Unifying Two Risk Programs After a Merger, Without Adding Headcount
Two years after a merger, the combined company ($2.4 billion revenue, 14 business units in three countries) still runs two risk management programs. Unit group A uses a 40-question annual self-assessment; group B uses a real-time incident log and no assessment at all. Combined insurance premium is $22 million across 31 policies, 41% of incurred losses come from three units, and certificate-of-insurance compliance is tracked in spreadsheets by two different coordinators. The new CRO has 18 months and $3 million to deliver a unified program, and the audit committee wants a dashboard by next quarter. Business unit leaders have been told the program must not add headcount.
1. Sequence the first 12 months. What do you implement, in what order, and what do you deliberately defer?
Read the worked answer
Sequence by dependency, not by ambition. The audit committee wants a dashboard next quarter, so the first move is to establish what data actually exists and make one visible win before asking anyone to change a process.
Months 0-3: baseline and credibility
- Exposure inventory and consolidation of the 31-policy schedule into one view; identify duplication, gaps, and inconsistent retentions across the two legacy programs.
- Centralize COI compliance. It is measurable, it is currently broken, and fixing it is a visible win that costs little and protects contracts.
- Publish dashboard v1 using data you already have: premium, incurred losses, COI compliance, incident counts. Do not wait for perfect data.
Months 3-9: one common process
- A single risk taxonomy and one assessment standard, replacing the 40-question form and the stand-alone incident log with one register plus one incident process.
- A risk champion in each of the 14 units, as a collateral duty with a defined time allocation.
- Deep dive on the three units generating 41% of losses, using their own numbers.
Months 9-18: optimize
- Retention and insurance structure strategy; renewal consolidation; KRIs with tolerances; culture and near-miss metrics.
Deliberately deferred: a GRC software replacement (long procurement, low early value, easy to substitute with existing tools), full quantitative scenario modeling, and any attempt to standardize all 14 units simultaneously. Big-bang rollouts fail on adoption, not on design.
2. Design the audit committee dashboard. Which metrics, at what frequency, and what makes a metric decision-useful rather than decorative?
Read the worked answer
Decision-usefulness test. A metric belongs on the dashboard only if it has a named owner, a target or tolerance, a defined action when breached, and a denominator that makes it comparable over time. If a metric cannot fail, or nobody would do anything differently when it moves, it is decoration.
Tier 1, quarterly to the audit committee:
- Total cost of risk by business unit and trend (premium + retained losses + admin + loss control).
- Incurred losses versus expected, with the three high-loss units called out separately.
- COI compliance percentage, with the count of non-compliant contracts.
- Top five enterprise risks with direction of travel and owner.
- Claim closure rate and average cycle time; aged open claims.
Tier 2, monthly to operating leadership (leading indicators):
- Near-miss and incident reporting rate per 1,000 employees, plus reporting timeliness.
- Corrective action closure percentage against due date (the single best predictor of whether a program is real).
- Self-assessment completion and quality score, sampled and reviewed rather than merely counted.
- KRI status against tolerance, with red items escalated by name.
Format guidance:
- Normalize: losses per $100 million of revenue or per 1,000 employees, not raw counts, so units of different sizes are comparable.
- Show trend and target, not a single period.
- Avoid composite risk scores that cannot be decomposed. If a number goes up, the reader must be able to see why.
- Keep it to one page. A dashboard nobody reads is not a control.
3. How do you drive adoption across 14 business units with no added headcount, and what do you do if the three high-loss units resist?
Read the worked answer
Adoption comes from embedding, not exhorting. A parallel risk process that sits outside how people already work will be ignored no matter how well designed it is.
Levers that do not require headcount:
- Embed into existing gates: contract approval, procurement, capital requests, and budget cycles. If a capital request must state which risks it increases and how they stay in tolerance, risk thinking happens without a new meeting.
- Make the output useful to them first. Give unit leaders their own loss and premium allocation data, and show them what the program does for their P&L. COI compliance protects their contracts; claims data helps their budget.
- Write it into roles and incentives: risk responsibilities in job descriptions, a risk component in unit leader objectives, and an allocation mechanism so units that reduce loss keep some of the benefit.
- Risk champions as a defined collateral duty with explicit time allocation and a direct line to the CRO.
- Executive sponsorship: a mandate from the CEO and audit committee, stated once, loudly, and then relied on rather than repeated.
If the three high-loss units resist:
- Start with their data, not the framework. A unit leader who sees that their unit drives a disproportionate share of premium allocation has a financial reason to engage.
- Offer a shared-savings or allocation adjustment so improvement accrues to them.
- If the unit leader still will not own the risk, escalate - document the risk, the owner's refusal, and the decision, and take it to the CEO or audit committee. That is a governance decision, not a turf war, and it should be recorded as one.
- Do not let resistance in three units stall the other eleven. Sequencing around blockers preserves momentum and creates internal pressure.