A doctor sat at a desk surrounded by data

Risk & Innovation

Balancing Risk And Opportunity: Data’s Role In Enterprise Risk Management

March 22nd, 2017

Overview

As we collect more data, and become more sophisticated within our use of analytics, we can understand, manage, and mitigate more emerging risks than ever before.

In turn, our better-informed outlook changes how we approach risk. Instead of considering individual incidences, we now have the data to think about and build new approaches to understanding overall risk – including mitigation and management strategies. Enterprise Risk Management (ERM) provides a framework for understanding and responding to business uncertainties and opportunities with relevant insights that are delivered through common, integrated risk identification, analysis and management disciplines. Approaching ERM with analytics can provide a more strategic approach to holistically identifying, managing and mitigating risks.

“Business leaders are not only looking at specific elements of risk anymore. It’s not just about single claims, like medical malpractice, which can be easily priced from an insurance perspective,” says Dominic Colaizzo, Chairman of Aon’s U.S. Health Care Practice. “Increasingly, leaders are looking at other risks which have not been measurable or predictable in the past, but are becoming more so.”

When assessing the risk of, for example, property damage, risk managers have decades of data to draw on, data like incidence rates or average claim size, which helps model exposure profiles. Emerging risks, precisely because they are new, do not have this data. “What really keeps risk professionals up at night is emerging enterprise risk – big picture risks such as cyber, damage to brand and reputation, and supply chain,” says Colaizzo.

Few industries exemplify this better than health care.


In Depth

Why Health Care?

In health care, data has been criticial in the education of practitioners and the treatment of patients – it has provided the necessary information needed to establish best practices and clinical protocols, and provided the metrics that help increase the quality of care provided.

It can also predict, and even impact, medical costs. Throughout the globe, medical costs are rising. In the U.S. alone, health care costs are around $3 trillion – accounting for 17.5 percent of national GDP. These costs are only set to rise as the effects of aging populations and changing lifestyles make themselves felt.

Luca Franzi De Luca, Vice President, Aon Italy, says: “The state of health care is a truly global concern. More than ever, care providers need new ways to manage the costs – and risks – that coming years will bring.” Data will be key in addressing these issues.

The Data Revolution And A Better Understanding Of Risk

The more parts of a system that you can observe – such as cost, quality, exposures to loss and population health – the more you can predict. And the more you can predict, the better you can understand, and price, risk. As such, ERM is becoming more of a possibility than ever before.

  • Risk control and traditional operational risks: From malpractice claims to workers’ compensation costs to property exposures, the health care industry now has decades of historical data that enables it to better manage and price risk. However, emerging risk poses a more severe problem: relatively new threats such as cyber attacks do not have the historical data behind them to give organizations a proper understanding of their exposure. And as health care – both data and actual care itself – becomes increasingly digitized, whether through backend services like databases or digital infrastructure, or through frontline services like robotics and smart health devices, cyber will become more and more important. This is already happening. In 2016, health care was one of the most attacked industries because of the value of patient records. And as with malpractice or workers’ compensation, as more data is gathered for cyber risk, we are better equipped to build risk models to address this emerging enterprise risk.
  • Population outcomes: One way for health care organizations to control their risk burden is to minimize the amount of illness in the world beyond their walls, and data is helping them to achieve this. For instance, big data, machine learning algorithms, and better integration between public services is allowing more and more sophisticated forms of epidemiology, and can help measure and control incidence rates in populations at large. This means a reduced risk profile for frontline care providers. “There’s a connection between keeping people healthy and enterprise risk. For example, malpractice claims will decrease if more and more individuals are healthy and not hospitalized,” Colaizzo explains. “Furthermore, analytics is enabling us to focus on 20 percent of the population that is driving 80 percent of the cost of care.”
  • Quality of care: Medical malpractice is estimated to cost around $55 billion cost in the U.S. alone. Improving the overall quality of care that individuals receive could reduce related costs in this area. Data has enabled organizations to better understand their processes, and eliminate the inefficiencies and errors that can lead to litigation.
  • Costs: Better data modeling processes can also give deeper insights into an organization’s total costs. For a hospital, keeping track of operating costs may be relatively straightforward. But other costs, such as those generated by supply chain risk, fluctuations in pharmaceutical or technology prices, or business interruption from a cyber attack or pandemic, may be more difficult to grasp. Advanced data tools can give health care providers a better understanding of their total financial burden.

Data tells us about the world. The better we are at collating and analyzing data, the better we are at predicting how the world will behave. The use of data in the health care sector is providing a greater visibility into all potential channels of risk – and also, new opportunities. Instead of looking at potential risks on an item-by-item basis, risk managers, senior management, and the C-suite can start thinking about risk in macro terms. What is our organization’s total risk bearing capacity? How does our current risk profile fit within that? And what strategies can we pursue to mitigate or finance those risks?

Data technologies and methodologies are evolving all the time. Using these developments to gather and analyze more and more data around emerging risks is essential. This isn’t just important in the medical industry, but something that all industries can and must do. Only then will their strategies be able to deal with emerging, enterprise risk. “Organizations will be able to focus holistically on enterprise risk management, rather than focusing on specific liabilities as in the past,” says Colaizzo.


Talking Points

“No hospital executive can afford to ignore policy developments emerging from Washington. But what is surprising is how rapidly operating challenges are mounting for hospitals across the country in advance of any policy changes. It is worth asking what hospitals can do to fortify themselves against unpredictable changes in policy or operating challenges that expose their patients and their institutions to potential financial hardship.” – Jeff Goldstein, Associate Professor, Public Health Sciences, University of Virginia, Charlottesville


Further Reading

Related stories