“PROMISED LAND” ENTERPRISE RISK MANAGEMENT

1. “PROMISED LAND” ENTERPRISE RISK MANAGEMENT Willis HRH Health Care Practice 13th Annual Forum July 14, 2009

2. ENTERPRISE RISK MANAGEMENT • Moderator: • Ken Felton, RN, MS, CPHRM, FASHRMWillis National Health Care Practice • Panelists: • Shulamith KleinSenior Director of Risk and Insurance ServicesEmory University & Emory Healthcare • Sheila Hagg-RickertSystem Director of Risk ManagementCHRISTUS Health

3. HOSPITAL FINANCIAL AND ORGANIZATIONAL RISK INCREASING • Financial risk growing in healthcare • Complexity of risks are changing • The Noblis – Center for Health Innovation research • Losses in investment income • Difficulty accessing capital • Risk Managers will face increased challenges

4. AMERICAN COLLEGE OF HEALTH CARE EXECUTIVES • Research concluded: • Quality and patient safety a top three concern for CEOs • Creating • Implementing • Monitoring

5. RESEARCH OF U.S. HOSPITALS • The Agency for Healthcare Research and Quality • “A study of U.S. Hospitals found that while most collect information on adverse events, far fewer make effective use of the data”1 • The Senate Health, Education, Labor and Pensions Committee • Concluded: No consistent progress in improving quality • United States ranked last out of 19 countries on mortality 1Health Care Daily, Patient Safety Most Hospitals Collect Adverse Data But Systems Need Improvement, Volume 13, Number 236, Tuesday, December 9, 2008., pg. 1.

6. CRISIS IS FAILURE OF RISK MANAGEMENT • Enterprise Risk Management (ERM) is attracting more attention • Corporate cases have motivated organizations to embrace ERM • External pressures encouraging enterprise-wide risk • Organizations have begun to develop, support and commit to ERM

7. Enterprise Risk Management, is it the “Promised Land”?

8. Emory at a glance Teaching, research, academic healthcare 23,500 employees 12,500 students $ 3.0 billion operating budget 2

9. Emory HealthcareFacts & Figures Largest healthcare system in Georgia Tertiary, geriatric, orthopaedic hospitals Multi-specialty & pediatric outpatient Long term care & independent living 3

10. Emory HealthcareFacts & Figures 1,241 occupied hospital beds 11,100 employees 533 fte employed physicians $ 1.6 billion net revenue $ 64 million charity care 4

11. Emory’s philosophy regarding risk “ Risk, in one form or another, is present in virtually all worthwhile endeavors. We recognize that not all risk is bad and our goal is not to eliminate all risk, for by doing so we would cease all productive activity. Rather, our goal is to assume risk judiciously, mitigate it when possible, and prepare ourselves to respond effectively and efficiently when necessary.” 5

12. Why ERM? Break through operational silos Identify key exposures Gauge vulnerability points Assess appetite for risk Identify best practices Plan proactively Prioritize resources Reinforce accountability NO SURPRISES! 6

13. It starts at the top Audit Committee of the Board Chief Internal Audit Officer Exec VP Finance and Administration The President is on board 7

14. ERM Executive Sponsors Committee (Reputational & Strategic Risks) ERM Steering Committee Finance and Investment Information Technology Campus Safety and Physical Plant Governance and Corporate Affairs Academic and Student Affairs Human Resources Research Healthcare and Research Healthcare • President (Committee Chair) • Provost and Executive VP for Academic Affairs • Executive VP for Finance and Administration • Executive VP for Health Affairs • President and CEO, Emory Healthcare • Senior VP and General Counsel • Senior VP and Dean, Campus Life • Vice President and Secretary of the University • Vice President for Communications & Marketing • Senior Director, Office of Risk and Insurance Service (Co-Chair) • Vice President, Finance • Vice President of Investments, Chief Investment Officer • Senior Vice Provost, Academic Planning & Faculty Development • Special Assistant to Sr. VP & Dean, Campus Life • Vice President, Human Resources • Vice President, Information Technology & CIO • Chief Audit Officer (Co-Chair) • Deputy General Counsel • Vice President, Health Affairs Research • Vice President for Research Administration • Vice President, Campus Services • Chief of Staff to Vice President, Campus Services • Executive Director, Critical Event Preparedness and Response June 26, 2009

15. Emory UniversityEnterprise Risk ManagementGuiding Principles Emory upholds an early-warning system for identification of adverse occurrences; All individuals are empowered to report problems and concerns early on, without fear of retribution; Reports of adverse occurrences are responded to promptly and thoroughly; Investigations of adverse occurrences, complaints, and concerns are conducted with integrity and continue until the fact-finding process is concluded; Reliable and useful information is shared promptly with leadership and other key constituencies; Communication with the Emory community and the public at large is pro-active, honest, and respectful of individual privacy; Emory maintains a framework for regularly assessing the effectiveness of risk management practices and a culture that fosters process improvement when indicated. These are the principles to which we hold ourselves, and those with whom we partner. 9

16. It’s a process…phase 1… Sub-committees identified 555 “risks” Ranked by severity and frequency Steering Comte edited down to 141 Rankings re-assessed 57 “key” risks based on final risk factors 10

17. …phase 2… Primary Operational Leader (“POL”) - primary responsibility over functional area where risk has greatest potential impact, (e.g., CEO, COO, Dean, EVP, Provost) Risk Mgt Process Owner (“RMPO”) - sufficiently familiar with risk to prepare comprehensive Risk Management Plan, (e.g., Directors, Quality Officers, VP) 11

18. …phase 3… President charged RMPOs with Risk Management Plans Steps being taken to manage risk at acceptable level Operational and communication responses to adverse occurrences 2 pages in 90 days 12

19. …phase 4… Steering Committee reviewed 57 plans Accountability Existing interventions or wish list? RMPOs revised plans 57 plans delivered to Executive Committee 13

20. …and phase 5 5 risk hearings/yearly, 3-hour sessions Maximum 2 operational areas/session 5 min presentation, 5 min q&a Bridge gap between exposure and response plan? Incorporate “best practices” Balancing mitigation costs with strategic goals Are we at an acceptable risk level? 14

21. 18 months to kickoff Exec Comte charges Steering Comte with risk identification Pres rolls out Comte Framework “Key Risks”, POLs, Guiding Principles Pres charges RMPOs Plans to Exec Comte Initial Plans due Plan review 1st risk hearing Mar/Apr 2006 August 2006 Nov 2006 April 2007 May 2007 June 2007 August 2007 Sept 2007 15

22. Lessons learned Process itself reveals trends and opportunities for risk mitigation Need to stay focused on critical risks Priorities change over time due to internal and external factors Set reasonable expectations 16

23. New in FY09 #1 Adjustments to “key” risks - Conflict of commitment Liquidity risk 17

24. New in FY09 #2 Mapping - Share key risks with Board Committee responsible for specific operational area Governing body needs to be aware of risk management processes in place Audit Committee maintains responsibility for overseeing ERM process 18

25. Perspective Bubble charts, COSO cubes, and influence diagrams aren’t for everyone It’s easy to over-engineer the process Privilege and confidentiality matter and can be managed Staff make decisions involving risk every day without calling it Enterprise Risk Management 19

26. …And I believe in a promised land… Broad-based management ownership + Principled action + Common sense = Success 20

27. Frequency & severity Likelihood of occurring (frequency) 1-low: <10% chance of occurring in 2 years 2-medium: <25% chance of occurring in 2 years 3-high: <50% chance of occurring in 2 years 4-very high: >50% chance of occurring in 2 years or already occurring Potential Impact (severity) 1-minor: unlikely to have permanent or significant effect on institution’s reputation or achievement of its strategic objectives 2-moderate: will have significant impact on institution but can be managed without major impact 3-serious: will have significant effect on institution and require major effort to manage and resolve occurrence, as well as its ramifications 4-very serious: will threaten existence of institution if not resolved Risk factor = [(.50) x (frequency)] + (severity) 21

28. Promised Land: Enterprise Risk Management Sheila Hagg-Rickert, MHA, MBA, JD, CPCU, DFASHRM, CPHRM CHRISTUS Health Houston, TX July 14, 2009

29. CHRISTUS Health and Emerald Assurance Cayman, Ltd: A Brief History • CHRISTUS Health: • Founded in 1868 in Galveston, TX • System one of the 10 largest Catholic healthcare systems in U.S. • 40+ hospitals and other facilities in TX, LA, UT, MO, AR, GA and NM+ Mexico • Assets>$ 5 billion and FY 09 revenues > $4 billion • Emerald Assurance Cayman, Ltd. • Formed in 2003 • Single-parent structure • Assets> $150 million • Retained risk, excess and reinsurance coverage- U.S., Bermuda and London

30. The CHRISTUS ERM Process to Date • Formally initiated mid-2008 • Initial education • Development of a corporate framework • Risk identification • Risk assessment • FY 09 pilot projects

31. ERM Pilot Projects • ERM Oversight Committee • Senior Leader Process Owners • Task Forces • Specific Deliverable (Matrix, Algorithm, Database) to identify gaps in processes, develop priorities, apply controls and assign responsibilities • Quarterly Metrics • ERM Scorecard • Round I Projects: • Plant and Equipment Infrastructure: Repair, Maintenance and Replacement • Revenue Cycle and Collections • Strategic and Business Planning • Semiannual Reporting Through Audit Committee of the Board • Round II Projects: • Physician Alignment • Resource Availability • Emergency Preparedness

32. Emerald Assurance’s Support of ERM • Broadening of insurance coverages provided through the captive: • Employer’s Liability • Worker’s Compensation (as a reinsurer) • D&O/ Employment Practices Liability deductible buyback • Security Guard Liability (as a reinsurer) • 25% of first $100 million Property layer on a quota share basis • Reinsurer for Employed Physicians • Expenses Related to Miscellaneous Business Litigation • Evaluating extending coverage to indemnity

33. Emerald Assurance’s Support of ERM • Funding of System-Wide Loss Prevention Initiatives: • Associate Back Injury Prevention • Electronic Fetal Monitoring Certification • Education and training • Purchase of lift equipment • Performance-Based Development System (PBDS) • Assessment of clinical competency, judgment and decision-making and inter-personal communication skills • Mentoring and re-testing • Termination • Premium discounts • Building Hardening in Gulf Coast Locations • Simulated Learning Labs

34. Emerald Assurance’s Support of ERM • Emerald Innovations Grant Program: • Applications submitted by local facilities • Must include measurable goals, timelines, resource requirements, metrics, budget, cost/benefit analysis, etc. • Multi-disciplinary screening and selection committees • Focus on start-up and demonstration projects • $9.6 million distributed to date

35. Emerald Assurance’s Support of ERM • Other Emerald-Funded Initiatives: • Risk Management Scorecard • ICARE (Issue, Cause, Analysis, Resolution, Education) Docket • Risk Management and Occupational Health and Safety Councils • AICE Infection Control Tracking Software • RASMAS Product Recall Tracking Software • Legal Solutions Suite Software • Emergency Department • Education and Loss • Prevention Algorithms

36. Emerald Assurance’s Support of ERM: • Covering expenses related to uninsured litigation through the captive • Provides rationale for RM to handle all litigation • Proposal to expand to indemnity coverage • with specified facility retention and coverage limits • CHRISTUS energy management initiative

37. How a Captive Can Help Foster ERM • Providing additional or broader insurance coverages • Funding loss prevention initiatives

38. Limitations to Utilizing Your Captive as an ERM Vehicle • Risks typically must fit within definition of insurable risks to be covered • Lack of “follow form” excess coverage • Regulator unfamiliarity with ERM process • Difficulties in making actuarial projections • Tendency of organization to view captive as a source of free money to fund virtually anything

39. The Future of Emerald Assurance as an ERM Vehicle • Expand Emerald Innovations grant process to include: • ERM risks • Initiatives proposed by other system departments • Fund ERM education • Review specific ERM risk mitigation and risk financing strategies as they are developed to determine feasibility of Emerald’s providing assistance

40. ERM READINESS ASSESSMENT SURVEY RESULTS

41. ERM READINESS ASSESSMENT SURVEY RESULTS

42. “PROMISED LAND” ENTERPRISE RISK MANAGEMENT Willis HRH Health Care Practice 13th Annual Forum July 14, 2009