Three Questions: Doug French

With pressure being applied by shareholders and rating agencies and governance requirements such as those in the federal Sarbanes-Oxley Act, more and more insurers are moving to embrace enterprise risk management. And, as they begin looking at exposures across their organizations, increasingly they're hiring chief risk officers to play a part in the process. A recent survey by the Insurance and Actuarial Advisory Services practice of Ernst & Young L.L.P. found that 58% of insurers now have a CRO in place, and 8% more expect to have one in the near future. Still, despite that activity, the role of the insurance industry CRO is not yet clearly defined. Recently, Doug French, New York-based global director of Ernst & Young's IAAS practice, discussed the trend.

Q: Is the increase in interest in CROs significant in the insurance industry, and how are these individuals fitting into their organizations?

A: The last time we surveyed the market, about two-thirds of insurance groups had a CRO and that's increased perhaps twofold over the past two or three years. So it's obvious the larger insurance groups have decided to create the CRO position and they've gone out and filled those jobs.

The insurance industry is a little different than the banking industry and there's no standard CRO definition out there. The job description has not been bedded down and has not been standardized. Probably part of that has to do with regulatory issues, that ERM is being driven by rating agencies and not by regulators.

Q: So despite the variety in the CRO role at different companies, do you see the increasing recognition of the need for such an individual as a positive development?

A: CROs have a seat at the table. Risk committees have been formed and CROs either run them or are part of them. But while risk committees have been formed at insurance companies, a lot of them vary widely. Some of them are information sharing groups.

In some places CROs are running the committees and in others the CRO is part of the committee. In some places the CRO is someone who collects information from across the organization. In some places the CRO is a couple of steps down from the CFO level.

I think it is a positive. I think in a lot of cases it's something companies have done because they have pressure either internally or externally to hire one. It's a position that can have a lot of value you empower that person. We'll see how it shakes out.

Q: Would you expect to eventually see more standardization of the CRO role across the industry?

A: Absolutely. But it will take time unless the regulators step in and I don't see them stepping in anytime soon.

Information will be disseminated by consultants and others working with the insurance companies. Over time best practices will be shared. People will compare notes and they will move to a common ground. ERM is not going to go away. SOX 404 and the regulatory environment, it's only going to get ratcheted up.