Lee Coppack talks to Clive Pracy about trends in risk management in Europe.

LC: What would interest me particularly is whether you have observed differences in the current priorities of risk managers in North America, particularly the US, and risk managers in Europe.

CP: If we go back, say, 10 to 15 years, everyone perceived that risk management was an American idea and that was going to be something that American companies did. At that time, as an example, my company Exxon had a very vibrant risk management culture and functions. BP and Shell and the others still had insurance functions, and they used to come and ask us what this risk management stuff was all about. I think Exxon was pretty close to the cutting edge in terms of doing real risk management anyway, but certainly risk management in the rest of Europe at that time was almost negligible in terms of corporate function.

LC: Was it, do you think, the workers' compensation regime in the US that concentrated peoples' minds?

CP: That is one of the drivers behind why the function is different. But I just think risk management was something that most people had not got their heads around; it was a case of - we read it in the books, we saw that it seemed to be a good thing to do. I have not really ever had a chance to sit down to talk with the founding fathers of AIRMIC to find out what were they really doing 20 years ago, so I just speak personally.

When I left Exxon and went to KPMG, we set up a conference on risk management in London, and got the head of our American risk management practice in KPMG to come and talk at it. When he saw the topics that we were doing and everything else, he was gobsmacked. He said: "Not only are you guys doing what we are, you are ahead of us by a sort of quantum factor."

That gap to some extent is widening. The US risk managers are having to deal with a different lifestyle and a different set of issues; workmen's comp leads into managed health care which leads into the litigation background, and everyone says: "What we have got to do is to stop our people from having accidents."

LC: Because the first captives were workers' comp related, weren't they, or many of them?

CP: Yes, and again when you think where did the captives concept start, it very much started in America. But if you then look at the history of those, the drivers were not the in-house risk managers. It was almost all external pressures, but yes, of course, they were American in concept. Most of the original, as it were, alternate risk financing probably came from over there, but I think that their clothes are being stolen fast now by some of the Europeans who are giving them a run for their money, like Centre Re and Zurich.

LC: What do you think is the priority today of the risk manager of a major European company? Presumably he or she can buy fairly cheap insurance for fairly conventional risks. What are they concerned about that they cannot cover easily, conventionally?

CP: I start from the position that you ought to treat all risk as uninsurable and manage it out as best you can. I have never been persuaded much by the argument that insurance is cheap. If you are not having any claims, it is just an overhead cost that you are bearing. And if you are not having claims and that is not a fluke, and you can answer that question honestly, then do not buy insurance. If you are having lots of losses and, therefore, the insurance is necessary, then you should ask why, and you have to manage it out of the business. You go around in a circular argument.

LC: When you were with London Transport, weren't you dealing with old infrastructure and masses of the public, that must have presented you with a lot of risks that you just could not eliminate?

CP: We could do a lot of elimination, and we did, and we did a lot of mitigation, but it is a good example. London Transport has had a long standing relation with Mass Transit (MTR) in Hong Kong. Much of the management of Hong Kong Mass Transit was either ex-LT or was Mass Transit and then went to LT. Most of their first line supervisors will have been trained by London Underground. But there is a massive difference in the two organizations. There is a project that LT agreed that I should do, so we went and looked and thought risk management for MTR. One was able to ask that big question: "You have been operating for 15 years now, MTR, and you have not had a nasty incident at all. Is that a fluke?" And the conclusion that I came to was that it was not a fluke, and that the infrastructure helps no end.

The ordinance that allowed MTR to be built is a document of about 20 pages, and that ordinance says if MTR considers fit, then it can do anything it damn well likes, anything from pricing to infrastructure. If it wanted to dig up a side of a road, it dug up a side of the road. If it wants to stick some tunnels across the harbor, it does. Therefore, they built themselves the perfect railway system, with a lot of money, with sure knowledge that it would, probably from the day that it started, be lacking in capacity, just because of the sheer geography of the place, but that they could have the plans and they had the vision. That is why they are building the link to the new airport; that is why they have got something like £20-£30 billion projects lined up for the island.

They always knew that the growth would come, they always knew where the pinch points would be, they knew they would always be a victim of success. But because of the way they have operated, because of the absolute quality of the management, the quality of the systems, the quality of the infrastructure, they could honestly say that the reason they had not had a nasty incident was not a fluke. Compare that with LT and you realize that you have got two different environments. However hard you try, because of the asset age and the asset state of LT, you could not honestly rule out the one in eight year event.

LC: But that must apply to the situation a lot of risk managers inherit.

CP: But that is only one side of it, the probability factor. The next thing is what it is going to cost. The 1987 King's Cross fire in the London Underground when 31 people were killed was about £15 million all up. A tragedy in every sense but that is not a mega loss, in insurance terms. If you looked at the record of the organization before and since, that was a one-off, I would argue. That is not the way the market saw it, and that was not what I inherited when I went there. Because of the sheer asset age and the lack of investment, you could not rule out another loss. The tunnels are the way they are and they have got too many bends in them, they have got platforms and train edges that do not match up, and signalling systems that are in many ways safer than more modern ones because they are so mechanical and require a lot of various human things to make them function.

Also you have got 110 miles of old tunnel. As it turns out, it is 110 miles of very good tunnel; the Victorians knew what they were doing. But we had to spend a lot of money on the infrastructure, on the tunnels, because that was where the threat was. If you have got a river running by, or you are going underneath it, then there is a chance of ingress of water, so there was probably £100 million spent on just the tunnels under the Thames recently.

Even as an organization that was cash strapped, or perhaps because it was cash strapped, we used to have long, interesting and vibrant debates in the boardroom about why we were buying insurance at all. Because we were taking large deductibles, the potential exposure, if there was a massive and sudden ingress of water into the underground system, was so off the Richter scale in terms of its potential, that why were we buying this bunch of cover in the middle, for liability exposures or property? The answer to that was because we knew in our heart of hearts we could not manage that exposure out of the system. But we still had the debate.

I think many organizations have got exposures that on a worst case basis are way beyond their contemplation or their insurability, either because the capacity is not there or because the price is ridiculous. And they are living with that huge top end exposure.

LC: Or the nice comment that the company secretary from BP made that "there might be some difficulty effecting the contract."

CP: Indeed, quite. What the debate ought to be, is what is our ability to absorb the risk. Then we will worry about what we have to transfer, or try and transfer at the end. I suspect most of the thinking is trapped in the traditional in terms of insurability. We know the real risk is going to be in terms of what is really, really going to hurt the corporate bottom line and, therefore, after that we will worry about our ability to absorb it.

Then, of course, you get into the issue of reputational risk. Reputational risk is the one aspect that is going to kill many companies, and you have only got to go through loads of recent examples. What would have happened to London Transport if it had been private sector, and there was an alternative way for people to get to work after the King's Cross fire? I suspect that they would have been in big, big trouble. There was a demonstrable blight factor even for people who have to use the thing to get into work. And if there was a viable alternative, I suspect that London Underground would not have survived in the private environment in terms of the ownership. The public enquiry was damning of the management style and everything.

So reputational risk is the one that matters, and I doubt even now whether people sit down and have the real debate about it at the right level in the boardroom. I think they might start having to, and my thesis is still the same one. If, for example, you have got a company that has got a £140 billion capital base that is going to spend £2 billion a year having a gamble on R&D, I think it can afford most things to do with its normal, insurable loss.

LC: Is there enough differentiation between the different types of organizations in their attitudes towards insuring, because some organizations will be rich in assets but perhaps have sluggish cash flow, while others like financial institutions have huge amounts of funds washing around one way or the other?

CP: Well, they probably do not have a sufficiently sophisticated approach to risk. I think you have got to see it day in and day out. The only thing that surprises me is the number and size and the apparent successful nature of the organizations that still have a very naive approach to risk management. You are going to say to me: "Well, they cannot be too naive otherwise they would not be that successful." But everyone has got a rainy day. It is a case of whether people are confident that it will not happen to them because they have got a system, processes, management and everything else or have they just been damn lucky because they have not sussed it out.

But one talks to numbers of people where risk management is still a topic that does not really get in even the right kind of debate. They say: "It is on the finance director's agenda." Well, I do not know that it is, or that it is going to get into the definition of the problem, because what is the finance director thinking about risk management? Is he thinking audit or is he thinking about his exposures? The treasurer is certainly thinking about risk management differently because he is thinking about financial markets.

LC: You are dealing a lot with financial institutions to whom risk management with a treasury connotation is an everyday thing. How are they thinking about risk these days?

CP: You can see that in the way most people operate is they have sorted the credit and the trading risks out, or they know they have to and they know what they have to do. Now they are thinking about operations risk, and here we go again, another definitional problem. If it is "operations", then the chances are people are thinking just in terms of the transactional support of the trading activities of the bank. We prefer to work on the basis of "operational" risk, by which we mean everything other than credit and trading risk, so it really is from the "soup to nuts" of risk beyond that narrow but important focus of credit and market. If you are in retail banking, it is from the customer walking in the door all the way through the business that they do and how you run your bank's own P&L in terms of its operation. I would argue, of course, any organization has to have the totality of risk to worry about.

If you take that view, then you are going to find yourself in a huge, huge project, which a lot of them are prepared to undertake. What will probably come out of it, as I think I have said before, is ultimately a more scientific approach to risk management than we have ever had before in industry, commerce generically, because they are prepared to drill down very deep and wide in terms of working out the correlation and inter-relationship and inter-dependency of risks. If they apply the same amount of rigor and frankly, investment, into risk management as into operational risk, then I think risk managers and industry and commerce outside financial markets will really have a model to learn from. For the first time, there will be some science applied to it, real science.

LC: What sort of time scale are you looking at?

CP: As to the awareness, goodness knows. But some of these jobs in themselves for a typical bank could have a three to four year time frame just to do the risk mapping, which is a pretty frightening thought.

LC: What do you see happening in continental Europe?

CP: It is curious to me that perhaps there is a greater "oomph" coming from continental Europe. They are waking up, and it is almost like they can miss out a few phases here. Sleepy insurance companies with a narrow focus are suddenly being projected to being part of a bank's overall asset management structure, missing out all the bits in between, like: "Do I go Direct Line1 here?" and all the rest of it. They have changed; their whole operation will be changed in a dramatic way, missing out a lot, as I say, of perhaps the last five or 10 years of change that you have seen within an insurer.

I was at a meeting yesterday where the real, fundamental job which we were going to be doing for this newly formed insurance company, was to be in the whole customer dealing process - finding out what they want, how do we help them. What, from an insurance company? Gosh, this will never catch on, you know, smacks of service to me. Really, changing the whole focus into a real demand driven, customer supply chain excellence and everything else in terms of insurance. And this was not one of the bigger names who have always sought to find out what the corporates need.

With what is happening in Europe, probably we are going to see a much more responsive insurance industry. It may not be driven by insurers; it may be driven by a financier's approach to it. But that in itself will be a revolution, not an evolution, because you are going to have a vast array of genuinely new products available.

LC: So you are going to see risk finance rather than insurance.

CP: Yes, that is right. And catering for the reputational, and for the currently uninsured or uninsurable risk. It is going to be in huge tranches, it is going to be in mega, mega layers, but then banks can think in those terms. Risk managers are not going to go out and buy commoditized products any more unless they are raving mad, because they are going to want customized reactions from their financial trading partner. Notice I did not say insurer. They are going to want a solution that really is customized. We are not talking about tweaking there or cover a bit in about here, we are talking about fundamental, root and branch means of protecting their assets. And I think that is exciting. What you get is almost a sense that this sleeping giant is being forced into a whole new life form that I think is going to be great for corporates.

Clive Pracy is a consultant with Anderson Consulting, London. Tel: +44 (0)171 304 1980; fax: +44 (0)171 438 5297

Lee Coppack, co-editor, Global Reinsurance.

1. Pioneer of direct sales of motor insurance in the UK.