Rules Engine Can Make Risks Easier To SwallowRules Engine Can Make Risks Easier To Swallow

A big part of that risk management is understanding the degrees of threat. "You can put $10 in a $5 box--overspend on some risks when they don't really represent that great a threat," Phelps says. That's where the tendency to want to eliminate risk can get an insurance company in trouble, he says.

Banks have embraced this risk management approach as part of the Basel II standards, which require banks to focus on assessing risks more broadly, including operational as well as financial risk.

LogicManager was founded by CEO Steven Minsky, who sold his previous rules engine company, RulesPower, to credit rating company Fair Isaac. The LogicManager product is a new rules engine that's specialized for the insurance industry.

Without the risk assessment tools, Phelps says, it's difficult for managers to see trends as new risks emerge. A new condition, such as a rising threat of an outbreak of bird flu affecting humans, might pose a heretofore unassessed risk to a health care insurer. If one manager raises the issue, others can add their assessments for a companywide perspective on how to cope with it.

Phelps sees something more of a "heat map" taking shape in reports that show the hot areas of concern around the company. But the risk assessment tools haven't been in place long enough for Blue Cross Blue Shield of Florida to judge the return on investment.

One measure of success will be when risk management ceases to be a separate function and is embedded in the company's applications. But the field is too new to the insurance industry for that to occur for many years, Phelps says. Outside the company, Phelps is working with practice managers from six other companies on a committee in the Risk and Insurance Management Society to define areas of exposure and standards for evaluating them.

The Right Lens
One of the challenges Phelps and his peers in the field face is changing people's thinking. Risk avoidance isn't the right lens; an insurance company doesn't get to choose whether a flu epidemic is coming. Instead, managers need to assess that risk, decide the possibilities, and then choose what actions to take--including possible revenue opportunities. "If a company is looking to increase revenue, you're not going to get there without taking risks," Phelps says.

Blue Cross Blue Shield of Florida has a long way to go to become the model of effective risk management Phelps hopes for. Today, only a handful of employees use the risk management software, but he plans to extend it throughout the company. "My goal is to put it on our Web site and let anyone in the company use it," he says. No doubt Phelps will have thought through the risks before he takes that tricky step.