By managing risk, companies prepare for Y2K

ZD Net's recent survey of PC users concerns about Year 2000 problems and preparations underscores a key misunderstanding. During 1999, we all need a crash course on the role of information technology in business and how the cost of risk is managed. The fact is, companies don't see the risk consumers do, because they collect vast amounts of information the consumer is unable to access.

For, you see, while consumers perceive the potential for massive disruptions, the actual cost of managing corporate risk is falling, despite increased uncertainties about Y2K litigation. According to a new survey by the Risk and Insurance Management Society and Ernst & Young LLP, the risk management costs are falling to historic lows even though 22 percent of companies say they anticipate some "involvement in Y2K litigation."

Corporations were paying just $5.25 per $1,000 in revenue to manage risk in 1998. That's down from $8.30 in 1992. The cost of liability insurance fell by 32 percent between 1992 and 1997, while actual liability losses declined by 53 percent in the same period.

Why are companies paying less for insurance? Because they are collecting so much data that they can actually anticipate problems more effectively than ever before.

Like surgery, which a hundred years ago was a medically-managed form of blunt trauma, management's ability to diagnose and repair problems has improved substantially as technology has provided the ability to collect more data. Just as it is now possible to have heart surgery without having one's chest broken open, the day-to-day collection of information from far-flung parts of a company allow management to diagnose and respond to problems with far less effort than was required only a few years ago.

Of course, many IT professionals and "Y2K experts" don't see these improvements in management, preferring the Dilbert view of incompetent managers, which is a hell of a lot more fun and makes for a better story. In reality, there are as many smart people in upper management, as a percentage, as there are smart programmers and workers. That's why insurers are charging less for liability and disaster coverage for companies these days: those smart people are being empowered by technology.

Yes, there are still many companies that do a poor job of anticipating risk. And, yes, many small businesses involved with Y2K and computer services are paying higher insurance premiums - if they can get insurance at all - but the fact is their clientele in the Fortune 1000 are paying less. The little guys either can't or don't do as much work on risk management, and it costs them.

As more companies add chief information officers to their senior management, they are realizing huge gains in risk management costs through their distributed networks and information analysis. It's controversial, but not unreasonable, to conclude that the real benefit of PCs and networks may not be increased productivity, but reduced risk.

In effect, companies can run real-time actuarial table on their risks and respond quickly to threats. That the Y2K problem, which 61 percent of firms surveyed by RIMS/Ernst & Young said they had assessed, has not raised risk management costs, demonstrates that despite the secrecy of corporate Y2K projects there is ample reason not to over-prepare.

While consumers rush to prepare for problems, spending money on supplies and products they may never use, corporations are enjoying decreased costs for preparedness to deal with business interruptions and lawsuits. What's the message? People need to take a deep breath and try to see clearly the real problem, fear, in order to respond appropriately.

What the ZD Net survey found, though, was that 15.8 percent of consumers surveyed still plan to pull all their cash out of banks. Likewise, some 23.5 percent of consumers plan to stockpile food, fuel and supplies.

But, unlike the large corporation, which can shift resources from new investments or simply allocate more depreciable spending to Y2K, the typical family cannot make these preparations without overextending themselves financially.

So, that raises the question, what is the appropriate level of preparation? If you take the cost of risk management from the corporate world, it's just 0.0525 percent of income. For a family of four with a $38,000 annual income, the "right" level of spending on Y2K preparation is about $200. Just about enough for a week's worth of groceries, water, and other supplies, like toilet paper, first aid and wood.

As consumer or a member of a supply chain, then, you need to be sure to collect as much accurate information as you can, so that you can decide how best to apply your preparedness budget. That's the important lesson of risk management. Rather than focus on fears about how banks, governments or companies may respond to Y2K, you have to begin from a candid assessment of your own exposure - what is key to your comfort or, if you insist, "survival"? Who is responsible for getting that product or service to you? What's their Y2K status? Invest in finding out and, if you find a problem, then spend to prepare.

If you want to be the sucker, though, do what the companies responding to the RIMS/Ernst & Young survey don't do - react based on fear, spend too much money and pay the price later.