Measuring risk: enterprise risk management takes a holistic approach.

• Author: Mason, Laurie

Even before Sept. 11 knocked insurance premiums into the stratosphere, JoAnn Ralph began telling her clients that the days of easy insurance coverage were coming to an end. Her advice? Prepare for inevitable premium increases by looking for other ways to mitigate risk. Ralph, a risk management partner in the New Jersey office of Rothstein, Kass & Company, CPAs, uses a holistic approach to assess corporate risk and get the big picture.

Enterprise risk management is a broader method than traditional risk management for managing hazards that could hit a company and ultimately affect its bottom line. While risk management tends to address a business' risk on a segment-by-segment basis, ERM looks at the whole company and the impact of one sector's performance on the other.

Insurance premiums were more affordable before the stock market faltered two years ago. "When the stock market was doing extremely well, insurance companies were willing to sacrifice underwriting for investments," notes Ralph.

Then the bottom fell out. On top of that came Sept. 11. Add Enron to the stew, and everyone, it seems--from investors to CEOs--has the jitters. "There is absolutely zero tolerance in the markets right now for missteps, any kind of negative news," notes Bruce Meikle, managing partner of Deloitte & Touche's enterprise risk services group.

Now with insurance companies doubling and in some cases tripling their premiums, companies are seeing that a holistic approach to managing risk is the best way to keep costs under control. "When you talk about enterprise risk management, you're looking at credit risk, you're looking at currency risk, you're looking at investment risk, you're looking at physical risk, and all of these different things that could affect the bottom line," says Ralph. "Most people think of insurance as only the transfer of risk, and that's not true."

NO MORE CHECK THE BOX

Historically, internal auditors have performed risk management that is protective in nature and compliance-oriented. This has evolved into a more dynamic, systematic approach of seeking out potential risk, heading it off at the pass and putting the systems in place for mitigating that risk.

Scot Clover, a partner with Ernst & Young's business risk services group sums up the process: "We ask: 'What are the company's goals and objectives? What can get in the way of achieving those goals and objectives?' and, 'Can we do an assessment of those and help them figure out the path to get there?'"

Says Lance Ewing, risk manager for Las Vegas-based GES Exposition Services, "Risk management is not...