Risk Management and IT

When Microsoft’s claims manager BrianRM: What were the biggest technical hurdles you had
Warren (risk management) and senior programto overcome in working together?
manager Ed Shoemaker (treasury informationWarren: There has been a learning curve throughout
technology) joined forces five years ago to bring themy working with IT. I am always trying to
Redmond, Washington-based softwareunderstand IT budget cycles, how IT prioritizes
giant’s IT and risk managementprojects, learning how to express my business
departments together, they knew their work wasrequirements in ways that can be supported by IT.
cut out for them. Their challenge was not just toShoemaker: Brian came to the company about six
manage Microsoft’s risk more efficiently,years ago and I came about five years ago. By that
but also to affect the kind of institutional changetime, our departments already had a history
within the organization that would long outlive eithertogether, but it was very young. I came in as a
of their stays. Risk Management Magazine spoke withcontractor to deploy the first RMIS system at
Warren and Shoemaker on the difficulties of bringingMicrosoft. That was the real beginning of our
their departments together, what they haverelationship in terms of providing systems needs for
achieved and how their progress serves as a modelMicrosoft’s risk management department.
for other organizations.IT was not doing much for risk management prior to
RM: What makes Microsoft’s riskthat.
management and information technology demandsI’m unique in the IT group at Microsoft
unique?because I came in from eleven years in the insurance
Warren: Our main product is intellectual property.industry, so I already understood risk financing and
Consequently, we don’t have theinsurance. The challenge for me has been learning
property exposures that other businesses might. Wehow to help the business understand IT and helping
have relatively low investment in physical plants, andBrian meet his challenges while trying to be pragmatic
relatively less workers’ compensationabout striking a balance between evolving process
exposure than most manufacturing or serviceefficiencies and delivering systems solutions.
businesses. But we do have far more concern overRM: What cultural obstacles stood between your
intellectual property rights issues, contractual issues,departments?
etc.Warren: When we started working together, there
When you look at this company in terms of itswas a defensive attitude between IT and the rest
balance sheet, it’s a whole other dimensionof the business. Certain projects hadn’t
of opportunities and challenges. In many cases,gone well and a lot of blame got tossed at IT, so
Microsoft has more assets than the insurancethey did not want to get burned on future projects.
companies we consider doing business with, so weWe struggled with that for a little while.
have to ask ourselves, “What are weFor risk management, we had to figure out how to
trying to accomplish?” The answer to thatdefine our business requirements. That became an
is we are trying to achieve flexibility for alternativeexercise in documenting everything so that there
risk financing from other-than-commercial insurancewould be no opportunity for us to come back at IT
markets. This creates a lot of new business systemslater if a project fell through and say: “This
to manage.is your fault.”
Shoemaker: Microsoft’s significant cashWe realized if the business uses the system
resources give us the ability for creative risk financingsuccessfully, that results in a win for risk
that other companies do not have. As such, ourmanagement and for IT. If the project fails, it is a
unusual business systems needs take us out of theloss for all of us. Once we broke through the bad
mainstream of packaged solutions. When Brian comesblood created by others, we aligned the interests of
to me with a business need or a systems need, itour organizations, and developed a win-win mantra.
may not be mainstream. I have to take more timeThings started to smooth out and get better from
to understand his needs in creating and deployingthat point on. It gave IT permission to be flexible in
those solutions. This opportunity creates additionaltrying to solve our systems requirements, and if
challenge.something unsuccessful happened because of their
RM: What inspired Microsoft’s IT and riskbeing flexible, we would not blame them.
management departments to work together?Shoemaker: Now we share common values and goals.
Warren: We were not satisfied with the policy sideBut when Brian and I started working together,
of any RMIS [risk management information systems]IT’s business relationship with risk
products we looked at on the market, largelymanagement was like the Wild West. The dialogue
because of the unique risk financing Microsoft doesbetween IT and risk management was:
with captive utilization and some finite programs with“You told me you need to handle a certain
extended durations and broad coverage. Standardrequirement, I think I have a system for you,
RMIS does not encompass multiple-year policies orhere’s what you need.” And we
integrated policies with single-aggregate limits acrossgave it to them. They would end up coming back to
dissimilar additional coverages like property andus, saying: “This is not working for
general liability merged under a single limit.me!” So we told them they had to become
We realized we were not going to get what wemasters at telling us what they need, to articulate
needed from our RMIS vendors, so we opted tothat, and we would then build something to meet
develop a RMIS solution internally. We went thatthose needs.
route as a last resort because the costs can beRM: Given your departments’ common
prohibitive. But management decided it was importanthistory, would it be as difficult to build a Sandhurst II?
enough for IT and risk management to jointly workShoemaker: It would be much easier. When I came
on a proprietary risk financing program code-namedto Microsoft, I was a singular capital investment
Sandhurst, which launched on October 18.because I already understood risk and insurance. My
Sandhurst is a Web-based software solution youchallenge was to transfer my knowledge to the
access through Internet Explorer. It can captureother IT professionals. Sandhurst was a good
virtually any risk financing program or instrument youopportunity to do that. Because it was an internal
can think of. Extra aggregate limits, coverages, anycustom application, I could employ other analysts,
sublimits, per occurrence limits, retentions, all that. Itdevelopers and testers to help build it. They could
can set up an occurrence and suggest, based onget their hands dirty with this system and its
characteristics of that occurrence, which of ourdocumentation, so as we move on to other projects,
policies or programs have available limits and couldthese people have a greater familiarity with risk
possibly respond and provide coverage. This allowsmanagement’s systems needs. I am more
the user to take additional steps to select coverages,replaceable today than at the beginning of the
lock them in and make a record of the claim. Theproject, which is something we endeavor to do.
actual handling of the claim is still manual; you have toWarren: On the risk management side, we have
call the carrier, etc. But over time, this will give usexpanded my skill set to two or three people
much better perspective on the remaining balance orbeyond just me. On the IT side, Ed did a lot to
limits of our risk portfolio so we know at any givenexpand exposure to risk management systems to
time what programs have the potential to respond tothe other people on his staff. A couple of years ago,
specific situations.it was just Ed and myself. Now, there are four to
Shoemaker: Sandhurst is designed to support ourfive people on the IT side and the risk management
business needs for five years or more. We are goingside who are familiar with the process and can work
to start improving the code base immediately, so ittogether. We have built an institutional skill set
will go through an evolutionary process until,amongst the staff that will make things like
ultimately, Microsoft’s business needs willSandhurst much easier in the future.
have changed so much it will become cost effectiveRM: What words of advice would you give to
to create something from scratch rather thancolleagues trying to accomplish a similar goal?
continue to update Sandhurst. The only thing thatShoemaker: You should always scale your business
would derail that would be a sudden and significantrequests to IT according to whatever competency,
change in how Microsoft does business—abudgetary and other business restraints may exist. If
fundamental, underlying change in our databaseIT and risk management have not yet developed a
requiring such a substantial rewrite of the applicationmature relationship, if they don’t have a
that we would have to start over from scratch.big budget with lots of resources, then scale your
RM: Would you consider Sandhurst to be therequests to something that is possible for you to
capstone of your departments’achieve. Brian and I cut our teeth on smaller projects
collaboration so far?at first, enhancing an existing system or building a
Shoemaker: Sandhurst is a sign of the maturingnarrow function. As we got more successful at
relationship between Microsoft’s IT andworking together, we learned how each
risk management. If Brian and I started working onother’s processes worked, and whatever
Sandhurst four or five years ago, the project wouldpitfalls may exist between them. Once you get a
not have been as successful as it is today. We putjoint success, even if it is a modest one, you can
Sandhurst on the board, determined its specs,build on that.
scheduled it, costed it, made changes along the way,Warren: Try to get inside knowledge of how your IT
had a commitment date of 10/16 and missed that bydepartment functions. Learn how it sets its budget
only two days. All things considered, that’sand its priorities. Be realistic about what you need.
pretty good. Obviously, it was a cooperative effort,There are a lot of good services being offered by
for both IT and risk management.RMIS companies, so asking IT to build something
Warren: The concepts for this were prettyspecial for you might not always be necessary. You
groundbreaking. It presented a significant challengeare going to have problems if you ask IT to deliver
for an IT organization when the business is strugglingsomething unreasonable. But if you come in with a
to define new processes at the same time it is tryinglogical argument and a business case that makes
to build a system to run those processes. It wouldsense, the challenge then becomes how to engage
have been far easier to automate a well-establishedIT and get what you need. IT is motivated to make
manual process. We automated risk financing at aitself relevant to the business. If you present your
point in our experience when it was not aproject as an opportunity for IT to add a
well-established business process, however, whichvalue-added resource or a useful new business
made it much harder. We had to decide what ourfunction, you will be much more likely to get its
standard was going to be as we went along.support.