. The implementation of the ELD in 2009 reﬂects the mainstream’s changing attitudes towards protecting the environment. “The ELD is changing the risks regarding habitats and biodiversity but the reason companies are changing their attitudes to environmental liability is because of the public’s growing interest in this subject,” says AXA MATRIX Risk Consultants Germany’s liability loss prevention consultant Hans-Peter Koslowsky. But, for risk managers the problem with the ELD is the inconsistencies in its implementation across Europe. Local authorities are responsible for its implementation so there is a huge variety of interpretation and enforcement of the law. Companies need to know how this varying liability could affect their business. “For our clients that are operating across multiple countries in the EU, they need to know how strict the ELD is, what kind of liability they are operating under and whether there is requirement for ﬁnancial security in the countries involved,” Marsh environment practice leader Cliff Warman says. “Although there is harmonisation of environmental law throughout Europe, there are still clear divisions that risk managers need to be aware of. Environmental insurance is an emerging market in western Europe and nearly non-existent in eastern Europe,” says AXA Corporate Solutions environmental expert Sylvie Monereau. “The trend of the growth of enforcement of the international law throughout Europe is very gradual but it is strong.” In the difficult economic climate, authorities may be more lenient as governments don’t want to impede growth. It’s the risk manager’s job to ensure that the leniency of governing bodies doesn’t translate to complacency within the company. Once an environmental disaster takes place, it can be very expensive to reverse. “As a result of the economic crisis, companies are looking to save costs but if they don’t invest in the management of their environmental

liability this can deﬁnitely become a risk,” says AXA Corporate Solutions senior underwriter ﬁnancial lines Juan Fernández-Montes. This report will deal with the reasons the ELD came into being and how changing social attitudes, technology and media are affecting environmental liability and the insurance industry.

Contents [ ENVIRONMENTAL RISKS ]

28 29 30

The public perception Companies must take note of the public’s growing eco-awareness Alternative methods New resource extraction techniques have risk pros and cons Environmental exposure issues Awareness of your environmental impact can limit long-term risk

SPONSORED WORD

Navigate the changes ALTHOUGH ENVIRONMENTAL PROTECTION HAS improved within industrial companies over the last decades, new challenges are arising. These problems include the increasing speed of change of processes and material ﬂows, mergers and acquisitions, and growing public awareness. Corporate companies change literally every day, and one consequence of inconsistent environmental risk management practices is an increased probability of occurrence of an uncontrolled environmental incident. It is therefore critical for risk managers to keep a tighter rein on environmental issues. With its teams of more than 120 specialists, AXA MATRIX Risk Consultants provides multi-peril environmental risk consulting for risk managers and

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

found that this is not always the case,” says AXA Corporate Solutions head of casualty in the UK John Gibbins. The regulatory and social landscape has changed in the context of environmental liability but key risks remain. “The main risk is accidental pollution; a valve that is leaking or a pipe that breaks,” Sonigo says. Water pollution is a sensitive subject because of its portrayal in the media. Images of stagnant water or dead sea life mean an accident can quickly become a media scandal. “Pollution of rivers is a major liability for companies; anything that has to

‘Bigger companies don’t always have the resources to better understand their environmental exposures’ John Gibbins AXA Corporate Solutions

underwriters worldwide. Thanks to its long-term experience in handling environmental risks and claims, setting up and managing remediation programmes, and loss prevention consulting, AXA MATRIX Risk Consultants is able to provide risk managers with a comprehensive view on environmental risks. For European regions, AXA MATRIX Risk Consultants is able to offer appropriate environmental risks analysis respecting European regulations and restrictions, especially EIL (environment impairment liability) and ELD (European Liability Directive). The risk assessment approach includes risk-level deﬁnition of production processes, spatial analysis, identiﬁcation of neighbourhood exposures and grading per location. AXA MATRIX also provides risk assessment on a worldwide basis. With its advanced tools, relying on

do with water is a key risk. If a company is involved in anything that could lead to the contamination of a water supply, they need to be very careful,” says Polestar UK print group risk manager Gary Marshall. “Rivers are much cleaner than they used to be and there is a desire to keep that trend going. So if companies pollute something that is very clean, they will stand out head and shoulders above everybody else.” While high-proﬁle pollution stories are making companies take environmental liability more seriously and the public is increasingly concerned with the diversity of life in the ecosystem, air pollution is a liability that doesn’t get the same level of media coverage. “Air emissions are seen as a polluting risk but that doesn’t come over so strongly in the media,” Marshall says. It depends on a company’s operations – if it runs a manufacturing plant in an industrial valley, air pollution could be a serious issue. “Air pollution can have a much greater impact – everyone can see it and smell it. But groundwater and soil pollution is something nobody can see and often not smell; it may go unnoticed for years. And remediation of this kind of contamination can be very expensive,” says AXA MATRIX Risk Consultants loss prevention consultant Hans-Peter Koslowsky. Disposing of hazardous materials is an ongoing problem in construction, “particularly if you think about asbestos, which can often catch companies out”,

geographic information systems for spatial analysis and modern online applications, and its proprietary risk evaluation tools, AXA MATRIX Risk Consultants provides clients with state-of-the-art assessment results. Visio@RiskTM helps risk managers visualise the potential environmental impact of their company’s plants regarding environmental sensitivity. Other web-based services such as SCAN@RISK© assist in gathering relevant information, enabling organisations to identify and visit only those sites with signiﬁcant exposure. AXA MATRIX Risk Consultants’ environmental loss prevention reports can also be customised and include detailed recommendations for risk improvement. Hans-Peter Koslowsky, liability loss prevention consultant, AXA MATRIX Risk Consultants, Germany

Marshall says. For companies that are involved in building or have contracted a construction company abroad, this can be a serious risk as building regulations are often entirely different, meaning that companies can unknowingly break the law. Once a company understands the risks involved, they need to be able to mitigate the known risks. “One of the major parts of this is environmental risk mitigation, which is what the company can do to prevent it from escalating. This could be as simple as having clean-up materials on site or the ability to close down your drainage system at the ﬂick of a switch,” Warman says. Another way that companies can reduce exposure to environmental disasters is by establishing a relationship with the local environmental regulator. In the UK, this is the local environmental health officer, which could give risk managers insights into the possibility of industrial accidents and the vulnerabilities in the local environment. Establishing a relationship with local authorities would also allow companies to keep up with, and have a greater understanding of, regional legislation.

Online engagement Companies can proactively use the internet to engage with stakeholders, fostering a transparent approach that would reduce hostility towards the company. Businesses can also use the internet to monitor activist groups and understand their attitudes and potential grievances, which could allow them to mitigate the risk of protest and sabotage. In recent years, the insurance industry has been researching and developing products following the arrival of the Environmental Liability Directive and other regulations. As a result, the knowledge of insurers and brokers is indispensable for companies trying to understand their exposures and how best to transfer risk to the market. An environmentally friendly approach can add real value to a company’s brand – the Ftse4Good index and the Dow Jones Sustainability index benchmark companies against each other based on their environmental performance. “Increasingly investors are taking this kind of information into consideration before they invest in a given company; the environmental agenda is certainly going up the investment community’s list of key risk issues,” says Warman. SR

ENVIRONMENTAL DISASTERS

Alternative methods In the wake of several high-proﬁle environmental disasters, many ﬁrms are looking at different resource extraction methods – but these are not without their own ecological consequences

RECENT EXAMPLE OF AN environmental disaster is, of course, the Shell oil spill in August of this year, which took place at the Gannet Alpha platform off Aberdeen and which resulted in 0.5km of sea being covered with an oil ﬁlm. “If you go back a number of years, companies were pouring more of that into local rivers than into the sea and suddenly it’s a big issue for Shell. This has a lot to do with the media’s coverage: on the back of BP, they were looking for another big oil spill,” says Polestar UK print group risk manager Gary Marshall. Following these high-proﬁle spills, a lot has been written about the negative effects new energy extraction processes will have on the environment. These processes target unconventional forms of oil and gas that have become commercially viable due to technological developments and the ever-increasing demand for fuel resources. But the fracking process involved in extracting shale gas and tight oil in this way has the potential to pollute the environment. “Ultimately this boils down to the problem of polluting ground water. So, although the process may be new, the negative consequence is a well-known threat,” Marshall says. Tar sands oil is another unconventional energy form that’s becoming increasingly important. Tar sands make up the secondlargest oil reserves in the world and the largest deposits can be found in Canada and Venezuela, according to a recently released report by Reprisk. There has been much controversy surrounding Syncrude Canada, which reportedly agreed to pay $3m in penalties related to the death of 1,600 ducks. The company was found guilty of failing to prevent migratory birds from landing on its Aurora tailings pond, which contained oily residue that caused their death. The public and the relevant authorities

will be much more hostile if a company transgresses on an environment that provides resources such as food, water, agriculture, parkland or land that facilitates leisure activities such as walking, sailing, climbing and foraging. Companies need to understand the position of stakeholders involved and the state of the habitats in their area of operation. Protests and sabotage could be a problem for oil companies exploiting unconventional energy sources as activists have stated they plan to increase resistance to tar sands expansion. The tar sands oil ﬁelds in Venezuela’s Eastern Orinoco oil belt covers an area of more than 55,000km2

Syncrude Canada reportedly agreed to pay $3m in penalties related to the death of 1,600 ducks along the southern strip of the Orinoco river basin. In this area, both the land and aquatic ecosystems have been described by Unesco as having signiﬁcant biological diversity. The construction of the infrastructure necessary for extraction and pre-processing, together with the required transportation networks for waste, may prove highly ecologically unsound. Another problem is that poor governance and corruption could mean such projects are not properly regulated, resulting in the exploitation of natural resources. In the Niger Delta, the unfair distribution of Nigeria’s oil wealth gave rise to the terrorist group MEND and the same problem could arise in Venezuela and other parts of the world. Many big oil companies, such as BP, Chevron, CNPC, Statoil Petroleos de Venzuela (PDVSA) and Total, are involved in tar sands oil production. SR

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

SPECIAL REPORT [ ENVIRONMENTAL RISKS ]

INSURANCE IMPLICATIONS

Environmental exposure issues Many companies are completely unaware of the potentially ecologically damaging products and methods they employ, making it difficult to ensure they are covered for all environmental eventualities

OMPANIES’ IGNORANCE OF environmental regulations was one of the key drivers for improving insurance products in this sector and many companies still suffer from a lack of understanding. “There is somewhat of an education problem, as sudden and accidental pollution cover may provide less cover than risk managers think,” says AXA Corporate Solutions senior casualty underwriter, UK, Grant Le Sage. In the UK, the Bartoline case of 2003 underlined the financial risks of being uncertain of public liability insurance, and it justified the implementation of further legislation. Bartoline manufactures adhesives and packs hydrocarbons but after a fire at its East Yorkshire site in May 2003, the company faced a £600,000 clean-up bill. Bartoline made claims to its insurance company relating to the fire but was denied a pay-out for clean-up costs as this was not covered by the policy. “In the Bartoline case, as the river wasn’t owned by anyone the public liability policy didn’t trigger to pay for the clean-up of the river,” says Marsh environment practice leader Cliff Warman.

Toxic sludge Another major event that had an impact on environmental liability insurance was the ecological disaster in Hungary in 2010. “One of the biggest issues that came out of the Hungarian toxic sludge case is what to do when the company has no money or insurance to pay for damages. This begs the question of whether compulsory insurance would be a good idea, but commentators have suggested that now is not the time for this approach,” notes Polestar UK group risk manager Gary Marshall.

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

Commentators will tell you insurance for environmental liability has vastly improved in recent years. “We have a situation where, except in a few high risk cases, if a company wants to insure itself it can,” Le Sage says. But many of the policies involved depend on the information companies can provide to underwriters. “From a technical point of view, the risk is to do with the release of harmful substances from explosions and accidents but also through long-term leakages, which often happen at operational sites,” says AXA MATRIX Risk Consultants liability loss prevention consultant Hans-Peter Koslowsky. Insurance becomes more viable if the company provides more information. “It’s clearly much easier now for companies to cover their environmental exposures using insurance; the cover can be expensive so it

HUNGARIAN TOXIC FLOOD: THE FACTS •

•

In October 2010, a ﬂood of toxic slurry was released from a reservoir at an aluminium plant in what has been described as Hungary’s worst environmental disaster. The accident happened in the town of Ajka and claimed the lives a dozen people a er more than a million cubic metres of industrial waste ﬂooded over surrounding towns and villages and contaminated rivers. Hungary’s government declared a state of emergency and initially estimated the clean-up would take at least a year and cost tens of millions of euros. Aon has said the unfolding environmental disaster should serve as a warning about the strength of new environmental liability laws. In addition, both Munich Re and Hannover Re have said they expected their share of any claims to be negligible. Environmental group World Wildlife Fund claimed the reservoir may have been leaking as far back as June.

depends on your experience, loss history, who you are and how much information you can give,” Marshall says. “The insurance market has been proactive in looking at the types of coverage clients need. Policies have gone from being something you’d need to clean something up to being truly business-based,” Warman adds. Large companies tend to have the means to measure their impact on the ecosystem and effectively manage most of their liabilities. For any significant risks left over, large companies tend to have the funds to be able buy any insurance products that they may need. But this isn’t the case for small companies. “Many smaller companies won’t even have a list of the chemical products they use, of the quantities or even the kind of storage they use, so they can’t help the underwriters quantify the risk. There is not a level playing field for all companies regarding the access to insurance for their environmental liability,” says Ferma’s Sonigo. To reduce their exposures, smaller companies can hire an environmental consultant to help identify their exposures. “It’s a good idea for small to mid-sized companies to spend a couple of days with an expert, who will make recommendations – and it’s not too expensive,” says Ferma environmental working group chair Pierre Sonigo. Smaller companies can also use open source software to get insight into exposures. For example, Google Earth can be used to spot open bodies of water or settlements that could be exposed to pollution from a factory. Companies’ exposures in this context are changing because new products and technologies bring about an evolution in their liabilities. A good example of this is nanotechnology, which is being used in an increasingly large number of products. “Nanotechnology will have an impact on the environment that we can’t measure yet,” Sonigo comments. Corporate governance is also key to defining a company’s exposures and insurance premiums. AXA Corporate Solutions environmental expert Sylvie Monereau says: “By analysing a company’s governance, we focus especially on the integration of its corporate environmental responsibility, in terms of organisation, policy and strategy.” SR

Photos : Creatas, Photodisc, Enrique Algarra/PIXTAL, DigitalVision, Juliet White/Gettyimages -

a redeďŹ ned vision of service

a reliable company available teams attentive advice

www.axa-corporatesolutions.com

Corbis

Governance

[ ETHICS ] [ COMPLIANCE ] [ REPORTING ]

> How do you fare? .................. 35 Four top tips to make sure your ERM programme is ready for rating agencies

INSURANCE

Be ready for rating Led by Standard & Poor’s, rating agencies are looking at corporations’ ERM programmes as part of their assessments »

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

Corbis

GOVERNANCE [ ETHICS ][ COMPLIANCE ][ REPORTING ]

Key points 01: S&P has assessed financial services firms on ERM since 2005 – and is looking at moving into the non-financial sector. 02: Failure to appreciate the importance of ERM is seen as a key factor behind the financial crisis. 03: Assessment will allow ratings agencies to judge how well a firm has mastery of the risks it faces. 04: Implementation of modern ERM systems could bring firms competitive advantages.

ATING AGENCY STANDARD & POOR’S HAS DECIDED TO assess corporates on their enterprise risk management (ERM) programmes, and the other rating agencies are likely to follow suit. The move is controversial, but what will it mean for management, and how can companies make the most of the move? It is an uncomfortable paradox of the global financial crisis that its origins are widely seen as sloppy policy and regulation, and slipshod financial ratings. Yet tightening these discredited institutions is seen as the best way out of the current situation. Hence, despite well-catalogued policy failures, new superregulators are springing up in Europe and the USA. And ratings agencies – no stranger to controversy and criticism throughout the crisis (see box, below) – are broadening the scope of their activities. The biggest reason for Standard & Poor’s move is speculation on how the subprime mortgage crisis in the USA would have been handled had financial institutions fully invested in their ERM programmes. Most experts agree that one of the key problems lay in the lack of a comprehensive, management-wide appreciation of enterprise risk. ERM has subsequently raced up the agendas of the financial sector companies, and is subsequently migrating to the corporate sector. The better news for those fearing that their companies are likely to come under unwelcome scrutiny by agencies unaccustomed to examining risk in their sectors is that preparation for the change has been long in the pipeline.

Key topic of board discussion

Centre stage: Rating agencies will expect an increasingly strong performance from company’s ERM programmes in future

Since 2005, ERM has been gradually incorporated into analysis of assessments of the financial sector, becoming a key topic of discussion on most financial services board’s agendas. A spokesman for S&P says that the move has not “radically changed the way we assign ratings”. But it has “provided deeper insights that have caused us to ‘[ERM] has provided change the ratings and/or outlooks of many companies”. deeper insights that led Nor do the agencies only have experience with ERM in financial services. In 2006, S&P us to change ratings began a pilot programme directed at energy and/or outlooks’ companies, evaluating the trading risk Standard & Poor’s management programme of 10 energy firms. As a result, the agency gained significant additional new quantitative and qualitative information to

augment its traditional capital and liquidity stress test data for the energy market. Initially S&P was going to limit the focus of its analysis to the control processes for risk from trading in fuel and electricity markets, but it began to gain broader insights into the ﬁrms’ risk management capabilities and cultures that could inﬂuence the overall rating. Based on these results, the agency expanded ERM analysis to all energy companies by early 2008. Moreover, several credit rating agencies

IN THE SPOTLIGHT

Lehman Brothers collapse puts agencies under scrutiny FROM THE MOMENT LEHMAN BROTHERS COLLAPSED IN 2008, serious questions were asked of the credit agencies who, just weeks earlier, had awarded the stricken US bank a prized AAA rating. When the crisis turned into a sovereign debt issue, arguments over the agencies turned nastier. Political decision-making logjams in the USA and, this year, Italy, led to controversial downgrades of those countries’ sovereign debt. They also raised difficult questions about the agencies themselves.

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

The European Commission will soon announce a slew of new rules in an attempt to rein in the power of the rating agencies. These will include provisions preventing them from awarding ratings to companies that own shares in the agencies; insisting that all agencies rotate their work so that one agency does not monopolise assessment of companies or sovereign debt; and provisions encouraging new, smaller ratings agencies to enter the market and challenge the power of the big players.

A GUIDE TO ERM

How do you fare?

Analysis of risk management culture and governance This gauges how much risk management plays a part in corporate judgement.

TIPS The best way to demonstrate corporate risk judgement is to incorporate risk management ﬁrmly within the decision-making of the company. The kinds of questions that will be asked will include: • Who is charged with corporate risk management? • How much power do they have? • Do they follow a strategic risk assessment plan?

Analysis of risk control This examines the company’s ability and methods for identifying, measuring, and monitoring risks, and setting and enforcing risk limits.

TIPS

have been conducting research into ERM in the corporate sector, to better understand how they can expand their ratings into other sectors. S&P has stressed that it will take into account the usual business practice within differing lines of business when applying its tests. In general terms, what S&P and other raters will be looking for is the degree to which a ﬁrm has a comprehensive mastery of the risks they face, and the extent that the ﬁrm’s management optimises revenue for the risks they are willing and able to take.

Check that the company’s business strategies incorporate risk tolerance and disclosure. Ensure that there is the necessary infrastructure, including personnel, operations, data, and technology to back this up. Evaluate the methodology used by the company, including risk metrics, stress testing, validation and performance.

This component broadly deals with the company’s ability to handle shocks, and unforeseen risks.

TIPS Does your company employ innovative methods for analysing trends, contingency planning, and environmental scanning, to assess the danger of risks arriving from le ﬁeld?

Risk should be accounted for The latter criteria is significant, because it signals that risk should be accounted for as an underlying strategic quotient of business plans. But, for companies fearing the kinds of internal management preparation they need to carry out for such a survey (see box, right), the agency stresses that companies can see improvement as well as deterioration in their ratings as a result. So for some, the new test will be good news. What is certain is that companies will start to scramble to implement modern ERM programmes. And since the analysis can have either a positive or negative effect on the overall company rating, firms will soon see the competitive advantages to be gained from proper implementation. Additionally, since most experts believe that – as happened in the financial services segment – other rating agencies will soon follow suit, there will be little room for companies that have not committed to an ERM to dodge the issue. SR

Analysis of emerging risk preparation

Analysis of strategic risk management Here the raters will be looking to see how much the overall strategy of the company, including the proﬁt projections, incorporate comprehensive measurement of risk.

TIPS This component will depend largely on the type of sector in which the company operates. Check how your competitors may assess risk as a quota of performance, look to the speciﬁc risks of your sector, address these in your ﬁnancial projections, explaining how and why.

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

Theory & Practice

This will reﬂect both its risk capacity and the level of maturity of its risk management and risk culture. There is little advantage in having a substantial risk appetite unless you can manage it. Similarly, if the attitude to risk management is one of indifference, or a sense that risk management is little more than a bureaucratic paper chase, then the likelihood of developing an effective risk appetite is remote.

SIX STEP GUIDE

Understanding and measuring risk appetite Effectively measuring risk appetite and determining risk tolerance allows companies to analyse their objectives and take advantage of opportunites

USE KEY RISK INDICATORS AND KEY CONTROL INDICATORS, BOTH INTERNAL AND EXTERNAL This will help directors understand how performance drivers are impacted by risk.

Capacity: ﬁnancial

Strategic

Propensity to take risk

Propensity to exercise control

Risk taking

Tactical

Measurement

Stakeholder value Risk metrics

Project/ operational

Exercising control

Control metrics

Maturity: risk systems

Level

Capacity: infrastructure

Maturity: business context Maturity: risk processes

ISK APPETITE’ IS A TERM WIDELY used but arguably less well understood. The Institute of Risk Management (IRM) has attempted to shed some light on the subject with its new guide on risk appetite and tolerance. Why should organisations measure their risk appetite? “As well as meeting the requirements imposed by corporate governance standards, organisations in all sectors are increasingly being asked by key stakeholders, including investors, analysts and the public, to express clearly the extent of their willingness to take risk in order to meet their strategic objectives,” says IRM. In practice, knowing your risk appetite can clarify responsibilities and decisionmaking. It is a key part of risk management in that it builds scope for taking advantage of opportunities as well as safeguards. For example, managers will know the degree to which they can expose the organisation to the consequences of an event or situation. Executives will understand their aggregated and interlinked level of risk so they can determine whether it is acceptable or not. Risk tolerance can be expressed in terms of absolutes – for example, categorical statements that the organisation will not expose more than a certain percentage of its capital to losses in a certain line of business or will not deal with certain types of customers. Risk appetite, says IRM, is about what the organisation does want to do and how it goes about it, which is why it is the board’s responsibility to deﬁne it and ensure that risk management and all that entails is consistent with that appetite.

Capacity: people and knowledge

‘R

Maturity: risk management culture Capacity: reputational

The risk appetite working group of the IRM has developed an approach to unpack the various elements of risk appetite. The framework is depicted in the diagram above

Your measurement approach to the ramiﬁcations of risk appetite is likely to vary depending whether you are looking at the strategic, tactical or operational level. At the strategic level, it could involve using models based on shareholder value or economic value added. It is important to choose a model that is appropriate for the nature of your business. At the tactical and operational levels, consider developing a series of risk metrics and control metrics to measure risks and controls. Ensuring the relevance and accuracy of this data is essential.

APPRECIATE THAT RISK APPETITE IS NOT A SINGLE FIXED CONCEPT Your organisation will have different appetites for different risks. For example, there might be one risk appetite for selling a particular product, and a different appetite for taking risk while selling another product, or risk appetites might vary in different regulatory regimes. These need to align and will probably vary over time.

[ INSIGHT ] [ CASE STUDIES ] [ BEST PRACTICE ]

DEVELOP YOUR RISK APPETITE IN THE CONTEXT OF YOUR ORGANISATION’S RISK MANAGEMENT CAPABILITY

INTEGRATE RISK APPETITE INTO YOUR ORGANISATION’S CONTROL CULTURE This will involve looking at the propensity to take risks – generally a feature of strategic decision-making – and the propensity to exercise control – o en an operational consideration. How these balance out within your business will depend on your organisation itself, the types of risks that it faces and the regulatory environment within which it operates.

UNDERSTAND YOUR BUSINESS MODEL You need to be able to assess how much risk your organisation currently takes and how much more it might want to take in the future. Sketch a risk appetite framework that reﬂects your organisation’s core strategy, its principal risks and risk management approaches, and its risk management capability both in terms of capacity and maturity. Clearly articulate the consequences of adopting this. Engage with relevant stakeholders to ensure that your risk taking and control activities are broadly aligned with others, or that you identify potential divergences early. Your board and any risk oversight committee should then review and hopefully approve the risk appetite proposal. Implementation will take some time because of the complexities involved and the possible need to adapt the framework.

REPORT AGAINST YOUR RISK APPETITE STATEMENTS This should be done both internally in the normal way and externally to relevant stakeholders such as shareholders. Your board or risk oversight committee should review what has worked well, what has failed and what needs to be done differently. This will provide the opportunity to ﬁne-tune your risk appetite statement.

www.strategic-risk.eu [ NOVEMBER 2011 ] StrategicRISK

THEORY & PRACTICE [ INSIGHT ][ CASE STUDIES ][ BEST PRACTICE ]

HANDLING DATA

The dangers of dealing with customer data As customers become more aware of personal data use, companies must realise that preserving information on customers is of the utmost importance

S A GROWING NUMBER OF organisations will ruefully attest, the protection of customer data in an age of massive electronic storage capacity is turning into one of the most pressing issues of the day. This is particularly true in UK and Europe where the law is tougher than in the USA, particularly on the unauthorised use of customer data. Several high-proﬁle cases are under investigation within Europe including one on how Apple gathers and applies customer information. What’s changed the game is the sheer volume of customer data held by organisations. “Changes in the use of technology and the reliance on digital, rather than paper-based systems, mean that if the right controls and procedures aren’t in place, it’s easier to lose large quantities of aggregated data,” explains Vicki Saward, head of government practice at BAE Systems Detica (which has just signed a substantial contract with the Ministry of Justice). “The consequential loss is now greater as a result.”

Internet cafe in Tehran, Iran: Iranian police announced in January that Iran will have cyber police to patrol cyberspace

information is being stored and accessed by more organisations than ever – the penalties for seriously abusing the system still do not include the possibility of a prison sentence, even in the most serious cases.” The ubiquity of online records has pushed responsibility deeper into organisations of all kinds, as Sir Edmund Burton pointed out in his 2008 report into the Ministry of Defence’s loss of vital data. “There seems to be a lack of awareness that in the information age the behaviour of each individual is a signiﬁcant factor in the risks faced by the parent organisation.” This new vulnerability is applied right across the spectrum – central and local government, the private sector, universities and schools.

Misuse matters As well as loss of such data, its misuse is also high on regulators’ agenda. In September, four telecommunications companies – UPC, Vodafone, O2 and Eircom – were ﬁned a combined €15,000 in Ireland on charges related to the making of unsolicited marketing phone calls and sending unsolicited marketing messages, all using customer information. All four pleaded guilty. Punishment for breaches is likely to get more severe too, if the UK Information Commissioner has his way. Referring to a case in which an ex-Barclays Bank employee was ﬁned for ‘blagging’ (unlawfully accessing) the records of a woman whom her husband had sexually attacked, the IOC’s Christopher Graham, said in September: “It beggars belief that – in an age where our personal

Customers care But it’s not all about electronic storage. Sensitive paper documents are routinely mislaid too, like the nine case ﬁles on the

‘We’re facing a perfect storm where customers really care about what happens to data affecting them’ Stephen Bonner KPMG

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

welfare of young people recently inadvertently le in a filing cabinet in the office of the Scottish Children’s Reporter Administration. Sold on to a second-hand shop as part of an office refurbishment, they were only retrieved by the buyer. In general, regulators and customers alike are taking a firmer line. As specialist in customer protection and partner in KPMG’s information protection and business resilience department Stephen Bonner says: “There are great commercial benefits in having volumes of customer information but with that comes a commensurate responsibility in protecting it. We’re facing a perfect storm where customers really care about what happens to data affecting them.” Because the public has become more alert to breaches, data protection has become a selling point. “Banks are highlighting their enhanced security measures and pushing customer’s peace of mind as a competitive differentiator,” adds Saward. “As more and more services are brought online across all sectors, we’d expect this trend to be echoed in other industries too.” Here are 12 ways of ensuring your company protects customer data:

THINK BIG BUT START SMALL Improving data protection should be evolutionary rather than revolutionary process, says Saward. “The organisation doesn’t have to be turned upside down.”

TRACK CHANGES As changes are made step by step, track the financial and non-financial benefits.

USE THE TRASH Keep only data needed for a speciﬁc purpose, keep it up to date and dispose of it when no longer needed.

COMMUNICATE THE CONSEQUENCES Make sure employees are aware of the value of the data at their disposal. Risk consultants say most employees will take responsibility if put fully in the picture.

HAVE NO FEAR Encourage employees to immediately bring loss of data – or near misses – to line managers’ notice without fear of retribution. “Near misses are very instructive,” Bonner explains.

STRATEGY

REMEMBER THE HARD COPY Don’t ignore old-fashioned paper documents. They are o en le lying around.

PRIORITISE Some data is more sensitive than others and should be prioritised for protection according to the risk it poses to ﬁrm and customer.

RUN REGULAR AUDITS, INCLUDING INFORMAL ONES One ﬁrm checked desks a er staff had departed for the day and le coloured balloons on the compliant ones. Another put posters in toilets reminding staff of the importance of respecting customers’ privacy.

UNDERSTAND THE DATA FLOW Suppliers and other third parties should be in the loop and their responsibilities written into contracts. One ﬁrm successfully included a supplier in its own internal data protection campaign.

MAKE SURE SENSITIVE DATA IS ENCRYPTED Regulators will take a dim view if unencrypted information is lost.

TAKE CARE Grade and protect customer information according to its importance. “Protect the data that’s of highest value,” Saward suggests.

BE TRANSPARENT Above all, don’t attempt to cover up loss of data. When the breach eventually reaches the light of day, as it will, the inevitable loss of customer conﬁdence will cost dearly.

Resilience through sustainability Businesses must shi to an embedded sustainability strategy to guarantee growth and competitive advantage in the future

NTEGRATING SUSTAINABILITY INTO your business is becoming increasingly critical. It is no longer a nice addition to a business but a core strategic risk consideration. Colliding economic, social and environmental conditions are creating an unstable future. The need for creativity and openness to change is fundamental to any business interested in future growth and survival. The real winners will be the companies that conduct a thorough analysis of their sustainability and business impact areas. Are businesses really spotting the right signals, trends and impacts? Are they integrating these risk areas into their risk registers to gain competitive advantage? True sustainability requires a transformative business model. A successful green agenda should be embedded into a corporate strategy and made central to core business policies, practices and investment decisions. For many businesses, a sustainable transition is limited to carbon and energy management. But there is a growing need for companies to shi this approach and shape a new sustainable agility in facing the challenges of the future. Hot spots include access to raw material, natural resources, utilities, assets value, operational

performance, supply partnerships, markets and customer bases. This agility will not only ensure ongoing competitive advantage but could yield further proﬁtability linked to sustainable investments. Sustainability should not be seen as a optional cost; it is an essential investment. Once businesses have a clear view of the cradle-to-cradle impacts, they will have the room and foresight to collaborate, grow, innovate and inspire change. But making the required culture shi to a sustainable future is challenging. Your sustainability strategy must reﬂect the needs of the business, its consumers, its stakeholders, the markets it operates in and your core business ambitions. A glossy strategy document is no good if the business isn’t genuinely and deeply engaged with sustainability values. Organisations with the most enterprising and transformational sustainability approaches will carve out a strong and healthy hold over their competitors. Businesses should not be led by anxiety. Ingenuity and ambitions are essential factors in manoeuvring change. David Beer is managing director of IndustryRE Sustainability

Nanotechnology is set to have an explosive impact. $1 trillion boost to the economy. 2 million new jobs. Numerous ﬁres and explosions? Download our White Paper on managing the risks at www.fmglobal.co.uk/nanotechnology-risk

Secure the value you create

VIEWPOINTS [ PEOPLE ][ OPINION ][ COMMUNITY ]

WHAT’S INSIDE YOUR HEAD?

Headspace Sabrina Hartusch recalls her journey from restaurant dishwasher to Triumph boss, and the experiences and memories she has collected over the years

What is your greatest achievement? The greatest achievement is probably to have moved bravely in my younger days from Germany to the UK and then to Switzerland. I made each of these places my home and made long-term friends in all of them. Last, but not least, I have learned from all these places.

‘It makes me unhappy to see people without an eye for the nice things in life and the beauty of the world’ behind the actual incident, and on the opposite line going in the other direction. It did not seem unusual that the train was forced to stop, but all of a sudden a strange feeling came over in the train once we were asked to leave it immediately. Once I was on the streets again, I realised that something was not right, especially when my mobile phone could not get a signal. So the fear, for me, developed afterwards. But ever since then I have been more aware that life can end abruptly.

StrategicRISK [ NOVEMBER 2011 ] www.strategic-risk.eu

What makes you unhappy? It makes me unhappy to see less privileged people who do not have any chances in life, compared with others who have chances but complain all the time. It makes me unhappy to see people who do not have an eye for the nice things in life and the beauty of the world.

What is the worst job you’ve ever done? During secondary school I worked for some weeks in the kitchen of a restaurant – mainly responsible for the dirty dishes – which was extremely straining. During that time I considered this the worst job ever. Today, I realise that there are other jobs that are much worse.

What is your greatest fear? My greatest fear is that my loved ones could get hurt and that I could fall ill with a severe long-term disease, now or later on in life. The scariest thing that ever happened to me was when I lived in London. I was actually on the Tube during the London bombings in 2005, on the Piccadilly Line. But I was some trains

What makes you happy? Having time to enjoy a relaxed dinner with my partner. Reading a good book. Skiing on a sunny day. Seeing a beautiful landscape.

What’s the biggest risk you’ve ever taken? The biggest risk I will take is to have an eye laser operation to correct my short-sightedness. I trust the technology and hope that it turns out well.

What are you thinking about right now? Right now I am thinking about how I will answer all these questions. I am also thinking about my two-week business trip tomorrow to South America, wondering whether I have done all my preparation and really looking forward to meeting my colleagues there.

What was your most embarrassing moment? Some years ago when skiing I fell off the T-bar ski lift when exiting, and the entire lift was stopped. It took me so long to stand up again that the lift operators had to come to carry me aside. Ever since then I have hated taking the T-bar ski lift (as many other people do).

What is your most treasured possession? My experiences and memories built over time.

What is the most important lesson you’ve learned? You should come across other people with no prejudices and treat others as you want to be treated yourself. Tell us a secret? I played the accordion for many years. After secondary school, I actually wanted to start working at the German Bundeskriminalamt (the German federal criminal police office), but it didn’t work out as I am short-sighted. SR Illustration by Richard Phipps

Sabrina Hartusch is global head of insurance at Triumph and a board member of the Swiss Association of Insurance and Risk

In top gear Gallagher Heath's commitment to first class service is always at full throttle. This has been recognised two years running by our industry peers, putting us first for business insurance: â&#x20AC;˘ Commercial Lines Broker of the Year at the British Insurance Awards 2010 â&#x20AC;˘ Commercial Lines Broker of the Year at the Insurance Times Awards 2009. To find out more about how working with Gallagher Heath could benefit your business contact:

Mike Hibling t: +44 (0)20 7560 3861 e: mhibling@heathlambert.com www.gallagherheath.com

Gallagher Heath is a trading name of Heath Lambert Limited, which is authorised and regulated by the Financial Services Authority. Registered Office: 9 Alie Street, London E1 8DE. Registered No: 1199129 England and Wales. www.gallagherheath.com

www.gallagherheath.com

ol t s i r B a n i n a eg b e r i f to d a e “The r p s d n a ’’ e n i s a u t o i r h B s s o ware r c a s t e e r t High S A major ﬁre doesn’t just damage property, it can destroy supply agreements, consumer goodwill and share value. That’s why FM Global takes a different approach. We are engineers as well as underwriters. So we can work with you to understand and manage the critical risks in your supply chain, and help you to prevent a loss. And if the worst does happen, you can rely on us for prompt settlement. In short, we don’t just protect your buildings, we protect your business. Speak to your FM Global representative or contact your broker, and visit www.fmglobal.co.uk/touchpoints to read our latest White Papers.

Secure the value you create