ENTERPRISE RISK MANAGEMENT Mary Lynn Curran, VP, Clinical Risk Management Ken Felton, SVP, Senior Clinical Risk Management Consultant July 14, 2009

ENTERPRISE RISK MANAGEMENT

SOMETIMES IT’S HARD TO REACT TO RISK!

COMPETING DEMANDS Competition for resources The level of exposure Decision making and setting of priorities

TODAY’S GOAL We will speak about LTC risk – and not necessarily INSURABLE risk OUR challenge for today reflects YOUR challenge every day: Creating a framework to Give each risk context and Make each risk actionable Even when there is no risk transfer option available

ERM IS ESSENTIAL TO EVERY BUSINESS Lord Levene, Chairman of Lloyd’s of London wrote: “But risk management is not simply about preparing for the worst. It’s also about realizing your full potential. With a clear understanding of the risks they face, businesses can maximize their performance and drive forward their competitive advantage”. Levene, Lord; “Risk management is essential to every business”: Financial Times, October 17, 2006.

WHY CONSIDER UTILIZING THE ERM PROCESS Connect business and risk management strategies Determine full realm of risk exposure Improve business plan execution Monitor the effectiveness of enterprise actions

ENTERPRISE RISK MANAGEMENT PROCESS Identify critical risks ?) – Whether insurable or not!! Quantify their impact on organizational objectives Develop and implement risk management strategies Mitigate risk and maximize value

ENTERPRISE RISK MANAGEMENT Helps the organization understand that risk can be viewed not only as just a threat, but as an opportunity

WHAT IS ENTERPRISE RISK MANAGEMENT? ERM is a structured analytical process that focuses on identifying, quantifying, prioritizing and eliminating the financial impact and volatility of a portfolio of risks rather than on risk avoidance alone Essential to this approach is an understanding that risk can be managed to gain competitive advantage1 1”Enterprise Risk Management”, Defining the concept, recognizing the value, ASHRM, January 2006, pg., 1.

RISK IDENTIFICATION Goal: Capture all risks that could potentially affect the achievement of organizational objectives How does this occur? Surveys and questionnaires Checklists Flow charts System analysis FMEA Brainstorming Assessments based on records and experience Results of audits, inspections or site visits

ENTERPRISE RISK MANAGEMENT Four Areas of Focus Financial Risk – Risks that effect the profitability, cash position, access to capital or external financial ratings through investments, business relationships or the timing of the recognition of revenue or expenses Hazard Risk – Risks attributable to physical loss of assets or a reduction in their value, or injury to others or their property, including customers, employees or other business entities Operational Risk – Risks to the conduct of the business operations that result from on-going or changes in business practices, use of resources, external regulations or requirements, inadequate or failed internal processes, people or systems Strategic Risk – Risks to reputation, market position or ability to pursue strategic goals and objectives

FOUR QUADRANTS OF LTC ROUNDTABLE RISK FINANCIAL STRATEGIC HAZARD OPERATIONAL

RISK EVENT PRECIPITATING ENTERPRISING VALUE DROPS (# OF COMPANIES) Mercer MC Research Investigated risk factors behind the 100 largest one month drops in shareholder value among Fortune 1000 companies between 1993-98 Found top 100 stock drops Identified triggering event Determined causes of triggering event Categorized primary cause Analyzed results and implications % of top 100 24 12 7 6 4 2 1 11 3 5 10 15 20 25 Competitive Misaligned Loss of R&D Cost Overruns Management Foreign High Interest Lawsuits Natural Pressure Products Key Delays ineffectiveness Macro- Input Rate Disasters Customer Economic Commodity Fluctuation Issues Price Customer M&A Customer Regulatory Supplier Accounting Supply Chain Demand Integration Pricing Problems Problems irregularities Issues Shortfall Problems Pressure Strategic Operational Financial Hazard 58% 31% 6% 0%

FOUR QUADRANTS OF RISK FINANCIAL 6% STRATEGIC 58% HAZARD 0% OPERATIONAL 31%

ENTERPRISE RISK MANAGEMENT PROCESS Understand the organization’s business and strategic objectives List all of the risks in the four specific areas of focus; financial, hazard, operational and strategic Arrange risks by order of magnitude Risks are quantified in dollars or order of magnitude Severity of probability and frequency of loss (Risk Map) Risks are defined as uninsured, partially insured or insured What controls are in place to address the risks Develop a Financial Exposure Snapshot – identifying what degree of risk the organization faces Determine if the organization can do one of the following: Avoid the risk Transfer the risk Retain and manage the risk Identify what controls are in place to address each risk from 1) least risk control to 5) greatest risk control Determine gaps and opportunities for improvement

THE RISK MAP MODEL Risk # Description Type of Risk Probability Impact Score 1 Loss of state licensure Legal and Regulatory 10 2 Failing a high profile joint venture Financial, Strategic 9 81 3 Medication error Operational 8 5 40 4 Manufacturer backlog fails Technologic 20 Risk Priority Critical = 60+ High = 30-59 Medium = 16-29 Low = 1-15 Adapted from the Housing Corporation. London (UK) [cited 2005 Dec 15] Risk Management Topic Paper No. 4; 2003 Apr.

THE RISK MAP MODEL 10 1 9 2 8 7 6 5 4 3 Catastrophic Moderate   10 1 9 2 8 7 6 5 4 3 Catastrophic Moderate Insignificant Impact Not Likely Likely Almost Certain Probability Adapted from the Housing Corporation. London (UK) [cited 2005 Dec 15] Risk Management Topic Paper No. 4; 2003 Apr.

ENTERPRISE RISK MAP: PART ONE HIGH 5 CAT LF HF HS HS 3 4 SEVERITY LF HF LS LS 1 2 LOW 0% 50% 100% PROBABILITY OF OCCURRENCE

RISK EVALUATION Beswick, Kelsey and Bloodworth, Jane: Housing Corporation “Risk Mapping – Dilemmas and Solutions”; Risk Management Topic Paper No. 4

Measurements – Defining Impact

Description/Type of Risk THE ERM RISK MODEL Risk # Description/Type of Risk Frequency Impact Severity Controls Score Gap Interventions Risk Priority Frequency + Impact X Severity = Inherent Risk Score X Controls = Residual Risk Score

THE ERM RISK MODEL Risk # Description/Type of Risk Frequency Impact Severity Controls Score 1 Falls with Injury/(H) (F) (S) (O) 5 3 23 2 Decreasing Occupancy Rate /(F) (S) (O) 4 30 Elopement /(F) (S) (O) 15 Inconsistent communication among a multi-facility organization / (F) (S) (O) (H) 19 Gap Interventions Risk Priority Frequency + Impact X Severity = Inherent Risk Score X Controls = Residual Risk Score

RISK CONTROL ASSESSMENT AND ACTION PLAN Beswick, Kelsey and Bloodworth, Jane: Housing Corporation “Risk Mapping – Dilemmas and Solutions”; Risk Management Topic Paper No. 4

CONCLUSIONS: There is no right or wrong way to implement Enterprise Risk Management within your organization Enterprise Risk Management fosters communication among organizational departments Experts believe Enterprise Risk Management must be: Customized to the organization Kept simple and understandable Able to show immediate success Understand and utilize the process to maximize your value in the organization