Ventiv Technology

2 0 | 360º Aon eSolutions As part of the group's risk management team, Houghton sought a risk management information system (RMIS) to automate and enhance the depth in risk reporting. e ultimate goal was to better analyze, prioritize and act on the most significant exposures. IMPROVING RISK ASSESSMENT Semi-annual risk assessments are a cornerstone of risk management, and the company has historically utilized a sophisticated spreadsheet model to catalog and track exposures and controls. "We ask managers in our businesses to consider, review and compile a list of their risks, which they derive from what we call a risk universe, or register," Houghton observes. "ey also describe the risk mitigation controls in place, planned or ongoing, and their estimate of the likelihood and potential impacts of these risks and the effectiveness of their controls. 'Risk Champions' within each business coordinate the whole process and, once submitted, the central risk management team collates, reviews, analyzes and reports on the resulting dataset." As with any risk assessment, Houghton notes, "We rely on the experience and judgement of our management. At the same time, we saw a need to augment the subjective, intuitive elements of our risk management program with a scientific approach to identifying and tracking risk company-wide." DRUDGERY OUT, THINKING IN According to Houghton, the selection criteria when choosing a RMIS included simplicity and ease of use. "In most cases, our risk champions are not full-time risk managers, so we have to be realistic about how much time they can devote to the assessment process. We knew that the simpler and easier we could make this for them, the more likely it would be that they would use the RMIS and take a more active part in maintaining their risks." In developing the RMIS, one of Houghton's key goals was to make the risk assessment process more fulfilling: "Releasing time for those facilitating the risk assessments to do the clever work, the critical thinking and to really apply their skills and knowledge is very important. Risk Register eliminates the drudgery of operating a complex database and working directly with data." EMBEDDING ACTION-ORIENTED RISK MANAGEMENT According to Houghton, making risk management more action-oriented was a central goal: "e real value of a risk assessment process comes from, having identified the risks, making sure that the mitigating controls are well directed, effective and timely. We needed a structure to ensure that these control actions are monitored and followed up with the individuals responsible so that the whole process remains active, dynamic and meaning ful." By deploying Risk Register, the company can track over time the progress being made in addressing each risk entered in the system. "After all, risk management is about trying to reduce the risks and not just recording them and saying what you're doing about them," Houghton states. "e whole point is to make sure risk management is embedded in the business, and we're now making risk assessment and control a living process." FLEXIBLE, ITERATIVE DEVELOPMENT Houghton has worked closely with her Aon eSolutions account manager, Ross Ellner, as well as Aon eSolutions IT developers to create a RMIS tailored to the company's needs. Risk Register is now poised to roll out to the 10 to 15 global risk champions as well as Houghton's risk management colleagues. Houghton values the "iterative" development process that produced the company's RMIS: "Since the process began, I've realized that RiskConsole could do so much more than I first knew. From the beginning, the step-by-step development process allowed me to choose the things we wanted, change our minds when we needed to and see the results quickly. The process has been quite flexible, and I like the way we've kept in touch all along." Houghton appreciates the regular, frequent contact with Ellner and the software developers: "RiskConsole has responded quite nicely and adapted well to the changes that we as a company have made." PRODUCING AUTOMATED, ENGAGING REPORTS As Risk Register rolls out within the organization, Houghton expects enhanced reporting to be especially valuable at all levels of the company. Much of the work of generating, distributing and accessing reports will be automated. Risk champions won't have to build reports, but rather, simply access them through dashboards or even by email. Moreover, the reports will be concise, color-coded and feature meaning ful charts and graphs. And these reports will be automatically customized based on criteria such as the user's business unit, region and position within the company. "Reporting is critical for us because it helps us show graphically, in an easily comprehensible manner, what our risks are at any level of the organization," Houghton says. "We're still getting the structure in place, but once we do, distributing reports will be relatively straightforward." With the improved reporting capabilities, Houghton expects the business units will take a different view of their risk assessment function: " We want to avoid the common ' head office' problem, not confined to risk management, of sending the businesses a lot of questions and templates and forms to fill in, insist they do it in a short time span and then not tell them anything until the next time we ask for their input. I really want to be able to let our businesses get something back rather than simply feeding stuff into the sausage machine and never getting any sausages back."

• Cover