The subprime mortgage crisis has shown all too clearly that a bank's reputation can come under pressure just as quickly as that of any other organization. Capital adequacy and security continue to dominate the risk agenda for financial institutions—and to meet the international standards created under Basel II, these institutions need to demonstrate a clear link between those risks and the steps they are taking to manage risk.

As one of the 20 largest financial institutions in the world, ING Groep N.V. consists of 500 different legal entities across 44 countries, covering 75 million private, corporate and institutional clients with a workforce of more than 120,000 people. Its activities include private banking, asset management, computer leasing, real estate funds and Internet banking. Operating in many different legal jurisdictions, and in some cases also managing risks on behalf of clients, led the firm to the conclusion that it needed a better way of tracking and managing key risk information.

In 2005, ING selected Aon RiskConsole to manage policy and claims data for a pilot region of 60 legal entities in seven European countries. The solution currently holds approximately 200 policies that are managed throughout the year, each with an average of three sub-policies.

When considering the reasons for selecting RiskConsole, Marc Mathijsen, ING's head of corporate insurable risk management, says, "From the operational viewpoint, you have the different languages, you do not have to install it and you can use it immediately across locations. From a corporate perspective, it is the structure. The flexibility to map our complex organization of legal entities and third parties in RiskConsole is something we didn't see elsewhere."

A key benefit has been ING's ability to develop custom fields for Basel II reporting, such as the loss event type, operational risk management incident number and Basel II business line. "I have to prove to the regulator to what extent our insurance programs are properly used, that the incident reporting matches with the insurance, the degree of coverage and indemnity received," says Mathijsen. "That is the final proof that the system is working and that ING is really eligible for capital relief."

Sabine Desantoine, insurable risk manager for South West Europe at ING, adds, "Of course, IT security is also much more important for a bank than other industries. Money can be wired with two clicks, so we had long discussions with Aon and the IT security department. We know that it is compliant with ING's IT security requirements."

RISKCONSOLE HAS RADICALLY SIMPLIFIED THE PROCESS

Implementing a new process doesn't happen overnight—it demands the solution to be actively used and monitored. Desantoine has worked to ensure that type of consistency occurred and, now, after two years, the solution is used every day. "At our South West Europe headquarters," she says, "the team uses RiskConsole throughout the day. For us, it has the same status as our mail inbox—you start your PC, open your e-mails and also access RiskConsole. The team uses the system because they can see the benefits … RiskConsole is really improving the way we manage policies and claims."

With regard to renewals, every year ING has to prepare the budget for its various entities. As Desantoine explains: "We no longer have to take our hard copy with the note received from the broker and check everything. Now, it is just a question of running a query in RiskConsole. The same process applies for the renewal of data/policies … we just have to click a button to renew. It saves time and is far more efficient." Mathijsen adds, "RiskConsole gives complete transparency in the cost, premiums and commissions, which is needed for the Spitzer environment."

But this team is not the only beneficiary of the new approach. The 18 facility managers of ING's 1,000 buildings in Belgium are also finding new efficiencies. When shown RiskConsole, the facility management department liked the system so much, it wanted to use it for claims notification. So, it was mutually agreed that no claim would be processed unless it was passed through RiskConsole.