In this post, I’ll give some background on the growth in Enterprise Risk Management and how it relates to the construction industry, and explain why adopting an Enterprise Risk Management philosophy for running your construction business is a wise decision. I say philosophy, because at its core, ERM is a shift in thinking, a shift in managing your business. It applies best in high risk industries, like construction, which have high failure rates due to persistent failures to recognize and mitigate risk across the entire business.

Enterprise Risk Management Growth

In a 2001 survey, Enterprise Risk Management: Implementing New Solutions, it was noted that 41% of the public companies surveyed indicated that they were currently implementing some form of ERM program.  As a result of Sarbanes-Oxley Act (aka SOX, the compliance requirements set forth after the Enron debacle), that number has been climbing ever since.  Why?  Quite simply, the rules of the game have changed for public companies.  They must now prove they have strong internal controls, complete intregrity and systems to manage all risks they face.  Unexpected “surprises” are no longer accepted; they now have swift consequences.  Given this environment it’s no wonder that Enterprise Risk Management (ERM) is being adopted by public companies at an ever increasing pace.

In the United States, the Securities and Exchange Commission, as well as the U.S. Federal Reserve and the American Institute of Certified Public Accountants, are demanding more accountability from corporate directors in terms of identifying risks and developing systems for managing them.  The National Association of Corporate Directors is encouraging audit committees to expand their scope of risk management reviews. Dunn and Bradstreet has released software to provide ERM Solutions. Standard & Poors, one of the largest credit rating companies of businesses worldwide, has announced that it is now including questioning about a company’s ERM practices to determine ratings for credit.  This rise in expectations requires a level of risk management knowledge and capability not found in many organizations so companies are scrambling and reacting to institute risk-based controls.

But how does all this apply to private companies that don’t have to worry about compliance issues brought forth by SOX? Plainly stated, ERM is not just for the “Big Guys” anymore.  As Tim Ling, president and chief operating officer of Unocal, stated: “I think you will see almost all companies over the next few years moving in the same direction [as we are], really trying to integrate the notion of risk management with the notion of just business management. To me, running a business is all about managing risk.”  Essentially, managing risk is really about properly managing a business, and therefore managing risk can create shareholder value if done correctly.  Thus, ERM is now seen less as a reactionary requirement to regulations, and more as just plain old good business practice.

Why Contractors make good Candidates for ERM

But you may question, does ERM apply to contractors? The answer is yes… more than ever. Since ERM best fits companies in high risk fast moving industries, contractors are prime candidates for adoption. Let me explain some of the reasons why:

Abundance of Risk - There are so many risk factors in a construction business that it is hard to manage them all. In essence, a contractor is like a juggler, typically having a ton of balls in the air, each being a problem that needs to be solved. Unfortunately, the functioning of the company is usually last priority. Since money is made or lost in the field, solving problems in the field typically takes precedence over solving problems in the company.

Tight Time Constraints – As every contractor knows, the construction industry moves at a million miles a minute. Since it moves so fast, it is very difficult to implement risk controls, or in other words, fix internal problems. The industry is very competitive, margins are small and great pressure exists to keep overhead down. So if overhead is already stretched thin and key management personnel are focused on solving problems in the field, there is simply not much time or human capital to get risk controls implemented. An internal problem may get temporarily addressed and go away for awhile, until many months later when it pops up again and everyone looks at each other and says “didn’t this happen before,” and the cycle repeats itself.

Insufficient Knowledge – Since contractors are so busy, do they have time to learn? If they don’t have the proper guidance, do they know the options available to improve the function of their company? The answer to both questions is usually no. Unfortunately, since they are so busy, they don’t have time to seek out those professionals who can give them advice, and to compound matters, Enterprise Risk Managers who understand the construction industry are hard to come by.

Unstable Controls – During day to day activities at a construction company, internal problems often come up and management will conclude that “we should do something about this.”  Unfortunately, the pressure to constantly meet day to day deadlines in a fast moving environment does not allow management sufficient time to methodically establish a plan to install risk controls effectively, and even if installed, management does not have time to perfect or monitor the control to assure it remains in place. As a result, a “quick fix” is often used as the solution. However, when a risk control is quickly put in place there usually is not enough thought behind it.  Therefore it simply does not stick, especially when not monitored.

All of these characteristics make contractors great candidates for ERM. So let’s talk about the how ERM can actually overcome the challenges for implementing risk controls as stated above, namely: the abundance of construction risk, the time constraints upon management, the insufficient knowledge about ERM and unstable controls.

How ERM overcomes the challenges for implementation of risk controls

ERM establishes a culture. First and foremost, ERM establishes a new corporate philosophy, a change in thinking toward a risk-based mindset, not only amongst management, but amongst all in the company. If nothing else were to be accomplished, just this mind shift alone is of huge benefit. When people realize how the company’s ability to make a profit can be put at risk directly by their work, there is a behavioral change. Not only do they realize the impact of their work, but they also gain a feeling of just how valuable they are, how valuable their work is, and how their work can be part of the company’s success. Since it is well documented that bottom-line performance can be largely attributed to employee fulfillment, an ERM approach to running business certainly has its benefits.

ERM creates root level accountability. The ERM methodology enables management to deal effectively with problems, even though an abundance of risk may exist. The accountability for mitigating risk is spread to all levels in all departments and therefore the responsibility for implementing controls is not just up to time-strapped management, but up to everyone.

ERM relentlessly drives improvement. Persistence, that’s the word. ERM does not go to sleep after a risk control is put in place. It relentlessly monitors the controls put in place and persists to uncover new risks. Risk is forever changing and new risks arrive on the scene all the time. The ERM process fully incorporates a “risk-sensing” mindset by constant reassessment and monitoring to validate current controls as well as address new risks.

Takeaway

In short, ERM addresses an abundance of risk by following a systematic process that educates the workforce on elements of risk within their area of responsibility, empowers them to individually install risk controls which are then monitored within the process to make sure the controls remain fully in place, thus creating a “no surprises” management environment.  Without an ERM framework, the failure to recognize risks or to mitigate known risks can make it difficult to compete, financially weaken the company, and potentially jeopardize its future.

So there you have it. ERM is being adopted worldwide and it is a perfect fit for construction. It will just be a matter of time before you will be expected to run your business with a risk-based approach. In fact, the banks and sureties are already asking contractors, “who handles enterprise risk management for your company?” Do you want to be the company that lags behind in understanding and taking action on business risks, or do you want to be a survivor in today’s fiercely changing and competitive environment? As to the ultimate question: “Should I personally get engaged in a risk-based mindset and adoption of ERM,” I leave you with some final questions.

· What can happen to create value in your company?
· What can happen to destroy value in your company?
· What degree of confidence do you have in the outcomes?

Think about it. Many will conclude it’s wise not to be “stuck in the mud.”

The large amount of potential problems, combined with low industry margins,  is undoubtedly a major reason the construction industry has one of the highest failure rates (right up there with restaurants).   Unlike companies in most industries, though, contractors usually don’t fail because of poor products or service.

Why Contractors Fail

Sure there are some cases, but in general, contractors don’t fail because of poor construction.  Most contractors build a decent building.  After all, they have to follow rigid design specifications and plans and have to undergo inspections.  So if they don’t fail because of poor building practices, then why do contractors fail?

In simple terms, it is because of poor business practices.  Many construction companies are started by project managers without specific schooling in running a business.  They know how to run a job, but haven’t been taught to run a construction company. To compound matters, there isn’t really much formal education offered in running a construction company.  Frankly, there should be a college major for it.

Finding the Root Causes of Failure

Every company has a bunch of business practices, and if those business practices are properly in place, the company will maximize its ability to make a profit.  All those business practices (or things you need in place) are called risk factors.  That is the heart of Enterprise Risk Management…

Every process, practice, system, procedure, or activity that takes place in a company must be working perfectly to maximize profitability. Obviously, this sort of perfection is impossible, but it is (or should be) a goal for every company.

So, I started on a quest to uncover the root causes of business failure. I began by identifying all of the major contributing causes for loss based upon my years of experience and sought out publications and other professionals who could serve as resources for further adding to the list.

I knew that all causes of loss could be fixed by putting a business practice or control in place and that if those controls or practices weren’t in place, it could cause a business to fail.  Conversely, having all the necessary controls and practices in place would provide a business with the greatest ability to generate profits (to maximize profitability).

With a greater understanding of how controls impacted profitability, it became clear that the effectiveness of existing controls at a company had to be assessed to determine the degree the company was at risk of failure. This is, in fact, what the Enterprise Risk Management process does and what risk management was intended to be long ago.

Reactive Management

Just like financial advice is sought after a portfolio has shrunk or a financial dilemma has occurred, and business analysts are brought in after a company has lost money, I spent my early days as a consultant patching up systems or procedures in construction firms that were disheveled. In fact, a large amount of my time was spent on complete turn-arounds.

Proactive Management

Enterprise Risk Management identifies potential causes for loss well in advance so they can be addressed before harm occurs.  This is a large shift from the thinking of fixing problems once they occur.  That is the beauty of ERM.  It prevents problems by recognizing weaknesses while they can still be corrected.  That said, most contractors continue to unknowingly risk profits by failing to inspect systems and controls that could cause future problems.

I encourage any contractor interested in preventing problems rather than patching them to consider adopting an ERM process and the philosophy of enterprise-wide risk management.  It’s a sure way to strengthen business fundamentals and maximize potential profit.

Business functions across the gamut are tied to financial statement results: everything from hiring, equipment purchases, salaries/bonus, financial credit, to surety credit. For this reason, many of the risk factors in the category “Accounting Procedures” have high importance for contractors. We could easily make the case that financial statements have (or at least should have) the greatest influence on a company’s decision making.  

The Risk Victim
Conway Remodeling, Inc. (CRI) is a relatively young contractor who has been in business for six years. CRI has historically performed 80% residential and 20% commercial remodeling. Commercial projects are relatively small and almost never consist of more than two or three units of an office building.

During the most recent year, CRI took an opportunity to perform a large commercial project. Instead of the common two or three unit remodel, CRI was in charge of remodeling an entire five story office building. Since the commercial work was more sizable, management felt the carpentry work, which was typically subcontracted out, could be self-performed.  Using historical financial statements, management determined that the carpentry could be performed at a profit.

The Risk Impact
CRI’s management relied on their historical financial statements to make a decision, which is usually a good practice; decisions should be made by gathering the most information available.  However, just because a company has prepared financial statements does not guarantee that the information is accurate. The financial data could be of poor quality and relying on incorrect financial data is just as bad as guessing.

As is the case with many small contractors, CRI did not allocate some indirect costs to projects or to their labor burden rate.  Instead, the costs were kept as General and Administrative because they were not believed to be significant.  When management determined carpentry would be profitable, they used financial statements that didn’t properly allocate workers’ compensation premium to each project. Thus, they didn’t realize that the carpentry work would add significant costs and was not as lucrative as expected. If management had the correct labor burden rates and allocated costs correctly, they would have determined the margin was too small and continued to subcontract out carpentry.

The Lesson
As CRI’s workers’ compensation insurance policy came to a close, the insurance carrier came in for a final audit to determine the audit premium. Overall revenue had grown only slightly, so CRI expected the audit premium to be rather small. However, there was a fundamental change in the structure of CRI’s operations. Almost twice as much in wages was paid as a result of self-performing the carpentry work. Thus, workers’ compensation insurance was going to be twice as expensive and this would all be reflected on the final audit. CRI was shocked to learn that their audit premium for workers’ compensation was $30,000 and, as standard, was due in 30 days.

We mentioned that financial statements are the linchpin for decisions throughout the entire company. In addition to performing the carpentry work, CRI had made several other bad decisions based on the financial statements. Additional labor was hired, not enough cash was banked to cover the audit premium, slightly higher Christmas bonuses were paid to reflect what appeared to be a good year, and more commercial jobs were bid using the estimates from the last job.

In the above exhibit, CRI would have made a better decision if they used high quality financial data. By installing two controls, CRI could have had high quality financial statements:

1. Performing a monthly insurance audit: The monthly audit makes adjustments to the premium in order to reflect the year-to-date difference in estimated and actual wages. 
2. Use approprate labor burden rates: If CRI’s accounting system tied the indirect cost of workers compensation to wages paid, the calculations used to estimate profit margin would have signaled management to subcontract out the carpentry work. 

If both controls were in place, either would have sent off a red flag early in the project, or even before the project was bid. Unfortunately,  many contractors don’t install these controls until they are burned the first time.  

We can’t overstress the importance of controlling your “Accounting Procedure” risk factors. Our Free Construction Business Analysis reflects this same level of importance. Many contractors who perform a Business Analysis expect to score very high. However, they often receive lower than expected scores due to weak accounting procedures. Strengthening the business practices that control accounting procedures will have a large impact on decision making and help ensure that more earned revenue is sent directly to net profit.

This was a prime example of the perception surrounding the terms “risk management” and “risk manager,” and how they’ve been equated solely to insurance coverage and insurance professionals in the past.   I’ve witnessed this misrepresentation of the terms so many times that I felt not just inspired, but a public obligation, to write this article and help clear the confusion with the terminology that began long ago.

PASSING THE SMELL TEST

In the early 1960’s, two professors, Robert Mehr and Bob Hedges, developed the concept of Enterprise Risk Management. These two could easily be called the Godfathers of Risk Management. They published the first text to fully address the subject of business risk, “Risk Management in the Business Enterprise.”  The book introduced how risk management of an entire business could maximize efficiency, which would result in greater productivity. The basic premise was that all business risks should be managed, not simply those that could be “insured.”

Suffice it to say that over time, the term “risk management” began to take on a more limited meaning, referring just to insurable risks (for a slightly more elaborate outline see history of enterprise risk management). Now, some 45 years later, many large public firms are finally returning to the original roots of risk management. The Risk Managers of these firms manage the risk exposures of the entire business, not just those risks that are insurable. Mehr and Hedges would be very happy about this if they were here with us today. And, I might add, this helps put my mind at ease as well.

You see, having been heavily involved in construction for much of my lifetime and having witnessed many different construction business failures, it became evident to me that the causes for each failure all boiled down to risk. However, it never seemed to make sense that insurance brokers and agents called themselves risk managers, especially since they only provided a form of management that addressed insurable risk. It just never sat right with me. First of all, they really didn’t address anywhere close to all of the business risks that exist. Second, out of all the business failures I had witnessed, none were the result of having too little insurance or poor loss control procedures. When I finally came to understand how risk management evolved over the years it was somewhat of an awakening.

THE ENTERPRISE RISK MANAGEMENT PROCESS

Robert Mehr and Bob Hedges came up with the steps for the risk management process, and the basic form is still in practice to this day:

• Risk Identification (Identify all the risk factors; all the possible causes for loss in a typical company)
• Risk Analysis (Analyze the risk; assess and measure the potential for loss in the company to be examined)
• Risk Response (Determine what to do; either assume, transfer or reduce the risk)
• Risk Control (Implement internal controls to reduce or transfer the risk)
• Risk Monitoring (Select a method for monitoring results and put it in practice)

As originally intended, risk management would encompass management of the entire business enterprise; hence, the field became known as Enterprise Risk Management (ERM for short). ERM requires examination of all risks that an organization faces and applies directly to four distinct types of risk: Operational Risk, Financial Risk, Strategic Risk, and Hazard Risk.

For the most part, only hazard risks are insurable.  Thus, insurance brokers should have called themselves hazard risk managers instead of just “risk managers”.  Now, with the reemergence of ERM, traditional insurance-based “risk managers” are being pushed into a wider arena of risk management, one that incorporates all other areas of business risk, many new forms of risk analysis, and a wider array of risk control mechanisms.

The primary challenge of expanding risk management across the enterprise is that, because it involves so many different aspects of an organization’s operations, traditional insurance-based risk managers (who focus only on hazard risk) are simply not qualified as enterprise risk managers. They simply don’t have the experience or expertise necessary to have a firm grasp of all aspects of a business, and there are already signs they are losing their hold on the “risk manager” title. In fact, the fastest growing position in the business world today is that of Chief Risk Officer (CRO). As ERM continues to filter down from public companies to smaller and smaller private companies, you can expect a CRO type individual to become part of every management team. After all, the adoption rate of the ERM process has already reached 40% in public firms.

In order for risk managers to evolve from insurance minded professionals to ones who understand the risks of an entire business enterprise, they will have to learn the language and the approach of each business area, either alone or as a team. If they are to act as a team, the team leader will need to have a basic understanding of all the steps involved in the entire process of risk management and the methodology used in each business area. Clearly, traditional risk managers will need to obtain additional skills to be involved with enterprise risk management.

TYPES OF RISK MANAGERS

There is no doubt Enterprise Risk Management is making its way from large public firms to firms in the private arena. It is being dictated by credit providers of large public firms as a result of Sarbanes-Oxley and, given the current credit environment, may soon be expected of private firms too. It may not be long until ERM becomes an expected and necessary way for all companies to operate.

Since risk management has expanded to cover risk across the entire enterprise, one of the largest challenges has been finding individuals capable of understanding and managing such risk. Since insurance agents or brokers who only provide insurance advice to their clients do not fit the bill, corporate decision makers only have a couple options:

1. Salaried employees who can learn to manage a wider scope of risk for their company than traditional risk managers (often chief financial officers or treasurers); and
2. Independent consultants who provide comprehensive Enterprise Risk Management services.

Individuals who perform at this level are called CRO’s. They are in very high demand today and typically are drawing salaries even higher than the CFO. As time progresses, I expect that there will be a lot of CRO’s working on a consultancy basis since smaller firms won’t be able to find, much less afford individuals qualified to identify, assess, and control all of the risks in a business enterprise. Obviously, such individuals must be very specialized in a particular industry to serve their clients well.

To choose the best type of risk manager for their companies, corporate decision makers must now consider the potential increase in profits that the adoption of the Enterprise Risk Management process can bring. For those early adopters, employing an experienced professional in Enterprise Risk Management is the key to real benefit. If that person is a consultant, he can be used as the de facto enterprise risk manager who can be relied upon to retrain traditional risk managers already on staff so they can gain the full knowledge of how to control risk across the enterprise. As time will tell, the true risk manager will not be the traditional insurance professional who addresses Hazard risk, but will be the individual who can address Operational, Financial, and Strategic risk as well. That is how risk management is evolving and what is expected of a risk manager in many companies today.

Thus, will the real risk manager, please stand up!

By:  David F. Druml, ERM Specialist a My Risk Control, LLC

Excerpts from “Journal of Risk Management of Korea Volume 12, Number 1” D’Arcy, Stephen P., Professor of Finance, University of Illinois at Urbana-Champaign, May 30, 2001

This weeks Case ‘n Point looks at the question on all our minds, “Is risk management doing its job?” Our real-world example isn’t based on just one story. We’ve encountered this scenario so many times that we’ve provided the quintessential example. As always, the names have been changed to protect the innocent parties.

The certificate of insurance description box must read: “Jake’s General Contracting is named as general liability additional insured.”

Top of page 1

THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS CERTIFICATE DOES NOT AMEND, EXTEND OR ALTER THE COVERAGE AFFORDED BY THE POLICIES BELOW.

Top of page 2

If the certificate holder is an ADDITIONAL INSURED,  the policy(ies) must be endorsed. A statement on this certificate does not confer rights to the certificate holder in lieu of such endorsement(s).

The Risk Victim
Xcavator Inc has been in operation for just under a decade. Its strong reputation places it on top of local GCs’ calling lists when excavation and grading work is needed. Unfortunately, management is a bit closed-minded to installing risk control procedures.  Xcavator Inc has been lucky during its last few years of growth and has grown a little cavalier, mostly due to effects of the success paradox. But all games of Russian Roulette must come to an end.

The Risk Impact
While grading for a public works project, Xcavator Inc hired a third-party to off haul dirt from the construction site. The expense for off hauling dirt wasn’t part of the original contract, but Xcavator received a verbal change order from the public agency’s construction manager to incur the extra cost.

The bill for off hauling came to $20,000 and Xcavator Inc added the additional expense to its next invoice. But the public angency rejected the extra cost, stating that it hadn’t approved the change order. Xcavator Inc tried to produce a valid change request, but since the order was verbal, none could be produced. And to compound matters, the construction manager who had given that verbal order was no longer with the agency.

The Lesson
Faced to absorb the $20,000 expense, Xcavator Inc management set out to lay blame. Ultimately, the superintendent had blame for ordering the hauling company to begin work. With proper controls, there should have been at least two responsible parties: the superintendent making a request and the project manager approving the request.  Lack of a written change request should have been a red flag for one or the other responsible parties. This weakness would have been uncovered by the MyRiskControl system during a review of the Contract Non-compliance risk factor.

This story helps illustrate how Enterprise Risk Management shadows its own success. Xcavator Inc learned a hard lesson. Whether it begins to get serious about installing risk controls has yet to be seen. But even if it does, the reward for installing controls after a disaster is greatly reduced. However, if the controls were in place from day 1, we would never know the value Enterprise Risk Management can have.

With respect to business, a risk factor is defined as an activity, practice or condition that can cause financial harm. Risk factors vary by industry.  For example, smoking is a risk factor in the medical world, specifically related to the health of an individual. It does not apply to a construction business. Likewise, failing to have a job cost system in place is a risk factor related to a construction business, but certainly is not a risk to an individual. Risk factors are also different across businesses. A risk factor related to overstocking perishables in a restaurant due to poor inventory control does not apply to construction. Poor humidity control is a risk factor in a flower shop but not in a restaurant.

As you can imagine, there are many different types of risk factors and for the most part they are specific to an industry.  Some risk factors are really important because the harm they can cause is great.  Other risk factors are of lesser importance because the harm they can cause is not so great, thus having a smaller impact. To actually determine the impact a risk factor can have (its importance), takes years of case study. But suffice it to say, importance varies.

What also varies is a contractor’s perception of the importance of various risk factors. Interestingly, the risk factors that a contractor usually thinks are important are the ones which it has experienced. While those the contractor thinks are unimportant are the ones it has yet to experience, and some of those can actually be very important.

Focus on Expertise

Now a case in point:

The particular contractor I mentioned at the beginning of this article was a General Contractor (the word “was” is telling). One of the risk factors he determined was of no consequence is taking on new types of work without prior experience. Another was estimating without historical data. In the months to come, this contractor decided that it could make more money by doing the rough carpentry work (framing) of buildings by itself rather than using subcontractors.

In California, there are separate companies that do framing and that is all they do. It is very competitive and the cost is simply driven on how fast carpenters can put lumber in place. This GC proceeded to bid three large school projects. Now it had done schools before, but never the framing. I personally advised against the approach indicating that the estimating staff did not have experience bidding framing work, that the estimating staff did not have any historical information on hand to rely upon, that the personnel were not in place to do the framing, and that the company had no prior experience doing the work. Well, this particular contractor looked at themselves as a risk taker. Indeed they were. The net result was as follows:

1. The contractor couldn’t man the jobs with experienced tradesmen.
2. The tradesmen they did hire ended up quitting because the quality of the work was so awful.
3. The agency made them do the work over because it was so shabby.
4. The union ended up picketing the sites because the GC was taking on framing work as a non-union contractor
5. The estimating department did not anticipate the rising cost of lumber because they were not connected into the framing world and did not know that dramatic increases were coming; thus they paid much more for lumber than budgeted
6. The estimated amount of labor hours was insufficient.
7. On one of the three jobs they had to ask another framer to step in to do the work because they could not put together the resources; the framer charged much more than what the GC had in its original bid.
8. All of the jobs were severely delayed resulting in liquidated damages and preventing one of the schools from opening on time for the fall classes enraging parents against the Agency.
9. The contractors money was held by each Agency for damages.
10. The contractor could not meet financial obligations.
11. The General Contractor finished the jobs, then dissolved and did not pay the subs and suppliers and did not have financial resources to go back to do punch list items or repairs.
12. The bonding company stepped in to pay subs and suppliers left hanging and to complete punch list and repair work.
13. The contractor went out of business. Game over.

This particular GC was in business for over seven years and had been quite successful. However,  GCs work on very tight margins. The contractor could ill afford to lose large money on the framing, but they did, and it cost them their business. That was all based upon risk factors that the contractor did not consider of importance.

Contract Review

Let’s look at another case in point:

A contractor performed steady work in a niche market and historically made good money, however it didn’t have a contract review procedure in place. In fact, this contractor had signed a contract without having reviewed it completely and was unaware of the insurance requirements. One of the requirements was for $5MM of pollution coverage, but the contractor only had $1MM in place. The contract was for repair of 450 balconies on a 40-story apartment complex. It had done this type of work on large structures before, but never for a building that did not have air conditioning.

During the summer months it became unusually hot while work was underway and many of the 450 residents had to keep their windows open because of the stifling heat, even while the contractor was chipping and grinding out the old concrete that needed repair. Concrete dust invariably drifted into some of the apartments. Simultaneously, the owner had given notice of eviction to a lawyer. To get back at the owner, he banded a bunch of the residents of the apartments together convincing them of great rewards, and proceeded to file a lawsuit against the owner for allowing cancer causing silica dust to harm the health of all of the residents. Since a lot of the residents were old, having little funds, and had little to do with their time, they had nothing to do but listen to an evicted attorney. Once the thought of cancer causing dust was put in their minds, even the invisible bothered them.

During that time, one of the residents who had chronic respiratory problems was hospitalized even though work was not being performed at the time near her apartment. This just fueled the claim that all the residents were being exposed to a major health hazard, even though open windows were being covered with a filter cloth. Unfortunately, the court approved the suit as a class action with all 450 residents represented. The owner in turn tendered the suit to the contractor only to find out that the contractor did not have $5MM of pollution coverage in place as called for in the contract. The contractor had no choice but to reject the tender and the owner began to pick up the attorney’s fees to defend itself.

Well, since the owner’s counsel was sure that they would ultimately recover the attorney’s fees from the insurance carrier, they showed up at every meeting and at every appearance with a fleet of staff attorneys, no less than four each time. The attorney’s fees for the owner went through the roof. Since the owner did not know if its own insurance carrier would even cover the fees or whether the contractor’s insurance carrier would eventually be forced to do so, the owner began to withhold large sums of money from the contractor’s payments. As a result, the contractor’s cash flow was severely impacted. The attorney’s fees grew to over five hundred thousand dollars and it surely looked as if the $1MM coverage limit would be exceeded. With little other options, the Contractor began making plans for a new company.

During this time, another risk factor came into play, one that contractors often pay little attention to, namely, computer backup. The contractor had a backup system in place for its server, but it wasn’t being checked. Well, the server went down. No problem, call the computer guy it fixed., right? Well, it wasn’t that simple, the hard drive had crashed. No problem, get another drive up and running and use the backup to restore it. Big problem, there wasn’t a procedure in place to check that backups were running properly and a backup had not run properly for almost a year.

The computer consultant tried to retrieve the data to no avail. Now the contractor has several problems going: (1) not getting paid on its largest job making the contractor go deep into its line like it never had before thus causing the bank to become so concerned as to request current financials, (2) unwillingness to bid additional bonded work because the owner did not want to be personally liable for bonded jobs if the company was to fail, (3) inability to provide work-in-progress reports or financial information to the bank or surety therein casting doubt (4) making the staff turn over to a completely manual process having lost all of its historical data and unable to resurrect current financial information, (5) and countless sleepless nights. Could it get worse? No, it got better.

After a month of down time Intel was able to recover the data, the contractor was able to produce financials, the accounting staff was able to get caught up, the class action lawsuit was dismissed after the owner’s attorneys had built up close to $750K of fees, the contractor’s carrier picked up the tab only causing the contractor to lose the $25K deductible, and the contractor did not have to start a new company, nor go broke. But what did it cost him?

Well, historically, this contractor made $250K in profit year after year. At the close of the fiscal year containing all of the problems, the company recorded only $24K in profit and opted to make up for the business lost during all of the distractions by taking on a big job in a different type of work. The jury is still out.

Moral of the Story

So, the contractor experienced the simultaneous consequence of uncontrolled risk related to two risk factors, one important one: review of contracts, and one not so important: computer backup. You can see how the consequence of two risks working together can cause havoc. Not being able to produce financials when both the bank and bonding company want to see them during tenuous times could have turned disastrous. But that is how risk works. The overall consequence of risk in a business is rarely the result of one uncontrolled risk, but instead, normally multiple uncontrolled risks working together. Sometimes the overall consequence may be caused by risk related to just a couple important risk factors, or maybe a lot of not so important risk factors, or maybe a mix of important and not so important risk factors. Any combination is possible and any combination can be a knock out punch. The graph below explains how.

We’ve established how risk factors vary in importance, and we’ve established that the overall consequence of risk in a business is almost always the result of the risk associated with multiple risk factors. We’ve established how contractors rarely recognize the ones that can and will hurt them, and we’ve established that even though a risk factor may seem of little importance it will usually work in conjunction with others to cause an overall consequence. In other words, we’ve established that even though a risk factor might only cause a small amount of financial harm when uncontrolled, all such risk factors do matter.

So the real question becomes: How do we lower the potential consequence of risk related to a multitude of risk factors in order to prevent loss or potential failure? The Answer: Adopt an Enterprise Risk Management (ERM) method of running your business. The ERM process identifies risks factors that might otherwise be unknown, establishes a way to assess the level of risk with respect to each risk factor, and determines what kind of controls need to be put in place to minimize risk and the potential consequences.

For a thorough understanding of ERM visit the about risk section of MyRiskControl’s home page. Take the available tours to learn how MyRiskControl helps a contractor implement practices, systems or procedures to control risk and then monitor risk on an ongoing basis. There is no question that implementing ERM in your company requires a change in philosophy, a change in thinking, and a call to action. But with ERM, you don’t have to do all the work yourself, it gets spread to the staff, and MyRiskControl makes that easy. It is the only total enterprise-wide solution to identify, assess, analyze, control and monitor construction risk. And remember, just because you choose to ignore risk, risk won’t ignore you.

At the end of the day, business is about achieving profitability, which is defined as the ability of an enterprise to generate revenues in excess of the costs incurred to produce those revenues and is often measured by a rate of profit or rate of return on investment. Credit underwriters also seek to achieve profitability, and that means avoiding large, unforeseen losses. To maximize profitability, underwriters need to find the optimal balance between premiums charged and risk present.

Unfortunately, as discussed in The Risky Game of Credit Underwriting, underwriters are often working with insufficient, inadequate, or obsolete data so measuring the “risk present” becomes quite a tall order, and many times involves outright guessing. They have no way of knowing where the applicant lies in the ERM – Business Success Matrix. Fortunately, with the advent of a standardized mean to collect and analyze qualitative data, most of these underwriting deficiencies can be overcome. In this post, we’ll discuss how qualitative and quantitative data fit together to form a complete picture of an applicant during the credit underwriting process.

One of the most important components of the Enterprise Risk Management is risk assessment. Without that step, there is no process. However, the assessment of risk focuses principally on qualitative data, an observation that involves subjectivity by the very nature of the measurement. Is it possible that ERM, the process for managing risk, could be used to determine the likelihood of a company’s success or failure based solely upon qualitative data? The answer is no.

In the world of ERM, there is often talk about business failure and determining its likelihood by measuring risk based upon qualitative data. In fact, the term failure risk is often referred to in discussions about the ERM process. The truth is that the study of risk data alone cannot determine the likelihood of failure without due consideration of financial data. In other words, without regard for the results provided by financial statements.

You see, failure may seem all but guaranteed by terrible business systems and controls, which both indicate a high presence of enterprise risk. However, if the company being analyzed has billions of free cash in the bank and routinely makes huge profits, is there a high likelihood of failure? Unless that company is also extremely leveraged, such as was the case with Bear Stearns, the answer is certainly no. Therefore, qualitative data alone cannot determine the likelihood of business failure, which should clear up the incorrect application of the term failure risk. Just as Yin and Yang must coexist by definition, qualitative data must be joined with financial data to make the whole, to complete the risk picture; risk data and financial data are both required to determine the likelihood of business failure.

That being the case, how do we classify the qualitative risk data derived in the ERM process? What is it standing alone? As stated, it is not a determinant of success or failure in itself. However, since every system and process that is not in place, or poorly in place, will harm profitability, qualitative risk data is clearly a determinant of the likelihood of achieving the best results possible. And in the business world that is the likelihood of achieving Maximum Profitability, or the highest level of profitability achievable by an enterprise under ideal conditions. In essence, the qualitative risk data derived in the ERM process determines overall Profitability Risk, that is, the likelihood that an enterprise will not achieve its Maximum Profitability.

Risk by definition is the possibility of suffering loss or harm. In the business world, harm is not a black and white issue, which is suggested by the terms business failure or failure risk. Rather, harm is a spectral issue with a lot of gray area, which is why speaking of a decrease in profitability or profitability risk is more appropriate. Therefore when we talk about the ERM process and focus purely on examining qualitative data, we should be talking about profitability risk of a company, not failure risk. And knowledge about where a company stands in relation to its ability to make a profit is a very valuable piece of underwriting information. Combined with quantitative data, it gives an underwriter a firm grasp on a prospects total potential for business failure or failure risk. The following chart shows the basic relationship between the two:

This relationship between quantitative financial results and qualitative risk data holds true for every industry, however the exact line between profitability risk and financial results will vary.  The bottom line is that both types of data work harmoniously to define the risk of business failure and provide much needed insight into the inner-workings of enterprises.  Those who seek to consider both types of data when making decisions to grant credit or guarantees will be considering the whole of risk.  Like the concept of Yin and Yang, qualitative and quantitative data complement each other and will protect creditors and guarantors if used regularly!  For more information on how qualitative risk information is being standardized, we encourage you to read about the Certified Professional Assessor of Enterprise Risk.

1. A company has proper risk controls in place and is successful/profitable
2. A company does not have proper risk controls in place and is successful/profitable
3. A company has proper risk controls in place and is unsuccessful/unprofitable
4. A company does not have proper risk controls in place and is unsuccessful/unprofitable

The Success Paradox

The term “Success Paradox” has been used to refer, among other things, to individuals that are economically successful not being as happy as those less economically well-off, to the increased vulnerability of developed countries to diseases such as measles, and to the concept that an enterprise, such as a poverty NGO, can put itself out of business if it is successful.

All these references are useful, but our use of the term is specifically in reference to situations where a risk is present and successful mitigation of that risk, in hindsight, reduces the risk’s perceived importance. One great example is the Y2K problem. Since there were no major catastrophes related to Y2K, there is a tendency for people to assume it was not really a problem in the first place! However, the fact that no catastrophes occurred might also be attributable to the excellent risk mitigation efforts of thousands of companies and individuals working diligently to fix the exposure.  In essence, effective ERM can cause a business to run very smoothly, which actually lessens the perceived value of the ERM implementation.

The Four Quadrants

In the first quadrant, effective ERM leads to enterprise success.  This quadrant describes a company that is maximizing long-term profitability.  If management understands the role that effective risk controls played in the success, they will appreciate its importance.  However, it is often the case that the perceived importance of the risk controls will be diminished, just as Y2K controls were downplayed after a relatively uneventful Jan 1, 2000.  This is the Success Paradox.

The second quadrant, however, is slightly different in that it deals with chance/luck. It is analogous to Russian Roulette.  In this situation, a Russian Roulette play might assume there is no danger to the game because no damage occurred from his “turn”. In a sense, he is still successful/profitable, but that does not mean his actions were risk free, or that he made the right decision to play. He just got lucky, which is the operative word; he could very well have died.

The third quadrant, is one we rarely encounter.  With effective risk controls in place, companies rarely are unsuccessful.  They may go out of business, but this is usually due to, among other reasons, wanting to exit the industry or simply shutting down due to retirement.

The fourth quadrant is one in which poor risk management controls and operations lead to business failure.

Prevalence

Because effective risk controls do not exist in most businesses, quadrants one and three are the most rare.  Companies in quadrant one are usually at the top of their industry.  They have spent a good deal of time implementing effective risk controls and have excellent long-term strength and security to show for it.  They rarely experience business failure, more commonly just closing up shop in an orderly business when they decide to exit a business.

The second quadrant is the most prevalent in the business world, and especially in the construction industry.  Most companies skate by with ineffective risk controls in place; they may stay in business but do not maximize long-term profitability and remain susceptible to numerous risk exposures.  Unfortunately, many of them are not so lucky and find themselves in the fourth quadrant.  That is why tens of thousands of contractors go out of business each year; poor risk controls leading to undue exposure to risk.  Millions more simply get “lucky” and remain to battle the risk gods another year.

Our goal with MyRiskControl.com is to make quadrant one the most prevalent in the construction industry.  How do we do that?  By making ERM simple, affordable, accessible and easily manageable.  In essence, by bringing ERM to the masses and an extremely cost effective manner.  Speaking of costs, we’re often asked what the typical ROI is for implementing an ERM program.  Unfortunately, this isn’t an easy question so it will be the subject of a future post.

Myth Number 7: You Can Manage Risk Only from the Center

No one is likely to argue that strong, central risk management is a bad thing. Unfortunately, many organizations make the mistake of investing only in a centralized function because it’s too difficult to federate, and they don’t know how to push risk management to lower levels of responsibility in the organization. It’s a classic issue of consistency vs. quality of information.

But, accurate information lies at the business line level. Organizations must augment their centralized risk management efforts with localized, distributed data, and the only way to reliably and cost-effectively do that is to invest in automated technology solutions.

Along this line of thinking, he continues:

ERM needs to be deployed bottom-up so that business managers are the first-line managers of risk, embedding enterprise risk management within the day-to-day business processes of the firm. They must understand the risk/reward trade-offs involved in their own decision-making. Risk management should create a bias for action, surfacing problems as they arise and empowering the entire organization to be risk managers.

This is one of the most important aspects of a well thought out Enterprise Risk Management system.  There must be management and employee buy-in at all levels; otherwise ERM implementations tend to suffer from the same pitfalls that plague most change management:

Unclear rationale for change

Lack of understanding of the urgency of change

Inadequate employee mobilization and engagement

Complacency (resistance to change because of prior success)

Too many initiatives at one time, overloading change management capacity

Mixed messages from top and middle management

Short-term thinking and lack of follow-through, especially in long-term initiatives

Without proper buy-in, and the creation of a true risk management culture within an organization, the change for ERM success falls significantly.  There are simply too many risk factors for a centralized risk manager to deal with.

Myth Number 3: It Just Takes Common Sense

“There are really no cookbook solutions. One has to use creativity and a lot of common sense.” This was a May 16, 2000 email response from Enron Corp. risk expert Vince Kaminski, when asked by a colleague to recommend a good book on operational risk.

As Enron proved, creativity is a no-no and common sense alone just doesn’t suffice when it comes to risk management. As business activities have become more complex, so has risk management. The sheer magnitude of the regulations leaves many firms struggling to put in place processes and infrastructure Relevant Products/Services that are able to identify and control the compliance risks they face.

Risk management covers a wide variety of risk disciplines, including operational, compliance, financial controls, legal, liquidity, business strategy and technology, each of which has its own nuances and specialized models for assessing risk. It may not be rocket science, but it does require application of sophisticated models and analytics, aided with accompanying software tools.

While many of the steps taken in the ERM process seem like common sense, the process as a whole should not be approached in a “common sense” fashion.   Common sense would say to focus first on the fires that need to be put out right now.  Otherwise you might not even have a business tomorrow!  Unfortunately, oftentimes, there’s only enough time in the day for dealing with “fire drills” and when you’re done, you’re too exhausted to do the little things that fall under the category of “sharpening the axe”.

When running a business, it’s easy to forget about all the details of all the various disciplines required to prevent business failure and promote a strong, secure company.  When we talk to companies about certain risk factors, we often hear the same response:

“I never thought about that (or I never realized that could cause harm to my business)”

That’s why an ERM framework is so important.  Used properly, it ensures that adequate policies and procedures are in place to prevent against all the risks you “never thought about” or the ones you did think about but never had time to address.