The notion that by outsourcing or contracting you have transferred your risk to another party is a myth. Senior executives, both in government and private enterprise, say, “There is no need to worry about that risk – I have transferred that to the contractor.” This is simply untrue. If you own the consequences (or at least part of them), then you own the risk. For example; In the TV series "Air Crash Investigation," there is an episode titled “Dead Weight.” In this episode, maintenance staff working for a company that is sub-contracted to conduct maintenance on behalf of Air Midwest’s primary maintenance contractor skip nine of 25 steps detailed in the maintenance manual when adjusting the tension on the elevator control cable. As a result, the cable is unable to traverse through its full range of motion. When Air Midwest flight 5481 took off overweight, the center of gravity shifted rearward when the landing gear was raised, which pitched the nose higher. Because of the issues with the elevator control cable, the pilots were unable to bring the nose down. The aircraft stalled and crashed into a hangar on the ground, killing all passengers and crew on board. The issue arose because there was no contract oversight/assurance by either Air Midwest or the primary contractor. A contract is a control -- but a control is only as good as the measurement of its effectiveness. Organizations that outsource simply cannot afford to assume that, because there is a contract in place:

• They have outsourced the risk to the contractor
• The contractor’s performance will be as contracted and as reported.

This last point may seem a cynical one, but you need to accept that the primary driver for a contractor is to maximize profit. If shortcuts can be taken, they are likely to be pursued. What is even more important for organizations to understand is that, if the function that is contracted is a compliance requirement, and if there is a compliance breach, it is the organization -- not the contractor -- that will be held to account. So, what are the keys to reducing the outsourcing risks? Firstly, the organization needs to ensure that, before developing the solicitation documentation for an outsourced function, the risks during the contracted period are identified and assessed and treatments (such as oversight and performance measurement) are fully built into the contract. It is absolutely critical that compliance risks with the highest-level consequences are included in this list. Secondly, the organization needs to ensure that contract performance is actively monitored and measured (i.e. do not simply accept contractor’s performance reports as fact). In essence, organizations need to remember that, although you can outsource responsibility for the management of functions, you cannot outsource accountability for the consequences of not managing risk. In simple terms, if the contractor fails, the organization fails. If an organization owns the consequence, it owns the risk. If your organization is one where contact management and contract assurance are not front of mind, or yours is one where the assumption is that the risk has been transferred to the contractor, you are in a dangerous position.

If you’re like any successful business I know, to create sustainable growth and be competitive in your marketplace you must continue to control your operating costs. Among other things, you must limit the number and cost of workers' compensation claims and lawsuits. You’re reading the right article if:

• You’re frustrated with how claims and lawsuits, especially fraudulent ones, are killing your profitability, and you feel powerless to control them.
• You know losses are an unfortunate part of business. and you tried to reduce them, but with little or marginal success.
• You’re so ready to eliminate claims in a predictable way, and you want a system that gets consistent results.

In this article, you’re going to learn:

• The five costly mistakes leaders make that kill profitability.
• Why you need to implement systems and get your team on board to reduce risk and increase profitability.
• How you can gain peace of mind by knowing what your blind spots are that are costing you money.

The Five Costly Mistakes Not knowing your numbers: Tom Peters coined the phrase, “What gets measured gets done.” I find many businesses do not have a handle on the analytics of their claims. More important than just knowing your number of claims is having data on hand that will let you skillfully mitigate the risks that are causing your claims. In other words, do you see trends in the types of claims you are having? Without good analytics, it’s difficult to create a targeted plan to reduce your risks. If you’re not familiar with your numbers, we would suggest you commit to finding out what your numbers are, and the story behind those numbers. Not knowing the real cost of claims: When coaching clients across the country, I’m amazed to learn that many business leaders do not fully understand the financial impact that claims have on their bottom line and top line.  OSHA suggests that the indirect cost of claims can range anywhere from a multiple of 1.1 to 4.5 added to the direct cost of a claim itself. A claim totaling $67,000 multiplied by an indirect loss cost factor of just 1.1 suggests that the indirect loss costs would total $73,700. Adding those two numbers together, the company has sustained total loss costs of $140,700. If you are a company sporting a 9% net profit margin, you’d have to sell $1.6 million in products and services just to break even to pay for that claim. Not knowing your operational blindspots: In the best-selling Execution, authors Larry Bossidy and Ram Charan wrote, “Too many leaders today fool themselves into thinking their businesses are well run”. We’ve all heard the saying, “Sometimes you don’t know what you don’t know.” It’s critically important that companies seek out operational best practices to lower their chances of having claims and lawsuits. That has presented a challenge to many businesses because there are so many independent silos within the insurance industry. Between claims adjusters, loss control representatives, underwriters, medical providers, etc., most businesses feel that these groups of people rarely collaborate to create a holistic best practices platform. When given the opportunity, company leaders want to do the right thing and play by the right rules, but they don’t know what the right rules are. When companies begin deploying industry-endorsed policies and procedures (possibly through products such as my firm's RiskScore), they predictably see reductions in their number and cost of claims. These procedures start with a view of a company’s hiring practices and what policies and procedures they have before and after a claim occurs. Not having systems in place: Dr. George Weathersby is known for his thoughts on systems. He says, “Ordinary people achieve extraordinary results consistently using the system. Extraordinary people (the really smart people), without a system, won’t produce consistent results.” This reality holds true in the insurance world. In my consulting practice, we advise clients to deploy systems that involve multiple layers of management. In football terms, we say “the left tackle and the right tackle, along with the rest of the team, need to know where to go when the play starts.” When you’ve got your team assembled on the field, and everyone is coached on what their responsibilities are in the risk mitigation process, you will see dramatic reduction in your number and cost of claims. It’s important to locate systems (such as our Diamond Risk Reduction System) that can map out checklists and procedures, along with training and claims management tools to streamline this process. Not Taking Action: Take a deep breath, and don’t be overwhelmed by the size and scope of this important topic. A journey of 1,000 miles starts with one step. All you need to know is that there are systems out there that can help you in creating better results.

The 4th District Court of Appeal has ruled on the “retroactive” application of the independent bill review (IBR) provisions of California's SB 863 and whether the legislature intended to remove from the Workers' Compensation Appeals Board (W.C.A.B.) the jurisdiction to address bill disputes that existed before the law took effect. (Jan. 1, 2013).  In California Insurance Guarantee Association (C.I.G.A.) v W.C.A.B. (Elite Surgical Centers), the court ruled that the legislature did not wrap up pre-existing medical billing disputes into the new IBR process and that the W.C.A.B. continues to have jurisdiction to resolve those disputes. The court also found that the process used by workers' compensation judges (WCJ) and adopted by the W.C.A.B. to determine the appropriate fee in these disputed cases constituted the necessary substantial evidence. The issue in the case involved fees for outpatient surgical center fees for more than 300 cases for treatment provided before Jan. 1, 2004. (The cutoff date is significant as ambulatory surgery centers (ASC) became subject to the official medical fee schedule (OFMS) after that date. Before that date, only hospital-based surgery centers were subject to the OFMS.) Evidence was presented that Elite had increased its rates in November 2000. C.I.G.A. (along with seven other defendants) contested the amount billed and paid the undisputed portion of the bill. The remainder was left for resolution at the W.C.A.B.  At the time this matter came to trial, the W.C.A.B. had consolidated 333 liens, involving different procedures, into a single litigated case. The case was litigated for 17 days. Elite provided its evidence showing the services provided and its customary fees accepted for similar procedures. Defendants presented contrary evidence, to portray the Elite charges as grossly disproportionate to those of other local providers. Defendants also argued that the ASC OFMS that went into effect on Jan. 1, 2004, was the most reasonable and objective method for determining a fee for Elite’s services. Before a decision was issued, the legislature passed SB 863, which became effective on Jan. 1, 2013. On Feb 1, 2013, the WCJ issued his decision awarding specific amounts for each of the different types of services at issue. The amount awarded was not based strictly on the evidence presented by one side or the other but represented a figure midway between the ASC OFMS that became effective on Jan. 1, 2004, and the OFMS for hospital-based surgery centers that was in effect beforehand. The awarded fees were between 22% and 45% (depending on the procedure) of what Elite had presented as its reasonable charges. Defendants appealed from the WCJ’s order, arguing that SB 863 removed the W.C.A.B. jurisdiction to resolve billing disputes and instead required the use of the newly enacted IBR process to resolve the disputed bills. Defendants also argued that the WCJ’s decision was not based on substantial evidence. After initially granting reconsideration, the W.C.A.B. affirmed the WCJ’s decision. Defendants’ petition for writ of review was granted, and the appellate court upheld the W.C.A.B.’s jurisdiction to decide the disputed issues. The court also found that the WCJ’s analysis was based on substantial evidence. In considering the potential application of IBR to the disputes existing as of the time SB 863 became effective, the court took note of section 84 of the statute, which required: "This act shall apply to all pending matters, regardless of date of injury, unless otherwise specified in this act, but shall not be a basis to rescind, alter, amend or reopen any final award of workers' compensation benefits." Defendants’ argued, unsuccessfully, that because there was not another provision dictating when the IBR provisions were to become effective, the provisions applied to all pending matters. The court agreed that at first blush the section appeared to mandate application of IBR to pending matters. The court, however, did not stop at that analysis, noting that a review of the entire framework of the IBR procedure indicated the matter was more complex. The court pointed out the impracticality of applying the new provisions to existing cases because of how the statutory process was set up: “After considering SB 863 as a whole, we conclude that this legislation is ambiguous with respect to whether the IBR process was intended to apply to pending billing disputes, or, rather, was intended to apply only prospectively, to new billing disputes that arise with respect to injuries that occur after the effective date of the legislation. Attempting to apply section 84 of SB 863 in this case would leave these parties without a process by which to have their dispute resolved by a third party, since the new IBR process may be utilized only if certain conditions precedent have been met, and the deadlines for meeting those conditions have passed. Leaving these parties without a viable process to decide their dispute cannot be what the legislature intended. We conclude that in creating the IBR process, the legislature intended to establish a new dispute resolution procedure that would apply to disputes arising on or after the effective date of the legislation, and not to disputes like this one that were pending at the time the legislation went into effect.... "Although this provision does not expressly state that the legislature intended that the IBR and IMR processes go into effect only prospectively, it provides an indication that the legislature viewed both the IMR and IBR processes as applying to future employment-related injuries and to future disputes as to medical care and billing for such care.” Defendants argued that the lack of process for disputes on billing before Jan. 1, 2013, could be addressed by administrative regulation. The court pointed out the administrative director (AD) had already created regulations and that no such process existed. Acknowledging the ambiguity of the statutory language and the practical problems in applying the statutory process where the events precedent to IBR have already passed, the court ruled: “In the face of such ambiguity, we are led to interpret the statute as operating prospectively.  … [statutes ordinarily are interpreted as operating prospectively in the absence of a clear indication of a contrary legislative intent]; see also Myers v. Philip Morris (2002) 28 Cal.4th 828, 841 [when a statute is ambiguous regarding retroactivity, it is construed to be prospective in application]. In construing statutes, there is a presumption against retroactive application unless the legislature plainly has directed otherwise by means of " 'express language of retroactivity or . . . other sources [that] provide a clear and unavoidable implication that the legislature intended retroactive application.' " (McClung v. Employment Development Dept. (2004) 34 Cal.4th 467, 475 (McClung).) Although, at first blush, SB 863 section 84 might appear to constitute " 'express language of retroactivity' " …, it specifically allows for other portions of the statute to provide a different rule regarding retroactive/prospective application, and at least one other provision of the statute, Labor Code section 139.5, suggests that the IBR process was intended to apply only to disputes over medical treatment provided for injuries that occur on or after Jan. 1, 2013.... "Considering these obstacles to applying the new billing review process to pending claims, it is clear that the legislature could not have intended to leave parties who had pending billing disputes on the effective date of the new statutory scheme with no meaningful procedure for resolving their disputes. ” The court also provided an extensive discussion of the WCJ’s analysis in determining the appropriate fee for the services in dispute. The court determined the WCJ properly applied the guidelines required in the Tapia v Skill Master Staffing case including its reliance on Kunz v Patterson Floor Coverings, both W.C.A.B. en banc decisions. “As the WCJ noted, the formula that he used to calculate the "reasonable" facility fees for the relevant time period for the procedures at issue took into consideration what Medicare allowed, what Elite charged, what Elite accepted as payment, what the OMFS for ASCs as of Jan. 1, 2004 allowed, what the OMFS for hospitals during much of the relevant period allowed and the fees that other ASCs billed and accepted for the same or similar services. The WCJ considered evidence as to all of these factors, and arrived at results that fell somewhere in the middle of all of these figures. These conclusions are supported by the evidence and are clearly permissible.” Comments and Conclusions: The court was clearly swayed by the practical issues in attempting to implement the IBR procedure to disputes where the necessary steps to enter the IBR process had long since passed. While defendants and amicus argued the procedural gaps could be addressed by regulation, the court remained unconvinced that the legislature intended the billing dispute process to be restarted and then shoehorned into IBR. While the fact the legislature had defined an implementation timetable for IMR but not IBR may have made it tempting for the court to rule, and defendants to argue, for retroactive application, the practical problems in doing so ultimately carried the day. The court’s rather lengthy discussion and approval of the WCJ’s analysis of how to resolve the facility fee dispute may have broader import in the long run as it may provide a roadmap for how to address similar disputes in existing cases. While most ASC fees in cases from after Jan. 1, 2004, are fairly easily resolved, cases pending for services before that date still exist. Prior cases such as Kunz and Tapia had provided some guidance, but translating those cases into easily applied formulas still poses problems. The WCJ’s discussion and the issues he considered, as well as the objectively based formula, may serve as guidance in pending cases with similar disputes. This does not necessarily mean that all such cases should resolve at the same midway point. Among considerations that both the WCJ and appellate court pointed out as significant was the quality of the facility. Elite presented evidence that its facility was state-of-the-art and provided higher-quality medical technology than other local facilities. One witness seemed to suggest the facility was closer to a hospital-based surgery center than most ASCs. One might therefore view the WCJ’s objective standard as the upper end of the scale for ASC facilities. Surgery centers with more mundane credentials might very well have to settle for a value between the 2004 OMFS  and the WCJ’s formula.

Although most boards of directors are aware of risk and the need to manage it, many board members do not actually know much about risk management or how to oversee it. This article reviews a list of questions that may help board members execute their mandate. The list is not comprehensive but is illustrative of important points a board member would want to know about how an organization is managing its risk.

• Who is responsible for the enterprise risk management or risk management process?

Without assigning someone clear accountability for the process of risk management, it is unlikely that risks would be identified, prioritized and mitigated across an organization on a periodic basis and in a thorough way. In addition, it is unlikely risk would be given the focus that is required to achieve a reasonable degree of control over the many uncertainties facing organizations in today’s highly dynamic marketplace. Less important are such details as the title of the individual with the accountability or how large a budget or staff the individual is provided. A named, accountable person is key to ensuring that a sound process is in operating.

• What are the most significant risks to the strategy, and what is being done to address these?

Given that failures are generally caused by a strategic risk that has not been addressed rather than by a catastrophic storm or single cyber attack, for example, it is vital for organizations to know and deal with their strategic risks. Strategic risks typically involve aspects of the business such as:

1. What is the organization’s vision of the future – does it take into account where technology, science and other dynamic forces are going?
2. What is the mission – what does the organization make or sell, to whom and in which geographies?
3. What are the goals and objectives – how much does the organization want to grow, at what margins, keeping what capital and debt levels?
4. What are the values – how does the organization want to behave and be perceived in the marketplace?
5. What is the position with strategic partners, investors and vendors?

• Is there a single risk register that collates all significant risks (strategic and non-strategic), with action plans to mitigate them?

Strategic and non-strategic risks of a certain magnitude should be combined into one risk register that allows management and the board to see:

1. all the major risks
2. what is being done to mitigate them
3. what is the progress against the risk mitigation plan

The board should expect to see such a report or ask for one, if it is not already being created.

• What are the top 10 risks overall?

These should be top of mind for the organization’s senior team at all times and be a familiar topic of discussion with the board. Board members should consider if these make sense based on all the information they have been privy to about the organization.

• Do individual performance plans include risk management?

If managing risk is really important to the organization, the individual performance plans of a large number of employees at different levels of the organization should include a specific objective or task related to risk management. Thus, the performance against these would be evaluated at regular intervals. It is well-known that what gets measured gets managed, and what gets rewarded gets attention.

• Who is responsible for information technology security?

Clear accountability for the task of ensuring IT security is also critical. With the risk of cyber breaches, demands for service, extortion and stealing of bank accounts and intellectual property so high, an organization needs to ensure it has the necessary expertise to create a secure technological platform. This can be in the form of hired staff or expert contractors. In the case of some recent, high-profile breaches, it appears that the role of chief information security officer (CISO) was either non-existent or that the individual filling the role was brand new. An inference can be drawn that a seasoned CISO who understood the organization might have made a difference. Of course, having the role filled does not guarantee never having a security risk come to fruition. But it does reduce the risk to some extent, and having a CISO makes the discovery and recovery from a breach or attack quicker and more efficient when one does occur.

• Do all employees get some information and training on identifying and reporting a risk? Is there a risk reporting “hot-line”?

The answer to this question will give the board insight into several things. If there is a hot-line, it shows that the organization is seriously interested in identifying risks and that the topic of risk is being handled fairly transparently within the organization. If there is not one, the board may wonder why there is no channel for the rank and file to alert management about risks.

•   Have correlated risks been looked for, and what are they?

Large and small organizations, alike, have the potential to harbor correlated risks. Correlated risks are a group of risks that might occur at the same time because there is a relationship of some sort among them. The aspect at play could be:

1. a geography in common
2. a single source with multiple ties. For example, a company that has call centers, data processing and manufacturing plants in a single Southeast Asia country has the potential for correlated risk if that country is hit by a natural catastrophe, political upheaval or some other turbulence.  Another example is, if different product units of a manufacturing company use the same supplier for raw materials or OEM parts, there is the potential for correlated risk if that supplier is unable to deliver on its orders.

A correlation might also be in terms of chain reactions. One risk event may give rise to other risks, which is often true in the case of natural disasters such as earthquakes and hurricanes. A question about correlated risks will not only elicit an answer about those risks but also provide insight as to whether risk is being discussed in depth and across organizational silos.

• Are a business continuity plan and disaster recovery plan in place?

No matter how robust a risk management process is, a company will experience catastrophes of one sort or another from time to time. There is a need for plans that deal with these because reaction speed is critically important in managing them well. The business continuity plan has the aim of keeping all or some of the business running from another venue or with back-up systems or on-call staff, or whatever allows continuous operations. The disaster recovery plan has the mission to restore normal operations as quickly as possible after the business has been interrupted in whole or in part. In reviewing these plans, key elements to look for include:

1. a communication hierarchy for notification that is complete and up to date
2. a decision tree for creating clarity around who can make which decisions
3. a list of third-party resources that have been previously vetted and can be called in to assist – some will be part of any insurance policies that may be triggered by the risk/loss event.

• What risks are being transferred by insurance versus what is being mitigated internally, and what is the quality of the insurer?

Insurance can be an effective and efficient way to handle risk when it is used in a well-constructed fashion. The board will want to consider high-level issues such as:

1. Is the right set of risks covered; i.e. those that are less predictable, require special expertise and are beyond the financial wherewithal of the organization to withstand?
2. Are the right limits being purchased; i.e. is the value of the policy high enough to truly cover a major loss?
3. How highly is the insurer rated, and what is its claims service reputation.

A way in which the board can judge the merit of the answers to these questions is to find out:

1. the kind of analysis that was done to determine the insurance program
2. who did the analysis
3. whether there is benchmark information to look at from comparable organizations.

There are, undoubtedly, other questions that the board may need to ask. These are an excellent starting place for getting a sense of how well the organization is addressing risk.

In our first article in this series, we looked back at an insurance industry reeling from several consecutive natural catastrophes that generated combined insured losses exceeding $30 billion. In the second article, we looked at how, beginning in the mid-1980s, people began developing models that could prevent recurrences of those staggering losses. In this article, we look at how modeling results are being used in the industry.   Insurance is a unique business. In most other businesses, expenses associated with costs of operation are either known or can be fairly estimated. The insurance industry, however, needs to estimate expenses for things that are extremely rare or have never happened before. Things such as the damage to a bridge in New York City from a flood or the theft of a precious heirloom from your home or the fire at a factory, or even Jennifer Lopez injuring her hind side. No other industry has to make so many critical business decisions as blindly as the insurance industry. Even in circumstances in which an insurer can accurately estimate a loss to a single policyholder, without the ability to accurately estimate multiple losses all occurring simultaneously, which is what happens during natural catastrophes, the insurer is still operating blindly. Fortunately, the introduction of CAT models greatly enhances both the insurer’s ability to estimate the expenses (losses) associated with a single policyholder and concurrent claims from a single occurrence. When making decisions about which risks to insure, how much to insure them for and how much premium is required to profitably accept the risk, there are essentially two metrics that can provide the clarity needed to do the job. Whether you are a portfolio manager managing the cumulative risk for a large line of business or an underwriter getting a submission from a broker to insure a factory or an actuary responsible for pricing exposure, what these stakeholders need to minimally know is:

1. On average, what will potential future losses look like?
2. On average, what are the reasonable worst case loss scenarios, or the probable maximum loss (PML)?

Those two metrics alone supply enough information for an insurer to make critical business decisions in these key areas:

• Risk selection
• Risk-based pricing
• Capacity allocation
• Reinsurance program design

Risk Selection Risk selection includes an underwriter's determination of the class (such as preferred, standard or substandard) to which a particular risk is deemed to belong, its acceptance or rejection and (if accepted) the premium. Consider two homes: a $1 million wood frame home and a $1 million brick home both located in Los Angeles. Which home is riskier to the insurer?  Before the advent of catastrophe models, the determination was based on historical data and, essentially, opinion. Insurers could have hired engineers who would have informed them that brick homes are much more susceptible to damage than wood frame homes under earthquake stresses. But it was not until the introduction of the models that insurers could finally quantify how much financial risk they were exposed to. They shockingly discovered that on average brick homes are four times riskier than wood frame homes and are twice as likely to sustain a complete loss (full collapse). This was data not well-known by insurers. Knowing how two or more different risks (or groups of risks) behave at an absolute and relational level provides a foundation to insurers to intelligently set underwriting guidelines, which work toward their strengths and excludes risks they do not or cannot absorb, based on their risk appetite. Risk-Based Pricing Insurance is rapidly becoming more of a commodity, with customers often choosing their insurer purely on the basis of price. As a result, accurate ratemaking has become more important than ever. In fact, a Towers Perrin survey found that 96% of insurers consider sophisticated rating and pricing to be either essential or very important. Multiple factors go into determining premium rates, and, as competition increases, insurers are introducing innovative rate structures. The critical question in ratemaking is: What risk factors or variables are important for predicting the likelihood, frequency and severity of a loss? Although there are many obvious risk factors that affect rates, subtle and non-intuitive relationships can exist among variables that are difficult, if not impossible, to identify without applying more sophisticated analyses. Regarding our example involving the two homes situated in Los Angeles, catastrophe models tell us two very important things: what the premium to cover earthquake loss should roughly be and that the premium for masonry homes should be approximately four times larger than wood frame homes. The concept of absolute and relational pricing using catastrophe models is revolutionary. Many in the industry may balk at our term “revolutionary,” but insurers using the models to establish appropriate price levels for property exposures have a massive advantage over public entities such as the California Earthquake Authority (CEA) and the National Flood Insurance Program (NFIP) that do not adhere to risk-based pricing. The NFIP and CEA, like most quasi-government insurance entities, differ in their pricing from private insurers along multiple dimensions, mostly because of constraints imposed by law. Innovative insurers recognize that there are literally billions of valuable premium dollars at stake for risks for which the CEA, the NFIP and similar programs significantly overcharge – again, because of constraints that forbid them from being competitive. Thus, using average and extreme modeled loss estimates not only ensures that insurers are managing their portfolios effectively, but enables insurers, especially those that tend to have more robust risk appetites, to identify underserved markets and seize valuable market share. From a risk perspective, a return on investment can be calculated via catastrophe models. It is incumbent upon insurers to identify the risks they don’t wish to underwrite as well as answer such questions as: Are wood frame houses less expensive to insure than homes made of joisted masonry? and, What is the relationship between claims severity and a particular home’s loss history? Traditional univariate pricing analysis methodologies are outdated; insurers have turned to multivariate statistical pricing techniques and methodologies to best understand the relationships between multiple risk variables. With that in mind, insurers need to consider other factors, too, such as marketing costs, conversion rates and customer buying behavior, just to name a few, to accurately price risks. Gone are the days when unsophisticated pricing and risk selection methodologies were employed. Innovative insurers today cross industry lines by paying more and more attention to how others manage data and assign value to risk. Capacity Allocation In the (re)insurance industry, (re)insurers only accept risks if those risks are within the capacity limits they have established based on their risk appetites. “Capacity” means the maximum limit of liability offered by an insurer during a defined period. Oftentimes, especially when it comes to natural catastrophe, some risks have a much greater accumulation potential, and that accumulation potential is typically a result of dependencies between individual risks. Take houses and automobiles. A high concentration of those exposure types may very well be affected by the same catastrophic event – whether a hurricane, severe thunderstorm, earthquake, etc. That risk concentration could potentially put a reinsurer (or insurer) in the unenviable position of being overly exposed to a catastrophic single-loss occurrence.  Having a means to adequately control exposure-to-accumulation is critical in the risk management process. Capacity allocation enables companies to allocate valuable risk capacity to specific perils within specific markets and accumulation zones to minimize their exposure, and CAT models allow insurers to measure how capacity is being used and how efficiently it is being deployed. Reinsurance Program Design With the advent of CAT models, insurers now have the ability to simulate different combinations of treaties and programs to find the right fit, maximizing their risk and return. Before CAT models, it would require gut instinct to estimate the probability of attachment of one layer over another or to estimate the average annual losses for a per-risk treaty covering millions of exposures. The models estimate the risk and can calculate the millions of potential claims transactions, which would be nearly impossible to do without computers and simulation. It is now well-known how soft the current reinsurance market is. Alternative capital has been a major driving force, but we consider the maturation of CAT models as having an equally important role in this trend. First, insurers using CAT models to underwrite, price and manage risk can now intelligently present their exposure and effectively defend their position on terms and conditions. Gone are the days when reinsurers would have the upper hand in negotiations; CAT models have leveled the playing field for insurers. Secondly, alternative capital could not have the impact that it is currently having without the language of finance. CAT models speak that language. The models provide necessary statistics for financial firms looking to allocate capital in this area. Risk transfer becomes so much more fungible once there is common recognition of the probability of loss between transferor and transferee. No CAT models, no loss estimates. No loss estimates, no alternative capital. No alternative capital, no soft market. A Needed Balance By now, and for good reason, the industry has placed much of its trust in CAT models to selectively manage portfolios to minimize PML potential. Insurers and reinsurers alike need the ability to quantify and identify peak exposure areas, and the models stand ready to help understand and manage portfolios as part of a carrier’s risk management process. However, a balance between the need to bear risk and the need to preserve a carrier’s financial integrity in the face of potential catastrophic loss is essential. The idea is to pursue a blend of internal and external solutions to ensure two key factors:

1. The ability to identify, quantify and estimate the chances of an event occurring and the extent of likely losses, and
2. The ability to set adequate rates.

Once companies have an understanding of their catastrophe potential, they can effectively formulate underwriting guidelines to act as control valves on their catastrophe loss potential but, most importantly, even in high-risk regions, identify those exposures that still can meet underwriting criteria based on any given risk appetite. Underwriting criteria relative to writing catastrophe-prone exposure must be used as a set of benchmarks, not simply as a blind gatekeeper. In our next article, we examine two factors that could derail the progress made by CAT models in the insurance industry. Model uncertainty and poor data quality threaten to raise skepticism about the accuracy of the models, and that skepticism could inhibit further progress in model development.

With the launch of Apple's HealthKit, the pieces are now in place to enable employers to get out of the health risk business within five to 10 years, if not sooner. Notice I use the term “health risk,” by which I mean that the cost of the employee’s health insurance will not be priced by the employer. The cost will no longer be based on the average age of the employee population, claims experience or any of the standard underwriting/pricing rules used today. That does not mean an employer will not contribute to some of the cost, but the employer will not have to worry about setting budgets based on its medical renewal. Employers won’t have to worry about managing large claims, employee wellness (unless they want to), hospital networks or plan design. While I do think employers don’t mind helping employees pay for healthcare, I don’t think they ever wanted to be in the health insurance risk business, or the claims management business or the wellness business, or to wonder if the person they just hired has a wife at home expecting triplets. There are three main reasons why employer-based health insurance is coming to an end: reductions in Medicare/Medicaid reimbursements, the advancement of mobile technologies by firms such as Apple and cost shifting to employees. Medicare/Medicaid reimbursements The combination of the expansion of Medicaid under Obamacare along with the reduction in reimbursements for services provided under government programs is forcing hospital systems to change the way they do business. In fact, hospital systems are looking to get into the insurance business (a la Kaiser) because they need to get money from healthy people, not just sick people. Almost everybody wants this to happen. Employers want out of the risk business. Hospitals need and want capital. The government wants the relationship to be between the doctor and the patient. The employee wants lower healthcare costs. And, I don’t know about you, but I would prefer that my primary care physician -- not my employer -- worry about my health and wellness. So, in my opinion, the nation is going Kaiser, the staff model HMO route, because that’s what the market will want. Advancing mobile technologies If a provider system is responsible for my health care, then it needs access to my information to manage my health. Apple, with its HealthKit, and others want to make it easier to gather a person’s health information and make that information available to the provider responsible for caring for that person. Kaiser is one of the first provider systems on board with Apple. I am not surprised. Today, I can get on a scale in the morning, and my scale can send my weight via Bluetooth to my smartphone. Blood pressure tests, blood glucose tests and other relevant health information can be also easily be sent to my cell phone, which I can then make available to my doctor in real-time. The doctor would be responsible for my wellness, because she is working for the system that is responsible for keeping me healthy and, I hope, out of the hospital. Imagine the doctor having a system that would house all this information on her patients. The system could automatically send me an email or text message to call and set an appointment because I put on 10 pounds. Today, I get an email from Jiffy Lube saying I need an oil change for my car but never get an email from my doctor saying I need a physical. This is about to change. Employees want to pay less I’ve heard this before: HMOs were tried in the '80s, but they really didn’t totally grab the market. Well, things are different now. In the '80s, the employer paid close to 100% of an employee’s health insurance costs. So, the No. 1 variable when selecting a plan back then was provider access. Is my doctor/hospital in the network? That is all I ever heard. As a result, every doctor and hospital joined every network. Today, it is different. Employees are paying 40% to 50% of the costs, and the percentage is going up. Cost has become the No. 1 variable for an employee when making a health insurance purchase decision. The statistics are out there: When given a choice in plans, employees are choosing lower-cost options. They are now willing to change doctors and sign up for smaller networks for lower costs. What we have is the perfect storm: government intervention, advancing technology and a cost-conscious consumer. This storm combines with the fact that everyone wants the change: the government, employers, employees, provider systems and the technology companies. I want it, too. I don’t want my employer knowing my health information or worried about my wellness. I want my doctor to know. I want my doctor to see me because he thinks I need to see him. I want a test because I need it. I don’t know what I don’t know, so I need someone to tell me. The shift from the risk being on the employer, employee and insurance company, to the provider of care, is a welcome one. I want my physician to want me healthy, too. In this new scenario, there is a role for the insurance companies (look at what Aetna is doing), the brokers and even the employers. I do believe the government and the providers will want the employer engaged in educating employees on what, for many, will be a new healthcare system. Employees will have to learn how to use some technology. How brokers can participate in this process is another article. As the often-used quote says, “Healthcare should be between the patient and his/her doctor.” The stars are aligning for this to happen.

While physicians are well-trained in diagnosis and treatment, most have received little or no training in how to evaluate their patients' ability to do work. Whenever asked about a patient’s work ability, physicians should think through the issues by considering three terms: risk, capacity and tolerance. This first topic, risk, I would like to explore in this communication. Risk refers to the chance of harm to the patient, or to the general public, if the patient engages in specific work activities. Familiar examples are that the Department of Transportation medical certification processes require examining physicians to disqualify individuals with uncontrolled seizure disorders from working as aircraft pilots and as commercial motor vehicle drivers. Thus, a work ­restriction is something a patient can do, but should not do, as opposed to a work limitation, which is something the patient cannot physically do. The terms "work restriction" and "work limitation" are frequently seen on work status certification forms. Unfortunately, there is little scientific literature on the real-world observed risks of working despite known medical conditions. Ideally, this would be the type of information on which to base work restrictions. Where generally accepted sound scientific evidence exists, there should logically be universal agreement among physicians about the issue in question. Sometimes, there are consensus documents that are helpful in assigning work restrictions based on risk. One example is the American College of Cardiology guidelines for physicians in approving participation in competitive sports. While this is a consensus document, and thus not scientifically proven, following these guidelines is our best approach to achieve consistency among physicians. If a patient is applying for work, a physician performing the pre-placement medical examination for the employer must remember that the Americans with Disabilities Act of 1990 permits the employer to deny the tentatively offered employment only if, on the basis of objective information, the work activities of the “essential job functions” pose a substantial risk of significant harm to self or others that is imminent. Under this law, these criteria would be the basis for physician-imposed work restrictions that would disqualify an applicant from working.  Substantial harm means an objectively verifiable worsening in the patient’s condition, and not merely an increase in previously present symptoms, like pain or fatigue. The law says that individuals may choose to work despite pain or fatigue. While physicians in pre-placement examinations generally remember and adhere to the maxim that “if there is not objective evidence of substantial risk for significant harm, the patient may choose whether or not to work despite symptoms,” many times the obverse of this principle is forgotten when physicians are asked by patients to certify work disability based on subjective symptoms without evidence of risk of harm. The decision to work with no significant risk, and despite symptoms, is the patient’s decision (and not the physician’s decision), and the decision is still the patient’s when the patient is requesting disability certification. There are recurring situations in which physicians have historically restricted patients on the basis of medically plausible risk assessment. Examples ­include heavy overhead lifting after shoulder rotator cuff repair, and heavy lifting, carrying and jumping with combined anterior and medial instability in a knee. In these cases, it is plausible to argue that recurrent cuff rupture and progressive osteoarthritis may occur, despite the lack of prospective human studies to prove that these risks are real. Until studies disprove these risks, they will be “generally accepted” and noted by consensus groups. For decades, spine surgeons placed permanent lifting and other activity ­restrictions on patients who had good results after a first-operation lumbar diskectomy. Recently, studies have shown that those with good results can return quickly to full work with no increase in the incidence of disk ­re-rupture. In the next article, I hope to explore the concept of capacity and what it means in the process of approaching patients with complaints of limitation.

A new survey by Deloitte reinforces the obvious truth that a smart CEO and her board will nurture the organization's reputation because it is critical to success (in almost every case). The survey states one other truth that should be obvious to us all: “Reputation risk is driven by other business risks.” As Miriam Kraus, a senior vice president at SAP responsible for its risk management program, is quoted as saying in the report: “Usually, reputation risks result from other risks. For example, noncompliance with applicable laws and regulations, misconduct of senior management, failure to adequately meet our customer’s expectations and contractual requirements. All of these could lead to civil liabilities and fines, as well as loss of customers and damage to the reputation and brand value of SAP, to just mention a few.” But, while the paper has many interesting numbers and charts, I think it leaves much left unsaid. I wish that Deloitte had advised that when decision-makers assess risks they should consider the potential impact on the organization’s reputation (which can be good, bad or neutral) and add this to the assessment of other (more direct) potential effects. It should be noted that the likelihood of a significant impact on reputation arising from, say, a safety issue is not necessarily the same as the impact from fines, lost time and so on. In addition, the impact on reputation may be positive while the impact on, say, cash flow is negative! For example, the decision to divorce the organization from a supplier who is found to have broken the law may raise costs and disrupt delivery of product to the market – while enhancing the reputation of the organization. I also wish that Deloitte had made it clear that organizations need to understand what is most likely to have a significant impact on their reputation. While Deloitte mentioned a few important areas, it omitted situations like failures (or excellence) in customer service, the help desk, public statements (including on social media), responses to media and regulators’ inquiries, announcements about plant closures and so on. I believe it is important to identify the more significant drivers of reputation value, both the potentially positive and negative, so that they can be monitored and treated when appropriate, to optimize reputation. Monitoring is key, and Deloitte has a sidebar that talks to some of the ways to do this. Deloitte calls the process risk-sensing. One aspect that I didn’t see mentioned is that an organization’s reputation can be affected by the actions of third parties – without any stimulus from the organization. For example, from time to time, statements are made by the CEO of Oracle that are intended to attack the reputation of SAP, its primary competitor. The organization that is attacked needs to know what is happening and assess whether a response would help or hurt. In the same way, when there is violence in some part of the world, people look to the U.S., EU, and others for a reaction. It’s not only the action that can affect reputation but the failure to act. When the media find that there have been an unusual number of apparent failures in a model of automobile, the failure of the manufacturer to react can be as damaging as or more damaging than a poorly worded press statement. Actions by third parties that are part of the extended enterprise (suppliers, channel parties, agents and even customers) can affect reputation. They need to be identified, assessed and monitored closely, as well. Reputation risk is critical. While Deloitte doesn’t make this clear, because so many decisions and actions can impair or improve the organization’s reputation, it is essential that the impact on reputation be considered in pretty much every decision, from strategy-setting to the daily operation of the business. Every manager and decision-maker -- not just the chief risk officer -- needs to own the risk. One final point: One of the reasons I like the ISO 31000:2009 global risk management standard is that it doesn’t limit the risk management discussion to preventing bad things from happening. Every organization needs to pay attention to the ways in which it can build and grow its reputation, not just protect it. Do you agree? I welcome your comments and perspectives. This article was first published on:  Norman Marks on Governance, Risk Management, and Audit.

The top 25 insurers consume 70% of the market share in workers’ compensation, and, as the adoption of data and predictive analytics continues to grow in the insurance industry, so does the divide between insurers with competitive advantage and those without it. One of the largest outcomes of this analytics revolution is the increasing threat of adverse selection, which occurs when a competitor undercuts the incumbent’s pricing on the best risks and avoids writing poor performing risks at inadequate prices. Every commercial lines carrier faces it, whether it knows it or not. A relative few are actively using adverse selection offensively to carve out new market opportunities from less sophisticated opponents. An equally small crowd knows that they are the unwilling victims of adverse selection, with competitors currently replacing their best long-term risks with a bunch of poor-performing accounts. It’s the much larger middle group that’s in real trouble — those that are having their lunch quietly stolen each and every day, without even realizing it. Three Warning Signs of Adverse Selection Adverse selection is a particularly dangerous threat because it is deadly to a portfolio yet only recognizable after the damage has been done. However, there are specific warning signs to look out for that indicate your company is vulnerable:

1. Loss Ratios and Loss Costs Climb – When portfolio loss ratios are climbing, it is easy to blame market conditions and the competition’s “irrational pricing.” If you or your colleagues are talking about the crazy pricing from the competition, it could be a sign that your competitor has better information to assess the same risks. For example, in 2009, Travelers Insurance, known to be utilizing predictive analytics for pricing, had a combined ratio of 89% while all of P&C had a combined ratio of 101%.
2. Rates Go Up, and Volumes Declines – As loss ratios increase along with losses per earned exposure, the actuarial case emerges: Manual rates are inadequate to cover expected future costs. In this situation, tension grows among the chief decision makers. Raising rates will put policy retention and volumes at risk, but failing to raise rates will cut deeply into portfolio profitability. Often in the early stages of this warning sign, insurers opt to raise rates, which makes it tougher on both acquisition and retention. After another policy cycle, there is often a lurking surprise: The actuary will find that the rate increase was insufficient to cover the higher projected future losses. At this point, adversely selected insurers raise rates again (assuming their competitors are doing the same). The cycle repeats, and adverse selection has taken hold.
3. Reserves Become Inadequate – When actuaries express signs of mild reserve inadequacy, the claims department often argues that reserving practices haven’t changed, but their loss frequency and severity have increased. This leads to major decreases in return on assets (ROA) and forces insurers to downsize and focus on a niche specialization to survive, with little hope of future growth. The fundamental problem leading to this occurrence is that the insurer cannot identify and price risk with the accuracy that competitors can.

Predictive Analytics Evens the Playing Field The easiest way to prevent your business from being adversely selected is starting with the foundation of your risk management — the underwriting. Traditional insurance companies rely only on their own data to price risks, but more analytically driven companies are using a diversified set of data to prevent sample bias. For small to mid-sized businesses that can’t afford to build out their internal data assets, there are third-party sources and solutions that can provide underwriters with the insight to make quicker and smarter pricing decisions. Having access to large quantities of granular data allows insurers to assess risk more accurately and win the right business for the best price while avoiding bad business. Additionally, insurers are using predictive analytics to expand their scope of influence in insurance. With market share consolidation on the rise, insurers in niche markets of workers’ compensation face even more pressure of not only protecting their current business, but also achieving the confidence to underwrite risks in new markets to expand their book of business. According to a recent Accenture survey, 72% of insurers are struggling with maintaining underwriting and pricing discipline. The trouble will only increase as insurers attempt to expand into new territories without the wealth of data needed to write these new risks appropriately. The market will divide into companies that use predictive models to price risks more accurately and those that do not. At the very foundation of any adversely selected insurer is the inability to price new and renewal business accurately. Overhauling your entire enterprise overnight to be data-driven and equipped to utilize advanced data analytics is an unreasonable goal. However, beginning with a specific segment of your business is not only reasonable but will help you fight against adverse selection and lower loss ratio. This article first appeared on wci360.com.

If you want to deliver a great customer experience, you better be prepared to pay up…  right? Maybe not. Conventional wisdom suggests that with an enhanced customer experience comes greater expense. But that’s not always the case. The fact is, a better experience and lower costs can actually go hand-in-hand. The origins of that unlikely pairing lie with a fundamental principle that many businesses fail to appreciate: Broken, or even just unfulfilling, customer experiences inevitably create more work and expense for an organization. That’s because sub-par customer interactions often trigger additional customer contacts that are simply unnecessary. Here are some examples:

• An individual receives an explanation of benefits (EOB) from his health insurer for a recent medical procedure. The EOB is difficult to read, let alone interpret. What does the insured do? He calls the insurance company for clarification.

• A cable TV subscriber purchases an add-on service, but the sales representative fails to fully explain the associated charges. When the subscriber’s next cable bill arrives, she’s unpleasantly surprised and believes an error has been made. She calls the cable company to complain.

• A mutual fund investor requests a change to his account. The service representative helping him fails to set expectations for a return call. Two days later, having not heard from anyone, what does the investor do? He calls the mutual fund company to follow up on his request.

• A student researching a laptop purchase on the manufacturer’s website can’t see the difference between two closely related models. To be sure she orders the right one for her computing needs, what does she do? She calls the manufacturer.

• An insurance policyholder receives a contractual amendment to her policy that fails to clearly explain, in plain English, the rationale for the change and its impact on her coverage. What does the insured do? She calls her insurance agent for assistance.

In all of these examples, less than ideal customer experiences generated additional calls to centralized service centers or field sales representatives. The tragedy is that a better experience upstream would have eliminated the need for these customer contacts. There are both real and opportunity costs incurred as a result of these unnecessary inquiries. Every incoming call, e-mail, tweet or letter drives real expense – in service, training and other support resources. Plus, because many of these contacts come from frustrated customers, they often involve escalated case handling and complex problem resolution – which, by embroiling senior service professionals, managers and executives in the mess, drives the associated expense up considerably. Layer on top of that all of the associated opportunity costs: the diversion of company staff from more valuable, profit-enhancing activities, because their time is consumed handling customer inquiries that shouldn’t even exist. Studies suggest that, at most companies, as many as a third of all customer contacts are unnecessary – generated only because the customer had a failed or unfulfilling prior interaction (with a sales rep, a call center, an account statement, etc.). In organizations with large customer bases, this can easily translate into hundreds of thousands of expense-inducing (but totally avoidable) transactions. Take into account the additional opportunity costs, and it’s enough to make a CFO cry. To avoid this profit-sapping outcome, consider these three tips:

• Really understand why customers contact you. Whether your company handles a thousand customer interactions a year — or millions — don’t assume they’re all “sensible” interactions. Identify and drill into the top 10 reasons that customers contact you. You’ll likely find that, for some subset of those categories, these contacts can be avoided with upstream changes, in the form of streamlined procedures, simplified communications or revised marketing materials.

• Drill the importance of ownership into all sales and service staff. How many of your customer contacts are really just follow-up inquiries – generated only because a staff member failed to keep a promise or honor a commitment to the customer? Absence of ownership drives customers crazy. Yet, with good training and executive support, it’s one of the easiest ways to improve service and reduce costs.

• Promote a balanced orientation on quality and quantity. A single-minded focus on volume measures (e.g., how many calls you answered, how many sales you closed) can compromise quality. The resulting errors – by triggering unnecessary contacts and driving corrective re-work – will offset any productivity gains you thought you were realizing.

Great customer experiences can be powerful drivers for a firm’s top line. Even small improvements in customer loyalty, retention and repurchase can have a huge impact on revenues. What gets far less attention, though, is the fact that better experiences can also translate into expense reduction and avoidance, given that poor customer interactions spawn lots of unnecessary work that consumes organizational resources. So the next time you’re looking to control costs, consider a counterintuitive approach: deliver a better customer experience. It’s a great way to turn customers (and CFOs) into raving fans.