Before I begin to opine on this topic, I'd like to say that I am not at all opposed to the concept of enterprise risk management. In fact, I have served on ERM committees and taken the classes in my master's program in risk management at Florida State. So I get it.

I understand the need, I understand why this evolution is occurring, and I think risk managers have a large role to play--particularly on ERM committees.

As the practitioner of a profession that is sometimes underappreciated by senior management, I also understand the risk manager's desire to take their game to the next level. All that being said, I have to ask whether we risk managers are missing a step here, as well as an opportunity to have a bigger impact on our organizations.

The traditional risk manager needs to be part adjuster, part attorney, part underwriter, part risk-finance professional and part loss-control engineer.

Since there aren't too many people who can be a master of all these disciplines, the greatest trait a risk manager can possess is to know when to defer to someone smarter. This is why having an excellent insurance broker/team is so important.

Keeping all this in mind, I have a problem with the popular dictum that all risk managers should be looking to assume the mantle of enterprise risk manager.

Lead an ERM committee--yes, but as a one-person show, I think the added breadth comes at the expense of depth. There are just too many areas that fall outside of the skill set of most risk managers, who already essentially must be part mathematician and part economist, as well as understand the intricacies of financial hedges, the firm's information technology systems and regulatory risks, to name just a few duties.

I seriously doubt whether anyone can possess all of the skills needed to effectively address all of these areas outside of a team setting.

The best ERM department I have seen, and the model that I think best supports the spirit of ERM, is at a large Midwestern utility company. The department is headed by a chief risk officer who is a Ph.D. in mathematics. She has on staff a traditional risk manager, a financial risk manager, an environmental engineer and other experts reporting up to her.

Each of these direct reports speaks to their respective disciplines. The CRO then aggregates the various data into enterprisewide reports and strategies.

While I'm not saying that a risk manager can't or shouldn't make the leap to this type of position, isn't there a more natural extension of the risk manager's domain that should be examined first?

Before making the jump from senior risk analyst to risk manager, I had the opportunity to complete a rotation as a health and welfare benefits manager. The best way to briefly sum up my responsibilities in this role would be to take the bullet points directly from my resume:

o Responsible for $66 million health and welfare budget.

o Responsible for all benefit plan designs and applicable coverage placements.

o Responsible for tracking, projecting and benchmarking health care costs for the organization and reporting to senior management.

o Responsible for all carrier, broker, actuary relationships.

o Manage health and welfare department, including development of business plan and supervision of two direct reports.

o Oversight of employee benefit department's Sarbanes-Oxley compliance.

o Employee benefits due diligence for mergers and acquisitions.

o Respond to employee issues and chair benefit appeals committee.

Now, I don't know about you, but managing brokers and actuaries, designing and placing coverage, forecasting losses and overseeing claims all sound pretty darn familiar to me, and a lot more so than doing an interest rate swap or managing supply chain risk.

What's even better is that today's bachelor's of science and master's programs in risk management and insurance, or at least the ones I attended, all include several classes on employee benefits.

The end result is that when I took the reins as benefits manager, it was not a leap for me to round out my skills with a refresher on the Health Insurance Portability and Accountability Act, the Consolidated Omnibus Budget Reconciliation Act and the Mental Health Parity Act.

My time in benefits opened my eyes to a wealth of synergies and economies of scale that, in my opinion, have remained largely unexplored by most companies.

For starters, risk management and employee benefits departments are often approaching and utilizing the same insurance carriers, broker and actuaries, yet they conduct separate requests for proposal and have separate fee agreements.

To find out if the wall between HR and risk management is preventing your organization from leveraging its suppliers, take a quick spin online and see how many of your carriers and brokers offer or service both property-casualty and health and welfare lines of coverage--then find out if there is a centralized person in your organization able to take advantage of this.

There are also a number of project-specific initiatives where the two departments can benefit from a more collaborative approach and/or a centralized person at the helm.

For example, if you're looking to generate third-party business in your captive insurance company for tax purposes, why not use it to finance your voluntary benefits? Unqualified plans do not require Department of Labor approval to be included in a captive.

All of these synergies and opportunities aside, it is still important to recognize that the primary function of employee benefits is to recruit, retain, reward and retire employees, and HR has a critical role to play in the process.

Fortunately for me, however, I do not believe the two goals are mutually exclusive. Making sure the risk manager has a dotted-line reporting relationship to someone in HR, shares responsibility for benefits with the existing benefits manager, or has someone with a traditional HR background reporting to them should ensure the proper balance between analytics and employee relations.

Gaining responsibility for, or a role in this area will take some effort, as it is often hard to challenge the status quo. However, I don't see that effort as any more challenging than becoming the ERM for your organization.

The difference is that employee benefits are a more logical extension of the risk manager's current duties and skill set. And with health care costs rising concurrently with the age of the baby boomers, this is an area crying out for a little old-fashioned risk management.

Zachary S. Finn, ARM, is insurance risk manager with J.M. Smucker Company in Orrville, Ohio.

Special Reports /

Not Every Risk Manager Needs To Become An ERM

Related Stories

Recommended For You