Risk managers deserve to know the criteria on which management will evaluate them for pay, performance, promotions, or job security. Likely more than one company has used yardsticks such as loss ratio, total cost of insurance, number of claims annually, and so on. These are quantitative metrics that are readily available (or extractable) for the company. 

Because risk managers typically report to financial types–CFOs, treasurers, comptrollers, and so on—most of the evaluation criteria for a risk manager's performance focus on quantitative metrics.

On the other hand, we must be careful to differentiate between the numbers the risk manager can control and those that a risk manager cannot. Some people believe that linking risk manager performance—and by extension compensation—to some of these metrics is dangerous and pernicious. It may create incentives for game-playing, whereby risk managers “game” the numbers in the direction that maximizes the bonus. Some examples would be saving money on the insurance budget by not buying enough insurance, manipulating and under-reporting claims in order to look better, and the like. Some believe that management descends a slippery slope by linking risk manager compensation to metrics such as lowering the insurance budget.

Fairness in Appraisal Standards

An equity/inequity issue surfaces here as well for the risk manager. For example, should your compensation take an undeserved hit because of factors beyond your control, like a large uptick in losses that nobody could have foreseen or prevented? Does the risk manager reap an unearned bonanza because of changes in market conditions (such as a softening insurance market) that drive premiums lower due to no action on the risk manager's part? These are fairness issues where a risk manager can either be unjustly punished or rewarded. Having said that, there may not be anything evil in basing some contingent compensation on reasonable metrics such as the aforementioned. Having these determine base compensation increases gets trickier.

If you take credit for reduction in insurance costs during a soft market, then are you willing to take the hit when those costs jump (through no fault of your own) in a hard market? For some risk managers, that is not sound. As one risk practitioner said, “Don't take credit for the wins unless you're ready to get credit for the defeats.”

Well, if we don't include quantitative metrics and yardsticks like reductions in insurance budgets and reductions in claims/losses, the risk managers perform its calculus, then what in the world do we include?

Some do believe that the soundest way of conducting performance-based compensation for risk managers is identifying the main issues facing the business and setting targets based on those. When attacking an above-average workers' compensation loss ratio, you could establish a target to reduce debt, either by directly targeting the actual number of workers' compensation claims or by tracking the number of injuries, whether resulting in a claim or not. You can also track the number of workdays lost due to injuries. For a company facing substantial fleet auto exposures, you could target the number of vehicle accidents in a given year.

The Cost of Risk Yardsticks

Other risk practitioners suggest that a sound approach is to agree on a total cost of risk benchmark and apply a bonus scheme to that benchmark. According to these advocates, it is the only calculation that factors in losses (both insured and retained), risk financing costs (actual and frictional), and cash flow from risk activities.

Measuring cost of risk entails totaling up the following components:

• Insurance premiums, including commissions paid to intermediaries.
• Retained losses through deductibles, self-insured retentions, and uninsured losses.
• Risk management department costs, including staff salaries, risk management information systems, and so on.
• Outside vendor costs for TPAs, consultants, lost control services, and attorneys.
• Indirect costs, such as business reputation, lost productivity, and other subjective factors.

No one suggests that the risk manager not be reviewed for performance or that he or she breeze through the process for being a nice person. The challenge is to drain subjectivity out of the appraisal process. Strong risk manager performance cannot be like the classic definition of pornography: “I can't define it, but I know it when I see it.”  If we avoid subjective criteria, then the challenge then is to develop consensus yardsticks that make sense and create the right incentives, which are equitable. Crafting this is a tough challenge.

No one is offering million-dollar contracts to top-flight risk managers. Nevertheless, risk managers should be highly aware of the criteria used to appraise their performance. If they have the chance, they can provide sensible input on shaping these criteria. A clear understanding of goals blended with relentless execution can make a risk manager the corporate equivalent of a first-round draft pick.