ENTERPRISE RISK MANAGEMENT Mary Lynn Curran, VP, Clinical Risk ManagementKen Felton, SVP, Senior Clinical Risk Management Consultant

July 14, 2009

2

ENTERPRISE RISK MANAGEMENT

3

SOMETIMES IT’S HARD TO REACT TO RISK!

4

COMPETING DEMANDS Competition for resources

The level of exposure

Decision making and setting of priorities

5

TODAY’S GOAL We will speak about LTC risk – and not necessarily INSURABLE

risk OUR challenge for today reflects YOUR challenge every day:

Creating a framework to Give each risk context and Make each risk actionable Even when there is no risk transfer option available

6

ERM IS ESSENTIAL TO EVERY BUSINESS

Lord Levene, Chairman of Lloyd’s of London wrote:

“But risk management is not simply about preparing for the worst. It’s also about realizing your full potential. With a clear understanding of the risks they face, businesses can maximize their performance and drive forward their competitive advantage”.

Levene, Lord; “Risk management is essential to every business”: Financial Times, October 17, 2006.

7

WHY CONSIDER UTILIZING THE ERM PROCESS Connect business and risk management strategies Determine full realm of risk exposure Improve business plan execution Monitor the effectiveness of enterprise actions

8

ENTERPRISE RISK MANAGEMENT PROCESS

Identify critical risks ?) – Whether insurable or not!! Quantify their impact on organizational objectives Develop and implement risk management strategies Mitigate risk and maximize value

9

ENTERPRISE RISK MANAGEMENT

Helps the organization understand that risk can be viewed not only as just a threat, but as an opportunity

10

WHAT IS ENTERPRISE RISK MANAGEMENT?

ERM is a structured analytical process that focuses on identifying, quantifying, prioritizing and eliminating the financial impact and volatility of a portfolio of risks rather than on risk avoidance alone

Essential to this approach is an understanding that risk can be managed to gain competitive advantage1

1”Enterprise Risk Management”, Defining the concept, recognizing the value, ASHRM, January 2006, pg., 1.

11

RISK IDENTIFICATION Goal: Capture all risks that could potentially affect the

achievement of organizational objectives How does this occur?

Surveys and questionnaires Checklists Flow charts System analysis FMEA Brainstorming Assessments based on records and experience Results of audits, inspections or site visits

12

ENTERPRISE RISK MANAGEMENTFour Areas of Focus Financial Risk – Risks that effect the profitability, cash position,

access to capital or external financial ratings through investments, business relationships or the timing of the recognition of revenue or expenses

Hazard Risk – Risks attributable to physical loss of assets or a reduction in their value, or injury to others or their property, including customers, employees or other business entities

Operational Risk – Risks to the conduct of the business operations that result from on-going or changes in business practices, use of resources, external regulations or requirements, inadequate or failed internal processes, people or systems

Strategic Risk – Risks to reputation, market position or ability to pursue strategic goals and objectives

13

FOUR QUADRANTS OF LTC ROUNDTABLE RISK

HAZARD OPERATIONAL

FINANCIAL STRATEGIC

14

RISK EVENT PRECIPITATING ENTERPRISING VALUE DROPS(# OF COMPANIES)

24

12

76

4

21 1 1

11

7 76

32

10 0

0

5

10

15

20

25

Cost Overruns

Accountingirregularities

Managementineffectiveness

Supply ChainIssues

CompetitivePressure

M&AIntegrationProblems

MisalignedProducts

CustomerPricingPressure

Loss ofKey

Customer

SupplierProblems

R&DDelays

CustomerDemandShortfall

% of top 100

RegulatoryProblems

Strategic Operational Financial Hazard

ForeignMacro-

EconomicIssues

InterestRate

Fluctuation

HighInput

CommodityPrice

Lawsuits NaturalDisasters

58% 31% 6% 0%

Mercer MC Research

- Investigated risk factors behind the 100 largest one month drops in shareholder value among Fortune 1000 companies between 1993-98

- Found top 100 stock drops

- Identified triggering event

- Determined causes of triggering event

- Categorized primary cause

- Analyzed results and implications

15

FOUR QUADRANTS OF RISK

HAZARD0%

OPERATIONAL31%

FINANCIAL6%

STRATEGIC58%

16

ENTERPRISE RISK MANAGEMENT PROCESS Understand the organization’s business and strategic objectives List all of the risks in the four specific areas of focus; financial, hazard,

operational and strategic Arrange risks by order of magnitude

Risks are quantified in dollars or order of magnitude Severity of probability and frequency of loss (Risk Map) Risks are defined as uninsured, partially insured or insured What controls are in place to address the risks

Develop a Financial Exposure Snapshot – identifying what degree of risk the organization faces

Determine if the organization can do one of the following: Avoid the risk Transfer the risk Retain and manage the risk

Identify what controls are in place to address each risk from 1) least risk control to 5) greatest risk control

Determine gaps and opportunities for improvement

17

THE RISK MAP MODEL

Risk # Description Type of Risk Probability Impact Score

1 Loss of state licensure Legal and Regulatory 1 10 10

2 Failing a high profile joint venture Financial, Strategic 9 9 81

3 Medication error Operational 8 5 40

4 Manufacturer backlog fails Technologic 4 5 20

Risk Priority

Critical = 60+ High = 30-59 Medium = 16-29 Low = 1-15

Adapted from the Housing Corporation. London (UK) [cited 2005 Dec 15] Risk Management Topic Paper No. 4; 2003 Apr.

18

THE RISK MAP MODEL 

                       

 10 1                  

 

  9                 2    

  8                      

 7                    

 

 6                    

 

 5       4       3    

 

  4                      

 3                    

 

 2                    

 

 1                    

 

    1 2 3 4 5 6 7 8 9 10  

                         

                         

                         

Not Likely Likely Almost Certain

Probability

Cat

astr

op

hic

Mo

der

ate

Insi

gn

ific

ant

Imp

act

Adapted from the Housing Corporation. London (UK) [cited 2005 Dec 15] Risk Management Topic Paper No. 4; 2003 Apr.

19

ENTERPRISE RISK MAP: PART ONE

HIGH

LOW

SE

VE

RIT

Y

0% 50% 100%

LF

HS

LF

LS

HF

HS

HF

LS

3

1

4

2

5CAT

PROBABILITY OF OCCURRENCE

20

RISK EVALUATION

Beswick, Kelsey and Bloodworth, Jane: Housing Corporation “Risk Mapping – Dilemmas and Solutions”; Risk Management Topic Paper No. 4

21

Measurements – Defining Impact

Value Term Definition 1 Rare Expected to occur only in rare circumstances 2 Unlikely 5% chance of occurrence in the next 12 months 3 Possible 25% chance of occurrence in the next 12 months 4 Likely 55% chance of occurrence in the next 12 months 5 Expected 90% chance of occurrence in the next 12 months Risk Severity Value Term Definition 1 Slight Financial impact on earnings less than $50,000 2 Minor Financial impact on earnings more than $50-$500,000 3 Moderate Financial impact on earnings more than $500K - $1Million 4 Critical Financial impact on earnings more than $1Million-$500M 5 Catastrophic Financial impact on earnings more than $500 Million Period Impact Value Definition 1 Able to adjust risk strategies due to extended period of notice 2 Shorter term of notice provides a limited opportunity to change strategy 3 No immediate notice or warning Controls Value Definition Consequence 0 Adequate risk controls in force X 0.75 1 Limited risk controls in force X 1.25 2 No risk controls in force X 1.50

22

THE ERM RISK MODELRisk # Description/Type of Risk Frequency Impact Severity Controls Score

Gap Interventions

Risk Priority

Frequency + Impact X Severity = Inherent Risk Score X Controls = Residual Risk Score

23

THE ERM RISK MODELRisk # Description/Type of Risk Frequency Impact Severity Controls Score

1 Falls with Injury/(H) (F) (S) (O) 5 1 3 1 23

2 Decreasing Occupancy Rate /(F) (S) (O) 5 2 4 1 30

3 Elopement /(F) (S) (O) 2 1 4 1 15

4Inconsistent communication among a multi-facility

organization / (F) (S) (O) (H) 4 1 3 1 19

Gap Interventions

Risk Priority

Frequency + Impact X Severity = Inherent Risk Score X Controls = Residual Risk Score

24

RISK CONTROL ASSESSMENT AND ACTION PLAN

Beswick, Kelsey and Bloodworth, Jane: Housing Corporation “Risk Mapping – Dilemmas and Solutions”; Risk Management Topic Paper No. 4

25

CONCLUSIONS: There is no right or wrong way to implement Enterprise Risk

Management within your organization Enterprise Risk Management fosters communication among

organizational departments Experts believe Enterprise Risk Management must be:

Customized to the organization Kept simple and understandable Able to show immediate success

Understand and utilize the process to maximize your value in the organization