"We paid it back and never used a penny, he said, "but it provided security."

Mr. Ryan said that one of the products the company sells is life insurance, "We experienced that we had more money going out than coming in and significant revenue declines," he said. "We also realized our investments were being downgraded."

He added that when the company's assets were plummeting, the company found that it couldn't renew its debt, which normally was renewed every 364 days. "Nobody was going to loan us $500 million," he said.

The company had to make some changes, he explained, "We learned we had to do better. We needed to match our assets with our liabilities, we needed to sell our products and we needed to tailor our products so that we could diffuse some of the risks in them--we didn't want to take on all of the risk anymore."

From an underwriting perspective, he said the company needed to evaluate the type of risks it was taking. "For example, people that don't yet have a life insurance policy may be underwritten differently now," he noted.

An ERM program was in place before the crisis, "but we learned some things about ourselves and we tightened it up," He added. "I relate this to disaster recovery. We all think we have plans for disaster recovery. You test them, but you don't really test them until something happens."

The company had to get a handle on a number of issues, including, "our investment, our change of interest rates, regulatory issues, our surplus of liquidity, employee retention and morale," he explained, noting, "You could also add brand. Brand is important and if you lose that brand, you have a problem because it takes a long time to get it back."

The company's captives, he said, contain no third-party risk and ERM is done from "a global perspective, considering all our legal entities. So it's all encompassing," he said.

Mr. Ryan said his company has learned its ERM lessons. "We've tweaked--modified our investment policies, changed the type of risk we underwrite and take on. We've indoctrinated our lessons learned."

William Montanez, director, risk management explained that Ace Hardware has 2,500 stores in 50 countries and 50 states. It has been in business for 90 years and has $3.5 billion in wholesale sales and $15 billion in retail sales.

"We're making inroads towards ERM," he told NU Online News Service. "It's a process that's taking place in the different departments and it's bubbling up right now. We just need to aggregate it."

He is currently working on getting a committee together. "It's not called ERM, more like loss control," he said, adding that the committee will function at the management directory level, reporting to the board.

"The ideal is to try to at least get the vehicle in place, so we can make regular reports into the audit committee or the finance committee," he said.

At the same time, the board is becoming more aware of risk. "They're seeing all these different risks being presented by different functions, but it's very solid, so we're trying to take a more comprehensive look and give it a more strategic approach."

Like other companies, he said, "We are going along a revolutionary process to ERM. We have a good risk control process in place, we're extremely good at operational, extremely good at regulatory and financial, but the one thing we're struggling with, that I think most companies do, is the strategic, the forward looking risks."

Why is that so important? Because a lack of the strategic control process in place represents "a significant risk," he noted. The kind of risks that should be focused on are those with the most significant impact, he said. They include decline in core product demand, competitor infringement on core markets and margin pressure.

As a result these risks need to be included, "but we can't do them in big gulps or we won't be very successful." While they try to get ERM at the top level, "Most companies, even if they have an ERM process in place, it's a checklist--we did this, we did that. That's not necessarily good enough."

He went on to say that one thing that is valued by senior managers is "how we react--agility is a measure of our success."

The three items that comprise agility are early risk identification, risk assessment and risk mobilization, he added.

"How we react and how quickly we react will have a major impact on our companies. We can see that in the case of BP," Mr. Montanez noted.