ENTERPRISE RISK MANAGEMENT

1. ENTERPRISE RISK MANAGEMENT Mary Lynn Curran, VP, Clinical Risk ManagementKen Felton, SVP, Senior Clinical Risk Management Consultant July 14, 2009

2. ENTERPRISE RISK MANAGEMENT

3. SOMETIMES IT’S HARD TO REACT TO RISK!

4. COMPETING DEMANDS • Competition for resources • The level of exposure • Decision making and setting of priorities

5. TODAY’S GOAL • We will speak about LTC risk – and not necessarily INSURABLE risk • OUR challenge for today reflects YOUR challenge every day: Creating a framework to • Give each risk context and • Make each risk actionable • Even when there is no risk transfer option available

6. ERM IS ESSENTIAL TO EVERY BUSINESS • Lord Levene, Chairman of Lloyd’s of London wrote: • “But risk management is not simply about preparing for the worst. It’s also about realizing your full potential. With a clear understanding of the risks they face, businesses can maximize their performance and drive forward their competitive advantage”. Levene, Lord; “Risk management is essential to every business”: Financial Times, October 17, 2006.

7. WHY CONSIDER UTILIZING THE ERM PROCESS • Connect business and risk management strategies • Determine full realm of risk exposure • Improve business plan execution • Monitor the effectiveness of enterprise actions

8. ENTERPRISE RISK MANAGEMENT PROCESS • Identify critical risks ?) – Whether insurable or not!! • Quantify their impact on organizational objectives • Develop and implement risk management strategies • Mitigate risk and maximize value

9. ENTERPRISE RISK MANAGEMENT • Helps the organization understand that risk can be viewed not only as just a threat, but as an opportunity

10. WHAT IS ENTERPRISE RISK MANAGEMENT? • ERM is a structured analytical process that focuses on identifying, quantifying, prioritizing and eliminating the financial impact and volatility of a portfolio of risks rather than on risk avoidance alone • Essential to this approach is an understanding that risk can be managed to gain competitive advantage1 1”Enterprise Risk Management”, Defining the concept, recognizing the value, ASHRM, January 2006, pg., 1.

11. RISK IDENTIFICATION • Goal: Capture all risks that could potentially affect the achievement of organizational objectives • How does this occur? • Surveys and questionnaires • Checklists • Flow charts • System analysis • FMEA • Brainstorming • Assessments based on records and experience • Results of audits, inspections or site visits

12. ENTERPRISE RISK MANAGEMENT • Four Areas of Focus • Financial Risk – Risks that effect the profitability, cash position, access to capital or external financial ratings through investments, business relationships or the timing of the recognition of revenue or expenses • Hazard Risk – Risks attributable to physical loss of assets or a reduction in their value, or injury to others or their property, including customers, employees or other business entities • Operational Risk – Risks to the conduct of the business operations that result from on-going or changes in business practices, use of resources, external regulations or requirements, inadequate or failed internal processes, people or systems • Strategic Risk – Risks to reputation, market position or ability to pursue strategic goals and objectives

13. FOUR QUADRANTS OF LTC ROUNDTABLE RISK FINANCIAL STRATEGIC HAZARD OPERATIONAL

14. 25 24 20 15 12 11 10 7 7 7 6 6 5 4 3 2 2 1 1 1 1 0 0 0 RISK EVENT PRECIPITATING ENTERPRISING VALUE DROPS(# OF COMPANIES) • Mercer MC Research • Investigated risk factors behind the 100 largest one month drops in shareholder value among Fortune 1000 companies between 1993-98 • Found top 100 stock drops • Identified triggering event • Determined causes of triggering event • Categorized primary cause • Analyzed results and implications % of top 100 Misaligned Management Lawsuits Natural Competitive Loss of R&D Foreign High Interest Cost Overruns Products ineffectiveness Disasters Pressure Key Delays Macro- Input Rate Customer Economic Commodity Fluctuation Issues Price Customer M&A Customer Regulatory Supplier Accounting Supply Chain Demand Integration Pricing Problems Problems irregularities Issues Shortfall Problems Pressure Strategic Operational Financial Hazard 58% 31% 6% 0%

15. FOUR QUADRANTS OF RISK FINANCIAL 6% STRATEGIC 58% HAZARD 0% OPERATIONAL 31%

16. ENTERPRISE RISK MANAGEMENT PROCESS • Understand the organization’s business and strategic objectives • List all of the risks in the four specific areas of focus; financial, hazard, operational and strategic • Arrange risks by order of magnitude • Risks are quantified in dollars or order of magnitude • Severity of probability and frequency of loss (Risk Map) • Risks are defined as uninsured, partially insured or insured • What controls are in place to address the risks • Develop a Financial Exposure Snapshot – identifying what degree of risk the organization faces • Determine if the organization can do one of the following: • Avoid the risk • Transfer the risk • Retain and manage the risk • Identify what controls are in place to address each risk from 1) least risk control to 5) greatest risk control • Determine gaps and opportunities for improvement

17. THE RISK MAP MODEL Adapted from the Housing Corporation. London (UK) [cited 2005 Dec 15] Risk Management Topic Paper No. 4; 2003 Apr.

18. THE RISK MAP MODEL Catastrophic Moderate Insignificant Impact Not Likely Likely Almost Certain Probability Adapted from the Housing Corporation. London (UK) [cited 2005 Dec 15] Risk Management Topic Paper No. 4; 2003 Apr.

19. ENTERPRISE RISK MAP: PART ONE 5CAT HIGH LF HF HS HS 3 4 SEVERITY LF HF LS LS 1 2 LOW 0% 100% 50% PROBABILITY OF OCCURRENCE

20. RISK EVALUATION Beswick, Kelsey and Bloodworth, Jane: Housing Corporation “Risk Mapping – Dilemmas and Solutions”; Risk Management Topic Paper No. 4

21. Measurements – Defining Impact

22. THE ERM RISK MODEL

23. THE ERM RISK MODEL

24. RISK CONTROL ASSESSMENT AND ACTION PLAN Beswick, Kelsey and Bloodworth, Jane: Housing Corporation “Risk Mapping – Dilemmas and Solutions”; Risk Management Topic Paper No. 4

25. CONCLUSIONS: • There is no right or wrong way to implement Enterprise Risk Management within your organization • Enterprise Risk Management fosters communication among organizational departments • Experts believe Enterprise Risk Management must be: • Customized to the organization • Kept simple and understandable • Able to show immediate success • Understand and utilize the process to maximize your value in the organization