Tunstall turns to technology

Steve Tunstall describes his path into risk management as a “long and unexpected journey”. After studying mechanical engineering, surveying, and then project management, he “stumbled across” the nascent risk profession while working on big projects, believing there was a need for companies to look at broader downside issues.

“I did a part-time masters in project management and did my dissertation in risk management when no-one was doing it,” he says. “I wanted to look at big strategic risk issues facing companies.”

An early curiosity has developed into a distinguished career in the Asia-Pacific region. Tunstall’s risk management journey started in the 1990s when he took a job at Hambleton Risk Management, a UK consultancy with a large Asian client base. Heading out to Hong Kong and then Singapore in the 1990s, he worked as a risk consultant for businesses operating in most countries across the region.

“I don’t think the industry really existed here in the 1990s,” he says, speaking from his base in Singapore. “There wasn’t a professional association, and there wasn’t much going on. I tried to bring the Institute of Risk Management from the UK to Asia, and set up a special interest group, but they never got properly established.”

Tunstall has witnessed plenty of changes in the Asia-Pacific risk management industry over the years. Among the pioneers in the profession in Asia, he has seen companies adapt their approach to strategic risks.

“Risk management wasn’t really a term here,” he says, referring to the 90s. “People were buying insurance on behalf of companies, and there were people who called themselves risk managers, but they were mostly compliance people in the finance sector.”

After decades in the profession, Tunstall says there has been more “global recognition” for the risk industry, as chief executives embrace “structured processes that encourage genuine communication about the bad things that might happen in life”.

He says modern boardrooms and CEOs recognise the need for a “formal structure” to navigate the myriad of risks in 2020: “The top of the business understands that when things go wrong, they really go wrong, so you need a formal structure for that.”

The Cathay years

As the risk profession began to blossom in the early to mid-2000s, Tunstall landed at Hong Kong airline giant Cathay Pacific, becoming the group’s first head of corporate risk management. The experience at the heart of one of the region’s key corporations was an eye-opener for Tunstall, getting to grips with the risks facing one of the region’s top airline operators. As part of the role, he reported key risks to multinational conglomerate Swire, Cathay’s owner.

“One of the biggest issues was setting up the risk management function from scratch,” he says. “It was all about finding allies in the business, and a cohesive approach. Cathay was going through huge changes, particularly the evolution in the technology space, shifting from being solely an airline operator to an effective data manager.”

Tunstall cites bringing together the risk, insurance, legal, compliance and back-office functions as one of his proudest achievements at Cathay. He says engaging with senior figures and controlling shareholders was challenging: “Telling it like it is to senior figures is always difficult. Finding a way of having those conversations without losing your job is a big achievement.”

Tunstall has sympathy for the airline sector, which is facing an unprecedented shock and reduction in demand in the wake of the Covid-19 crisis. With borders closed and planes grounded, many airlines across the region will struggle to survive the year. He predicts pain for the industry and risk managers in the sector.

“You have to work out how to keep your job. Many airlines will go bust this year, and won’t exist anymore,” Tunstall adds. “That has huge implications for those companies, and for all of us who have enjoyed cheap travel. Flight activity may not come back for another decade, so there’s a huge issue there.”

Tunstall says airlines operating in countries with competition restrictions should survive, and “will continue to exist one way or another, because people will need to fly from London to Auckland or from Hong Kong to Australia”.

“It’s too early to say what the future will look like, but we will see some major changes in the [airline] sector,” Tunstall says. “If I were a risk manager in that industry, I’d be asking what is the industry going to look like in the next five years? How can we pivot to new opportunities?”

Going it alone

In 2013, Tunstall left Hong Kong to work for leisure giant Genting, taking responsibility for risk management at the company’s Singapore operations, and Resorts World, Sentosa. After spending a year at the corporation, he went out on his own to build a risk consultancy and pursue entrepreneurial ventures.

Today, Tunstall runs a consultancy, Tunstall Associates, developing risk, insurance and resilience services for corporates across the Asia-Pacific region. He is also known for his work as co-founder, board member and general secretary of PARIMA, the Pan-Asia Risk and Insurance Management Association. For Tunstall, the trade body underlines how far the sector has come in Asia.

“I saw it as a great way to give back to the industry,” he says. “It’s a not-for-profit organisation, and it was set up to help our emerging profession and give people the ability to talk to one another, learn, improve through education, and build some consistency. That’s vital for our profession.”

According to 2018 figures, PARIMA has over 1,641 members across 984 organisations, covering 13 Asia-Pacific nations. Tunstall wants the organisation to help risk managers professionalise.

“Most recognised professions have a formal entry or qualification process, so people can look and see they have achieved a qualification. Risk management has not been like that… In the fullness of time, risk management as a vocation must be taken as seriously as accountancy,” he adds.

Tunstall has plenty of plans for the future, and believes technology will be at the heart of the risk management industry in the years to come. In 2016, he set up Inzsure, a technology platform to help SMEs procure, manage and claim on their insurance. The company is ramping up activity, and ultimately, Tunstall believes insurance technology platforms will replace intermediaries and agents.

“The platform helps smaller companies get the right protection. The introduction of technology will be massive in helping businesses,” he says. “Covid-19 could be the final nail in the agency coffin. Small companies only need an agent for the most complicated risks.”

He says businesses across Asia have typically been reluctant to trust agents, leaving many under-insured.

“Small companies across the region don’t buy insurance. They see dealing with intermediaries as expensive. I was at a conference in Bangladesh and asked a company why they didn’t have more agents in a particular city. He told me they would probably be killed. There’s a lack of trust in intermediaries, so tech has an important role to play. It will help companies get insurance in a fairer, cheaper way.”

While attempting to disrupt the intermediary market, Tunstall says risk managers must also be aware of technological changes within their own organisations.

“Your future will be entirely about technology, or your business will no longer exist,” he says. “Companies and industries that have failed to progress with their technological adoptions and solutions are going to be devastated by Covid-19.”

He believes risk managers also need to be mindful of the risks posed by technology, particularly as organisations shift to remote working and outsourced IT solutions.

“So many companies must be close to a technology collapse right now. No-one is ready to have everybody working from home. So many must be on the edge of their technological capabilities, using personal devices to access corporate systems in a way never envisaged when these systems were set up.”

“We are going to see some of the biggest corporate security collapses and data breaches ever over the next six months,” Tunstall predicts. “Companies are overstretched and have over-reached. There are cybercriminals out there right now, loving this. Technology is key to opportunities, but is also one of the biggest downside risks.”

He says insurers need to do more to protect companies against cyber and technology risks.

“I worry about the insurance industry. It is not stepping up fast enough to offer the right amount of protection in this area that customers need. Insurers have to seize the mettle and head towards cyber protection policies that look more like all-risk coverage. That would give buyers more confidence.”

After witnessing the emergence of the risk profession in Asia, Tunstall is ready for the technological revolution.