"A little risk management avoids a lot of fan cleaning," jokedCNA's chairman and CEO, Steve Lilienthal, during a discussion aboutenterprise risk management at last month's International InsuranceSociety annual conference. I only wish risk managers had been thereto witness this firsthand. After being lectured for years aboutsound risk management, buyers would have been amused to seecarriers and brokers challenged to get their own houses inorder.

Indeed, it was refreshing to hear how a top broker, commercialcarrier and financial services provider grapple with practical andcultural obstacles threatening to sabotage ERM--efforts beingclosely watched by rating agencies.

Insurers must practice what they preach--that was the essentialmessage delivered by the three heavyweight speakers at IIS. Withpeople entrusting their lives, families, homes and businesses toinsurers and brokers, the industry has a responsibility to makesure its unique exposures are under control so clients get whatthey are promised, no matter what the circumstances.

Leave it to a life insurer to deliver a definitive riskmanagement philosophy for carriers and brokers everywhere. "In atrue ERM culture, everyone is a risk manager," said PrincipalFinancial Group's chairman and CEO, J. Barry Griswell, whose firmhas a chief risk officer in place. "We must imagine theunimaginable." He cited earthquakes, hurricanes, terrorist attacksand pandemics among his most feared concerns.

"The question is not just whether you can survive economically,but operationally," he added. "Can you continue to function and doyour jobs?"

Any entity's corporate risk unit "must have influence andauthority" to be effective, advised Mr. Griswell. "It must be bothpartner and police," remaining independent of business units butworking with them to identify, quantify and contain exposures.

Again, the speakers emphasized, money talks. If a riskmanagement program is purely defensive, "it's hard to get past theorganizational inertia," said Greg Case, president and CEO of AonCorp. "Focus more on the potential upside--the bottom line, thestock price, your competitive position--to get people to buyin."

However, a big concern for insurers and brokers--as well astheir clients--is not to go overboard with risk management, in thesense that a company can become too conservative for its owngood.

"You shouldn't start playing not to lose," warned Mr. Case."You've got to look at ERM as value creation to make it work.Diagnostic models are essential, but they're just the table stakes.To win, you need to monetize the potential impact. What is ERMworth to you, literally? Look at its balance sheet impact."

CNA, which also has a CRO, seconded that advice. "The tendencyis to become fixated on risk aversion and run the organizationupside down," said Mr. Lilienthal. "But we're in the risk-takingbusiness. The key is to take risks responsibly and be fullyprepared for the consequences."

He also urged risk managers of all stripes to "use your commonsense. Don't just allow numbers spewed out of a computer to dictateyour every course of action. What do your years of experience tellyou?"

Ultimately, however, the speakers made clear that ERM is notsomething you buy off the shelf and plug into your operation. It isa value system that must be internalized, as well asevolutionary--adaptable to changing circumstances in a volatileworld.

This certainly isn't too much to ask of an insurer orbroker--not after they've made the same demands of their clientsfor years.