Businesses at Risk

Today’s business climate has forced companies to redefine the concept of risk and plan specific ways to manage it. But many business schools aren’t turning out the kinds of graduates who can handle this complex job.
Businesses at Risk

Even a cursory reading of the business news indicates there’s a dearth of high-caliber risk management talent available to the global market—at a time when there’s a pressing need for such talent. The corporate world is straining to manage risks presented by a wide array of challenges: the seemingly endless fallout from Enron, the subprime meltdown, the skyrocketing price of oil, supply chain issues in China, widespread natural disasters, and global warming.

Many business leaders are starting to realize that they need effective and imaginative risk management to achieve significant competitive advantages, an enhanced corporate reputation, and a better overall stakeholder value. Business schools can help them meet this need—but only if they turn their own programs into true training grounds for risk managers.

Today’s Risks

Attention to risk management has intensified recently because companies worldwide are facing hazards that they didn’t even acknowledge five or ten years ago. In the past, even those companies that recognized additional risks largely ignored them, believing that they couldn’t be measured or managed.

Instead, companies focused on management risks that could be identified in a property/casualty insurance contract: risks posed to employees and vehicle fleets, as well as the potential liabilities faced by C-suite executives and board members. In the early ’80s, these manageable risks spread to the treasury department as the capital markets developed so-called derivatives contracts that allowed companies to deal with fluctuating currencies, interest rates, and commodity and equity prices. Companies may have found these financial risks more difficult to understand than risks to their people and property, but—and this is the important point—they still were quantifiable.

Then a series of cascading events happened along the way to the millennium, changing the way people perceived risk. First came two disturbing realizations:

  • Some risks aren’t predictable in magnitude or easy to manage in the insurance and capital markets. Remember the scare over Y2K and the lack of liquid insurance markets and products to cover those risks?
  • Overall costs of risk could be lowered by taking unrelated exposures and measuring them through a single financial or insurance contract rather than multiple separate ones. An explosion of financial engineering in the 1990s inspired a number of these holistic risk management models. The most famous example was in 1997 when Honeywell combined foreign exchange and hazard risks in a multiyear contract, saving an estimated $4 million annually.

Next came a series of disasters:

  • Hurricane Andrew made landfall in Florida in 1992, causing an estimated $26.5 billion in losses. Nearly bankrupting the reinsurance industry, Andrew led to the creation of so-called catastrophe bonds and a new type of financial and natural disaster modeling to make the bond ratings possible.
  • The World Trade Center attacks on September 11, 2001, forced businesses to consider terrorism, business continuity, disaster recovery, and security issues as part of their corporate risk management plans.
  • Enron collapsed at the end of 2001. That led to the passage of Sarbanes-Oxley and the rush to involve accountants, auditors, controllers, and IT experts more formally in corporate risk management and governance.
Companies face a plethora of new risks in areas as diverse as corporate reputation, human resources, IT, supply chain management, disaster planning, and financial and nonfinancial controls.

Hard on the heels of these events has come the notion that a company’s ability to manage risk can affect its standing in the world markets. For example, last November, representatives of the S&P announced that they might consider risk management part of their ratings process for individual companies.

As a result, companies face a plethora of new risks in areas as diverse as corporate reputation, human resources, IT, supply chain management, disaster planning, and financial and nonfinancial controls. Business leaders need to determine what organizational structure will present the best coherent strategy for managing such disparate risks, which aren’t as easily quantified or managed as the traditional risks of the past.

The new tagline for this enormous corporate endeavor is enterprise risk management (ERM). Companies must learn to combine the exacting science and mathematics behind insurance, capital markets, and modeling to meet ERM’s seemingly endless management requirements.

A Lack of Talent

Schools are facing a related challenge: training students to become employees who can slay the dragon of corporate risk. It’s urgent that they begin meeting this challenge today—particularly because the traditional sources of insurance talent seem to be drying up.

For example, since the 1990s, there has been a significant decline in the number of people taking the CPCU exam, the dominant professional certification exam for property and casualty insurance underwriters in the U.S. Between 1992 and 2007, the number of people sitting for the exam dropped from 52,500 to 18,000—almost a 75 percent decrease in just 15 years.

Meanwhile, in the past seven years, the number of U.S. actuaries accredited by the Society of Actuaries saw an annual growth rate of only 1.6 percent—which is anemic, considering that the industry’s asset base grew four times faster over the same time period.

The risk management programs at business schools are also struggling. Almost a decade ago, one university announced that it was discontinuing the insurance track in its undergraduate finance program due to lack of interest—and this is a school that was listed among the top 15 insurance and risk management programs in the most recent U.S. News & World Report. Another well-known risk program now offers only one undergraduate insurance course, although this program is considered a leader in teaching financial derivatives.

It’s not that business schools aren’t trying to meet the needs of today’s multinational corporations. The American Risk and Insurance Association (ARIA) boasts 46 academic institutions as members, and together they produce close to 1,000 graduates annually.

The problem is that, in too many schools, “risk management” and “insurance” are considered virtually interchangeable programs. These colleges and universities are not grooming risk managers who can help companies effectively handle global risk, especially in the executive suite and boardroom. And if these schools don’t re-examine the way they teach their students risk management, they will produce increasingly marginalized graduates who do not have the skills to help companies tackle some of their most urgent problems.

Zeroing In on the Challenges

Even for schools that are taking a long view of risk management, programming is complex. A growing number of disciplines are being put under the ERM umbrella, including insurance, accounting, auditing, IT security, supply chain management, and business continuity, and each functional silo claims to be the one to go to for risk decision making. Of course, each silo comes complete with its own educational degrees, certification processes, and professional associations, and each has its own ideas about how companies should handle ERM.

Nonetheless, risk programs are beginning to zero in on how to tackle ERM and produce graduates who are qualified to lead in a complex world. For instance, at Georgia State’s J. Mack Robinson College of Business in Atlanta, a revamped curriculum is bringing together a number of existing programs to create a series of risk-related graduate and undergraduate degrees. (See “Risk at Robinson,” on page 47.)

Other schools are also considering how to approach the topic. In 2006, the ARIA joined with Ohio State University’s Fisher College of Business in Columbus and the Griffith Foundation for Insurance Education to hold a two-day symposium called “Putting the ‘enterprise’ into risk management and insurance education.” Risk management academics from the U.S. and Canada attended to hear the viewpoints of executives from a wide variety of corporations and industries—as well as rating agency executives and consultants. Another symposium was held in August 2008.

Still other endeavors aim to bring together educators and the corporate community. The Enterprise Risk Management Initiative, founded by North Carolina State University’s College of Management in Raleigh, hosts a series of roundtable presentations where executives from companies such as Federal Express, Delta Airlines, and General Motors tell regulators, educators, and corporate practitioners how they are implementing ERM on the ground.

Mark S. Beasley, Deloitte Professor of Enterprise Risk Management at N.C. State and director of ERMI, says the initiative is gaining traction. “When we started, we had a list of maybe 20 corporate executives; now we have several thousand, so we’re making slow but steady progress.” While N.C. State’s initiative does not currently offer degree programs, Beasley expects growth in its future as executives recognize the need for broader talent.

Executives Weigh In

The best indicator that business schools need to address their risk programs comes from corporate executives themselves. Even traditional insurance companies have begun to look for graduates with more than an understanding of the math and science used to develop actuarial numbers.

For instance, Dutch-based insurance giant ING has expanded its actuarial program into one that deals with broader risks, according to Frederik ten Lohuis, the company’s manager of market risk. Since April 2007, the company has had a chief risk officer who reports directly to the board.

If schools can retool their programs to suit today’s risk marketplace, their students will be eligible for the most desirable jobs in the financial services sector and elsewhere.

 “As a life insurance company, we’ve concluded that only 10 percent of our risks are exposures to life insurance,” says ten Lohuis. “Fifty percent to 60 percent of our relevant risks really relate to interest rate movements and equity prices. The remainder revolve around operational, business, and credit risk. So our need for graduates who specialize in the actuarial sciences isn’t as great as we once thought it was, while our need is increasing for those who can help quantify other risks through metrics such as value-at-risk.

Nonfinancial corporations are also recognizing the need for graduates with broader skills. That’s true at the Southern Company, an Atlanta-based utility company. “What you haven’t seen historically are university programs producing well-rounded risk analysts,” says Silvia King, who until recently headed the ERM efforts at Southern. “Many of them produce the stereotypical ‘quant’ who specializes in technical fields and is uncomfortable dealing with managers in the C-suite. But managing risk from an enterprise perspective has as much to do with ethics, governance, and accountability as it does with actuarial science. Business school programs need to find a way to bring the technical and nontechnical skills together.

If business schools are going to meet the needs of business in the field of risk management, academia must look to the future, says Don Mango, managing director at Guy Carpenter, a global reinsurance intermediary. “Schools should try to produce the kind of graduates companies will need—even if most of them don’t know it yet,” says Mango. “The risk manager of the future should be able to go into an industrial company, for instance, and deal with the risks surrounding raw material, logistics, and the supply chain, among others. Today, the people assessing those risks are often traditional MBAs, but academia should be able to offer graduates who add more value. They should be able to train people who can provide expertise in all three areas—risk finance, insurance, and capital markets.

Room to Grow

As risk management programming becomes more urgent, schools and businesses will no doubt engage in a larger debate about what needs to be covered. The programs most likely to be successful will be those that blend financial engineering and actuarial science with more traditional risk management and insurance courses.

That blended approach will be powerful, says Paul L. Walker, an associate professor of accounting at the University of Virginia’s McIntire School of Commerce in Charlottesville. Walker teaches a graduate course on ERM and is the author of Enterprise Risk Management: Pulling It All Together and Making Enterprise Risk Management Pay Off. “I can’t imagine working at any major corporation today without having a broader understanding of risk than corporate executives have had historically,” he says. “Nor can I imagine being on a corporate board and being asked a question that I couldn’t answer. It would be embarrassing.”

The future may hold a wide variety of business programs tailored to risk management, believes Joan Schmit, the American Family Insurance Professor of Risk Management and Insurance at the University of Wisconsin in Madison. She says, “I think there will continue to be more traditional insurance programs, because there will always be a need for underwriters and claims adjusters and contract writers.” But since corporations will need to hire people with backgrounds in mathematics and operational risk, she says, schools need to offer programs that meet those needs. She adds, “What’s most important is for the leaders of these programs to know who they really are and who they want to be.”

If schools can retool their programs to suit today’s risk marketplace, their students will be eligible for the most desirable jobs in the financial services sector and elsewhere. Their enhanced risk management programs will boost the overall reputations of their schools, serve to differentiate them from competitors, and fill an important space next to more traditional academic programs like finance. At the same time, their programs will be ahead of the curve as they fulfill a need that global businesses are just beginning to realize they have.

Richard Phillips is Bruce A. Palmer Professor and Chair of the Risk Management and Insurance Department at Georgia State’s J. Mack Robinson College of Business in Atlanta. Lawrence Richter Quinn, president of Quinn Risk Management Media in Atlanta, contributed to this story.