Archive For: Enterprise Risk Management

The Risky Game of Credit Underwriting

The Risky Game of Credit Underwriting

Credit underwriting decisions are a cornerstone of any economy. Made wisely, they can assist entrepreneurship, promote economic growth, and generally ensure that capital is allocated to its highest and best use. On the other hand, poor credit underwriting decisions can negatively impact an industry or the economy as a whole.  Recent troubles in the U.S. economy are directly tied to the poor credit decisions of lenders to support prospective home owners who had little money and provided little information about their financial strength in an over-inflated housing environment. Recent failures of banks such as IndyMac are partly tied to poor credit underwriting decisions and over-leveraging.  The failure of banks to consider the full range of construction risk is leaving many banks high and dry due to the recent spate of construction business failures, with many more to come. The five consecutive years of recent losses in the surety industry was directly related to poor credit underwriting decisions. With all of these losses you have to wonder what is going wrong. The answer is twofold: an unusually high tolerance for risk and credit decisions based upon insufficient data.


In the case of mortgages that went bad, because loans could be packaged and resold, an anything goes atmosphere developed and many risk management practices were thrown out the window. Many loans were provided based on simple applications that provided minimal financial information. The fallout of this lending environment is showcased on Mortgage Lender Implode-o-Meter. In the case of IndyMac, a large portfolio of non-performing Alt-A loans, sometimes called liar loans, and risky construction and land development lending, left the bank with very little cushion in a falling housing market. Other banks impacted by losses only relied on financial data, failing to consider all the risks of lending to high risk industries such as construction and auto dealerships.


Read more →

The ERM – Business Success Matrix, and the “Success Paradox”

The ERM – Business Success Matrix, and the “Success Paradox”

Companies usually find themselves in one of four quadrants of the ERM/Business Success matrix:

  1. A company has proper risk controls in place and is successful/profitable
  2. A company does not have proper risk controls in place and is successful/profitable
  3. A company has proper risk controls in place and is unsuccessful/unprofitable
  4. A company does not have proper risk controls in place and is unsuccessful/unprofitable

The Success Paradox

The term “Success Paradox” has been used to refer, among other things, to individuals that are economically successful not being as happy as those less economically well-off, to the increased vulnerability of developed countries to diseases such as measles, and to the concept that an enterprise, such as a poverty NGO, can put itself out of business if it is successful.


Read more →

Yin and Yang of Credit Underwriting

Yin and Yang of Credit Underwriting

This title seems especially appropriate following the recent Beijing Olympics. But today we are not talking about Chinese culture, we are talking about qualitative data and quantitative data, risk data and financial data, causes for success and causes for failure. What do these have in common? As the Chinese definition goes, they are two complimentary qualities that, when put together, form the whole.

Yin-yang Symbol

At the end of the day, business is about achieving profitability, which is defined as the ability of an enterprise to generate revenues in excess of the costs incurred to produce those revenues and is often measured by a rate of profit or rate of return on investment. Credit underwriters also seek to achieve profitability, and that means avoiding large, unforeseen losses. To maximize profitability, underwriters need to find the optimal balance between premiums charged and risk present.

Unfortunately, as discussed in The Risky Game of Credit Underwriting, underwriters are often working with insufficient, inadequate, or obsolete data so measuring the “risk present” becomes quite a tall order, and many times involves outright guessing. They have no way of knowing where the applicant lies in the ERM – Business Success Matrix. Fortunately, with the advent of a standardized mean to collect and analyze qualitative data, most of these underwriting deficiencies can be overcome. In this post, we’ll discuss how qualitative and quantitative data fit together to form a complete picture of an applicant during the credit underwriting process.


Read more →


Contractors: Are You Adopting ERM or Still Stuck in the Mud?

For those of you unfamiliar with construction terminology, mud is synonymous with concrete. But, for the sake of those contractors reading this post, I wish it was synonymous with something that didn’t “set up,” like snow for instance. You always know that snow will melt and set you free.  Unfortunately, many construction companies are stuck in the mud, so to speak, by the way in which they are operated. As the world progresses to more sound methods of operating businesses, such as adoption of Enterprise Risk Management (ERM), I certainly hope construction doesn’t stay stuck in the mud.

In this post, I’ll give some background on the growth in Enterprise Risk Management and how it relates to the construction industry, and explain why adopting an Enterprise Risk Management philosophy for running your construction business is a wise decision. I say philosophy, because at its core, ERM is a shift in thinking, a shift in managing your business. It applies best in high risk industries, like construction, which have high failure rates due to persistent failures to recognize and mitigate risk across the entire business.

Enterprise Risk Management Growth

In a 2001 survey, Enterprise Risk Management: Implementing New Solutions, it was noted that 41% of the public companies surveyed indicated that they were currently implementing some form of ERM program.  As a result of Sarbanes-Oxley Act (aka SOX, the compliance requirements set forth after the Enron debacle), that number has been climbing ever since.  Why?  Quite simply, the rules of the game have changed for public companies.  They must now prove they have strong internal controls, complete intregrity and systems to manage all risks they face.  Unexpected “surprises” are no longer accepted; they now have swift consequences.  Given this environment it’s no wonder that Enterprise Risk Management (ERM) is being adopted by public companies at an ever increasing pace.

In the United States, the Securities and Exchange Commission, as well as the U.S. Federal Reserve and the American Institute of Certified Public Accountants, are demanding more accountability from corporate directors in terms of identifying risks and developing systems for managing them.  The National Association of Corporate Directors is encouraging audit committees to expand their scope of risk management reviews. Dunn and Bradstreet has released software to provide ERM Solutions. Standard & Poors, one of the largest credit rating companies of businesses worldwide, has announced that it is now including questioning about a company’s ERM practices to determine ratings for credit.  This rise in expectations requires a level of risk management knowledge and capability not found in many organizations so companies are scrambling and reacting to institute risk-based controls.

But how does all this apply to private companies that don’t have to worry about compliance issues brought forth by SOX? Plainly stated, ERM is not just for the “Big Guys” anymore.  As Tim Ling, president and chief operating officer of Unocal, stated: “I think you will see almost all companies over the next few years moving in the same direction [as we are], really trying to integrate the notion of risk management with the notion of just business management. To me, running a business is all about managing risk.”  Essentially, managing risk is really about properly managing a business, and therefore managing risk can create shareholder value if done correctly.  Thus, ERM is now seen less as a reactionary requirement to regulations, and more as just plain old good business practice.

Why Contractors make good Candidates for ERM

But you may question, does ERM apply to contractors? The answer is yes… more than ever. Since ERM best fits companies in high risk fast moving industries, contractors are prime candidates for adoption. Let me explain some of the reasons why:

Abundance of Risk – There are so many risk factors in a construction business that it is hard to manage them all. In essence, a contractor is like a juggler, typically having a ton of balls in the air, each being a problem that needs to be solved. Unfortunately, the functioning of the company is usually last priority. Since money is made or lost in the field, solving problems in the field typically takes precedence over solving problems in the company.

Tight Time Constraints – As every contractor knows, the construction industry moves at a million miles a minute. Since it moves so fast, it is very difficult to implement risk controls, or in other words, fix internal problems. The industry is very competitive, margins are small and great pressure exists to keep overhead down. So if overhead is already stretched thin and key management personnel are focused on solving problems in the field, there is simply not much time or human capital to get risk controls implemented. An internal problem may get temporarily addressed and go away for awhile, until many months later when it pops up again and everyone looks at each other and says “didn’t this happen before,” and the cycle repeats itself.

Insufficient Knowledge – Since contractors are so busy, do they have time to learn? If they don’t have the proper guidance, do they know the options available to improve the function of their company? The answer to both questions is usually no. Unfortunately, since they are so busy, they don’t have time to seek out those professionals who can give them advice, and to compound matters, Enterprise Risk Managers who understand the construction industry are hard to come by.

Unstable Controls – During day to day activities at a construction company, internal problems often come up and management will conclude that “we should do something about this.”  Unfortunately, the pressure to constantly meet day to day deadlines in a fast moving environment does not allow management sufficient time to methodically establish a plan to install risk controls effectively, and even if installed, management does not have time to perfect or monitor the control to assure it remains in place. As a result, a “quick fix” is often used as the solution. However, when a risk control is quickly put in place there usually is not enough thought behind it.  Therefore it simply does not stick, especially when not monitored.

All of these characteristics make contractors great candidates for ERM. So let’s talk about the how ERM can actually overcome the challenges for implementing risk controls as stated above, namely: the abundance of construction risk, the time constraints upon management, the insufficient knowledge about ERM and unstable controls.

How ERM overcomes the challenges for implementation of risk controls

ERM establishes a culture. First and foremost, ERM establishes a new corporate philosophy, a change in thinking toward a risk-based mindset, not only amongst management, but amongst all in the company. If nothing else were to be accomplished, just this mind shift alone is of huge benefit. When people realize how the company’s ability to make a profit can be put at risk directly by their work, there is a behavioral change. Not only do they realize the impact of their work, but they also gain a feeling of just how valuable they are, how valuable their work is, and how their work can be part of the company’s success. Since it is well documented that bottom-line performance can be largely attributed to employee fulfillment, an ERM approach to running business certainly has its benefits.

ERM creates root level accountability. The ERM methodology enables management to deal effectively with problems, even though an abundance of risk may exist. The accountability for mitigating risk is spread to all levels in all departments and therefore the responsibility for implementing controls is not just up to time-strapped management, but up to everyone.

ERM relentlessly drives improvement. Persistence, that’s the word. ERM does not go to sleep after a risk control is put in place. It relentlessly monitors the controls put in place and persists to uncover new risks. Risk is forever changing and new risks arrive on the scene all the time. The ERM process fully incorporates a “risk-sensing” mindset by constant reassessment and monitoring to validate current controls as well as address new risks.


In short, ERM addresses an abundance of risk by following a systematic process that educates the workforce on elements of risk within their area of responsibility, empowers them to individually install risk controls which are then monitored within the process to make sure the controls remain fully in place, thus creating a “no surprises” management environment.  Without an ERM framework, the failure to recognize risks or to mitigate known risks can make it difficult to compete, financially weaken the company, and potentially jeopardize its future.

So there you have it. ERM is being adopted worldwide and it is a perfect fit for construction. It will just be a matter of time before you will be expected to run your business with a risk-based approach. In fact, the banks and sureties are already asking contractors, “who handles enterprise risk management for your company?” Do you want to be the company that lags behind in understanding and taking action on business risks, or do you want to be a survivor in today’s fiercely changing and competitive environment? As to the ultimate question: “Should I personally get engaged in a risk-based mindset and adoption of ERM,” I leave you with some final questions.

· What can happen to create value in your company?
· What can happen to destroy value in your company?
· What degree of confidence do you have in the outcomes?

Think about it. Many will conclude it’s wise not to be “stuck in the mud.”

Read more →


Construction Failure: Why Contractors Fail

The construction industry is full of unending challenges, requiring high energy and constant problem solving.  The company owner is like a juggler with 50 balls up in the air (potential problems); if any drop (actual problem) it could cause all the rest to drop as well (total problem i.e. business failure).

The large amount of potential problems, combined with low industry margins,  is undoubtedly a major reason the construction industry has one of the highest failure rates (right up there with restaurants).   Unlike companies in most industries, though, contractors usually don’t fail because of poor products or service.

Why Contractors Fail

Sure there are some cases, but in general, contractors don’t fail because of poor construction.  Most contractors build a decent building.  After all, they have to follow rigid design specifications and plans and have to undergo inspections.  So if they don’t fail because of poor building practices, then why do contractors fail?

In simple terms, it is because of poor business practices.  Many construction companies are started by project managers without specific schooling in running a business.  They know how to run a job, but haven’t been taught to run a construction company. To compound matters, there isn’t really much formal education offered in running a construction company.  Frankly, there should be a college major for it.

Finding the Root Causes of Failure

Every company has a bunch of business practices, and if those business practices are properly in place, the company will maximize its ability to make a profit.  All those business practices (or things you need in place) are called risk factors.  That is the heart of Enterprise Risk Management

Every process, practice, system, procedure, or activity that takes place in a company must be working perfectly to maximize profitability. Obviously, this sort of perfection is impossible, but it is (or should be) a goal for every company.

So, I started on a quest to uncover the root causes of business failure. I began by identifying all of the major contributing causes for loss based upon my years of experience and sought out publications and other professionals who could serve as resources for further adding to the list.

I knew that all causes of loss could be fixed by putting a business practice or control in place and that if those controls or practices weren’t in place, it could cause a business to fail.  Conversely, having all the necessary controls and practices in place would provide a business with the greatest ability to generate profits (to maximize profitability).

With a greater understanding of how controls impacted profitability, it became clear that the effectiveness of existing controls at a company had to be assessed to determine the degree the company was at risk of failure. This is, in fact, what the Enterprise Risk Management process does and what risk management was intended to be long ago.

Reactive Management

Just like financial advice is sought after a portfolio has shrunk or a financial dilemma has occurred, and business analysts are brought in after a company has lost money, I spent my early days as a consultant patching up systems or procedures in construction firms that were disheveled. In fact, a large amount of my time was spent on complete turn-arounds.

It made me feel like a lawyer, always looking in the past at what went wrong rather than looking toward the future and preventing problems from occurring.   That really isn’t the best business philosophy… that is, to bring in an expert after something is messed up.  A much better business philosophy is one that prevents “mess-ups” from occurring in the first place, which is why Enterprise Risk Management is so well suited to construction.


Proactive Management

Enterprise Risk Management identifies potential causes for loss well in advance so they can be addressed before harm occurs.  This is a large shift from the thinking of fixing problems once they occur.  That is the beauty of ERM.  It prevents problems by recognizing weaknesses while they can still be corrected.  That said, most contractors continue to unknowingly risk profits by failing to inspect systems and controls that could cause future problems.

Let’s get back to our project manager turned business owner.  Without the proper educational tools or experience actually running a company, his chances of survival are low, which is exactly what the statistics show.  To increase his odds, he should study the business practices (risk factors) necessary to run a construction company effectively; there are at least 79 which are important to a company’s success.

I encourage any contractor interested in preventing problems rather than patching them to consider adopting an ERM process and the philosophy of enterprise-wide risk management.  It’s a sure way to strengthen business fundamentals and maximize potential profit.

Read more →

Construction ERM Workshop in Qatar

Construction ERM Workshop in Qatar

Enterprise Risk Specialists, in cooperation with Druml Group, recently concluded a three day ERM workshop in Qatar, led by its President and ERM expert, David Druml. The workshop included participants from top companies in the construction, engineering, land development and oil & gas industries and received strong feedback.

20120412 ERM Workshop - Qatar

The workshop, hosted by Excelledia Quality Consulting, was the first step in bringing the company’s extensive management consulting experience, especially in the field of Enterprise Risk Management, to the Middle East and North Africa.

Read more →

Will the Real Risk Manager Please Stand Up!

Will the Real Risk Manager Please Stand Up!

Today I met an individual who asked what I did for a living. I was somewhat distracted and mumbled the word “risk management.” As I regained my focus this gentleman said “Oh, you’re a risk manager. I’ve had trouble with my Workers' Compensation...” and he began to talk about insurance. This was a prime example of the perception surrounding the terms “risk management” and “risk manager,” and how they’ve been equated solely to insurance coverage and insurance professionals in the past. I've witnessed this misrepresentation of the terms so many times that I felt not just inspired, but a public obligation, to write this article and help clear the confusion with the terminology that began long ago. PASSING THE SMELL TEST In the early 1960’s, two professors, Robert Mehr and Bob Hedges, developed the concept of Enterprise Risk Management. These two could easily be called the Godfathers of Risk Management. They published the first text to fully address the subject of business risk, "Risk Management in the Business Enterprise." The book introduced how risk management of an entire business could maximize efficiency, which would result in greater productivity. The basic premise was that all business risks should be managed, not simply those that could be "insured."

Read more →

Construction Risk Factors – Ignore at Your Own Peril

Construction Risk Factors – Ignore at Your Own Peril

“These factors don’t matter.” Those were the words I heard after presenting a contractor with a proven list of over 65 risk factors that can impact a construction company’s ability to make a profit.  He gave the list back to me with 20 risk factors circled and told be the rest were of no consequence. If I hadn’t previously run a number of construction companies and closely observed hundreds more, his words may have cast doubt.  But I knew better.  Some risk factors are certainly less important than others, but they all can play a roll in causing business failure; even seemingly unimportant risk factors can interact with one another to have a large impact.

With respect to business, a risk factor is defined as an activity, practice or condition that can cause financial harm. Risk factors vary by industry.  For example, smoking is a risk factor in the medical world, specifically related to the health of an individual. It does not apply to a construction business. Likewise, failing to have a job cost system in place is a risk factor related to a construction business, but certainly is not a risk to an individual. Risk factors are also different across businesses. A risk factor related to overstocking perishables in a restaurant due to poor inventory control does not apply to construction. Poor humidity control is a risk factor in a flower shop but not in a restaurant.

As you can imagine, there are many different types of risk factors and for the most part they are specific to an industry.  Some risk factors are really important because the harm they can cause is great.  Other risk factors are of lesser importance because the harm they can cause is not so great, thus having a smaller impact. To actually determine the impact a risk factor can have (its importance), takes years of case study. But suffice it to say, importance varies.


Read more →


Enterprise Risk Management Myths

The topic of Enterprise Risk Management can seem quite confusing, especially since there is a good deal of misinformation floating around.  In “The Top 10 Enterprise Risk-Management Myths,” Gordon Burnes of discusses some of the most common myths of Enterprise Risk Management.  The article is a good read for those interested in ERM, although we should point out that it is (like most information on ERM) still heavily IT/Financial focused.  A couple of the myths speak directly to the premise behind

Myth Number 7: You Can Manage Risk Only from the Center

No one is likely to argue that strong, central risk management is a bad thing. Unfortunately, many organizations make the mistake of investing only in a centralized function because it’s too difficult to federate, and they don’t know how to push risk management to lower levels of responsibility in the organization. It’s a classic issue of consistency vs. quality of information.

But, accurate information lies at the business line level. Organizations must augment their centralized risk management efforts with localized, distributed data, and the only way to reliably and cost-effectively do that is to invest in automated technology solutions.

Along this line of thinking, he continues:

ERM needs to be deployed bottom-up so that business managers are the first-line managers of risk, embedding enterprise risk management within the day-to-day business processes of the firm. They must understand the risk/reward trade-offs involved in their own decision-making. Risk management should create a bias for action, surfacing problems as they arise and empowering the entire organization to be risk managers. (more…)

Read more →