Enterprise Risk Management for Small and Medium Size Enterprises (and How Captive Insurance Can Help

Risk management is a part of everyone´s lives whether they formally recognize it or not. As an individual choosing when to cross a street requires one analyze the road conditions and the flow of cars and then decide when to cross or not. That process requires identification, evaluation, implementation (crossing at the right time) and measurement – hopefully you made it.

Similarly, many organizations employ risk management techniques without a formal risk management philosophy or program in place. This is particularly true of small and medium size enterprises (“SMEs”) which tend to be more entrepreneurial and less regimented in structure on which to base a risk management policy.

Many SMEs understand the risks they face day to day and strategize over the best ways to operate, avoid issues and exploit opportunities. However, they may not have a written risk management policy to guide them or and individual risk assessments may not be completed. Measurement can be haphazard with payments from cashflow rather than a specific record of what happened.

Even without a formal risk management framework SMEs intrinsically understand that they face certain risks and chose to transfer the risk to a commercial insurer e.g. fire insurance. However, insurance, especially commercial insurance can have its limitations and is not a panacea to all ills.

SME´s may need to take a more holistic approach to their risk exposures.

Enterprise Risk Management ("ERM")

ERM is a risk based approach to managing an enterprise that integrates internal control with strategic planning to increase overall stakeholder value.

The ERM process looks to identify risks within and external to the organization. Those risks may include such things as:-

• Hazard - Liability torts, Property damage, Natural catastrophe

• Financial - Pricing risk, Asset risk, Currency risk, Liquidity risk

• Operational - Customer satisfaction, Product failure, Integrity, Reputational risk;

• Internal - Poaching; Knowledge drain

• Strategic - Competition, Social trend, Capital availability

By considering such risk areas an organization can then identify, evaluate and consider control mechanisms for their exposures or methods by which a company can exploit its opportunities.

When a company has identified that it wishes to consider the risks faced is does so by establishing a structured approach. There are various important ERM frameworks, each of which describes a way for identifying, analyzing, responding to, and monitoring risks and opportunities, within the internal and external environment facing the enterprise.

ERM for SMEs

All too often, for an SME ERM is not a focus. Some of the reasons might include the lack of familiarity with the subject, the perceived cost of implementation, apprehension towards change, lack of awareness to the benefits and that most literature and guidance is more suited to larger organizations.

The approach for SME´s may be different from that or larger organizations. The entrepreneur tends to have a clear vision of how they see their business. With much control centered on the individual owner it can be difficult to change that perspective.

When assessing and prioritizing risk a larger organization has a greater spread of risks as well as financial stability sufficient to maintain the business following incidents. Indeed, much of ERM for larger companies is designed to meet the requirements of rating agencies. Larger businesses may therefore look at prioritization in a different manner than a SME. An SME is far more likely to want to address shock loss from low frequency, high severity events. It may be easier to assess and manage risks of an SME, but consequences of a risk occurring may be far greater

The ultimate goal is that the ERM process will assist the SME to better understand and control the internal and external environments in which the business operates and to exploit opportunities to the full. However, to do this the SMEs may need to move away from the norm to find an ERM solution that fits their need.

How A Captive Insurance Company Can Help

Whilst there are many subtleties that are required to be addressed in a captive structure, in its most basic form a captive insurance company is an insurance company owned by an organization that insures the risk of the organization. Rather than using a commercial insurance company the operating entity places insurance risk with its wholly owned insurance company.

Alternative risk transfer mechanisms such as captive insurance companies have become more mainstream in the past 30 years. 95% of the S&P 1000 are thought to have their own captive insurance company. In the past 15-20 years, the middle market has seen a dramatic rise in captive products that focus on their needs.

Working with captive professionals an SME can gain independent perspective of the business operations, identify and evaluate of risk, establish an integrated approach and implement control measures as well as a system for monitoring results and ongoing reviews.

It is important to distinguish between the risks being faced by an organization and what can be insured. ERM encompasses all risks faced within the organization and relatively few risks can be insured as a means of response.

Businesses face a plethora of risks some are speculative where there is a chance of loss or gain such as currency movement and some are pure risks where there is no chance of gain e.g your building either remains undamaged or it is burnt down by fire. Only pure losses are insurable.

Insurable risks may appear to be more tangible and therefore more easily identified, more easily evaluated, transferred and monitored. Whilst it provides a limited approach insurance can be an important part of ERM. Further, this approach may fit better to the focus of the entrepreneur run business.

Commercial insurance has long been the mainstay of risk transfer for corporations. However, there are limitations to what is provided by your commercial carrier. For example :-

• Wage and hour losses are excluded from Employment Practices Liability policies or they may apply large deductibles.

• For rapidly changing risks such as cyber liability commercial insurers may not be able to keep up with the developing hazards being faced.

• Standard business income cover provides only for loss subsequence to loss or damage at the insured´s premises due to limited hazards and do not respond to such risks as loss of a key supplier or customer, loss of reputation, loss of key employee or loss of a license

• Administrative actions, including civil fines and penalties, arising from regulations are rarely covered by commercial insurance

• Deductible are common place and sometimes appear excessive.

Commercial carriers may not wish to deviate from their norm to accommodate a risk specific to an individual client.

There are many reasons why commercial insurance is an important tool to control the risks faced by an organization but the limitations mean that it is worth considering alternatives.

There are several benefits for an SME to operate its own captive, including: -

1. Individually designed Insurance policies

2. Control over claims handling

3. Control of underwriting

4. Retention of underwriting profit

5. Encouraging a risk management focus

Working with risk professionals that can establish and manage a captive insurance company also provides the SME with resources to identify, evaluate, design a response and monitor the insurance risks being transferred. In essence, the external captive management team can apply ERM principles to the insurance risks of the SME with minimal interference with day to day operations.

Whilst the costs associated with the operation of a captive insurance company may at first seem somewhat onerous together with the need to actively participate periodically, the benefits can quickly outweigh them to provide a reduction in the overall costs of risk faced by an SME.

A captive program can provide an SME with a focus to consider ERM within the organization as a whole or just concentrate solely on insurable risks.

Commercial insurance is limited and a risk conscious SME can benefit greatly by considering the wide range of covers that are uniquely available in the captive realm as well as retain profit for commercial risks transferred to a captive program.

Whilst this method is limited to insurable risks with the right service providers a wider non-insurance program can be augmented to provide an all-encompassing ERM framework.

Working with a captive risk professional to consider alternative risk solution can provide an SME with a valuable insight into control measures to reduce its total cost of risk and increase stakeholder value.

Contact Albion Risk Consulting, S.A. to see how we can help augment your risk management framework with a captive insurance structure and increase shareholder value.

Greg Taylor