ENTERPRISE RISK AND STRATEGIC DECISION MAKING: COMPLEX INTER-RELATIONSHIPS By Mark Laycock The views and opinions expressed in this paper are those of the authors and do not necessarily reflect the official policy or position of Thomson Reuters.
Enterprise Risk and Strategic Decision Making: Complex inter-relationships 2 TABLE OF CONTENTS DECISION TIME 3 RISK APPETITE 3 RATIONING, ALLOCATING AND PRIORITIZING 3 THE SUSTAINABLE FIRM 3 RETURN 4 RISK MITIGATION PROJECTS 5 ENHANCEMENTS (FINANCE) 6 ENHANCEMENTS (NON-FINANCE) 6 ENHANCEMENTS (FINANCE) - FOR LOW TO ZERO TOLERANCE RISKS 7 SUMMARY 7
Enterprise Risk and Strategic Decision Making: Complex inter-relationships 3 When making strategic decisions about the allocation of often limited resources, boards and senior managers must consider multiple corporate objectives as well as the portfolio of investment opportunities available. Enterprise Risk and the firm s risk appetite are also key considerations. i DECISION TIME Certain times of the year appear to have clusters of decisions that need to be made and one such time is during the preparation of budgets for the next period. For some firms this activity is part of an annual cycle that fits into a rolling five year strategic cycle. The annual and strategic cycles often involve decisions about investments, costs and shareholder value. With the pro-active role of the businesses, as the first line of defense against risk, there is unlikely to be a shortage of project proposals. If resources were infinite then all proposals would be funded, assuming that they move the firm towards meeting its multiple objectives. In reality, resources are not infinite and so a rationing or allocation system is needed, in particular one that supports the board s risk appetite statement. In plain language, it s decision time. RISK APPETITE The risk appetite statement focusses attention on the relationship between risk and the firm s objectives. It is one of the responsibilities of the board and a particular challenge for executives is cascading that statement down the organization, using appropriate terminology and granularity. For the financial sector, the risk appetite statement is a formal requirement, whilst firms in the non-financial sector probably have risk appetite statements, even if these are merely implicit in the decisions they make. At its most generic, the risk appetite is about the amount and types of risk that the firm, and hence the shareholders, are willing to accept to achieve a set of returns. For a core group of shareholders that objective is to have a sustainable business, i.e. a business that will be functional some period into the future. At the other extreme there are investors who own the shares for seconds, or part thereof. Other investors will have horizons between these two extremes. A view of the value of the firm is that it represents the portfolio of activities that it undertakes with associated risks. These risk components include both expected and unexpected losses and those risks for which the firm has low or zero tolerance. These risks should be reflected in the rationing or allocation system applied to funding projects. RATIONING, ALLOCATING AND PRIORITIZING Resources are not infinite. Firms need frameworks to guide those generating proposals and those making decisions about the allocation of resources. This paper is not going to make an extensive investigation into valuing investments. These investments may be acquisitions, expansions to product lines, experiments with new customer segments, or investments relating to a risk management activity. Rather the paper focuses on the decision support framework and its issues. Some references, on making investment decisions, refer to utility curves. These curves have their background in the economically rational person. In reality, behavioral aspects in decisions have a significant effect and can lead to sub-optimal decisions from a purely economic perspective. There are some inputs into the decision that are hard to quantify, for example trust and reputation. Any framework or model is an aid to, not a replacement for, judgment. Having a framework to elicit priorities on investments and resource allocation provides a number of advantages, including consistency and efficiency. The framework needs to reflect the risks involved with the activity and the risk appetite - at the firm level or as it has been cascaded down through the firm. THE SUSTAINABLE FIRM It was mentioned above that for a core group of shareholders an objective is the sustainability of the firm. Every firm is regulated to some degree and is expected to comply with regulations or suffer the consequences, including sanctions of various types and related reputational damage. An investment priority will be projects enabling the firm to meet regulatory requirements by amending various aspects of assets (such as buildings), infrastructure or even day-to-day activities. These projects may arise out of new regulations or changes in the interpretation of existing regulations. Economically, the formulas may say don t invest in change, just pay the fine. But, in some circumstances the regulators have the authority to increase sanctions until they impact on some of the firm s objectives, such as being a trusted counterpart. At a minimum, the board and executive will expect some new activities (product, distribution channel, geographic expansion) to comply with the prevailing regulations. Specific projects, to enable compliance with regulatory requirements, are usually going to be associated with existing assets, infrastructure and activities. For example, the outcome may be to change the business model to meet, or even exceed, the required minimum standards. Excellence in risk management, for example developing leading practices, can provide competitive advantages.
Enterprise Risk and Strategic Decision Making: Complex inter-relationships 4 RETURN For a firm to be sustainable, not only must it comply with regulations, it must also produce a positive return on its investments and/ or allocated capital. There are several variations of using returns in frameworks to allocate resources, and they get progressively more complicated. The simplest form of return for ranking projects is gross revenue. The revenue will be forecast either as part of a new business proposal or as part of the budgeting process. Focusing exclusively on the revenue omits the cost of raw materials, staff, production, IT, and risks, e.g. the expected losses and as a result, some form of earnings before interest and tax (EBIT) will be better than gross revenue. For financial industry firms, owing to leverage, the equivalent return figure might be earnings after interest, but before tax. These numerators have the benefit of being aligned with the bottom line. For existing activities, rationing resources using the forecast absolute return can result in mature products and services attracting the lion s share of additional resources and leading to the big getting bigger. This may not be desirable from a strategic perspective. However, if the project relates to regulatory compliance, then it is natural to defend a significant earnings stream. To address this shortcoming of considering only one attribute, firms use ratios to incorporate multiple attributes ii. Different firms use different, but related benchmarks such as return on investment (ROI), return on equity (ROE) and return on capital (ROC - risk-adjusted or not). The implication is that the projects with the highest ratios get funded first, then the next highest ratio and so on until either the resources available for investment are consumed or some threshold is reached, such as the cost of capital. If only it was that easy. Being a ratio, strange things can happen. For example, the project with the highest ratio may only generate a return of $x, a tiny proportion of the forecast earnings as part of the five year rolling strategic plan. A single source of material profit may be some way down the ratio rankings. In terms of strategic decisions, the framework should therefore not override judgment, because, for example, blindly following a ratio may prevent investment in future stars that have the potential to become future cash cows. The numerator in the ratio is some form of return, preferably an earnings figure that includes expected losses due to risks. The denominator is a bit more convoluted. For non-financial industries this will probably be a measure of the investment. For the financial industry the denominator will probably be a representation of the forecast risk that the activity will generate. This forecast risk is usually described as economic capital, or the amount of capital required to support the credit, market, operational and other risks. Elsewhere in the firm there will be a model that links economic capital to balance sheet capital. The economic capital can be estimated using models with a range of sophistication. At the simplest end of the spectrum are the basic or standardized models available to estimate regulatory capital. There are some doubts as to whether these models are risk-sensitive. As a result, firms often use their own models to estimate risk for a period into the future and a given confidence interval (e.g. 99.9%). The risk estimates may be calculated in silos and then a correlation factor used to aggregate the risk estimates into a single homogenized total. This is effectively a RAROC (risk adjusted return on capital) calculation. In terms of modeling the estimated risk, the credit and market risk models are able to produce figures on the incremental contribution of the new business to the entire firm. Less easy is estimating the incremental operational risk. For operational risk the issue is the lack of historic data. As a result the risk estimate may need to be generated from a combination of expert opinion, scenarios iii and various structured approaches iv. For the decision makers, the less elegant approach required to estimate operational risk is a source of bias and uncertainty. From a finance industry Enterprise Risk Management (ERM) perspective, RAROC calculations are an advance over the simple return estimates for allocating resources. Firstly, the numerator (some variant of EBIT) includes expected risk losses as part of the costs. Secondly, for the finance industry, the denominator explicitly reflects the non-expected risk amounts for the activity. As a result, risk is being explicitly incorporated into strategic decisions. For the non-finance sector it reflects the level of required investment. FIGURE 1A - INVESTMENT IN NEW ACTIVITIES (FINANCE) Finance Revenues - Operating Costs - Expected Risk Losses - Cost of Funding = EARNINGS AFTER INTEREST BEFORE TAX FIGURE 1B - INVESTMENT IN NEW ACTIVITIES (NON-FINANCE) Non-Finance Revenues - Operating Costs - Expected Risk Losses = EARNINGS BEFORE INTEREST AND TAX MARKET RISK CREDIT RISK OPERATIONAL RISK INVESTMENT active selection of risks active selection of risks Incurred by, or imposed upon the business
Enterprise Risk and Strategic Decision Making: Complex inter-relationships 5 RAROC and equivalent indices have some shortcomings, for example their relationship to the risk appetite statement. The indices have their attractions, for instance a great variety of data is compressed into a single number. As a ratio of EBIT over capital/investment there are some assumptions that arise out of the structure of the index. One assumption is that, provided EBIT is big enough, then the amount of risk is acceptable to the firm. This is a form of compensation of return for risk. At its most simplistic this works, but in reality there are shortcomings, for example: a) Are there preferences between the major risk classes? Is credit risk preferred over market risk (both of which generate returns) and where does operational risk fit? v b) Are all of the major risk categories reflected in the ratio? How is funding risk reflected in the capital estimate? v Drilling down into each of the risk silos, their capital estimates are homogenized risk estimates within the silo as shown in Figure 1a. For credit and market risk it is assumed that separate limits are applied to aspects such as counterparty type and form of market risk before the capital calculation is made, effectively applying a granular version of the firm s risk appetite. Credit and market risks are seen as risks that the firm actively takes and where it has a degree of control over the sub-type and amount that it accepts. In comparison, operational risk tends to be embedded in the activity, or done to the firm by external agents. Some operational risks can be quantified, for example external mortgage fraud. Other operational risks are much softer and the impacts are less understood, creating significant uncertainty. Five or more years ago conduct risk had these features. Recent history has shown that some of these softer issues can lead to significant fines in the finance sector and various non-finance sectors have also been forced to respond to similar issues. RISK MITIGATION PROJECTS Excluding projects that are required to meet regulatory requirements, there will be a number of other risk mitigation projects requesting investment. These investment requests are likely to be generated by mature processes, products or infrastructure. The challenge is how to incorporate these into the framework given that they will be of interest to the risk owners (the businesses) and ERM. The particular risk mitigation may reduce one type of risk and simultaneously increase another. At the macro level this might be a reduction in credit risk and an increase in operational risk due to the collateralization of credit risks. At a more granular level this might be a reduction in human error but an increase in exposure to systems failure. The initial thought is that enhancing the risk management framework is going to increase total costs owing to the cost of the additional controls. Maybe. Some of the projects relating to automation of processes can reduce the annual cost as staff are released to perform more value-added activities, such as risk analysis. However, from a risk management perspective, is the increased exposure to systems failure preferable to human error? While the annual running costs may be lower (owing to automation) and the expected losses lower, the unexpected risk may increase. This simple example shows how important it is to incorporate risk issues into these decisions. The benchmark needs to be a comparison of the ratios of returns: capital assuming that nothing is done (status quo), and if the change is made as expected vii. A comparison between the two forecasts might show that post-change some costs are higher and others lower, but the amount of required capital is less. That is the beauty of ratios, the ability to adjust the numerator and the denominator. So post-change the annual running costs might be higher (reducing earnings) but the expected losses and their handling costs are lower (increasing earnings). The project may also change the distribution of losses so that the 99.9% confidence interval value is separately or in addition lower. From a risk management perspective it becomes important to consider the source of change in the ratio as well as the amount of change. If the investment metric just focused on the reduction in risk, and ignored the impact on earnings, then some sub-optimal results could occur. In extremis the activity could be so over-controlled that the costs exceed the revenues, giving rise to steady perpetual losses. This is why the ratio of returns: capital is still an appropriate framework for these risk mitigation projects.
Enterprise Risk and Strategic Decision Making: Complex inter-relationships 6 FIGURE 2A - ENHANCEMENTS TO EXISTING ACTIVITIES (FINANCE) Post-Change Revenues - Operating Costs - Expected Risk Losses - Cost of Funding = EARNINGS AFTER INTEREST BEFORE TAX Status Quo Revenues - Operating Costs - Expected Risk Losses - Cost of Funding = EARNINGS AFTER INTEREST BEFORE TAX MARKET RISK After filtering out "unwanted" items via active selection of risks CREDIT RISK After filtering out "unwanted" items via active selection of risks OPERATIONAL RISK Incurred by, or imposed upon the business Vs. MARKET RISK After filtering out "unwanted" items via active selection of CREDIT RISK After filtering out "unwanted" items via active selection of risks OPERATIONAL RISK Incurred by, or imposed upon the business FIGURE 2B - ENHANCEMENTS TO EXISTING ACTIVITIES (NON-FINANCE) Post-Change Revenues - Operating Costs - Expected Risk Losses - Cost of Funding = EARNINGS BEFORE INTEREST AND TAX INVESTMENT Vs. Status Quo Revenues - Operating Costs - Expected Risk Losses - Cost of Funding = EARNINGS BEFORE INTEREST AND TAX INVESTMENT For non-finance industries the level of investment, to achieve risk mitigation, can be influenced by concepts such as as low as reasonably practical (ALARP) or so far as is reasonably practical (SOFAIRP) viii. The key aspect is the reasonably practical element, which represents a judgment between the level of risk and the level of investment to further reduce that risk. A firm is not expected to invest a grossly disproportionate amount, but this requires judgment by management as to what constitutes grossly disproportionate. Depending on the risk event, assuming that it materializes, then the English courts may agree or disagree with management s judgment. It is not yet clear if the financial industry wants to or will be able to adopt the concept of grossly disproportionate and effectively accept the risk. Adding complexity to the operational risk element for finance firms is that for some components of this risk, the board and other stakeholders have low or zero tolerance. This is particularly the case for some of the softer operational risk issues such as risk culture, conduct and mis-selling. From an ERM perspective, these issues, for which stakeholders have low tolerance, need to be explicitly considered in the decision support framework. This also allows the board, which sets the risk appetite, to appreciate that these low or zero tolerance risks are being actively managed. A way of achieving the necessary transparency is to exclude them from the operational risk capital estimate and consider them separately. As mentioned above, these softer issues can be difficult to quantify, so the reference point might be an expert opinion on the trend or impact on an exposure figure. A mechanism is proposed in Figure 3.
Enterprise Risk and Strategic Decision Making: Complex inter-relationships 7 FIGURE 3 - ENHANCEMENTS TO EXISTING ACTIVITIES (FINANCE) - LOW OR ZERO TOLERANCE RISKS Post-Change Revenues - Operating Costs - Expected Risk Losses - Cost of Funding = EARNINGS AFTER INTEREST BEFORE TAX MARKET RISK CREDIT RISK OPERATIONAL RISK & Low to Zero Tolerance Risk active selection of risks active selection of risks Incurred by, or imposed upon the business Status Quo Vs. Revenues - Operating Costs - Expected Risk Losses - Cost of Funding = EARNINGS AFTER INTEREST BEFORE TAX MARKET RISK active selection of risks CREDIT RISK active selection of risks OPERATIONAL RISK Incurred by, or imposed upon the business & Low to Zero Tolerance Risk SUMMARY This paper has shown how risk can be incorporated into frameworks for making strategic decisions. It has also discussed some of the shortcomings. Boards and senior managers have multiple objectives and criteria to consider when making these decisions in isolation and when considering the portfolio of investment opportunities and requests for resources. As a result, a framework or model can only be used to support judgment, not replace it. Investing to become compliant with new regulations or revised interpretations of existing regulations is a high priority investment. This is needed for the firm or business to remain sustainable. When investing in projects with high returns on investment or allocated capital, the returns are a form of earnings after costs, including expected losses from risk events, but before taxes. These investments may be in traditional earnings-generating activities or in enhancements to existing processes and activities. In these decisions there is a need to take into account changes in the risk profile. The change in risk profile may be achieved by the transformation of one risk into another, for example a reduction in credit risk via an increase in operational risk, or the reduction in human error for an increase in exposure to systems failure. These transformations may affect the numerator and/or the denominator in the returns calculation. Finally, there is a need to explicitly consider the risks for which the firm has low or zero appetite. It is proposed that these are separately and explicitly considered in the process. Leaving them bundled in the return on investment or on capital implies that a higher amount of risk is acceptable if there is a higher return. In the case of low or zero tolerance risks, the need to manage them is part of the firm s risk appetite statement and it may not be possible to offset a lack of management with higher returns.
Enterprise Risk and Strategic Decision Making: Complex inter-relationships 8 Some of these risks can be difficult to quantify. This is especially the case for some of the softer issues with low or zero tolerances. As a minimum, the firm may need an expert opinion that the trend is in the right direction. More quantitative techniques include scenarios and various structured approaches, but these still have bias and uncertainty. Ultimately, for these low or zero tolerance risks, extremely large amounts could be invested in control activities or other mitigating actions, and the residual risk would still not be zero. For the non-finance industry there is the concept of having a risk as low as reasonably practicable (ALARP). This has the concept of grossly disproportionate investment to achieve small improvements. What constitutes grossly disproportionate is a board or senior management judgment call. It is the cost-effective reduction of risk that has clear economic value to the firm: there is more certainty over revenue getting to the bottom line, which is in the interests of most stakeholders. Additionally there should be fewer surprises of the negative variety. Notes i In this paper Enterprise Risk is considered to include all risks that prevent a firm from achieving its objectives. ii Formally this is known as Multiple Attribute Utility Theory (MAUT). iii Reference to existing Thomson Reuters white paper, https://risk.thomsonreuters.com/whitepaper/operational-risk-quantification-scenarios iv Reference to existing Thomson Reuters white paper, https://risk.thomsonreuters.com/whitepaper/operational-risk-quantification-structured-approaches v Reputational risk is assumed to be a consequence of other risks and has more of an impact than a risk in its own right. vi Funding risk may be taken into account via the impact of internal transfer pricing for funding in the earnings after interest but before tax. vii If the comparison is made within the formula, so that it is change in earnings over change in capital, it is possible to get some strange answers when the amount of risk goes down and there is a negative capital figure. viii http://www.hse.gov.uk/risk/theory/alarpglance.htm
Enterprise Risk and Strategic Decision Making: Complex inter-relationships 9 RISK MANAGEMENT SOLUTIONS FROM THOMSON REUTERS Risk Management Solutions bring together trusted regulatory, customer and pricing data, intuitive software and expert insight and services an unrivaled combination in the industry that empowers professionals and enterprises to confidently anticipate and act on risks and make smarter decisions that accelerate business performance. For more information, contact your representative or visit us online at risk.thomsonreuters.com 2015 Thomson Reuters GRC03708/12-15