Wedded Bliss

Risk management generally and enterprise risk management (ERM) more specifically are growing in acceptance and importance in the boardrooms of Canada, the U.S. and beyond. Sarbanes-Oxley had a lot to do with that, as did the hard work and perseverance of risk managers and organizations such as RIMS. The next step in the evolution of ERM is a big one, but a logical one – the marriage of ERM and corporate performance management (CPM), also known as business performance management.

“CPM is an umbrella term that describes all of the processes, methodologies, metrics and systems needed to measure and manage the performance of an organization,” according to the research paper ‘Magic Quadrant for CPM Suites: No Dramatic Movement in 2004.’ If you know anything about ERM and you apply that knowledge to this definition, the relationship should already be becoming clear.

PERFORMANCE INDICATORS

CPM uses key performance indicators (KPIs) to measure the performance of an organization against its stated objectives. Typically KPIs are applied to historical data; conversely, ERM uses predictive data to identify and measure business risk. A fairly new term in the business lexicon is key risk indicators (KRIs). These describe the metrics used to identify and measure that risk. The two parallel systems – ERM and CPM – have evolved to help measure and manage an organization. But to be truly efficient and effective, the two need to cross paths.

ERM, like any business function, requires clearly set metrics or KRIs. No matter how broad or narrow an organization’s risk management function is, the development of KRIs will be useful. American management experts McKinsey & Company’s motto, which is gaining common acceptance, is: “Everything can be measured and what can be measured can be managed.” It is challenging for risk managers to find useful KRIs, but not impossible. No question, it is difficult to say with accuracy how many fires, MVAs and back injuries you prevented. It is, however, possible to identify the average time to close a file, the average legal or adjusting fee per claim, or the accuracy of loss frequency and severity estimates compared to actual ones. If your organization employs an ERM model, then KRIs might be used to measure market risks, compliance with industry standards, or outsourcing and vendor risks. By taking this structured approach, an organization is less likely to miss something. It will be better prepared, more informed, and better able to manage for success.

If you can integrate the concepts of ERM and CPM – or at the very least, create transparency between them – the benefits of such a conceptual merger will be greater than if each concept is used individually. Not only would the integration fill gaps associated with each approach, it will also improve the focus and effectiveness of each function and place risk management much higher up on the corporate organizational chart.

If, however, ERM and CPM are allowed to operate independently of each other – without transparency – then the organization stands to lose a great deal. CPM alone will let you know how you are doing operationally. ERM will let you know potential pitfalls of your business initiatives as you move forward. With a good understanding of both, the organization will know it was on track yesterday, is on track today and will be on track tomorrow.

ALIGNMENT

At its core, CPM is about alignment. CPM generates knowledge that empowers the organization. Using CPM allows the organization to see the degree to which employee behavior is aligned with corporate strategy. Ultimately, the end game of an organization’s CPM is to get everyone pulling in the same, correct direction. In his book, Performance Management – Finding the Missing Pieces (To Close the Intelligence Gap), Gary Cokins suggests CPM processes are designed to answer a simple question: How am I doing on what is important? He further suggests that, ideally, people at every level of the organization – from front-line operation team, to managers, directors and up to governing board room bodies – should be able to answer this question.

The larger the organization, the greater the challenge in implementing a CPM process that enables successful execution of strategy. Designing and implementing a CPM process for a business services organization seems almost impossible. Firms taking their first foray into CPM know the barriers faced when an executive team wants to implement a CPM initiative, and pulls the trigger. Pushback, and sometimes wholesale resistance, will come from the regions, middle management, and the frontline. For most employees, the prospect of being measured against clearly defined KPIs will not compute. Measures of variance will most certainly be resisted. Critics will insist the services they provide are complex and unique. Efforts to measure performance will often be seen as a threat and dismissed as a waste of time. Don’t be dissuaded by initial volleys of resistance as this is tantamount to being paralyzed at the bottom of your organization’s proverbial ‘Stairway to Heaven.’ The climb is one stair at a time.

STAIRWAY TO HEAVEN

Take, for example, the Rollercoaster Indemnity Company (RIC)’s strategy for 2006: to increase profitability by reducing claim expenses by x %. As a first step, the company’s executive has developed a measurement framework that consists of weighted KPIs, which score each component of the claims handling process from cradle to grave. The results flow into user friendly, Web-based reports enabling managers to know – by region, branch, business unit, and the individual claims representative – the degree of variance in claims expenses. RIC’s new process has illuminated trends and has identified point sources of unfavorable variances. It identifies behaviors both aligned with and divergent from this year’s financial strategy. The next huge next step in RIC’s CPM process is putting knowledge into action or, manage what has been measured.

In the example, RIC took the very important fist step of the climb. But the process cannot be static; it must evolve if RIC is to reach the top of the stairway. Its CPM must evolve to become robust; it must integrate additional strategic objectives, not just financial ones. Other key strategies to be aligned might include customer relationship management, internal core business processes, innovation and enterprise risk management. If the organization implements CPM in the absence of ERM, it could come tumbling down the ‘stairway to heaven’ in a hurry. Even if RIC evolved its CPM processes to the level at which it effectively coordinated the efforts of all its employees – so that they were all pulling in the same, correct direction and consistently achieving the organization’s strategic objectives – what would happen if the regulators changed the rules in auto insurance statutory accident benefits? What if the impending employee gap for the industry shows up sooner, rather than later? What if a different risk changes the game? To get to heaven, both CPM and ERM will need to climb that stairway together.