Finance pros at Heller Financial were seeing some odd patterns when they analyzed the company's loan losses last year.

"We started to see loan write-offs that had less to do with the borrowers themselves and more to do with our own operations," says Michael Litwin, chief credit and risk officer at the Chicago-based commercial finance company, which has $18 billion in assets under management.

"There were all these little silly things, like not documenting a loan properly, losing a lien on an unsecured creditor that we thought was secured, having the system spit out incorrect numbers causing us to close a loan when we shouldn't have. In and of themselves they did not mean much, but as a whole they gave pause for consideration."

Pause, indeed. Working with E-Risk, a consulting firm, Litwin determined that about 25% of Heller's write-offs originated from such avoidable mistakes. And he discovered that for every dollar of write-offs related to the errors, the company was spending another dollar-plus labor time-to cure the problem. Incomplete documentation in one business unit, for example, required a team of people to sift through dozens of files over a period of days to assure complete documentation.

Getting senior management to acknowledge the structural problems proved to be a challenge. "Most risk management initiatives are undertaken on a burning platform-a huge problem that has to be corrected immediately," Litwin notes. "We had a lot of little problems that didn't scream out."

But the analysis proved potent, and soon Heller joined a galloping trend. It decentralized risk management and made it a key performance metric in the evaluation of business managers throughout the company.

"When I was able to show that 25% of our write-offs were operational in nature, and the cause belonged to everyone in the organization, I got the go-ahead to implement new risk management controls," says Litwin.

A complete reorganization followed, and new positions were created. Heller hired an operational risk officer, Jeff Grigsby, who reports directly to Litwin and whose sole responsibility is to analyze and try to fix operational glitches.

Additionally, each of Heller's 22 business units has assigned an employee to serve as its operational risk manager, with responsibility to monitor, manage and measure risk in the unit. Together with Grigsby, they comprise a newly established operational risk office that reports jointly to the audit committee of Heller's board and to Litwin.  In recognition of his new role, Litwin has added the appelation of chief risk officer to his chief credit officer title.

To give the program impetus, Heller links compensation directly to risk management. "We've created goals, such as reducing operational risk by 'x' percent over a particular duration," Litwin explains. "To achieve the goal is to get the bonus."

Premiums at Perrier
Some companies have drilled down even deeper with programs to instill risk consciousness.

When Perrier wanted to put the fizz back into its U.S. operations a few years ago, the French water bottler assigned risk management responsibility to every senior manager at the company's 70-plus distribution facilities and 20 manufacturing locations. "Our insurance costs were increasing [and] were tugging at the bottom line," explains Douglas E. Rousseau, director of risk management at Perrier Group of America, which booked $1.7 billion of revenues last year. "We needed a new tack."

Making Them Accountable
With an ultimatum from the Greenwich, Conn., company's president to bring risk costs under control, Rousseau created a scheme that made line managers responsible for insured claims related to automobile liability, product liability and workers' compensation. Using transfer pricing, premium increases are now charged back pro rata to each manager's budget.

"We've made them accountable…and have tied their incentive compensation to it," says Rousseau, indicating that high expenses eat into profit-based bonuses.

So far, the experiment is working. "The first year [that] we made managers accountable, we had a 25% reduction in claim activity," Rousseau says. "If a guy says to a supervisor, ‘My back is sore,' previously the supervisor would have had him fill out a workers' comp report and forget it. Now the supervisor has an incentive to control this expense, perhaps giving light-duty responsibilities to the fellow with the sore back. At the end of the day, he knows if he works hard enough to control risks, it drills down to the bottom line and his own compensation."

Rousseau says that since the program began several years ago, Perrier America's sales have more than tripled while his insurance budget has remained stable, as close a measurement as he can get to the program's success. Premium prices were rising when the program began.

Wide Recognition
Heller and Perrier are among a growing number of companies that are using carrots and sticks to inculcate a risk management culture throughout their organizations. To be sure, the companies retain a senior risk manager to coordinate activities in the business lines, negotiate contracts and help develop mitigation strategies.

However, businesses as different in their cultures as computer networking's Cisco Systems and bus line operator National Express Corp. are training all ranks of employees to consider themselves frontline troops in scouting corporate exposures. And they're doing it not only with direct incentives but with stepped-up safety training and risk identification programs that show everyone from the executive suite to the mailroom how risks unheeded can damage financial prosperity and, by extension, their own livelihoods.

"Risk management must be everyone's job," says James Lam, the founder and vice chairman of E-Risk, a New York-based enterprise risk management consultancy. "We've all paid too much attention to the hard side of risk management-things like insurance policies and reporting systems-while ignoring the softer side of a strong culture, one that instills values for managing operational risks and offers incentives to motivate better loss control."

To be sure, companies must also nurture a sensibility for the value of risk-taking in many areas-including corporate finance and investments. But whether it's to constrain risky activities or to evaluate when it makes sense to take risks, decentralization is now viewed as a key organizational tool.

©2008 Sungard. All rights reserved. Legal Information