Michael Liebowitz
Director of Risk Management and Insurance
New York University (NYU)

What are the top issues this year that NYU’s risk-management department is working closely with your organization’s legal department to address?

The overarching issue is to get all of NYU’s contracts through review by the legal department and risk-management office. Many contracts bypass review and are signed by people who are unauthorized to do so. We’d love to make this a mandate, but then people would be loathe to comply. So from a grassroots perspective, we’d like to get people to understand why bringing contracts to both departments is important—because we can explain their repercussions, [potential] losses and risk-transfer mechanisms.

How are you working with the legal department to manage Cyber risk?

Cyber risk is a three-pronged issue that belongs to the legal department for licensing and IP agreements; the risk-management departments for the evaluation of exposure; and, of course, our IT people, the real owners of that risk. It also ropes back around to our third-party cloud [vendors], who are legally responsible for providing the policies and security procedures to protect our data that lives in their hardware.

At NYU, how do you communicate with the legal department in identifying issues and addressing them collectively?

It’s a collaboration. We talk amongst ourselves in “legalese,” but the key is to get each party to put things down to a language we both understand. The general counsel and I sit down and talk about our bifurcated issues. I don’t step into [legal] terms, and they don’t step into indemnity, but we come out with an agreement that is going to protect our organization. Unfortunately, we do sometimes have to walk away from a vendor because of indemnity and insurance provisions. The two pieces of legal and insurance have to come to an agreement as a single unit. If they don’t, that contract cannot move forward.

Sarah E. Pacini, R.N. J.D.
Vice President, Risk Management and Insurance
Advocate Health Care

What are the top issues this year that Advocate Health Care’s risk-management department is working closely with your organization’s legal department to address?

Health-care reform is obviously a huge focus from a provider perspective, and it is also a major focus from a risk-management perspective. Now that the Patient Protection and Affordable Care Act (PPACA) has passed the Supreme Court’s scrutiny, it is important for health-care risk managers to recognize the implications PPACA may have on their insurance coverage, actuarial analysis and scope of services.

Insurance coverage will likely be impacted by the potential for increasing claims in the Errors & Omissions, Directors & Officers and Institutional Negligence arenas.

Merger-and-acquisition activity is also on the rise across the health-care sector as consolidation proves to be a potential solution in response to PPACA for hospitals as well as physicians. This means the health-care risk manager must have a seat at the table during due-diligence analysis and must provide viable and valuable solutions to meet the strategic needs of his or her institution.

Although due-diligence analysis is essential, the work of M&A does not end with due diligence; it begins there. The real challenge for health-care risk managers is 1) the integration of two insurance portfolios into one comprehensive program; and 2) the cultural transformation necessary for two independent entities to integrate into one successful health-care program.

What advice can you give to other risk managers about effectively interfacing with the legal department?

I am a lawyer, so perhaps it is naturally easier for me to interact with the legal department, but it should be easy for everyone.

First, I believe it is important to present issues to the legal department only after you have conducted your own due diligence. This way when you are asked specific questions, you will be prepared to answer in a meaningful way.

Furthermore, I believe it is essential to come to the legal department with potential operational solutions already identified. This ensures that the attorney not only has the background information but also understands the direction in which you want to proceed. Once the lawyer understands these two points, it is easier for him or her to explain the most efficient and effective method to achieve your goal.

Remember to begin your interaction with your legal department with the end in mind: What do you want? If you want legal advice on a proposed solution, then you need to bring a solution that has enough substance for the attorney to opine. If you want options to overcome an operational challenge, make sure that you have all the current information on the operation and its challenges. It is important to remember that the legal department wants to support you in identifying creative and proactive solutions to eliminate or mitigate risks and advance the operations of the organization.

Gary Pearce
Vice President, Risk Management Group
Kelly Services Inc.

What are the top issues this year that Kelly Services’ risk-management department is working closely with your organization’s legal department to address?

Compliance and globalization are the top issues. Compliance is focused on wage-hour risk, employment eligibility, screening practices and safety management.

The globalization aspect revolves around deploying our best practices on a consistent basis across our worldwide organization, including litigation management, workplace-injury management, incident reporting and claim reserving.

At Kelly, how do you communicate with the legal department in identifying issues and addressing them collectively?

As for communication with our legal [department], we saw a compelling need for close collaboration in this regard—and so did our executive management. As a consequence, a few years ago we consolidated our legal, risk, safety, security, workers’ compensation and unemployment functions into one organization known as the Law and Risk Management Division.

We saw substantial initial advantages in customer-contract management and in launching an ERM program. But now this integration also spans many other issues such as liability-claim management and legal/risk support of new-product development.

Our staffs are co-located, which not only [fosters] daily collaboration but also affords cross-training and enrichment opportunities that might not otherwise exist. We also report to the General Counsel.

What advice can you give to other risk managers about the most effective way to interact with the legal department?

Risk managers often interface with legal staff under the unspoken presumption of being the junior party in the relationship. Consequently, there is an elevated need for personal credibility on the part of the risk manager: More than simply having a very strong understanding of business and legal principles, the risk manager needs to bring distinct and accretive skills to the table. Effective risk managers can anticipate legal issues and are able to lead the legal/risk dialogue, yet perform effectively in a supportive or consultative role when appropriate.

Special Reports /

Legal and Risk Departments Deliver a One-Two Punch to Organizational Threats

Related Stories

Recommended For You