In the beginning, there was nothing--or at least next to nothing.

"I came here my first day, went through orientation, went back to my office. There was a computer, that was it--not a file, not anything," recalled Carol Arendall, senior director-risk management for Naperville, Ill.-based OfficeMax Inc. The only other item she'd received was one sheet of paper that had the company's current insurance summary on it.

"That was it," she said.

It was a challenge, but one that Ms. Arendall met handily. She had spent two decades rising through the risk management ranks at Carson Pirie Scott & Co. in Chicago and then Saks Inc.--which had acquired Carson Pirie Scott--in Milwaukee, and had no plans to move.

"I spent almost 20 years at Saks," Ms. Arendall said. "You don't make a change lightly after you've been someplace almost 20 years. Saks was going through some organization changes and I was working on that when I got a call about this position at OfficeMax. I didn't have a resume out--it wasn't like I was thinking about it."

But "I found it kind of intriguing, knowing what OfficeMax was about to begin" in 2005, she said.

'Stars were aligned'

"I knew this was my destiny to come here. I really felt the stars were aligned for me to take this opportunity. You kind of feel this was the job that I'd worked my whole career to get here," Ms. Arendall said.

The changes and work she has accomplished since then have earned her a spot on Business Insurance's 2007 Risk Management Honor Roll.

"It was kind of a blank slate. Who wouldn't want that opportunity? Who wouldn't want that chance to come in, and you knew from the first day you got here that you made a difference?"

"I really think the biggest accomplishment was putting an effective risk management program in place with all the other balls rolling here. We knew we had to set up a new corporate office; we knew we had to put programs in place; we knew we had to solicit that information from other people in the organization to figure out what was going on," she said.

"I spent my second day thinking of the list of questions I was going to ask and spent the third day out in Boise, meeting with the folks out in the Boise group" in Idaho to discuss risk management issues.

She recalled that 2005 visit as being "challenging and exciting," and one in which she entered everything the Boise group said into her laptop computer.

"I think that's the key," she said. "You have to be a good listener and you need to solicit information" from internal and external partners. "You're just running through from one question to another question."

She also had to find what had been in place in Cleveland--OfficeMax's headquarters before the retail office supplies business was acquired by Boise Cascade. The two operations--the Boise paper products unit and the retail unit--had never been really integrated, she said.

Ms. Arendall found listening to be the key to success in her new role as she put together a risk management program and department.

"First you have to listen," she said. "You have to not only listen to what your outside vendors are telling you, what the program is that's in place, because certainly you have to understand that. Then you have to listen to what your internal partners are telling you. So I spent a lot of time going through the checklist of who the internal partners are--loss prevention, safety, store operations, human resources, accounting, and trying to get information from each one of those functional areas to tell me what are their needs, what do they need from risk management, what are they looking for--so we can put the most effective program in place."

As a result, Ms. Arendall drafted what she calls "our opportunities list." Then she sat down with John Jennings, OfficeMax's senior vp and treasurer. They drew up a list of priorities with the understanding that not everything could be accomplished at once, she said.

Instead, they identified key items that needed to be done in 2005 and followed them with items that had to be dealt with in 2006.

For example, Boise Cascade had operated a Bermuda captive--Clearfield Insurance Co.--for decades, she said. The captive is currently in runoff.

"It would be great if we were up and using the captive insurance company, but where would you put that in terms of what's the most opportune way for us to spend our time? It's a great thing, I think it's something we'll certainly look to use in the future, but the timing wasn't such that it was a priority for us."

"We certainly want to look at it going forward, but it was more important for us to do the basic blocking and tackling of risk management."

Ms. Arendall said that once she knew what the company had in place, she turned to outside resources to help make the most of opportunities. One of those was Marsh Inc.'s consulting group, which she called a "tremendous amount of help to us" in dealing with issues such as the size of staff needed and what roles those staffers should perform.

In addition to Ms. Arendall, the department currently consists of three claims people; one analyst; and a risk coordinator who handles certificates of insurance, a position created earlier this year.

Ms. Arendall calls bringing risk management down to the individual associate level her biggest ongoing challenge.

"We've been very effective bringing risk management within our corporate environment--we have great corporate partners who understand risk management, who understand the role, understand when they should get risk management involved--but I think it's more challenging at the individual associate level," she said.

Associates have to understand that everything they do can impact the company, and "I'm not just talking about insurance and claims," she said.

In fact, "every interaction they have with a customer impacts our company from a risk management standpoint. If you have a bad customer experience at a store, you may never shop there again."

She cited as an example an associate who wants to be helpful by loading a printer into a customer's car. "We certainly want to make sure that they know how to put it in the car so they don't rip the car seat."

Risk management has training materials that it uses in conjunction with human resources personnel, said Ms. Arendall. "It's pretty much training the trainer."