For mid-size European companies, risk factors affecting corporate well-being are strategic and operational rather than hazard-related.

Risk management has been making its way up the corporate agenda in Europe over recent years. The increased insistence on adequate corporate governance standards in some countries, coupled with hardening insurance markets and the consequent difficulties in purchasing reasonably-priced cover, has meant businesses in all sectors have had to turn their view to the risk profile and risk management within their organisations.

As a rule of thumb, risk management as a separate discipline is rarely found outside the largest corporates, with those further down the pyramid sharing the load across several members of the senior management team. And this at a time when an increasingly complicated set of risks can hit businesses.

"Mid-market firms are different (from the biggest organisations)," said Michael Turpin, European director of the corporate client practice at broker Marsh. "The financial decision-makers are wearing a lot of different hats, and insurance is seen as a necessary evil. And maybe they haven't historically been engaged in holistic risk management."

Between June and December last year, market research consultant arnold + bolingbroke conducted a survey of mid-sized organisations in six major European countries and across seven industry sectors. The results of this survey are being issued during the course of this month, but survey sponsor Marsh released the results to Global Reinsurance a month before the official publication.

Perhaps unsurprisingly, the survey found that cultural attitudes towards risk varied across Europe. The countries surveyed - Belgium, France, Germany, Italy, Spain and the UK - were chosen because Marsh felt it had the best understanding of those particular risk markets, and around 50% of the survey respondents were Marsh clients. "Our current clients felt a little more prepared, with a better understanding of risk and more plans in place," commented Mr Turpin.

The survey's definition of a medium-size company was an organisation with between 50 and 500 employees, and annual revenues between €50m and €500m.

Summary of findings
The key findings of the survey were:

  • in most cases, responsibility for risk falls in the lap of the chief financial officer;

  • most firms acknowledge the importance of understanding risk and see the management of risk as a top priority;

  • companies believe that attempting to identify, measure and control the risks they face is necessary for business;

  • strategic and operational risks pose the greatest concern, with competitive pressures, staff retention and staff absenteeism causing the most worry;

  • current methods of controlling, monitoring and measuring the effectiveness of risk management procedures are inadequate, particularly for high impact risks, and 40% of businesses do not have a formal policy;

  • one-third of respondents review risk less than once every six months;

  • one-third of senior managers do not know whether their organisations have sustained a significant loss;

  • cultural differences are evident across Europe, with some countries encouraging risk-taking while others are more conservative;

  • although medium-sized firms are more concerned about high impact risks, they may be sustaining significant losses from frequent, low impact risks;

  • many medium-sized firms have a problem with high staff turnover; and

  • the attitude to risk can be influenced by the occurrence of a significant external event.

    Post-September 11 - an event which fell in the middle of the survey period - more survey respondents confessed to not having plans in place to deal with such events, but they also did not perceive a huge shift in their risks. "They felt they were not as exposed as large multinationals," commented Mr Turpin. In the UK, although the survey indicated that before September 11 74% of medium-sized firms had formal plans in place to address these types of risks, after the event only 57% felt their plans were adequate.

    In respect of high impact risks, only half the survey respondents said they had a formal plan for identifying and mitigating such risks. The UK and Belgian respondents were most likely to have formal procedures in place (about 75% of Belgian respondents said their companies had such procedures). At the other end of the scale, only about 25% of Spanish companies said they had formal procedures in place to address high impact risks.

    Holistic risk
    The overarching message across the report, however, is the increasing need for a guided holistic risk management approach in these types of companies. Currently, the approach to risk is "bifurcated or even trifurcated," according to Mr Turpin, and new risk solutions were needed, he said. In such companies, "insurance is seen as a necessary evil, and maybe they haven't historically been engaged in holistic risk management," even though the CFO has tended to be ultimately responsible for all the organisation's risk. Risk management was not embedded as a cultural mantra across the organisations or, in fact, the countries surveyed, he said.

    However, with the growing tendency towards best corporate governance practice spreading throughout Europe, there could well be a change in this approach. Across Europe, and at the highest level, there is a move to introduce corporate accountability, including transparency of income. All these moves were causing "more pressure on the brokerage community to become risk advisers," commented Mr Turpin. In the past, he said, the broking community had been focused too much on risk transfer. "It is only in the last five years or so that some brokers have recognised the consultative process of risk transfer." It is in this capacity that they can add the value to the organisations within the medium-sized sector. For example, many of these businesses have grown quickly, outgrowing their infrastructure. "There has been a lack of a formal plan ... there are bigger and more exposures because of the way (these businesses) have taken their positions," he said. Effectively, they can outsource their risk exposure management in all areas, including those sectors not, historically, provided by the broking community. Across the full community of survey respondents, the most important financial impact - hence business risk - was seen as increased competition, which 65% of respondents said was a `significant risk' to their business. Second was the threat of losing key staff to competitors, which was cited by 56%, while `changes in customer demand' was perceived as a significant risk by 55%. Traditional hazard - fire and natural disaster - was seen as significant by just 47%.

    With strategic and operational risk being much higher on the corporate agenda than financial and hazard risks, and all of these landing in the CFO's lap, this does lead to questions over whether the CFO is truly able to deal with the plethora of problems on his plate. "Currently CFOs and finance directors are being overstretched," said Mr Turpin, "and there is a void a lot of people are looking to fill. People have looked at risk management as traditional hazard risk rather than on a wider basis." Instead, there is perhaps a case for a risk assessment across all exposures of the organisation. "Right now, the risk management curriculum is embedded in the finance module - it is not pulled together in an overview," said Mr Turpin. "But in the future, there is going to be an increased pressure on CEOs to have their fingers on the pulse."

    By Sarah Goddard
    Sarah Goddard is editor of Global Reinsurance