risk management

C02 01/07/2011 10:39:18 Page 30

Another research study shows that the vast majority of members of boards

of directors believe that the biggest threats for their organizations are strategic

risks rather than financial risks. Figure 2.4 shows the results of a 2006 survey

of directors by The Conference Board, which asked directors about the biggest

threats facing their organizations. The research reveals that, across all sectors,

24

12

7 6

4 2

1 1 1

11

7 7 6

3 2

1 0 0

0

5

10

15

20

25

Cost Overrun

Accounting Problems

Poor Manage-

ment Supply Chain Issues

Competitive

Merger Problem

Wrong Products

Pricing Pressure

Customer Losses

Supplier Problems

R&D Delays

Demand Shortfall

Regulation

Strategic 61%

Operational 33%

Financial 6%

Hazard 0%

Foreign Economic

Issues

Interest Rates

High Input

Prices

Law- suits

Natural Disaster

FIGURE 2.3 Largest 100 Declines in Value

0% 20% 40% 60%

All Sectors

Financial Services

16%

26%

41%

52%

53%

48%

Strategic risk Risk of regulatory change Financial risk

FIGURE 2.4 Directors’ Ranking of Biggest Threats

Source: The Conference Board, The Role of U.S. Corporate Boards in Enterprise Risk Management, 2006.

30 & Defining ERM

C02 01/07/2011 10:39:19 Page 31

directors believing that strategic risks are the biggest threats outnumber those

believing the threats to be financial risks bymore than 3 to 1 (53 percent versus

16 percent). Even within the financial services sector, directors voting strategic

risks as most important outnumbered those voting for financial risks by almost

2 to 1 (48 percent versus 26 percent).

Part of the myth that financial risks are the most important is based on an

incorrect approach to risk categorization and definition; in confusing the source

of a risk with its outcome, risks that are either in whole or in part strategic or

operational risks are frequently miscategorized as exclusively financial risks.

One example is the global financial crisis that began in the United States in

2007. There were multiple sources of risk that led to the financial crisis, many

of which were not financial risks. See ‘‘Criterion 2: All Risk Categories

Included’’ in Chapter 9 for the case study analysis.

Financial Analyst Bias A third cause of the lack of appropriate focus on non- financial risks is financial analyst bias. Most of those doing the modeling share a

financial-centric mind-set. Their education is focused on financial risk. Their

training and certification is in financial risk. Their experience is only with

financial risk. Even the name and purview of their department may limit them

to financial risk. In addition, their techniques cannot readily handle strategic

and operational risks; their methods work best when there is a wealth of

objective quantitative data available, which is not the case with strategic and

operational risks.

The lack of sufficient inclusion of non-financial risks may be the result of

one or a combination of the previously mentioned factors. Whatever the

reason, this represents a dangerous flaw in most ERM programs. The impor-

tance of this cannot be overstated. These partially quantitative ERM programs

fail to quantify the vast majority of the key risks in terms of their individual and

collective contribution to the overall volatility of the organization, in terms of

the key metrics.

These partially quantitative ERM programs give the strong impression that

they are not incomplete, causing management to erroneously rely on, and

misinterpret, the information. This false impression is given by the level of

precision implied by the data handed to management by the financial modelers

(also known as financial analysts or simply modelers) of these flawed ERM

programs. The modelers routinely provide outputs from their models showing

the volatility of key metrics, presented in a way that implies a high degree

of accuracy; one example is showing the figure out to a large number of

significant digits.

Definition of ERM & 31

C02 01/07/2011 10:39:19 Page 32

This problem is rampant in the financial services sector, where it is even

more common to find this imbalance in the quantification of key risks. One

example, from the banking sector, is the ‘‘Value-at-Risk’’ (VaR) metric. VaR

is often defined as the maximum amount of capital that can be lost in a single

day, within a given small predefined likelihood. Another example, at insur-

ance companies, is the ‘‘economic capital’’ metric, which is the amount of

capital needed on hand today to limit the probability of ruin, over a given

time horizon, to within a given small predefined likelihood. In both of these

examples, these numbers are commonly provided to management in number

form that includes a large number of significant digits, implying a high level

of accuracy (e.g., a number is shown as $35,455,809, rather than

$35 million). In addition, these numbers are often provided without the

proper disclaimers of incompleteness regarding overall firm volatility. This

offers an incorrect representation to management, despite being quite

unintentional, that this (financial-only) volatility represents the bulk, or

even the totality, of the risk exposures about which management needs to

be concerned.

This is alarming because of the dangerous nature of ignoring the majority

of the key risks in the metrics, and particularly so because this is often

occurring under the guise of an enterprise risk management program . . . yet

the word enterprise seems ignored. However, what is even more shocking is

that what the (usually) math-savvy modelers are doing violates a basic

mathematical concept we all learned in elementary school—the rule of

significant digits. See ‘‘Significant Digits.’’

SIGNIFICANT DIGITS

The rule of significant digits can best be illustrated through a simpleexample. Assume we have two numbers. The first number is 2. What do we know about the level of accuracy of this number? It might be rounded up from 1.50 or it might be rounded down from 2.49. Now, we have a second number, which is 2.04. This number is presented to us out to two decimal places. What do we know? Well, we know it has far more implied accuracy than the first number. However, the second number similarly may be rounded up from 2.0350 or rounded down from 2.0449. The significant digits rule indicates that where two numbers have different levels of significant digits, we must report the sum of those two numbers with

32 & Defining ERM

C02 01/07/2011 10:39:20 Page 33

Modelers in partially quantitative ERM programs are violating the rule of

significant digits. They are omitting the impacts of strategic and operational

risks from the ERM metrics, which purport to be holistic or all-inclusive, and

then presenting these metrics with only the financial sources of risks

included, and out to a high degree of significant digits. From the available

research data, it seems clear that financial risks are certainly not the totality

of the key risk exposure, and they are not even the majority of it. The research

suggests that, on average, financial risks are likely to represent only a small

percentage (at most, 15 percent) of the total volatility of the enterprise and

that the strategic and operational risks account for the majority of the

volatility. Therefore, if modelers are providing ERM metrics to management

representing the total firm risk exposure but the metrics only include

financial risk exposure, it is as if they are presenting the sum of two numbers

to management:

Total enterprise risk exposure ¼ ðRisk exposure from financial risksÞ þ ðRisk exposure from non-financial risksÞ

the same number of significant digits as the less accurate of the two numbers. In this case, we must report the sum of the two numbers out to only zero decimals.

2þ 2:04 ¼ 4

Alternatively, as a business matter, we could merely report each number separately, without summing them, and indicate the differing levels of accuracy of each number, if there is a desire not to lose the additional information that one of the numbers has more significant digits. This would maintain the integrity of the information and not mislead.

The significant digits rule also states that we cannot report the summa- tion of the two numbers as follows:

2þ 2:04 ¼ 4:04

This would be misleading, giving the false impression that we have confidence in the sum of the two numbers out to two decimal places. But this is not true. Claiming that the sum is 4.04 would mask the poor level of confidence in the accuracy of the sum, whose true value, expressed out to two decimals, ranges anywhere from 3.54 to 4.53, as shown:

ðMinimum;MaximumÞ ¼ ð1:50þ 2:04; 2:49þ 2:04Þ ¼ ð3:54; 4:53Þ

Definition of ERM & 33

C02 01/07/2011 10:39:22 Page 34

where:

a) The risk exposure from financial risks is calculated out to a large number of

significant digits, and

b) The risk exposure from non-financial risks is estimated as zero (and worse

yet, not even shown as a zero, but merely omitted from the page)

For example:

Total enterprise risk exposure

¼ ðRisk exposure from financial risksÞ þ ðRisk exposure from non-financial risksÞ ¼ ð$35;455;809Þ þ ð0Þ ¼ $35;455;809

If we assume, perhaps generously, that the financial risks represent a full

15 percent of overall firm risk exposure, then the total enterprise risk exposure,

rather than $35,455,809, is actually closer to the neighborhood of a quarter of

a billion dollars (number of significant digits intentionally minimized). This

gives some perspective on how much of a disservice is done by omitting

quantification of strategic and operational risks.

In some financial services companies, rather than use zero, they estimate

the non-financial risk exposure as an arbitrary percentage (e.g., 15 percent) of

the financial risk exposure. This is almost as bad a practice, and certainly still

violates the significant digits rule, because the large number of significant digits

in the financial risk exposure number is masquerading as a highly accurate

number worthy of our respect and attention. In fact, it is not that useful a

number and should be afforded the level of disrespect that it deserves.

The only defense offered by these modelers as to why they do not attempt to

quantify strategic and operational risks is related to the first reason stated

earlier—an inability to quantify. However, they verbalize their argument a bit

differently, saying that ‘‘you can’t quantify strategic and operational risks with

accuracy.’’ What they mean, of course, is that it is not possible to quantify these

risks with the same level of accuracy as financial risks. And that may be true,

but that doesn’t justify not estimating them at all, considering they represent

the larger component, which, as shown earlier, is an egregious alternative that

violates the business purpose of the ERM metric in question.

Criterion 3: Key Risk Focus

The word key in the basic definition indicates that ERM should only include

the major risks to the company’s value. ERM is not intended to include a

34 & Defining ERM

C02 01/07/2011 10:39:22 Page 35

comprehensive list of potential risks, which could range in the hundreds or

thousands. ERM is strategic in nature and is focused on a relatively small list

of risks that have the largest potential impact to the firm. For a company’s

first time through the ERM process cycle, a reasonable number of key risks

may be in the range of 10 to 30. Approximately 10 risks might be appropriate

for a pilot exercise, if management wants to build buy-in before implemen-

tation. However, 20 to 30 risks are needed to produce a robust set of results to

rely on for decision making. The specific number of key risks that is

appropriate for the enterprise depends on a proper categorization and

definition of risks and also on finding an appropriate cut-off point during

the qualitative risk assessment process.

However, the number of key risks does not depend on the size of the

organization. In other words, just because one company is 10 times the size of

another does not imply that it has 10 times the number of key risks. If the two

companies are otherwise identical, they will have approximately the same

number of key risks (the number of key risks may not be exactly the same,

because, for example, the larger company may have more key risks related to

reputational issues). This is because the number of key risks is merely a

reasonable number of risks on which senior management can focus, at a

given time, in a priority manner. It is based on people and their reasonable

limits of focus. There is only one CEO, one board of directors, and one senior

management team. The magnitude of the impact of the key risks will vary

significantly by company size, but the number of key risks should not vary

that much.

This is in stark contrast to the way many companies try to approach

ERM. Many companies mistakenly believe that ERM is merely an extension of

a Sarbanes-Oxley (SOX) exercise. The Sarbanes-Oxley Act passed in response

to a wave of financial reporting scandals. In trying to comply with SOX, most

companies created lists of every possible risk to financial reporting accuracy.

The list of risks often numbered in the hundreds or even thousands for the

larger companies. Each risk was tracked against information on its mitiga-

tion, including assignment of a risk owner. SOX compliance became a

quarterly routine of verification that the risks were adequately mitigated.

When ERM came along, many companies wrongly assumed it was similar to

SOX, with which they were familiar, with the only difference being that ERM

applied to all risks rather than just inaccurate financial reporting. Com-

pounding this issue, some technology vendors reinforce this false notion by

capitalizing on the software needs of maintaining an exhaustive list of every

potential risk for every company process. Similarly, some audit firms further

Definition of ERM & 35

C02 01/07/2011 10:39:22 Page 36

this misunderstanding by relabeling an expanded version of a SOX exercise

as ERM and claiming that it is part of a governance, risk, and compliance

(GRC) program.

Criterion 4: Integrated across Risk Types

Virtually all companies have been managing risk since their inception in some

fashion. However, companies have traditionally managed each type of risk in

isolation, rather than on an integrated basis: The information technology (IT)

department deals with technology-related risks; the human resources (HR)

department manages people-related risks; the investment department covers

market and credit risk; and so on. Unfortunately, this ‘‘silo’’ approach to risk

management has three disadvantages. Silo risk management is:

1. Incomplete

2. Inefficient

3. Internally inconsistent

Incomplete The most dangerous weakness of silo risk management is that it provides an incomplete representation of the risk profile. Silo risk management

does capture the most basic type of risk event—where one risk scenario occurs

at a time. This provides the most fundamental picture of a given risk and how it

can impact the enterprise. However, it is important to also measure the impact

of multiple risks occurring at the same time. There are three reasons why

limiting risk measurement to silo risk scenarios is incomplete:

1. Ignores real-world complexity. It is unrealistic for only one risk event

to occur at a time. This may be true for worst-case scenarios, where each

one is so unlikely to occur. However, many risks considered in an ERM

program are of moderate likelihood. For only a single moderate risk

scenario to occur at a time is like having everything happen precisely

as you expect for every aspect of your business, except one. For example,

your product strategy, your distribution strategy, your marketing strat-

egy, your human resources plan, and so forth all go perfectly . . . except

your technology update program is a little behind schedule. Reality

involves far more uncertainty than that.

2. Omits the largest threats. Multiple risk events occurring simulta-

neously can result in some of the largest threats to a company’s survival.

After the first event, the enterprise is in a weakened state, increasing the

36 & Defining ERM

C02 01/07/2011 10:39:23 Page 37

likelihood of some secondary events occurring. In addition, risks can

interact to exacerbate each other. A research study performed by Deloitte

Research called ‘‘Disarming the Value Killers: A Risk Management Study’’

revealed that over 80 percent of the 100 largest losses in shareholder

value (over the 10-year study period, 1994–2003) were the result of two

or more risks interacting.

This is also intuitive. Consider competitive boxers in the heavyweight

division. They are often said to be able to ‘‘take a punch,’’ which means a

competitor can land a single solid blow to their chin and yet they can stay

on their feet. But what can result in a knockout? It’s usually a combination

punch. This is a barrage of multiple blows occurring in rapid succession.

Also consider people you may have known or heard about whose lives

suddenly went into a downward spiral. Often it is not just one unlucky

event that caused their downfall, but rather two or more shocks to the

system that sends them reeling. It’s the same for organizations. So, if you

are not capturing multiple simultaneous risk events, then you may be

missing something that could potentially ruin the firm.

3. Does not capture offsetting risks. Multiple risk events can offset each

other. Our definition of risk includes both downside and upside risk events,

so one event can offset the financial impact of another. For example,

consider that one downside risk event lowers sales growth by some

amount, but another upside risk event occurs that increases sales growth

by an equal, and offsetting, amount. This seems fairly straightforward.

What may be surprising is that even two downside risk events can offset

each other, to some degree. For an example, see ‘‘Downside Risk Events

Can Partially Offset Each Other.’’

DOWNSIDE RISK EVENTS CAN PARTIALLY OFFSET EACH OTHER

To illustrate how two downside risk events can partially offset each other,we will use a hypothetical global manufacturing company, called Glob- alCo, as an example. Table 2.2 shows the GlobalCo strategic plan baseline scenario financial projection for the coming year. For illustrative purposes, in this example, we make the following simplifying assumptions:

(continued )

Definition of ERM & 37

C02 01/07/2011 10:39:26 Page 38

(continued )

& GlobalCo is only in business for one year.

& Expenses are 90 percent of revenues.

& Income tax rate is zero.

Consistent with our definition of risk as deviation from what is expected, risk is measured by the shock to, or change in, the strategic plan baseline scenario financial projection. In this example, we will use the net income metric to represent the baseline, and risk will be defined as deviations from net income. Consider two different risk scenarios, each from a different source of risk:

Risk Scenario A: A new regulation is passed increasing GlobalCo’s expense ratio from 90 percent of revenues to 95 percent of revenues.

Risk Scenario B: A new competitor enters GlobalCo’s markets reducing their market share from 5 percent to 4 percent.

First, let’s consider the financial impact of each risk scenario occurring by itself. If Risk Scenario A occurs by itself, the change in net income is a decrease of $50 million (shock scenario net income of $50 million minus baseline scenario net income of $100 million), as shown in Table 2.3.

If Risk Scenario B occurs by itself, the change in net income is a decrease of $20 million (shock scenario net income of $80 million minus baseline scenario net income of $100 million), as shown in Table 2.4.

TABLE 2.3 GlobalCo: Risk Scenario A

Risk Scenario A (in $ millions) Year 1

Revenues 1,000

Expenses 950

Net Income (Revenues less Expenses) 50

Change from Baseline !50

TABLE 2.2 GlobalCo: Baseline Scenario

Baseline Scenario (in $ millions) Year 1

Revenues 1,000

Expenses 900

Net Income (Revenues less Expenses) 100

Change from Baseline N/A

38 & Defining ERM

C02 01/07/2011 10:39:30 Page 39

In Chapter 3, we describe how a robust ERM framework addresses this

issue by capturing multiple risk events and their interaction, including exac-

erbation or offsetting of financial impacts.

Inefficient Silo risk management results in various inefficiencies. The most important of these inefficiencies are:

& Overpaying. The lack of awareness and coordination often present in silo

risk management can result in the separate purchasing of hedges for

Now, let’s consider the financial impact of both risk scenarios occurring simultaneously. If Risk Scenario A and Risk Scenario B both occur together, the change in net income is a decrease of $60 million (shock scenario net income of $40 million minus baseline scenario net income of $100 million), as shown in Table 2.5.

The $60 million decrease in net income from the combination of both risk events is lower than the sumof the two risks occurring separately, which is $70 million ($50 millionþ $20 million). So, in this case, the financial impact of the risks is not additive. The difference, an interactivity benefit of $10 million ($70 million !$60 million), is the amount that the risks offset each other. This is attributable to the additional 5 percent expense ratio (due to Risk Scenario A) that is operating on a revenue base that is $200 million lower (due to Risk Scenario B), which results in the offset of $10 million ($200 million multiplied by 5 percent).

TABLE 2.4 GlobalCo: Risk Scenario B

Risk Scenario B (in $ millions) Year 1

Revenues 800

Expenses 720

Net Income (Revenues less Expenses) 80

Change from Baseline !20

TABLE 2.5 GlobalCo: Risk Scenario A and Risk Scenario B

Risk Scenario A and Risk Scenario B (in $ millions) Year 1

Revenues 800

Expenses 760

Net Income (Revenues less Expenses) 40

Change from Baseline !60

Definition of ERM & 39

C02 01/07/2011 10:39:32 Page 40

related risk exposures in multiple parts of the company. This can increase

the overall cost of mitigation, as opposed to that which could be achieved

by buying in bulk. & Under-communicating. The absence of a centralized approach and

appropriately structured risk governance impedes information sharing.

This inhibits the development of best practices in risk management. In

particular, and most costly, is the inability to effectively share lessons

learned from costly mistakes, potentially dooming other departments to

repeat the same error.

In contrast, a robust ERM program is integrated, removes these in-

efficiencies, and results in appropriate bulk purchasing of hedges and sharing

of information enterprise-wide.

Internally Inconsistent A third disadvantage of silo risk management is that the organization may be making internally inconsistent projections

regarding the market. Different business segments, developing explicit or

implicit risk scenarios independently, may be making different assumptions,

for example, about the direction of the economy or sector growth. As a result,

different areas may unknowingly be making bets that are at cross-purposes.

In contrast, an integrated approach would facilitate a single set of internally

consistent market projections, and reconcile all bets on market direction,

enterprise-wide.

Criterion 5: Aggregated Metrics

Another implication of the word enterprise in ERM is the ability to aggregate

exposure metrics and risk decision making to the enterprise level. There are

two main aggregate pieces of ERM information at the enterprise level. One is a

calculated metric of aggregate risk exposure and the other is a management

decision defining the target level of aggregate risk exposure.

The first is a calculated metric, or set of metrics, that aggregates the risk

exposures to the enterprise level. This is called enterprise risk exposure.

Assume that company value is one of the ERM metrics. This will be defined

later in this chapter (see ‘‘Company Value’’), but for now consider it simply as

an internal valuation, performed by management, to calculate the value of

the company to its primary stakeholder. The enterprise risk exposure may

be expressed, for example, as ‘‘We currently have a 10 percent chance of

losing 15 percent or more of our company value.’’ This is just one example.

40 & Defining ERM

C02 01/07/2011 10:39:34 Page 41

There are usually multiple metrics, each with multiple thresholds, and

corresponding likelihoods. This is a calculated metric, or set of numbers,

at one point in time.

The second aggregate element—the counterpart to enterprise risk expo-

sure—is a quantitative definition, set by management, of the amount of enter-

prise risk exposure that is acceptable. This is called risk appetite. Another term

for this is risk tolerance, which is used by Standard & Poor’s. Risk appetite is the

target level of enterprise risk exposure. Risk appetite is what management wants

enterprise risk exposure to be, at the limit. Continuing our company value metric

example, management may define risk appetite as ‘‘We want no more than a

7 percent chance of losing 15 percent or more of our company value.’’ Again,

this example involves just one data point, whereas, mirroring enterprise risk

exposure, risk appetite is a set of defined targets for a set of metrics.

In this example, management defines risk appetite below the current

enterprise risk exposure level, indicating a desire to reduce the level of risk.

Because likelihood and severity go hand in hand, even our single data point

definition of risk appetite can be expressed in two ways. In our example,

management expressed a desire to reduce the likelihood, from 10 percent to

7 percent, of suffering a loss of 15 percent or more in company value. They

focused on a specific level of severity—a loss of 15 percent or more—and

wanted this to be less likely. This is the most common choice, because

management focus is on the severity of events more than the likelihood.

Management is well aware of the outcomes they would like to avoid. Never-

theless, management can express the desire for a reduction in risk by fixing

the likelihood and targeting a lower corresponding severity. For example,

management can define risk appetite as ‘‘We want a 10 percent chance to

correspond to, at the maximum, losing 12 percent or more of our company

value.’’ This is equally valid.

Most companies still use silo risk management and do not yet have either

of these aggregate elements. However, they are such a fundamental part of

ERM that without these two elements, the ERM program cannot perform its

primary function, which is to manage enterprise risk exposure to within risk

appetite. In our example, management is indicating that they wish to lower

enterprise risk exposure from its current 10 percent likelihood to within a 7

percent likelihood of crossing a threshold of a loss of 15 percent or more of

company value.

The ability to produce aggregate information at the enterprise level—and

particularly enterprise risk exposure and risk appetite—is not critical only

because it supports the primary function of ERM. It is also of vital importance

Definition of ERM & 41

C02 01/07/2011 10:39:34 Page 42

because this should be the first step, chronologically, in the risk decision-

making process. Information on risk exposures and risk appetite should first

be produced at the enterprise level, and then cascaded downward through the

organization, in a type of allocation or budgeting process. For example, risk

appetite is allocated or budgeted downward to determine risk limits. The type

of risk limits set varies by organization, and can include geographic areas,

business segments, and/or individual risks.

When this is implemented in the correct chronological order, it turns the

risk management process upside-down, or more accurately, right-side-up, for

the first time. Traditional risk management assesses risks at the local business

unit or risk level, and decides on mitigation based on local business manage-

ment’s judgment, instinct, or, even worse, arbitrary rules of thumb established

long ago for other purposes. Using a traditional risk management approach can

result in under-mitigating some risks, which can be disastrous if such a risk

event occurs and the company is not adequately protected. However, a more

common and immediate consequence of the traditional risk management

bottom-up approach is the converse—many risks are over-mitigated. This

results in waste, as resources are unwittingly spent on excess mitigation which

management would have vetoed, if the proper information had been available.

In contrast, ERM introduces a logical approach based on the overall

volatility of the enterprise and the desired level of enterprise stability, or shock

resistance, desired by management. This is more sensible, because this is

how the shareholders and other key stakeholders perceive the volatility: in

the way that it expresses itself at the enterprise level. Once the two essential

aggregate counterparts of information—enterprise risk exposure and risk

appetite—are determined, lower-level decisions can be made at the business

segment, business unit, or risk level, depending on the specific risk culture of

the organization, and how they choose to allocate their aggregate enterprise

‘‘risk budget’’ down through the organization.

Criterion 6: Includes Decision Making

The word manage in the ERM basic definition indicates the main purpose of

ERM: responding to the risk, managing it, making decisions. Many risk

management programs identify and quantify the risks, but then merely report

them to management and the Board with little or no action built directly into

the ERM process. For example, many companies conduct qualitative risk

assessments with the primary goal of developing a simple risk status report

to senior management or the board of directors.

42 & Defining ERM

C02 01/07/2011 10:39:35 Page 43

This report usually takes the form of a ‘‘heat map’’—a simple chart listing

key risks and scoring them with stop-light color coding: red (danger), yellow

(warning), and green (okay). Some color codings refer to the overall scoring

of likelihood or severity, while others refer to the level of exposure versus the

risk limit. An example of the latter heat map is shown in Figure 2.5.

This focus on reporting seems to skip the most important step—actually

doing something about the risk exposures. In a vigorous ERM program, the

main purpose is making decisions and addressing the risk exposures, bringing

them within the company’s risk appetite. This primary activity is central to the

ERM process and is repeated in each process cycle (see ‘‘The ERM Process

Cycle’’ later in this chapter).

Criterion 7: Balances Risk and Return Management

Another aspect implied by the word manage in the basic ERM definition is that

ERM is not just about risk mitigation. Prior to the introduction of ERM, risk

management was exclusively about downside risk, employing mitigation to

lower the exposure, and avoiding some risks altogether. The risk management

function often manifested itself in the form of risk managers frequently saying

no to projects, impeding the business segments from taking on more downside

Risk Quantification

Status

Key Risk Prior

Period Current Period

Projected Period

Currency risk E N W Supplier risk W N W Regulatory risk N E N Compliance risk W W W M&A execution risk N W W IT failure W W W

(W) = Within Limits (N) = Near Limits (E) = Exceeding Limits

... ... ... ...

FIGURE 2.5 Sample Heat Map

Definition of ERM & 43

C02 01/07/2011 10:39:36 Page 44

risk exposure. This sometimes frustrated business opportunities and business

decisionmakers, because it was not always clear that the upside potential of the

project was fairly weighed against the downside risk exposure. As a result,

decisionmakers in the business segments often looked to minimize involvement

by the risk management department.

However, ERM represents a quantum leap forward. Both upside and

downside volatility are in scope. This means that the full range of business

is recognized and addressed. Risk exposures from which the company does

not benefit are considered for mitigation—a reduction in exposure. This was

present in traditional risk management. But what is new with ERM is that

risks for which the company is rewarded are considered for exploitation—

an increase in exposure. This expanded approach allows for considering

any business decision holistically: The upside risk-taking opportunity is

considered alongside the downside risk exposures, for a full risk–return

evaluation. Upside volatility is in scope and factored into the enterprise

risk exposure calculations. As a result, ERM can identify where, and how

much, additional risk may be taken, in the context of appropriate risk–return

trade-offs. This involves a key linkage between risk and return, often missing

in traditional risk management programs and even traditional business

management approaches.

The importance of this cannot be overstated for risk management per-

sonnel. Rather than being the bearers of bad news whom business decision-

makers avoid, they are now welcome at the strategy table. They are invited to

decision-making conversations in the business segments and at the corporate

level. The risk professionals nowhave a framework for bringing risk and return

together, and can add value to important decision-making processes, includ-

ing strategic planning.

Criterion 8: Appropriate Risk Disclosures

When first implementing an ERM program, the question often arises as to

whether a new risk will be identified. The general answer is that the company

already knows its key risks, and uncovering a completely new type of risk that

management hadn’t considered is unlikely. However, there is one risk that is

frequently the single most overlooked risk, and that is the risk of improper risk

disclosures.

The word disclose in the basic ERM definition implies offering external

stakeholders real insights into the company’s risks and ERM program. Un-

fortunately, risk disclosures are typically generic—they look very similar from

44 & Defining ERM

C02 01/07/2011 10:39:36 Page 45

company to company—and their risk lists are often exhaustive, appearing to

list every major conceivable risk for their industry sector. Yet, there can be a

vast range of ERM sophistication between companies in a given sector—some

are quite advanced in their ERM process while others have not started theirs

yet. This mismatch between what is disclosed to external stakeholders and

what is the reality of the ERM program inside the company represents a

significant risk.

Imagine a company that suddenly has its stock price fall 50 percent due to

some risk event that did not occur for any of its competitors. Management is

now under scrutiny. Many questions will be asked, some by shareholder

litigation attorneys, including ‘‘What did management know, and when did

they know it, regarding the potential impact of this risk on shareholder value?’’

Imagine further that the litigants are able to say, ‘‘This risk is listed as #35 in

the risk disclosures, yet management should have known that based on the

potential impact to shareholder value it should have been listed in or near the

top five. Why didn’t management list it as such?’’

Now, imagine a second company that has its stock price collapse similarly.

However, when asked similar questions by shareholders, management is able

to respond as follows: ‘‘We cannot know what risk events will actually occur.

However, we recently implemented an ERM program that measured the

potential impact of all key risks on shareholder value, and used this to inform

development of the risk disclosures. This resulted in a significant shift from the

prior year’s risk disclosures. We changed the order of the risks, the length of

text, the tone, and the context of the information. We did our best to help

shareholders understand the risks present, and the shareholders were as well

informed as possible.’’ The second company is in a much better position to

defend the appropriateness of their risk disclosures.8

Virtually all companies are in the situation of the first company—they

do not infuse their risk disclosures with information about the potential

impact of key risks on shareholder value. For each such company, there

are two possible explanations. One is that the company may be unable to do so

because they do not measure the potential impact of risks on shareholder

value. Most companies are in this situation. Another possibility is that the

company may be unwilling to do so, because none of their competitors have

yet disclosed this kind of information. It is just speculation, but we may be

coming soon to a time when neither answer will be acceptable. At some

point, either shareholder litigation may raise the stakes for external risk

disclosures or regulations may require it. Chapter 7 discusses risk disclosures

in more detail.

Definition of ERM & 45

C02 01/07/2011 10:39:37 Page 46

Criterion 9: Measures Value Impacts

The word value in the basic ERM definition indicates the importance of using

holistic metrics in the risk quantification process—metrics that can fully

capture the value of the company to the primary stakeholder. People often

refer to the importance of value-added, yet few actually measure it. Manage-

ment needs measures to inform their decision making. For public companies,

the primary stakeholder is the shareholder. The market’s measure of share-

holder value is market capitalization, which is the stock price multiplied by

the outstanding shares. We will define management’s own measure of

shareholder value as company value. Company value is a key metric that

will be used throughout this book. It is management’s internal valuation of

what the company is worth to its primary stakeholders, which are the

shareholders for public companies or owners for companies that are not

publicly traded. See ‘‘Company Value.’’

COMPANY VALUE

We will define company value as an internal valuation, performed bymanagement, that calculates the value of the company from the perspective of its primary stakeholder. For public companies, company value is the value of the company to shareholders. Unless otherwise specified, in this book, we will generally refer to public companies, although the concepts are analogous for non-publics as well. In addition, we define company value herein in one particular way, but this is often modified by management to conform to internal views on the definition of value.

We will define company value by defining each of the following three terms:

1. Distributable cash flow

2. Company value

3. Baseline company value

Distributable Cash Flow

Distributable cash flow is cash flow available to be distributed to share- holders. Distributable cash flow is generally calculated as:

46 & Defining ERM

C02 01/07/2011 10:39:38 Page 47

Distributable cash f lowNon!f inancial services ¼Net income þDepreciation and amortization ! Increase in working capital !Capital expenditures

For financial services companies, distributable cash flow has an extra component and is calculated as:

Distributable cash f lowFinancial services ¼Net income þDepreciation and amortization ! Increase in working capital !Capital expenditures ! Increase in required capital

Unless otherwise specified, in this book, we will use the formula for non- financial services companies.

Technically, distributable cash flow also includes changes in the level of debt, which includes repayment of principal to bondholders as well as issuance of new debt. To simplify our discussions and illustrations in this book, we will omit this.

Company Value

Company value is an internal valuation by management of the value of the company to shareholders, which is the present value of distributable cash flows:

Company value ¼ X1

n¼1 Distributable cash f lown

ð1þ dÞn

Where:

& n ¼ year of projection & Distributable cash f lown ¼ distributable cash flow, projection year n & d ¼ discount rate, which is management’s estimate of the rate of return

required by the shareholders for their investment; this is an estimate of the cost of equity capital

Technically, company value also includes distributable equity capital at time zero, which is calculated differently for different types of companies. For non-financial services companies, it is adjusted shareholder equity. For financial services companies, it is available capital (adjusted shareholder equity minus required capital). To simplify our discussions and illustrations in this book, we will omit this.

(continued )

Definition of ERM & 47

C02 01/07/2011 10:39:40 Page 48

Surprisingly, very few companies have an internal valuation of the

company for general management purposes, and even fewer use this metric

in their ERM program. Traditionally, risk management programs quantify risk

in terms of short-term period metrics; for example, the impact on today’s

balance sheet or the impact on next quarter’s earnings. This is not adequate for

capturing the full impact of all types of risks and is also inadequate for informing

decision making. ERM must include more holistic metrics.

Criterion 10: Primary Stakeholder Focus

Many traditional risk management programs focus on maintaining their

ratings as their central theme. In addition to a focus on ratings, financial

service companies also focus heavily on maintaining regulatory capital

requirements. This is understandable when you consider that traditional

risk management is rooted in downside risk events and mitigation. However,

ERM is more strategic, involves upside volatility as well as downside volatil-

ity, and begins with a focus on the primary metrics of the firm. So, while

rating agencies and regulators are important, they are secondary to the

primary stakeholder: shareholders. As such, rating agencies and regulators

should not be maximally satisfied, because this often leads to less-than-

maximal shareholder value.9 For example, a financial services company that

holds excessive capital may garner the top rating from rating agencies, but

the fallow capital will lower future growth and returns and thereby lower

company value.

(continued ) There are many alternate ways to calculate company value. One example

is to discount distributed cash flow, in the form of projected shareholder dividends, rather than distributable cash flow, which we will use in this book.

Baseline Company Value

The baseline company value ismanagement’s calculation of company value based on distributable cash flow projections consistent with the strategic plan baseline financial projection. Whereas market capitalization is the market’s estimate of shareholder value, baseline company value is man- agement’s estimate, or ‘‘expectation,’’ of shareholder value. The baseline company value is the value an investor would pay today, if they believed that management will be able to perfectly execute the strategic plan and that everything will go the way the company expects.

48 & Defining ERM

C02 01/07/2011 10:39:40 Page 49

Instead, ERM must focus on increasing value to shareholders. The level of

satisfaction of secondary stakeholders is factored in, but only to the extent that it

impacts shareholder value, or company value, which is management’s estimate

of shareholder value. For example, while searching for the risk-to-value trade-

offs that might maximize company value, rating agency constraints must be

taken into account because a lower rating might negatively impact value. But it

might not. This is witnessed by the fact that most companies have long since

migrated away from AAA ratings, deeming them too expensive and un-

necessary in the quest to maximize company value, and the market has

validated this shift. As another example, if regulators are not sufficiently satisfied,

they may take action that will then result in a lower company value.

The ERM Process Cycle

ERM can also be defined in terms of its process cycle.We first clarify the definition

of process. After that, we identify the components of the ERM process cycle.

Process

ERM is a process. It is not a periodic validation exercise, it cannot be completely

delineated at the outset, and it is not an isolated stand-alone function. Rather,

ERM is a continuous, evolving, and integrated process.

Continuous ERM is not a periodic validation exercise, like an annual car inspection. ERM is more like the continuing activities you do to protect yourself

from risks involving your vehicle, such as routine car maintenance, safe driving

practices, and auto insurance.

Evolving It is not possible to fully determine at the outset precisely what an ERM program will ultimately be for a particular organization. Though it is

possible to lay out a high-level implementation plan, ERM evolves over time. It

usually takes years for an ERM program to fully develop to maturity, and many

things can change in that time. In addition, as the program develops, some

aspects may gain more popularity and be expanded. The pace and scope of ERM

adoption is a function of many variables, many of which are unique to each

organization. The most common examples of these company-specific variables

affecting ERM adoption are the following ‘‘10 Cs’’:

1. Catalyst. What or who initiated the desire to implement ERM?

2. Commitment. Is the Board focused on driving ERM adoption? Is senior

management?

Definition of ERM & 49

C02 01/07/2011 10:39:41 Page 50

3. Champion. Is there a chief risk officer (CRO) to continually advance

efforts?

4. Culture. Are they quick to adopt change?

5. Centralization. Does Corporate dictate requirements or are business

segments independent?

6. Climate. Are there distractions slowing adoption? Conversely, has there

been a recent risk event that has heightened risk awareness?

7. Circumstances. Is there an impending major threat or opportunity

about which the ERM program has the opportunity to help evaluate

decision alternatives?

8. Contagion. Can ERM concepts spread quickly across the enterprise via

communication, training, inter-department interactions, and sharing of

best practices?

9. Cascade. How long will it take for ERM applications, and supporting tools

and techniques, to filter from the strategic level down to tactical and

transactional levels?

10. Confirmation. Have rating agencies approved of the company’s ERM

program? What about regulators and shareholders?

Integrated In many companies, traditional risk management is a function housed in the corporate department, separate from the business segments.

Risk management processes are considered an add-on that can be performed

independently from other company processes. This is usually a sign that the

company has a compliance-centric approach to risk management, concerned

mainly with downside risk mitigation.

This is not the case with ERM, which is a more advanced approach

that involves merging risk management and return management. ERM

processes must be fully integrated with other key company processes,

including:

& Governance & Decision making

& Strategic planning & Strategic and tactical decisions & Transactions (e.g., M&A)

& Business performance analysis & Incentive compensation & Communications with shareholders, rating agencies, and regulators

50 & Defining ERM

C02 01/07/2011 10:39:42 Page 51

The ultimate goal, achieved in a mature ERM program, is to have ERM so

integrated that it becomes part of the culture; ERM just becomes a better way of

doing business.

Four Steps

There are four steps in the continuous ERM process cycle (see Figure 2.6).

While there are other steps involved in establishing an ERM program (ERM

framework discussed in Chapter 3 and risk governance discussed in Chapter 8),

the four steps described here are the major steps that are routinely performed

on a continuous basis, once the ERM program is up and running. The four steps

in the ERM process cycle are:

1. Risk identification. Risk identification is the first step in the ERM

process cycle. It involves determining the key risks, which represent

the biggest potential threats to the enterprise. This entails narrowing

down a very large list of potential risks to a small number of key risks. As

stated earlier in this chapter, this is commonly in the range of 20 to 30

risks. This is primarily done using qualitative risk assessments, based on

internal opinions as to the likelihood and severity of each potential risk.

Risk identification is discussed in detail in Chapter 4.

Risk Identification

Risk Quantification

Risk Decision Making

Risk Messaging

FIGURE 2.6 ERM Process Cycle

Definition of ERM & 51

C02 01/07/2011 10:39:43 Page 52

2. Risk quantification. In the second step in the ERM process cycle, the

key risks are quantified on both an individual and integrated basis. This

involves using an ERM model to quantify the impact of individual risk

scenarios, for each key risk, in terms of their potential impact on key

metrics. Once this is completed, the impact of integrated risk scenarios—

multiple risks occurring simultaneously—is quantified, leading to enter-

prise risk exposure metrics. Risk quantification is discussed in detail in

Chapter 5.

3. Risk decision making. Risk decision making is the third step in the

ERM process cycle. This consists of two categories of decision making. The

first category includes decisions related to managing risk exposures to

within risk appetite. The first step in this category is to define risk appetite.

Once risk appetite is defined, decisions can be made to reduce risk

exposures or to increase risk exposures. The second category includes

embedding ERM into routine decision making, such as strategic planning,

strategic and tactical decisions, and transactions. Risk decision making is

discussed in detail in Chapter 6.

4. Risk messaging. The fourth step in the ERM process cycle is risk

messaging. This consists of two distinct categories of messaging: internal

risk messaging and external risk messaging. Internal risk messaging

involves integrating ERM into business performance analysis and incentive

compensation. This is a strong form of internal messaging; it is a powerful

signal to management that risk and return must be considered together.

Once risk exposures are tracked by the departments, the business segments,

and the individuals generating them, and reflected in incentive compensa-

tion, it becomes clear that if one exposes the firm to more risk, more return

is expected. The second category is external risk messaging, which involves

integrating ERM into communications with shareholders, rating agencies,

and regulators. Risk messaging is discussed in detail in Chapter 7.

Fundamental Benefits

Another useful way to define ERM is by its outcomes. In other words, ‘‘What

are the reasons that a company should implement an ERM program? What do

they get out of it?’’ We examine the benefits of ERM from the perspective of

each major stakeholder:

& Shareholders & Board of directors

52 & Defining ERM

C02 01/07/2011 10:39:43 Page 53

& C-Suite & Management & Rating agencies & Regulators

Shareholders

Shareholders—the primary stakeholders—benefit from ERM in two main

ways:

1. Increased likelihood of achieving returns

2. Enhanced risk disclosures

Increased Likelihood of Achieving Returns With an ERM program, the company has an increased likelihood of achieving returns—of executing its

strategic plan as expected. This is a natural result of a more rigorous approach

to identifying and responding to its most important threats, which are risks that

can negatively impact its performance.

Figure 2.7 provides some unique evidence to support this claim, illustrat-

ing a correlation between ERM and resistance to declines in value. Standard &

Poor’s (S&P) has a separate component of its insurance ratings dedicated to

ERM. S&P analysis reveals that North American insurers with better ERM

scores tended to be more shock resistant through the heart of the global

financial crisis (January 1, 2008–November 14, 2008) than their counterparts

with lower ERM scores. Figure 2.7 also shows that, at the extreme, those with

weak ERM programs suffered more than twice the value loss as those with

excellent ERM programs.

Additional evidence that ERM helps companies deliver better performance

is provided in Figure 2.8, which shows a correlation between ERM and the

ability to stabilize volatility of results. This S&P study shows that better ERM

was positively correlated with lower stock price volatility in 2009. At the

extreme, those with weak ERM programs had more than twice the stock price

volatility as those with excellent ERM programs.

Enhanced Risk Disclosures ERM also provides shareholders, as well as potential investors, with a better sense of the risks and opportunities of owning

the stock. This is due to the enhanced risk disclosures, which list the key risks

prioritized from the perspective of the (current and future) shareholders: the

potential impact to company value.

Definition of ERM & 53

C02 01/07/2011 10:39:43 Page 54

54 & Defining ERM

FIGURE NOT AVAILABLE IN ELECTRONIC VERSION

FIGURE NOT AVAILABLE IN ELECTRONIC VERSION

C02 01/07/2011 10:39:44 Page 55

Board of Directors

The members of the board of directors gain additional comfort that the key

risks of the organization are well understood and effectively managed. This

reassurance primarily comes from three aspects of the ERM program:

1. A disciplined approach to quantify enterprise risk exposure, based on all

key risks

2. A clear definition of the firm’s risk appetite

3. A formal process for managing exposures to within risk appetite, sup-

ported by a risk governance structure

ERM also places the board of directors in a comfortable position regard-

ing the SEC disclosure requirements on the board’s role in risk oversight.10

In addition, ERM provides a solid basis for addressing the SEC disclosure

requirements on risky incentive compensation programs.11 A compensation

program is considered ‘‘risky’’ if it creates risks that are ‘‘reasonably likely

to have a material adverse effect’’ on the company. Each of these disclosure

requirements is discussed further in Chapter 7 (see ‘‘Mandatory Risk

Disclosures’’).

C-Suite

The C-Suite, and mainly the CEO and CFO, gain a more sophisticated

risk management program, which provides better shock resistance. The

company will experience less downside volatility and more strategic plan

integrity—a higher potential to achieve strategic plan goals. Perhaps even

more important for the CEO and CFO, ERM provides them with an advanced

and more accessible set of tools for communicating these competitive

advantages to key stakeholders, which can lead to a higher stock price

and a better rating.

Higher Stock Price For communication with stock analysts, the CEO and CFO are better equipped to respond to, or proactively address, concerns about

their ability to deliver results in the face of an impending risk or a developing

risk event. This is because the ERM model quantifies the financial impact of

key risk scenarios, in terms of the impact on company value (and other key

metrics) and does so in a timely manner. For example, if analysts are

overstating the impact an adverse market development will have on the

company, the CEO and CFO are in a position to rebut this in a credible way

Definition of ERM & 55

C02 01/07/2011 10:39:45 Page 56

because their information is bolstered by robust risk scenarios and an

integrated quantitative ERM model. The CFO could respond:

We have already thought through the eventuality now unfolding in the market. While it doesn’t exactly match, it is fairly close to one of the risk scenarios that we considered for this risk event. You are overestimating the impact on one of our major business segments where we have the following mitigation in place . . . We also have a detailed contingency plan, which will involve the following man- agement actions over the next period . . .

This kind of advanced ability to communicate quickly and in a credible

manner effectively conveys management’s superior abilities in risk manage-

ment. Over time, similar communications can lead to a higher ‘‘management

multiple’’ resulting in a higher stock price. The management multiple refers

here to the factor that analysts take into account when valuing the company

that to a large extent reflects their appraisal of the quality of management; a

higher factor indicates a higher level of trust in management’s ability to

consistently and successfully execute their strategic plan. Essentially, the

analysts are lowering the cost of equity capital for the company. A lower

cost of equity capital, with all other things being equal, increases analysts’

valuations and puts upward pressure on the stock price, to the extent that

analysts influence the general market.

Better Rating For communications with rating agencies, the CEO and CFO are able to satisfy the portion of the ratings review related to ERM. Over

the past several years, rating agencies have increased their level of focus on

ERM. S&P has led the way; as discussed earlier, they have a distinct

component of their ratings dedicated to ERM, in the insurance sector.

While rating agencies have raised the bar on ERM requirements, forcing

companies to advance their programs, their requirements are geared toward

ERM from their limited perspective: protecting the interests of the bond-

holders. A truly robust ERM program has a broader focus—protecting the

shareholder—which by its nature incorporates all secondary stakeholder

interests to the appropriate degree. ERM helps determine the optimal level

of satisfying secondary stakeholders—that which maximizes company value.

Therefore, a complete ERM program will more than satisfy the ERM portion

of rating agency reviews, and can lead to an improvement in, or strengthen-

ing of, the overall rating of the company, which means a lower cost of debt

56 & Defining ERM

C02 01/07/2011 10:39:45 Page 57

capital, which increases company value. Rating agencies tend to see the quality

(or lack thereof) of a company’s ERM program as a leading indicator of

performance and credit-worthiness.

In addition, for financial services companies, the CFO may be able to

persuade some rating agencies to lower their capital requirements for the

company. While this is not the official position of the rating agencies, it may

be possible to influence, at least implicitly, a downward adjustment to the

capital requirements. At one point, S&P indicated that they would consider

this in the insurance sector. Rating agencies have their own opinion of a

sufficient capital level for a company, based largely on their industry

perspective. In contrast, the ERM model estimates the impact of key risks

on the company’s capital position as one of its key metrics. This is a company-

specific capital model, which offers the potential to be a far more accurate

predictor of the company’s true capital needs. The ERM model also reflects

risk interactions, including offsets, resulting in a required capital level that is

often lower than rating agency capital requirements. However, to succeed in

having the rating agency consider the company’s ERM model in setting the

required capital level, the CFO must demonstrate the credibility of the ERM

model calculations. To do this, the CFO must overcome the natural (and

sometimes warranted) skepticism of the rating agency. After all, the ERM

model, along with its data and assumptions, are a product of management

which has a biased vested interest in lowering capital requirements.

Management

Management gains three significant enhancements to their decision-making

abilities. They gain a well-defined methodology to manage risk exposures to

within risk appetite, and quantitative information that supports decisions on

risk mitigation alternatives. In addition, management gets a decision-making

tool for selecting the projects with the best risk–return profile. The decision-

making tool—the ERM model—supports all types of routine decisions, includ-

ing strategic planning, strategic and tactical decisions, and transactions.

Finally, management benefits from better prioritization of its limited resources.

The ERM program allows focus on the most important risks.

Rating Agencies

Rating agencies enhance their ability to assess the credit-worthiness of the

companies for which they provide credit ratings. Through the ERM lens, they

see prospective information on the major threats to the company’s strategic

Definition of ERM & 57

C02 01/07/2011 10:39:45 Page 58

plan financial projections, which includes impacts to liquidity. The ERM

program provides a complete shift in the kind of financial information

typically provided to rating agencies, which is almost entirely retrospective.

With the ERM program, rating agencies receive prospective insights into

which risks are on management’s radar, how the risks would impact the

enterprise, the potential financial impacts, and management’s estimates of

the likelihood of each risk. They also receive data on enterprise risk exposure,

which is essentially prospective information on the company’s shock resist-

ance. In addition, as more companies achieve a mature, robust ERM

program, rating agencies will expand their sense of relative credit-worthiness

between companies.

Regulators

For companies in the financial services sector, regulators are primarily

concerned with preventing insolvencies. In the United States, there are

financial costs to the government and political costs to regulators when

financial services companies fail. When banks fail, the government FDIC

guarantee covers depositors (up to a limit).12 When securities firms suffer

losses due to fraud, the government SIPC guarantee covers investors (up to a

limit).13 When insurance companies fail, although the government does not

provide a guarantee, state regulators are held accountable politically, because

they are responsible for protecting policyholder interests. In unusual times,

like the global financial crisis that began in the United States in 2007, the

government provides special funding to bail out companies deemed critical to

maintaining the economic infrastructure.

Regulators benefit as more companies adopt ERM because it lowers

systemic risk. For our purposes, we define systemic risk here simply as the

risk that failures in one part of the economic system can spread contagiously to

others, resulting in a cascading set of failures threatening to crash the entire

system. ERM makes companies more shock resistant, lowering their risk of

failure andmaking themmore aware of their dependencies on other companies

in the event those other companies fail.

SUMMARY

Even with the most advanced risk practitioners, it is critical to clearly

define both risk and ERM before delving into any discussion on ERM. These

58 & Defining ERM

C02 01/07/2011 10:39:45 Page 59

are concepts that are often defined in quite disparate ways. Risk is any-

thing uncertain whose outcome can result in a deviation from expected

results, up or down. ERM can be defined in four different ways: by its basic

one-sentence definition; by its 10 key criteria; by its four-step process cycle;

and by its fundamental benefits. The 10 key ERM criteria provide the

most robust definition and can serve as a benchmark against which all

ERM programs can be compared. These criteria will be referred to periodically

throughout this book and will serve as a focal point of the next chapter,

as we evaluate an advanced yet practical approach to ERM: the value-

based approach.

NOTES

1. Volatility is being used here in a general sense, as opposed to specific reference

to the metric standard deviation.

2. ‘‘Phelps confirms right wrist is broken,’’ available at www.baltimoresun.com/

services/newspaper/bal-sp.phelps06nov06,0,3620926.story.

3. www.jockbio.com/Bios/Phelps/Phelps_bio.html.

4. The Black Swan: The Impact of the Highly Improbable, Nassim Nicholas Taleb,

Random House, April 17, 2007.

5. Capital requirements are requirements by external stakeholders, such as

regulators or rating agencies, to hold a certain amount of capital as a buffer

against existing liabilities.

6. The research study is published in an article titled ‘‘IMPACT Study: focusing on

risks that matter to you . . . and to the media,’’ a Watson Wyatt Horizons

publication.

7. Source: CFO Executive Board; Audit Director Roundtable research.

8. This does not constitute legal advice.

9. Throughout this text, we refer to stock analysts and rating agencies as

stakeholders (the former being primary and the latter being secondary).

Technically, stock analysts and rating agencies are largely acting as agents

of the shareholders and bondholders, respectively, who are the true underlying

stakeholders. For convenience, we use the term stakeholder interchangeably

for the true underlying stakeholders and their agents.

10. Code of Federal Regulations, Title 17 (Commodity and Security Exchanges),

Chapter II (Security and Exchange Commission), Part 229 (Regulation S-K),

Item 407(h), effective February 28, 2010.

11. Code of Federal Regulations, Title 17 (Commodity and Security Exchanges),

Chapter II (Security and Exchange Commission), Part 229 (Regulation S-K),

Item 402(s), effective February 28, 2010.

Notes & 59

C02 01/07/2011 10:39:45 Page 60

12. At the time of the writing of this book, the FDIC guarantee covered up to

$250,000 per individual bank account.

13. At the time of the writing of this book, the SIPC guarantee covered up to

$500,000 per individual investment account and up to $100,000 per indi-

vidual money market account.

60 & Defining ERM

C03 01/12/2011 23:58:21 Page 61

3CHAPTER THREE ERM Framework

What you risk reveals what you value.

Jeanette Winterson, English author and journalist

W HEN THE WORD framework is invoked, I become wary of what Iam about to hear. It is a word that is adored by consultants. It isoften accompanied by a visually appealing and complex chart with lots of boxes and arrows, or sometimes overlapping bubbles, which offers a

feeling of reassurance and comfort when viewed up on an office wall.

Unfortunately, these charts usually do not lead to anything actionable, or

sometimes even discernable. I have seen many such framework charts on ERM.

In sharp contrast, in this chapter, we will define the ERM framework in a

specific, meaningful, and practical way. Our accompanying chart will facilitate

our discussions, and will also be useful for ERM discussions within your

organization, particularly with senior executives and the board.

In Chapter 2, we defined the ERM process cycle as having four steps which

are repeated periodically—risk identification, risk quantification, risk decision

making, and risk messaging. Equally important are two additional elements in

an ERM program: ERM framework and risk governance. Consider each of these

61

C03 01/12/2011 23:58:21 Page 62

as ERM infrastructure or structural overlays within which the ERM process

cycle operates. The ERM framework provides the functional structure and risk

governance provides the hierarchical structure. Think of ERM framework as

the ‘‘what (activities), how (they interact), and why (they are performed),’’ and

risk governance as the ‘‘who (does what), when (they do it), and where

(activities take place).’’

Although ERM framework and risk governance are both elements of ERM

infrastructure, we will discuss ERM framework in this chapter, move on to

discuss the ERM process cycle (Part II, Chapters 4 through 7), and then discuss

risk governance in Chapter 8. There are three reasons for this.

1. Relative importance. Good risk governance is a necessary condition for

a robust ERM program, but it is not a sufficient condition. A company may

have designed and implemented what appears to be a robust risk govern-

ance structure, but that alone cannot reveal much without knowing what

activities are actually taking place. All the risk governance pieces might be

in place around a hollow ERM program, much like an elaborate highway

system with no vehicles traveling on it.

However, the functional structure, or ERM framework, is more

elemental, more closely linked to the quality of an ERM program. As a

consultant, when I have initial discussions with a company about their

ERM program, I often begin by asking about their ERM framework. That

tells me virtually everything I need to know about the level of maturity of

their ERM program. It is the ERM framework that reveals what activities

are actually taking place and how many of the 10 key ERM criteria,

discussed in Chapter 2, are present in their ERM program.

2. Implementation sequence. The order of our discussion more closely

mirrors what companies experience when first implementing an ERM

program. Initially, only the most basic risk governance structure is

warranted before moving through the ERM process cycle at least one

time. The way ERM evolves, is adopted, and becomes integrated into a

company’s key processes differs from company to company. Until it is clear

what the ERM activities will actually look like, the comprehensive risk

governance structure required to support them cannot easily be written.

3. Context for understanding. To understand risk governance it is im-

portant first to understand the ERM process steps. The roles and respon-

sibilities of the different key players in ERM can only be discussed in the

context of the ERM activities. The same is also true for the organizational

structure, as well as policies and procedures, which, along with roles and

62 & ERM Framework

C03 01/12/2011 23:58:21 Page 63

responsibilities, constitute risk governance. They can only be discussed

once the entirety of the ERM process is well defined and understood.

Finally, terms and concepts which will be needed to discuss risk govern-

ance are defined during discussions of the ERM process cycle (Chapters 4

through 7).

VALUE-BASED ERM FRAMEWORK

The ERM framework described in this chapter—the value-based ERM frame-

work—is an advanced yet practical approach to ERM. This ERM framework

represents an emerging approach toward which other frameworks in the

industry may eventually evolve. A small but growing number of consulting

firms and companies are employing this framework. It is the only framework

of which I am aware that satisfies all 10 of the key ERM criteria. Other ERM

frameworks will largely be a subset of the value-based ERM framework,

which can be used to benchmark other ERM frameworks.

CHALLENGES OF TRADITIONAL ERM FRAMEWORKS

We will discuss the challenges of traditional ERM frameworks from two

perspectives:

1. Inability to satisfy the 10 key ERM criteria

2. Three core challenges

Inability to Satisfy the 10 Key ERM Criteria

The 10 key criteria of an ERM program (discussed in Chapter 2) are:

1. Enterprise-wide scope

2. All risk categories included

3. Key risk focus

4. Integrated across risk types

5. Aggregated metrics

6. Includes decision making

7. Balances risk and return management

8. Appropriate risk disclosures

Challenges of Traditional ERM Frameworks & 63

C03 01/12/2011 23:58:21 Page 64

9. Measures value impacts

10. Primary stakeholder focus

These criteria must be in place for a risk management program to be

considered a robust ERM program. Unfortunately, traditional ERM frameworks

do not satisfy many of these 10 key criteria and often fail to achieve most of

them. As a result, companies employing these traditional ERM frameworks

discover that despite putting much good effort into development and imple-

mentation, their ERM program falls short of the bulk of their expectations.

Three Core Challenges

Years of research and client work in this area have revealed three core challenges

to successful ERM implementation, which are like flags, or symptoms, identifying

those companies that are using a suboptimal ERM framework and, as a result, are

struggling to satisfy the 10 key criteria. These three core challenges are:

1. Inability to quantify strategic and operational risks (subset of Criterion 2)

2. Unclear definition of risk appetite (subset of Criterion 5)

3. Lack of integration of ERM into decision making (Criterion 6)

The first core challenge—an inability to quantify strategic and operational

risks—is what I often refer to as the holy grail of ERM. The failure of traditional

ERM approaches to deliver this elusive ability is the root cause of many other

challenges in successfully implementing ERM.

The second core challenge is the most common question I am asked, which

is, ‘‘What is risk appetite? How do you define it? How do you quantify it in a way

that you can use it in risk governance?’’

Finally, the third core challenge is the most prevalent one, and ultimately,

the most important one: an inability to use ERM information for decision

making. If ERM is not providing actionable information, not resulting in

different decisions than would otherwise be made, then it has no purpose.

Although some traditional ERM programs do provide some decision-making

abilities, this is usually pretty limited. For example, most of the decisions

resulting from traditional ERM programs involve financial risk (which, tech-

nically, makes this merely a glorified version of financial risk management

rather than holistic enterprise risk management).

After we describe the value-based ERM approach, we will discuss how this

emerging framework satisfies each of the 10 key criteria, including the three

core challenges.

64 & ERM Framework

C03 01/12/2011 23:58:21 Page 65

VALUE-BASED ERM FRAMEWORK

The value-based ERM framework is illustrated in Figure 3.1.

Figure 3.1 shows the major process flows for three of the four steps in the

ERM process cycle:

1. Risk identification (highlighted in white)

2. Risk quantification (highlighted in grey)

3. Risk decision making (highlighted in black)

4. Risk messaging (discussed in Chapter 7)

Risk Identification

Starting on the extreme left side of Figure 3.1, we begin with all the risks in the

universe, known or unknown, which can potentially impact a company’s

value. These correspond to all categories of risks, which for most companies are

strategic, operational, and financial.1 The flow of action, as indicated by the

arrows, is to the right, as these risks attempt to impact the baseline company

value, represented by the cube (in grey highlight) labeled ‘‘ERM Model.’’ The

ERM model calculates the baseline company value (see ‘‘Company Value’’ in

Chapter 2 for the definition), as well as changes in the baseline company value

resulting from simulating key risk scenarios.

However, not all risks in the universe will impact a particular company’s

value. Many of these potential risks are simply not relevant. The company’s

chosen strategy acts as a natural filter, eliminating risks that are irrelevant. In

other words, the strategy will determine which risks will, and which will not, be

important to the company. The strategy is composed of the company’s choices

that fundamentally define its businesses, including:

& What products or services to sell & Which distribution channels to use & Which customer markets to serve & What value proposition to offer

For example, if the company does not do business in France, then sovereign

risks related to France will likely not impact the company’s value, are therefore

not relevant, and may be screened out of consideration. Or, as another

example, if the company is not manufacturing products using steel as a

raw material, then it probably doesn’t care if the price of steel rises

Value-Based ERM Framework & 65

C 03

01/12/2011 23:58:21

Page 66

FIGURE 3.1 Value-Based ERM Framework

6 6

C03 01/12/2011 23:58:22 Page 67

unexpectedly (all other things being equal). What remains, after considering

the strategy as a filter to a comprehensive list of all potential risks, are just the

relevant risks for the company.

However, the list of relevant risks is still too large of a list, from a practical

standpoint. A qualitative risk assessment process must be conducted to further

narrow down the list of relevant risks to a list of key risks, which are usually in the

neighborhood of 20 to 30 risks. This process commonly consists of internal surveys

askingmanagement tofirst identifyand thenqualitativelyassess thecompany’s key

risks by ranking them in terms of their frequency (how likely they are to occur) and

severity (assuming they occur, how much they would impact financial results).

This is illustrated in Figure 3.1 by a likelihood-severity graph. Various

methods may be used at this point to select a subset of the relevant risks based

on their likelihood-severity ranking. In the graph, risks above and to the right of

the line—those with higher likelihood and/or severity—are selected as this

subset; this is just an example of one of these methods. This process prioritizes

the list of relevant risks down to a smaller number of key risks. This determi-

nation of the key risks ends the risk identification process.

Risk Quantification

The key risks are those risks that will be quantified in the risk quantification

stage of the ERM process.2 In the value-based ERM approach, the quantifica-

tion process begins with developing discrete deterministic risk scenarios for

each key risk.3 For example, a single key risk may have the following multiple

risk scenarios:

& Very pessimistic & Pessimistic & Baseline—no risk event & Optimistic & Very optimistic

Not all risks have upside scenarios (the optimistic and very optimistic scenar-

ios). However, one example of a risk that does have upside scenarios for many

companies is stock market volatility. The market can move in a direction that

increases the company’s value, as well as in a direction that decreases its value.

Risk scenarios primarily consist of a description of the risk event, the

likelihood of its occurrence, and the financial impacts. There are two types

of key risks in terms of the level of difficulty, and therefore the type of approach

used, in developing risk scenarios: ‘‘mostly objective’’ versus ‘‘mostly subjective.’’

Value-Based ERM Framework & 67

C03 01/12/2011 23:58:22 Page 68

Those key risks forwhichdeveloping risk scenarios ismostly objective are those

for which there exists a large set of objective external quantitative experience data.

Most of the key risks in this category are financial risks. As an example, consider

market risks.We have decades of experiencewith daily (and intra-day) data on the

volatility of the major stock markets. As a result, we can construct a detailed,

smooth, continuous distribution of historical risk scenarios for market risk.

For these types of risks, developing risk scenarios is mostly objective. The

historical experience largely informs the understanding of the risk event, its

likelihood, and its financial impacts. Management selects a set of deterministic

risk scenarios from the continuous distribution, which introduces some sub-

jective judgment. A number of risk scenarios—both upside and downside—is

selected to adequately represent the shape of the distribution and capture its

key inflection points. This is depicted by the set of upper graphs in Figure 3.1,

where the continuous distribution is represented by the solid curve and the

deterministic risk scenarios selected are represented by the dots.

In contrast, the key risks for which developing risk scenarios is mostly

subjective are those for which no objective external quantitative experience

data exist, or for which there is a very limited amount of such data readily

available. Most of the key risks in this category are strategic and operational risks.

Take, for example, the strategic risk related to executionof strategy.There certainly

is no industry data available, because this is related to the particulars of the

company’s specific situation—strategy, competitive environment, capabilities of

currentmanagement, and so on. For these types of risks, developing risk scenarios

is mostly subjective. Management develops a set of deterministic risk scenarios

using an adaptation of an approach from the manufacturing sector called Failure

Modes and Effects Analysis (FMEA), which relies largely on input from internal

subject matter experts. The FMEA process will be further discussed later in this

chapter, as well as in Chapter 5. A number of risk scenarios, both upside and

downside, are constructedandare intended to represent the shapeof theunknown

distribution. This is depicted by the set of lower graphs in Figure3.1,where the lack

of a known distribution is represented by the dotted-line curve, and the determi-

nistic risk scenarios developed are again represented by the dots.

Even the ‘‘mostly objective’’ risk scenarios can benefit from the FMEA

technique. Historical data is often insufficient. In addition, subject matter

experts can contribute their knowledge and intuition, which can add signifi-

cant value to the process. For these ‘‘mostly objective’’ risk scenarios, a

combination of the two approaches is often best.

Once the risk scenarios are completed, we have all the risk-related inputs

needed to quantify the individual risk exposures. We are now ready to quantify

the impact on the baseline company value of a simulation involving only one

68 & ERM Framework

C03 01/12/2011 23:58:22 Page 69

event; that is, one risk scenario occurring at a time. This activity is represented

in Figure 3.1 by the lower arrow labeled ‘‘one event per simulation’’ passing

information to the ERM model for quantification.

We also must quantify the enterprise risk exposure. Enterprise risk

exposure is the distribution of all potential impacts on the baseline company

value from simulations involving one or more events; that is, one or more risk

scenarios occurring at a time. This is a more realistic and complete represen-

tation of the firm’s risk exposure, because in business, more than one variable

deviates from the strategic plan during any given period. Enterprise risk

exposure represents the overall aggregate volatility of company value.4 This

activity is represented in Figure 3.1 by the upper arrow labeled ‘‘one or more

events per simulation’’ passing information to the ERM model for quantifica-

tion. To perform this calculation, we need one additional risk-related input: the

impact of risk interactivity, or correlation between risk scenarios. Some risks

are more likely to occur together (positively correlated) than the multiplication

of their probabilities would otherwise indicate, some are less likely to occur

together (negatively correlated), and some are independent of each other

(uncorrelated).

After risk correlation is determined, we are able to quantify the potential

financial impact of individual risk events, as well as that of multiple simulta-

neous risk events, on company value and other key metrics. However, first we

must consider another natural filter which dampens the financial impact of key

risks: risk management tactics. Risk management tactics are implicit or explicit

actions that mitigate the likelihood and/or severity of risk events.

One example of a risk management tactic is the purchasing of insurance.

Consider an example of two companies—Company A and Company B—that

are virtually identical and across the street from each other. Now imagine a

disaster occurs whereby a hurricane totally destroys the headquarters of both

companies, but thankfully results in no injuries or deaths. The gross financial

impact on both companies is identical, amounting to the replacement cost of

their buildings. Assume this is $100 million. Now assume that there is just one

difference between the two companies: Company A had purchased $80 million

of insurance coverage on their building, but Company B had purchased only

$40 million. Although the gross risk exposure (also called inherent risk or

pre-mitigation exposure) is identical for both companies, the net risk exposure

(also called residual risk or post-mitigation exposure) is different:

Net risk exposure ¼ ðGross risk exposureÞ $ ðValue of mitigationÞ Company A :Net risk exposure ¼ ð$100 millionÞ $ ð$80 millionÞ ¼ $20 million Company B :Net risk exposure ¼ ð$100 millionÞ $ ð$40 millionÞ ¼ $60 million

Value-Based ERM Framework & 69

C03 01/12/2011 23:58:22 Page 70

Risk culture is another example of effective risk mitigation that dampens the

financial impact of risk events. Consider another example of two companies—

Company A and Company B—which are again virtually identical. However,

Company A has a risk culture of encouraging the early reporting of bad news,

whereas Company B has a risk culture of ‘‘shooting the messenger’’ when bad

news is delivered. Assume the same type of risk event occurs at both companies.

At CompanyA, the risk event is identified and reported early on in the process. As

a result, serious problems are averted long before the situation has an opportu-

nity to get out of hand. However, the same risk event occurring at Company B

might initially be hidden from management, causing it to grow and fester, until

by the time it is identified it can jeopardize the company’s very survival.

It is important to measure the potential impact of key risks on both a

pre-mitigation (gross exposure) and a post-mitigation (net exposure) basis.

There are two reasons for this:

1. Valuation of mitigation in place

2. Understanding the full potential impact of the risks

Valuation of Mitigation in Place

Measuring the potential impact of key risks on both a pre-mitigation (gross

exposure) and post-mitigation (net exposure) basis offers unique insights into

the value of the existing mitigation in place, which can highlight areas

of under-mitigation or over-mitigation, or confirm appropriate levels of

mitigation. These are significant insights.

As an example, consider the typical dilemma of those working in a risk

mitigation area such as helping the company stay in compliance with laws and

regulations. They often struggle to be fully appreciated within their organiza-

tion. They are usually seen only as an expense, and whenever the company

budget is under pressure, their department is often among the first to be

considered for cost cutting. Even worse, the better they perform their job, the

more unnecessary they can appear to be to upper management. Management

tends not to react to this by saying, ‘‘We have not gotten fined much at all this

year—great job!’’ Rather, more often, management will forget the potential

exposure to fines and secretly think, if not openly verbalize:

Do we really need all those folks in Compliance? We pay almost nothing in fines anyway! Is this risk really that important that we need to mitigate it so heavily with all of this costly overhead?

70 & ERM Framework

C03 01/12/2011 23:58:22 Page 71

However, quantifying risks on a pre-mitigation (gross exposure) as well

as post-mitigation (net exposure) basis offers management a clear ‘‘before

and after’’ picture of the impact on value (baseline company value) and value

volatility (enterprise risk exposure) of the risk mitigation in question. This

provides a rigorous quantitative approach to demonstrating the value added

by the compliance department, or the value of specific risk mitigation. This is

further discussed in Chapter 6, ‘‘Determining the Value of Mitigation in

Place,’’ where a formula for the ‘‘value of mitigation’’ metric is presented.

Understanding the Full Potential Impact of the Risks

A second reason that it is important to quantify risks on both a pre-mitigation

(gross exposure) and post-mitigation (net exposure) basis is that it offers a

deeper view of the full potential magnitude of the risk, because mitigation

does not always work out as expected. For example, consider two risk

events—Risk A and Risk B—each with identical potential financial impacts,

on a post-mitigation basis, equal to $1 million. This is a relatively negligible

impact for the company, which has annual profits of $1 billion. Informed by

only the post-mitigation exposure information, management is likely to be

equally indifferent to both Risk A and Risk B. Neither seems to deserve much

attention. However, when examined on both a pre-mitigation (gross expo-

sure) and post-mitigation (net exposure) basis, management is provided with

the information shown in Table 3.1.

With this additional information, the difference between these risks is

apparent. Management is now more likely to focus additional attention on

Risk A. Risk A will only be the same minimal risk as that of Risk B if the $99

million mitigation in place operates as expected. However, there are situa-

tions in which this does not happen. For example, the $99 million mitigation

may be an insurance contract, and the insurer may be unable or unwilling to

pay the claim.

TABLE 3.1 Quantifying Risks A and B on Both a Pre-Mitigation (Gross Exposure) and Post-Mitigation (Net Exposure) Basis

Pre-Mitigation

(Gross Exposure) Mitigation

Post-Mitigation

(Net Exposure)

Risk A $100 million $99 million $1 million

Risk B $1 million None $1 million

Value-Based ERM Framework & 71

C03 01/12/2011 23:58:23 Page 72

Now we are ready to quantify the risks. Recall that risk is defined as any

deviation from expected, and here expected is defined as the baseline company

value. Baseline company value is the present value of discounted distrib-

utable cash flows consistent with the strategic plan’s financial projection. The

ERM model is constructed to project these distributable cash flows into the

future, consistent with the strategic plan through the plan period (e.g., three

years), out beyond the plan period, and then discount them back to the

present time, with an appropriate discount rate. This is the same kind of

fundamental calculation that an equity analyst would use if he or she had

access to all the inside information that management does. This baseline

company value is the amount investors would pay today if they believed that

the company is going to perfectly execute its strategic plan and that every-

thing will go precisely as management expects. See ‘‘Do Companies Measure

Company Value?’’

DO COMPANIES MEASURE COMPANY VALUE?

Most public companies are in business to make money, and theirshareholders are their primary stakeholder. This means that distrib- utable cash flow is king and that the primary metric should be company value, which is the present value of distributable cash flows. Because you can’t manage what you don’t measure, it is natural to assume that most public companies would measure company value, both for baseline financial projections as well as to test the value of alternate strategies and tactics.

Unfortunately, this natural assumption is incorrect. Relatively few com- panies measure company value and model it dynamically. Instead, most rely on market capitalization, which is a poor proxy. Market capitalization is a static, point-in-time estimate of the company’s value, rather than a dynamic model which can be used to inform decision making. It is the market’s opinion of the company’s worth, rather than an internal management estimate, which would arguably be more accurate, because management has access to all the inside information. After all, why do rogue stock traders want inside information? Because it is valuable. Though nobody knows the future with certainty, local management can make the best guesses as to the expected distributable cash flows from their portion of the business, as well as reasonable ranges of volatility around that estimate. Capturing that information in a consistent manner around the entire enterprise and

72 & ERM Framework

C03 01/12/2011 23:58:24 Page 73

Risks are then quantified by ‘‘shocking’’ the baseline valuation with the

financial impacts of a simulation involving individual risk scenarios as well

as the combined impacts of multiple risk scenarios occurring simultaneously.

The two ‘‘Value Impact’’ charts on the extreme right side of Figure 3.1 depict

the results of both types of quantification.

The lower of the two charts (Individual Risk Exposures) shows the rank-

ing of each individual key risk scenario by the primary metric—the impact

on company value. This puts all types of risk on an apples-to-apples basis of

comparison, in quantitative form, and serves as a prioritization and ranking

of the key risks. For the key risks, this supplants the more rudimentary qualita-

tive ranking relied on in the qualitative risk assessment portion of the risk

identification process step. A modified case study example of the individual risk

exposures chart is enlarged and shown in Figure 3.2.

This individual risk quantification exercise is quite revealing, especially the

first time it is performed, in a way that is very surprising to management. Some

risks that management had assumed to be of low significance turn out to be

ranked highly, even among the top five risks, for example. Conversely, some

risks thought to be high on the list turn out to be far less potentially impactful,

sometimes due to their having already been over-mitigated, and some of these

are occasionally even deleted from the key risk list.

This is a very excitingmoment—one of the definingmoments—in the ERM

process. This is the first time that management sees a truly holistic list of key

risks, from all sources, quantified in terms of their potential impact on company

aggregating it to the enterprise level within a dynamic model produces a powerful tool for managing the firm.

Those companies that do build the capability to measure company value using such a dynamic model have a competitive advantage. They are able to strengthen their strategic planning process, because calculating the baseline company value in this way often identifies any areas of inconsistency in the strategic plan’s financial projection. These companies also gain an enhanced value-based management capability—the ability to understand the drivers of value and manage it upwards. Finally, they develop a more sophisticated communications strategy for external stakeholders—primarily equity analysts. Over time, management is able to consistently demonstrate to analysts an ability to quantify how market events can impact their value. This can eventually lead to a higher ‘‘management multiple’’ for the com- pany’s stock price.

Value-Based ERM Framework & 73

C03 01/12/2011 23:58:24 Page 74

value. This vision immediately shifts management’s attention and focus,

resulting in decision making to mitigate the largest potential threats (examples

of case studies are highlighted in Chapter 5). There are three main reasons why

this information leads to a clear and immediate shift in decision making. First,

company value is a metric everyone in the company can understand. Second, it

is also ametric that everyone knows they have to care about, both in protecting

it and increasing it. Finally, each quantitative result is based on a risk scenario

that is clearly documented and tangible, and as a result, this resonates with

management.

This last point is in sharp contrast to traditional risk quantification

methods, which commonly use convoluted formula-driven parameterized

mathematical distributions combined with stochastic simulations to generate

Individual Risk Exposures Company Value Impact

–25.0%–20.0%–15.0%–10.0%–5.0%0.0%

Consumer Relations Risk

Competitor Risk 1

Union Negotiations

International Risk 2

IT Risk 2

Loss of Key Distributor

Loss of Key Supplier

International Risk 1

Execution Risk

M&A Risk

Loss of Critical EEs

Legislation Risk

IT Risk 1

FIGURE 3.2 Individual Risk Exposures

74 & ERM Framework

C03 01/12/2011 23:58:24 Page 75

individual risk events. The results of such complex and abstract quantification

are not easily traceable to specific risk scenarios that are concrete or, at times,

even realistic. In fact, because the process involves random generation, the

specific risk scenarios produced by these complex traditional approaches

change every time. As a result, management has great difficulty getting

comfortable with the information, and when people are uncomfortable,

they hesitate to act.

Once calculated on the basis of the company value metric, the individual

risk exposure graph is also readily available for any other key metrics (revenue

growth, net income growth, etc., and for financial services companies, capital

ratios). This is easily done, because to calculate company value, every other

possible metric is required, so the value-based ERM model already has all the

elements needed for producing these other key metrics.

In Figure 3.1, the chart just above the individual risk exposures chart

is enterprise risk exposure. This is expressed in two forms. The first form is a

graph of the distribution of impacts on company value from simulations

involving one or more risk scenarios occurring simultaneously, including

both upside and downside events. The enterprise risk exposure graph is

enlarged and shown in Figure 3.3.

This illustrates a representation of the full range of potential outcomes, and

their likelihoods, for all key risk scenario combinations, recognizing the

interactivity of the risks. The horizontal axis is company value and the vertical

Li ke

lih oo

d

Company Value X

FIGURE 3.3 Enterprise Risk Exposure—Graph Form

Value-Based ERM Framework & 75

C03 01/12/2011 23:58:24 Page 76

axis is likelihood. The vertical dotted line in the middle intersects the horizontal

axis at the baseline company value (represented by an X), which is what the

company would be worth if they were to perfectly execute their strategic plan

and everything were to go as they expected. To the extreme right, the value of

the company is much higher, but with a very low likelihood; this is wheremany

upside risk events would have to occur at the same time. Similarly, to the

extreme left, the value of the company is much lower, but also with a very low

likelihood; this is where many downside risk events would have to occur at the

same time.

Unlike the individual risk exposures chart in Figure 3.2, it is difficult to gain

much information from just looking at the enterprise risk exposure graph. The

way this is used is to produce information about the likelihood of the company’s

‘‘pain points,’’ which are risk tolerance thresholds for whichmanagement wants

the likelihood of crossing them to be quite small. Management is always well

aware of what these are—they are the thresholds that, if crossed, would bring

great scrutiny down upon them by the board of directors, shareholders, and

other external stakeholders. Some examples of typical pain points include: a

decrease in company value of 10 percent or more; a ratings downgrade; falling

short of earnings expectations by more than 2 pennies per share; and so on.

Table 3.2 shows an example of the pain point information produced as a

representation of enterprise risk exposure in table form. Each piece of infor-

mation in the table (corresponding to each row) identifies a pain point and

the associated likelihood of its threshold being crossed based on current

exposures. This information is produced directly from the distribution in the

enterprise risk exposure graph (Figure 3.3) as the likelihood corresponding

to the area under the curve to the left of a vertical line intersecting the

horizontal axis at the pain point. This is illustrated in Figure 3.4.

Analogous to the individual risk exposures chart, once enterprise risk

exposure is calculated on the basis of the company value metric, both forms of

enterprise risk exposure—graph and table forms—are also readily available for

any other key metrics (revenue growth, net income growth, etc.).

TABLE 3.2 Enterprise Risk Exposure— Table Form

Pain Point Likelihood

DValue % 10% 15%

DValue % 20% 3%

76 & ERM Framework

C03 01/12/2011 23:58:25 Page 77

This is the end of the risk quantification process. At this point, manage-

ment now has all the current risk exposures—individual risk exposures

and both forms of the enterprise risk exposures. The next step is risk

decision making.

Risk Decision Making

We will discuss three aspects of risk decision making:

1. Defining risk appetite

2. Managing enterprise risk exposure to within risk appetite

3. Strategic planning and other business decision making

Defining Risk Appetite

The first step in risk decision making is for management to define risk appetite,

which is sometimes referred to as risk tolerance. Risk appetite is the level of

enterprise risk exposure with which management is comfortable, at the limit.

Because the current level of enterprise risk exposure may be different from the

desired level at any time, risk appetite represents the target maximum level of

enterprise risk exposure.

Li ke

lih oo

d

Company Value |

–10% Pain Point Likelihood

Value -10% 15%

Value -20% 3%

Li ke

lih oo

d

Company Value |

–20%

FIGURE 3.4 Developing Pain Point Data

Value-Based ERM Framework & 77

C03 01/12/2011 23:58:25 Page 78

The key step in defining risk appetite is the risk appetite consensus meeting.

This is where the ERM committee (which may be called by various names,

including the risk committee) gets together to review the enterprise risk

exposure metrics (see ‘‘Enterprise Risk Exposure’’) and decide on the target

level for enterprise risk exposure. In defining risk appetite, management is

essentially attempting to discern the level of risk in the enterprise that is desired

by the collective shareholders, which are often a highly diverse group with

different perspectives, expectations, and investment needs.

Each person on the ERM committee brings a different perspective to this

exercise. ERM committee members are individuals, and as such, each has a

different emotional, gut-level feel for how much risk he or she feels the

enterprise should be taking. However, intellectually, each person is looking

at a consistent set of metrics, along with the unifying metric of company value,

and this helps drive consensus on the definition of risk appetite.

Managing Enterprise Risk Exposure to within Risk Appetite

Once risk appetite is defined, the next step in risk decisionmaking can take place.

This is the most important exercise in enterprise risk management: moving

enterprise risk exposure to within risk appetite. This is the primary purpose of

ERM—not just to calculate and report risk exposures, but most critically to:

ENTERPRISE RISK EXPOSURE

Earlier, we defined individual risk exposure metrics as separate fromenterprise risk exposure metrics. And indeed, they are two separate types of information, used in different ways. However, technically, the former are included in the latter. Enterprise risk exposure is a distribution that contains the data points where one risk scenario occurs at a time (in addition to the far more robust and voluminous data points of two or more risk scenarios occurring simultaneously). Therefore, references to enterprise risk exposure, particularly in the context of metrics reviewed in the process of defining risk appetite, should be considered to include individual risk exposure information as well. Individual risk exposure information is pre- sented separately because it can be calculated prior to the full enterprise risk exposure calculation (because risk correlations are not required), and it is usually treated as a distinct element.

78 & ERM Framework

C03 01/12/2011 23:58:25 Page 79

A. Measure what the overall volatility of the enterprise is (enterprise risk

exposure)

B. To consciously decide on, and clearly define, what it should be, at the limit

(risk appetite); and

C. To manage A to within B.

Enterprise risk exposure is a calculation, whereas risk appetite is a

decision. This is a salient point, yet one that is missed by those who believe

that both are mere calculations. This results in confusion and leads the ERM

program down a twisted and tangled path, from which it is very difficult to

find the way back.

Now, let’s assume that the ERM Committee conducts the risk appetite

consensus meeting, and decides that the current level of enterprise risk

exposure is too high. In other words, the current level of enterprise risk

exposure exceeds the target level of risk exposure, or risk appetite. In this

case, there are only two things that management can do to decrease the level

of enterprise risk exposure and to manage it to within the risk appetite:

1. Change strategy

2. Change (risk management) tactics

This is illustrated at the top of Figure 3.1. As you can see, changing

strategy or tactics impacts the filters below. This in turn changes the calcula-

tions of enterprise risk exposure, as well as the calculation of the baseline

company value. What this illustrates is that the value-based ERM process

provides management with the ability to evaluate alternate risk decisions—

strategic and tactical—before they are made, by quantifying their impact on

the key metrics—enterprise risk exposure and the baseline company value.

Decision making is fully supported because management is provided with the

impact of each decision alternative on risk (enterprise risk exposure) and return

(baseline company value). This is one of the most effective elements of the

value-based ERM process and is certainly one of its most unique components.

This combination of both risk and return elements is a key ingredient that

supports decision making more generally.

To assist in the risk appetite consensus meeting, management usually

supplements the enterprise risk exposure information provided to the ERM

committee with some examples of how the enterprise risk exposure can be

changed by readily available strategic or tactical maneuvers. Helping the ERM

Value-Based ERM Framework & 79

C03 01/12/2011 23:58:25 Page 80

committee understand what is possible—how much the enterprise risk expo-

sure needle can feasibly be moved—is not only helpful, it is advisable.

Defining risk appetite should only be done after enterprise risk exposure is

calculated and, ideally, after getting some sense of the level to which it can be

feasibly managed. Unfortunately, this advice is not followed by everyone

implementing ERM, and it can lead to some difficulty. To see this, consider

an example of a company doing it the other way around—defining risk appetite

prior to knowing their current enterprise risk exposure. Imagine the following

sequence of events:

1. The ERM committee conducts a risk appetite consensus meeting, without

any quantitative information on enterprise risk exposure, and defines the

firm’s risk appetite.

2. Management reports risk appetite to internal stakeholders, and possibly to

some external stakeholders as well, such as rating agencies.

3. Six months later, management calculates enterprise risk exposure and

realizes that the enterprise risk exposure greatly exceeds their stated risk

appetite; even more problematic, after evaluating some strategic and

tactical changes designed to lower enterprise risk exposure, they realize

that there is no viable way to manage it to within risk appetite.

4. Management restates its risk appetite to allow for a higher level of

enterprise risk exposure.

The result of the unfortunate sequence of events in the example would

likely be, at a minimum, a loss of some confidence in management’s abilities in

enterprise risk management. This can be easily avoided by calculating enter-

prise risk exposure, and quantifying the impacts of potential strategic and

tactical maneuvers to manage it, prior to attempting to define risk appetite.

Nevertheless, it is useful to get an early sense, at a high level, of manage-

ment’s thinking on risk appetite, prior to finalizing the quantification. This is

only used for the ERM modeling team’s internal purposes, in defining metrics

and approximate breakpoints for the enterprise risk exposure pain points.

Strategic Planning and Other Business Decision Making

The value-based ERM framework provides an ability to quantify all key risks in

terms of their impact on company value (and other key metrics) and supports

the primary risk decision making in the ERM process—managing enterprise

risk exposure to within risk appetite. However, it does far more than that. This

80 & ERM Framework

C03 01/12/2011 23:58:25 Page 81

framework supports all management decision making, by informing decisions

with a more robust view on both the risk and return profile of any venture.

To see how, look once again at Figure 3.1. Imagine that you are standing

to the left of the figure, looking to the right. What the value-based ERM

framework appears to be doing is taking traditional ERM (identifying the risks

and developing risk scenarios, on the left side) and marrying it pretty tightly to

the company value metric (the value-based ERM model and value impacts, on

the right side).

Now, imagine that you are standing to the right of the figure, looking to

the left. From this vantage point, what this framework appears to be doing is

taking the traditional practice of value-based management (understanding

the drivers of company value and making the value of the company go up, on

the right side) and marrying it to more rigorous scenarios (risk scenario

development, on the left side). To see this, consider a key element of value-

based management: the strategic planning process. Management devises a

strategic plan, which, if properly executed, will increase the firm’s value. The

strategic plan is usually supported by a strategic plan financial projection.

Unfortunately, the result of most strategic planning processes—the ‘‘Plan’’—

is a binder on a shelf. The Plan is a static, single scenario projection of the

future, presented as if it will happen, just as expected, with 100 percent

certainty. This is a little unfair because the work done to develop the Plan by

the individual business segments often involves some excellent scenario

analyses, including SWOT analyses (strengths, weaknesses, opportunities,

and threats to the Plan) and sensitivity analyses, often with robust quanti-

tative workups. However, these are usually done in very different ways

throughout the company, by many different individuals, so that the scenario

analyses cannot be used on an aggregate basis:

& One person’s perspective of a worst-case scenario may be quite different

from another person’s (similarly, for all other scenarios, such as moder-

ately pessimistic, best-case, etc.). & Business segments, and even different individuals within business seg-

ments, may have different understandings of what is already embedded in

the strategic plan’s baseline scenario, and therefore, may have erroneously

constructed risk scenarios (in terms of how much deviation there is from

baseline in a given scenario). & Business segments may be taking different bets on, or have different

expectations of, the expected future environment (such as the direction

of the economy in the near future).

Value-Based ERM Framework & 81

C03 01/12/2011 23:58:25 Page 82

What the value-based ERM framework does is to align everyone in the

enterprise, in terms of what a best-estimate baseline projection of the future

strategy is, what a worst-case scenario is, what the future expectations of

the environment are, and so on, as well as how to define risk generally. The

importance of this alignment cannot be overstated. Through this alignment, the

value-based ERM approach provides management with a much more robust,

consistent, and dynamic strategic planning process and strategic plan financial

projection. The baseline company value is predicated on a set of business segment

financial projections with a consistent view on what constitutes a best-estimate

baseline scenario and future view of the internal and external environment.

In addition, the scenarios are consistent for all universal assumptions (the

economy, interest rate environment, currency exchange rates, weather, etc.)

and are consistently defined for all risk scenarios (for example, the definition of a

worst-case scenario is well understood, documented, and shared internally).

In addition to providing a dynamic strategic planning tool, the value-based

ERM approach provides a valuable ad-hoc ‘‘what-if ’’ tool, which can answer

such questions as:

& If a moderately pessimistic scenario for economic conditions occurs,

how would it impact revenues in each of our major business segments,

and the enterprise in total, including adjustments for any cross-segment

interactions? & If our worst-case scenario for currency exchange rates is realized, how

would it impact our earnings across the enterprise? & If our moderately optimistic scenario for the competitive environment

occurs, how would it impact our profit margins enterprise-wide?

These additional tools are not ancillary. Rather, they are critical to a

successful ERM program. A successful ERM program must be integrated into

key decision-making processes, such as strategic planning, strategic and

tactical decisions, and transactions.

In Chapter 2, we offered a commonly used short definition of ERM, which

offered a technical description of ERM:

The process by which companies identify, measure, manage, and disclose all key risks to increase value to stakeholders.

However, when ERM is implemented using a value-based approach, a

better definition may be as follows:

82 & ERM Framework

C03 01/12/2011 23:58:25 Page 83

A practical yet advanced approach to integrate both risk and return information into strategic planning and other business deci- sion making.

OVERCOMING THE CHALLENGES BY USING A VALUE-BASED ERM FRAMEWORK

At the beginning of this chapter, we stated that traditional ERM frameworks

often struggle to satisfy the 10 key criteria of an ERM program. We also

highlighted three core challenges, which are subsets of the 10 key criteria,

which are common symptoms of a suboptimal ERM framework. The emerging

value-based ERM framework was designed to effectively address the challenges

of traditional ERM programs, including these three core challenges. Now that

we have described the value-based ERM approach, we will discuss how this

emerging framework satisfies each of the 10 key criteria, and addresses the

three core challenges.

Criterion 1: Enterprise-Wide Scope

One of the main obstacles to achieving a consistent enterprise-wide adoption of

an ERM program is a limiting approach—an approach that simply cannot work

in every part of the organization. This is most common when the ERM program

is first developed with only the company’s primary business segment in mind.

This is especially common in financial services firms that have diverse busi-

nesses, some of which have to hold required capital on their balance sheets, and

some of which do not.

Required capital is an amount of capital that is required to remain on the

balance sheet in support of existing business on the books, and cannot be

employed to support future growth. The amount of required capital is set by

multiple stakeholders, including regulators, rating agencies, and management

itself, where each has its own approach to defining and calculating the required

amount. The company often holds the maximum of these amounts to ensure

satisfying all stakeholders.

Financial services companies where banking or insurance is the primary

business generally use a capital-based ERM framework; that is, they use capital

as their key metric. It is understandable that these types of organizations would

be drawn to a capital-based approach. It is an important metric for them. It is

also a metric that is a product of risk management—the required capital levels

are set based on assessing levels of risk in the firm. Unfortunately, this becomes

Overcoming the Challenges by Using a Value-Based ERM Framework & 83

C03 01/12/2011 23:58:26 Page 84

a nonstarter for those financial services companies that also have non-financial

services operations, in terms of achieving an enterprise-wide ERM program. A

capital-based approach simply can’t work in these non-financial services

operations, because they don’t have capital requirements.

For example, assume a bank holding company has a retail banking

division and a consulting division. They institute a capital-based ERM pro-

gram. Their key metric for quantifying risk exposure is the amount of

additional required capital generated by the risk exposure. The consulting

business clearly generates risk, yet it does not generate required capital,

because this part of the enterprise is not subject to capital requirements.

Capital requirements are not a universal currency that can be used to evaluate

risks across the enterprise, and as a result, the company has an incomplete

ERM program.

However, the value-based ERM program offers a metric that can, and does,

work across both financial services and non-financial services operations.

Company value is a unifying metric. Company value is the present value of

distributable cash flows for both types of operations. Each has a slightly different

definition for distributable cash flows, but once properly defined, they are

fully comparable:

Distributable cash f lowNon$f inancial services ¼Net income þ Depreciation and amortization $ Increase in working capital $ Capital expenditures

and

Distributable cash f lowFinancial services ¼Net income þ Depreciation and amortization $ Increase in working capital $ Capital expenditures $ Increase in required capital

Criterion 2: All Risk Categories Included

One of the most important of the 10 key criteria is the inclusion of all risk

categories in an ERM program. Ignoring a risk category, or not having a

balanced focus among all risk categories, can expose the company to excessive

risk and result in focusing limited risk mitigation resources on the wrong

84 & ERM Framework

C03 01/12/2011 23:58:26 Page 85

priorities. In addition, a lack of sufficient focus on certain risk categories can

result in unpleasant surprises; management doesn’t really care about which

risk source takes them by surprise . . . they just don’t want to be surprised.

Unfortunately, the vast majority of traditional ERM programs focus all, or most,

of their attention on financial risks, either ignoring or giving short shrift to the

strategic and operational risks, which are actually responsible for far more firm

volatility than the financial risks.

One of the main reasons for this imbalanced focus is an inability to quantify

strategic and operational risks. This is the first of the three core challenges to a

successful ERM implementation, which we discussed earlier. Let’s examine this

further.

Traditional Approach

There are three common approaches that traditional ERM frameworks use in

attempting to quantify strategic and operational risks:

1. Qualitative only

2. Industry data

3. Risk capital

Qualitative Only The most common approach used in traditional ERM frameworks is simply to not quantify strategic and operational risks, but instead

to develop qualitative information. This qualitative information takes the

form of key risk indicators (KRIs). For example, a qualitative KRI for the

risk of poor customer service might be the number of complaints per month.

KRIs can be useful. Changes in KRIs can indicate a potential underlying

problem, either existing or emerging, and prompt management to investigate.

However, KRIs are not enough to support ERM decision making; for example,

choosing between two alternate mitigation approaches. Management needs

numbers—quantitative data—to make decisions. Even quantitative data that

require estimates, or even guesses accompanied by confidence ranges, are

better than mere qualitative data.

Industry Data Another approach often used by traditional ERM frameworks is to rely on industry data to quantify strategic and operational risks. For some

risks this may be useful. However, the vast majority of strategic and operational

risks, and certainly the most important risks, cannot be quantified using this

approach. This is because industry data is often either unavailable or in-

appropriate or both.

Overcoming the Challenges by Using a Value-Based ERM Framework & 85

C03 01/12/2011 23:58:26 Page 86

Industry data is often unavailable for these risks. For example, there is no

industry data set that can quantify the potential impact of the company’s

strategic plan being flawed or the potential impact of poor strategy execution.

Each company’s strategy, or its ability to implement the strategy successfully,

is a completely unique risk.

Industry data is often useful as anecdotal supplementary data for risk

quantification. However, it is often inappropriate to rely on industry data as the

primary basis for risk quantification. The net impact of risk on an organization

varies significantly based on the risk mitigation tactics in place. For example, if

one company has more insurance coverage or a superior risk culture than

another apparently identical company, the first company will not suffer the

same consequences from a given risk event as the second company. How a risk

works its way through each organization can be radically different. Using an

industry data set does not take into account the specific nature of the company

and its risk management tactics.

Risk Capital The third approach routinely used to address quantification of strategic and operational risks is the one that may initially seem to be the most

rigorous quantitatively. Ironically, this is also the worst of the three traditional

ERM approaches. This approach is only used by financial services companies

that have capital requirements. This approach was introduced by Basel II, and

involves setting aside capital for operational risk. This effectively means that the

amount of required capital is increased to recognize balance sheet volatility

caused by the operational risks.

The first and most obvious failure is that Basel II ignores strategic risks

altogether. As shown in Chapter 2, strategic risks are more important than

operational risks, and appear to be at least twice as important. However, even

in terms of appropriately quantifying operational risks, there are significant

problems with the risk capital approach. Under Basel II, there are two

alternative methodologies:

Alternative 1: Set aside a percentage of revenues as operational risk capital.

Alternative 2: Use an internal model to calculate operational risk capital.

The vast majority of banks use alternative 1 and set aside approximately

15 percent of revenues as operational risk capital. A majority of insurance

companies have copied this method as well. The 15 percent is not risk-based.

The 15 percent, and therefore the amount of operational risk capital, is an

arbitrary number, totally unconnected to the reality of operational risks in the

86 & ERM Framework

C03 01/12/2011 23:58:26 Page 87

business. This is not a risk-based approach. But that is the least of its problems.

Worse still is the fact that this method produces an estimate of operational risk

whose changes are often even directionally incorrect.

Consider the following example. You are the head of the consumer

lending division of a large bank. The bank institutes an ERM program, and

in an attempt to quantify operational risk, defines operational risk capital as

15 percent of revenues. You are given the additional responsibility for opera-

tional risk management for your division. You excel at your new risk manage-

ment role. Within just the first year, you are a whirlwind of productivity,

and by everyone’s account, you have cut operational risk virtually in half.

You have decentralized key offices, instituted a litany of good operational

risk protocols, purchased more insurance coverage, and developed detailed

business continuity plans. In addition, in your primary role over the past year,

you have grown top-line revenues 25 percent. Congratulations: At year end,

operational risk capital—themeasure of howmuch operational risk there is in

your division—goes . . . up! This is not even directionally correct. The actual

risk was lowered by about 50 percent, yet the metric goes up 25 percent.

Clearly, this makes no sense, yet this is a very common approach employed in

the financial services sector.

Alternative 2 requires the bank to develop its own internal model to

measure operational risk capital requirements. Banks use VaR models and

insurance companies use economic capital models, both of which were

defined in Chapter 2. These models are risk-based in that they are generally

proportional to the risk: more risk means more risk capital, and less risk

means less risk capital. In addition, they can be, and sometimes are, used to

try to quantify strategic risks as well as operational risks. However, they do

not fully capture the financial impacts of strategic and operational risks. The

VaR and economic capital models are usually designed to quantify the impact

of risks on the balance sheet, to show the net impact to capital (assets less

liabilities) and to required capital. These models ignore the impact to future

revenues and expenses, which is often the bulk of the impact of strategic and

operational risks.

Consider the following case study. A large multinational insurance com-

pany is attempting to quantify the impact of a key risk involving a disaster at an

internal conference where top salespeople and managers are among those

killed. The key element to this risk quantitatively is that it significantly lowers

the entire future revenue projection of the strategic plan.

Unfortunately, the insurance company’s economic capital model woefully

understates this risk. Because most economic capital models are capital-centric

Overcoming the Challenges by Using a Value-Based ERM Framework & 87

C03 01/12/2011 23:58:26 Page 88

and therefore focus exclusively on balance sheet capital and required capital,

revenues for all future new business are generally not included, and so are not

available to be ‘‘shocked’’ downward to capture the full financial impact of

the risk. The baseline economic capital model includes a future projection

of revenues and expenses, but only those related to the current insurance

business ‘‘inforce,’’ or on the books. To add insult to injury, not only does the

economic capital model fail to fully quantify the downside impact of this worst-

case scenario, but it actually reports the event as good news, because it

accounts for a reduced allocation of expenses (due to fewer employees).

Value-Based Approach

Now, we will discuss the value-based ERM approach to quantifying strategic

and operational risks. After that, we will discuss how the value-based approach

addresses the shortcomings of the traditional ERM approach to quantifying

strategic and operational risks.

As discussed earlier, the ERM model projects distributable cash flows into

the future, consistent with the strategic plan, and then out beyond the

planning period in some reasonable way. The first metric calculated is the

baseline company value, which discounts the baseline distributable cash flows

to today, using the hurdle rate. The baseline company value is the price that an

investor would pay today, if they believed the company was going to perfectly

execute the strategic plan, and everything was going to go its way. Risk is then

defined as anything that shocks this baseline company value, up or down.

Failure Modes and Effects Analysis (FMEA) Technique The value-based ERM approach uses a technique called Failure Modes and Effects Analysis

(FMEA), adapted from the manufacturing sector, to develop the individual

deterministic risk scenarios for strategic and operational risks. There are four

steps to the FMEA process:

1. Identify interviewees. The first step in the FMEA process is to identify

the most appropriate internal subject matter experts for the risk in

question. For some risks, this might be the most senior person involved

with the risk, such as the executive risk owner, who has overall responsi-

bility for the risk, enterprise-wide. This might be the case for certain

litigation risks or human resources risks. However, the person closest to

the risk is usually the most appropriate choice.

88 & ERM Framework

C03 01/12/2011 23:58:26 Page 89

2. Develop risk scenarios. The second step is to begin the FMEA interview

with the identified interviewees by soliciting from thema set of risk scenarios

for the key risk in question. There are often several risk scenarios for eachkey

risk. For example, a single key risk may have the following risk scenarios: & Credible worst-case & Moderately pessimistic & Mildly pessimistic & Baseline (represents no risk) & Mildly optimistic & Moderately optimistic & Credible best-case

Not every key risk will have upside risk scenarios, but it is important to

consider these.

Each of these scenarios is an individual deterministic risk scenario. In

other words, these are hypothetical specific events. It is critical to develop

specific deterministic scenarios. Imagining a specific event occurring

makes it easier for interviewees to think through the sequential progres-

sion of likely events, as well as the consequences to the company.

It is best practice to begin with a credible worst-case scenario, by

asking the subject matter experts, ‘‘When your head hits the pillow at

night, what do you worry about?’’ This gets at something perhaps remote

in likelihood, but not out of the realm of all possibility, yet something that is

potentially very damaging to the company. Some of the less extreme risk

scenarios are often developed by modifying the credible worst-case sce-

nario (such as reducing its scale).

For each individual risk scenario, the FMEA process guides the experts

into thinking the event through in detail, chronologically. A series of

expert-led questioning extracts the internal subject matter expert’s knowl-

edge as to what eventualities in the external and internal environment

would likely flow from the initial event. What would be the initial damage?

What would be the secondary and tertiary repercussions? How would

management respond, and how quickly could they respond?

3. Assign likelihood. The third step is to assign likelihood to the event.

This is difficult because it is so uncertain. It is also difficult because the

interviewees are often not accustomed to making such estimates, and

usually do not speak the language of probability. They are unlikely to

respond in terms such as, ‘‘There is a 15 percent chance of this risk event

occurring this year.’’ This is another area where skill in conducting the

Overcoming the Challenges by Using a Value-Based ERM Framework & 89

C03 01/12/2011 23:58:26 Page 90

FMEA process is required to bridge the gap between the qualitative

language used by the interviewees and the quantitative language

needed for the ERM model.

4. Estimate quantitative impacts. The final step in the FMEA interview

is to develop estimates of the quantitative impacts of each deterministic

risk scenario on the baseline company value. This is done step by step,

using a series of questions: How would this impact revenues this year?

Future years? What are the impacts on fixed expenses? Variable expenses?

and so on. As with assigning likelihood, estimating quantitative impacts

can be difficult from the standpoint of getting interviewees comfortable

with making estimates. This is another reason why it is important to have

someone with experience conducting the FMEA interviews. See ‘‘But

Aren’t These Just Guesses?’’

An illustrative example is shown in Figure 3.5, which outlines the flow

of the four-step FMEA exercise, as well as an abridged summary of the kind

of information produced. Both the likelihood and the quantitative impacts

become inputs into the ERM model for shocking the baseline company

value, first to quantify individual risk exposures, and later to quantify

enterprise risk exposure.

Risk: Legislation Risk

Attendees: xxx, xxx, xxx

Scenario 1: Legislation passes reducing business opportunity in certain markets

Likelihood: 5%

Financial impact: • Revenue impact

ο 50% loss of planned revenues in market A • 1 st year: –$2.5M • 2 nd year: –$2.6M • etc.

ο 100% loss of planned revenues in market B • 1 st year: –$1.0M • 2 nd year: –$1.1M • etc.

• Expense impact ο Reduction in workforce

• –10% of salary and related benefits • +$100K severance costs

1) Identify interviewees - Those closest to the risk - Usually 1 or 2 subject matter experts

2) Develop risk scenarios - Begin with credible worst-case scenario - Select specific scenario and think it through

3) Assign likelihood

4) Estimate quantitative impacts - Determine distributable cash flow impacts

FIGURE 3.5 The FMEA Process and Sample Summary Output

90 & ERM Framework

C03 01/12/2011 23:58:26 Page 91

BUT AREN’T THESE JUST GUESSES?

A common initial concern raised in early discussions of the FMEA tech-nique is the claim that this information can’t possibly be useful because it is all based on mere guesses. Although the latter is largely true—the process does involve guesses—the former statement is incorrect: This information does add quite a lot of value to the ERMprocess. There are several factors that more than compensate for the uncertain nature of the information:

& Decisions happen anyway. As discussed in Chapter 2, the reality is that strategic and operational risks must be quantified in some way. They are far more impactful to firm volatility than financial risks, and management must make decisions involving these risks each and every day, with or without the benefit of quantitative data. Management is far better off with estimates, even highly subjective estimates, than with no quantita- tive information at all.

& Expert guesses. Although these are guesses, they are expert guesses, made by those closest to the risks and often those with decades of personal experience and even more anecdotal knowledge of risk events in the industry. There are many brilliant people in the firm, and there is much valuable knowledge trapped inside their heads. The FMEA pro- cess extracts this useful information out of the heads of the subject matter experts and puts it on the page in a consistent quantitative form, for all key risks, all across the company. Inmany cases, the FMEA process is the first time the subject matter experts have being asked to think through the risk scenarios and potential mitigation, and this thought- provoking process produces better guesses than previously existed anywhere, even inside the experts’ heads.

& Ranges. Ranges around the guess are used as a type of sensitivity analysis, which provides a level of comfort by showing how wrong the estimate could be. A case study illustrates this point. An ERM team presented a business opportunity, predicated on FMEA information, to a business unit, who initially objected based on the approximate nature of a single critical assumption. However, the business unit accepted the proposal once it was clear that, based on examining the ranges, the assumption would have to be off by a factor of 10 to negate the validity of the opportunity.5

In addition, the ranges themselves reveal useful information. The point estimates for two different risks might be identical at $10 million. However, the range for the first risk might be $8 million to $12 million, whereas the range for the second risk might be $5 million to $50 million.

(continued )

Overcoming the Challenges by Using a Value-Based ERM Framework & 91

C03 01/12/2011 23:58:26 Page 92

Advantages of Value-Based Approach

Now that we have described the value-based approach to quantifying strategic

and operational risks, we will compare the effectiveness of this approach with

the traditional ERM approaches. As discussed earlier, the three traditional ERM

methods used in attempting to quantify strategic and operational risks have

several disadvantages:

& Metrics don’t support decision making. & Data are unavailable or inappropriate. & Approach is not risk-based. & Inability to fully quantify risk impacts.

& Reduced bias. Another factor that makes this information better than pure guesses is the fact that the results of the FMEA interviews are documented. This reduces bias. When people know that their name is formally attached to something, they tend to be evenmore careful about its quality. This occurred during the initial implementations of SOX. At the end of the first major effort to gather and assess a large amount of data, senior executives had to sign their first attestation regarding the accuracy of the risk assessments, control assessments, and the financial reports. It was at this stage that the quality of the information increased somewhat, as the executives began scrutinizing the information more closely to increase their level of comfort before affixing their signatures.

& A crowd of experts. When the FMEA information is initially gathered, it is the product of just one or two experts. However, the FMEA informa- tion is published and shared with others in the company. This results in corrections and enhancements to the data, as others contribute their insights. This is much like the effect of Wikipedia, which benefits from shared knowledge leading to a collective consensus.6

& Relative comparisons. The FMEA process provides the ability tomake relative comparisons between risks. The FMEA exercise is performed in a consistent manner around the enterprise, for all risks, and expresses their potential impact quantitatively. Even though each individual risk scenario is quantified using subjective estimates, collectively this information becomes more powerful, because the relativities between risks are more reliable than any one estimate. The comparative analysis often leads to priorities shifting to those risks that are relatively more impactful.

(continued )

92 & ERM Framework

C03 01/12/2011 23:58:36 Page 93

The value-based approach addresses each of these issues.

Ability of Metrics to Support Decision Making The first traditional ERM method involves using only qualitative information, which leads to the inability

to make decisions based on the information. In stark contrast, the value-based

approach quantifies all key risks. In addition, the value-based approach

quantifies them in terms of the impact on company value, which robustly

supports decision making.

Availability and Appropriateness of Data The second traditional ERM method is to use industry data, which leads to the problem of unavailability and

inappropriateness. The value-based approach resolves these issues as well. The

data is available because the company is developing its own data primarily

using internal personnel. This information is abundant, because management

always knows who the one or two people are that are closest to a given risk, and

certainly has access to them. In addition, the data developed is company- and

culture-specific, because it is based on the specific situation within the firm.

Risk-Based Approach The third traditional ERM method involves using risk capital as the key metric. There are two alternative approaches: The first

uses an approach that is not risk-based and, worse, is sometimes directionally

incorrect in its measurement of changes in exposure. Clearly, the value-based

ERM approach is risk-based, because it begins with the company-specific

risk scenarios, and the ERM metrics properly rise and fall with the level

of exposures.

Ability to Fully Quantify Risk Impacts In addition, the value-based ap- proach allows for full quantification of the risks because the baseline company

value captures the full projection of future revenues, expenses, and other

components of distributable cash flow, and risk is measured as shocks to the

baseline. In our example discussed earlier, a disaster at an internal conference

results in the death of top salespeople and managers. The value-based ERM

approach has in its baseline company value the future revenues that these

salespeople were to generate. As a result, the quantification of the risk, which is

the shock to the baseline, would fully reflect all of the lost revenues.

Figure 3.6 summarizes the comparison between traditional ERM and value-

based ERM in terms of quantifying strategic and operational risks.

Overcoming the Challenges by Using a Value-Based ERM Framework & 93

C03 01/12/2011 23:58:36 Page 94

In the section titled ‘‘Case Studies’’ in Chapter 5, several case studies will

be discussed that more fully illustrate the value-based ERM methodology for

quantifying strategic and operational risks, as well as demonstrate its

effectiveness.

Criterion 3: Key Risk Focus

Many traditional ERM programs treat ERM as an expanded SOX exercise.

This is partly a result of the familiarity of the risk folks in the firm with SOX. It is

even more a result of the fact that the traditional ERM framework does not lend

itself to much beyond risk mitigation. As a result, without anywhere else to go,

management develops as comprehensive a laundry list of risks and risk controls

as it reasonably can.

Because the value-based ERM approach uses company value as the key

risk metric, it immediately focuses management on an appropriately limited

number of key risks. The key risks stand out quite distinctly in terms of their

potential impact—the amount of company value that they might destroy. This

naturally avoids an unnecessarily long list of risks, most of which would have

negligible impact on company value.

Criterion 4: Integrated across Risk Types

Risk management programs (precursors to ERM programs) almost always

involve ‘‘silo’’ approaches to risk, meaning each type of risk is handled

separately within the company. This leads to difficulties in three areas, as

discussed in Chapter 2:

Traditional Approach Value-Based Approach Method 1: Qualitative

Cannot support decision making

Quantifies impact to value/ supports decision making

Company/situation-specific

• Risk-based

• Fully quantifies risk impacts

Method 2: Industry data

Often unavailable or inappropriate

Method 3: Risk capital

• Not risk-based/often directionally incorrect

• Understates risk

FIGURE 3.6 Quantifying Strategic and Operational Risks

94 & ERM Framework

C03 01/12/2011 23:58:36 Page 95

1. Completeness

2. Efficiency

3. Internal consistency

Unfortunately, although all traditional ERM programs tout an integrated

approach as a key criterion, most of them still suffer from the same silo

mentality as their risk management predecessors. However, the value-based

ERM approach makes it easy to integrate an ERM program across risk types.

Let’s examine each of the three areas of potential difficulty regarding

integration, and compare the traditional ERM approach to the value-based

ERM approach.

Completeness

Traditional ERM programs using silo approaches are incomplete, because they

ignore multiple risks occurring simultaneously and fail to capture their inter-

activity—both offsets and exacerbations. In contrast, the value-based ERM

approach fully reflects this by directly measuring multiple risks and their

interactivity in the ERM model, producing the entire distribution of real-world

outcomes in the enterprise risk exposure graph (see Figure 3.1).

Efficiency

The inefficiencies in many traditional ERM programs caused by the lack of

centralized coordination and cross-departmental communication are resolved

in the value-based ERM approach. The structure provided by the value-based

ERM approach, as well as the unifying nature of the company value metric,

ensure a high level of ERM coordination and cross-pollination. The risk

scenarios are developed in a way that identifies and includes inputs from

any relevant area of the firm. In addition, the value-based approach uses a

central ERM model that can be used by business units anywhere in the firm to

measure the marginal impact of any risk decision. Finally, the top-down

approach to defining risk appetite, cascading down to risk limits, leads to

coordinated approaches by type of risk, enterprise-wide.

Internal Consistency

The internal inconsistencies of traditional ERM programs employing a silo

approach can manifest as conflicting projections of the internal and external

Overcoming the Challenges by Using a Value-Based ERM Framework & 95

C03 01/12/2011 23:58:36 Page 96

environment (for example, the performance of equity markets). However, the

value-based ERM approach clarifies where these exist and provides a single

consistent view for the company. The construction of the ERM model and the

calculation of the baseline company value correct these issues, as well as

strengthen the strategic planning process. In addition, risk scenarios are

developed in a way that includes all relevant viewpoints from anywhere in

the firm, partly during the FMEA process itself, and partly by the documen-

tation and internal sharing of the resulting risk scenarios.

Criterion 5: Aggregated Metrics

We will discuss two aspects of aggregated metrics:

1. Enterprise risk exposure and risk appetite

2. Top-down allocation of risk appetite to risk limits

Enterprise Risk Exposure and Risk Appetite

There are two key aggregate metrics required for ERM. The first one is

enterprise risk exposure and the second one is risk appetite. The former is a

calculated item, but the latter is a management-defined item. Enterprise risk

exposure represents the current level of overall enterprise volatility. Risk

appetite is the maximum limit of enterprise risk exposure to which manage-

ment would like the company to be exposed.

The two aggregate metrics should be mirrors of each other, because the

metric(s) used to define risk appetite should follow the metric(s) chosen for

enterprise risk exposure. This is because risk appetite is simply management’s

defined limit for the maximum acceptable level of enterprise risk exposure.

Recall that each of these aggregate metrics is actually an entire distribution

of outcomes (see Figure 3.1), which may be represented by multiple metrics,

each with multiple thresholds, and a corresponding likelihood for each

threshold. For enterprise risk exposure, one expression of these threshold-

likelihood pairs may be called a pain point. For example, one pain point

expression of enterprise risk exposure, and its risk appetite counterpart, might

be as follows:

Enterprise risk exposure pain point expression: 1 percent chance of losing

(amount X) of (metric Y)

Corresponding risk appetite expression: 5 percent chance of losing

(amount X) of (metric Y)

96 & ERM Framework

C03 01/12/2011 23:58:36 Page 97

So, because one (risk appetite) follows the other (enterprise risk exposure),

a key to producing these two aggregate metrics is that the enterprise risk

exposure metric(s) must be expressed, and calculated, at an enterprise level.

Without an aggregate level enterprise risk exposure, there is no aggregate level

risk appetite.

Unfortunately, most traditional ERM programs do not have this. Instead,

they commonly produce a large volume of key risk indicators (KRIs) to track

the exposure for their key risks. Disparate KRIs metrics are used for different key

risks. As a result, there is no single metric available to aggregate the exposures

to the enterprise level, which, in turn, means that there is also no aggregate

metric for risk appetite.

Without a quantitative definition of risk appetite, these companies com-

plicate matters in their attempt to produce some type of risk appetite statement.

What results is often a vague and confusing document. This is the second of the

three core challenges to a successful ERM implementation, which we discussed

earlier: An unclear definition of risk appetite. This leads to the inability to perform

the primary function of ERM—managing enterprise risk exposure to within risk

appetite. In addition, it also prevents the proper order of risk limit setting, which

should be top-down. Lacking a cascading top-down approach to setting risk

limits can sometimes lead to under-mitigation, which is potentially dangerous;

however, an even more common result is wasteful over-mitigation. This was

discussed in Chapter 2.

Unlike the traditional ERM programs, the value-based approach provides

both of the key aggregate metrics. All key risks can be quantified in terms of

their potential impact on company value. The company value metric works

consistently, regardless of geography or accounting system, because it is based

on distributable cash flow, which is a universal currency. It also works for all

types of risks, because it is the only metric that can fully quantify all risks,

particularly strategic and operational risks, which often impact future revenues

and expenses. This allows the calculation of enterprise risk exposure in terms of

company value as well, and as a result, risk appetite is easily expressed at the

aggregate level, on the same basis.

This facilitates the main goal of ERM: managing enterprise risk exposure to

within risk appetite. Both metrics are expressed consistently, so it is clear how

to do this because they can be compared directly. For example, modifying our

example discussed earlier, we might have the following:

Enterprise risk exposure: 1 percent chance of losing 30 percent or more in

company value

Overcoming the Challenges by Using a Value-Based ERM Framework & 97

C03 01/12/2011 23:58:37 Page 98

Risk appetite: 5 percent chance of losing 30 percent or more in company

value

Top-Down Allocation of Risk Appetite to Risk Limits

The value-based ERM approach also facilitates the appropriate top-down

allocation of risk appetite to risk limits. This is due to the same attribute

that allows the upward aggregation of individual risk exposures to enterprise

risk exposure: The company value metric is a consistent metric appropriate for

all key risks.

One way to visualize this is as a four-step process:

1. Upward aggregation of individual risk exposures to enterprise risk expo-

sure (graph form)

2. Developing pain point data (representation of enterprise risk exposure in

table form)

3. Defining risk appetite as a mirror of enterprise risk exposure (table form)

4. Downward cascading allocation of risk appetite to individual risk limits

This is illustrated in Figure 3.7. In Step A, the ERM model aggregates

the individual risk exposures, using the risk scenario information developed

in the FMEA process as well as the risk correlation data7 by running

simulations involving combinations of one risk event per simulation, two

risk events per simulation, and so on, producing the graph form of enterprise

risk exposure. In Step B, pain points are selected to produce the table form of

enterprise risk exposure. Step C involves two parts. The first part involves

mirroring the pain points from enterprise risk exposure, thus populating the

left-hand column of the risk appetite table. In the second part of Step C,

management defines the acceptable likelihood for each pain point during the

risk appetite consensus meeting, thus populating the right-hand column of

the risk appetite table.

Step D involves using the ERM model to reverse-engineer any desired

risk limits, below enterprise level, which will aggregate to risk appetite at

the enterprise level. Regardless of the type of allocation, or budgeting, of

risk appetite—whether the limits are by source of risk, by business unit, by

geography, and so on—the reverse-engineering aggregation is feasible,

because all exposures are measured with the consistent metric of company

value.

98 & ERM Framework

C03 01/12/2011 23:58:37 Page 99

Some illustrative examples of these types of risk limits may include:

& By source. No more than a 2 percent loss of company value from a risk

event caused by technology failure & By business unit. No more than a 5 percent loss of company value from

risk events arising from our retail business unit & By geography. No more than a 10 percent loss of company value from

risk events arising from our international operations

An example is provided in Chapter 6, ‘‘How to Define Risk Limits.’’

Criterion 6: Includes Decision Making

The third step in the ERM process cycle is risk decision making, which is most

central to the purpose of ERM—actually doing something about the risks,

acting on the information gathered up to this point in the process. Sadly, the

most common problem plaguing traditional ERM programs is the inability to

integrate ERM into decision making. This is the third, and final, of the core

challenges to a successful ERM implementation, which we discussed earlier.

Enterprise Risk Exposure Table Form

Enterprise Risk Exposure Graph Form

Pain Point Likelihood

∆Value ≤ –10% 15%

∆Value ≤ –20% 3%

∆Value ≤ –30% 1%

Individual Risk Exposures

… …

Li ke

lih oo

d

Company Value

Risk Appetite

Pain Point Likelihood

∆Value ≤ –10% 20%

∆Value ≤ –20% 5%

∆Value ≤ –30% 2%… …

ERM Model

ERM Model

Risk Limits

By Source

By Business Unit

By Geography …

A

B C

D

FIGURE 3.7 Aggregate Risk Metrics

Overcoming the Challenges by Using a Value-Based ERM Framework & 99

C03 01/12/2011 23:58:37 Page 100

There are three critical elements that must be in place for effectively

integrating ERM into decision making:

1. ERM metrics that support decision making

2. Practical ERM models

3. Consensus buy-in from business segments

Let’s evaluate both the traditional ERM approach and the value-based ERM

approach in terms of whether, and to what extent, they satisfy these three

critical elements.

Do the ERM Metrics Support Decision Making?

There are two aspects to having ERM metrics that support decision making:

1. Robust metrics for all types of risks

2. Metrics with both risk and return information

Traditional ERM programs do not have either of these in place, and

therefore do not have ERM metrics that support decision making. However,

the value-based ERM approach has both of these aspects and fully supports

decision making.

RobustMetrics for All Types of Risks Traditional ERM programs generally do not have robust metrics for all risks. Themetrics for strategic and operational

risks are either nonexistent or are simply not robust enough—not nearly as

robust as the metrics for financial risks. This was discussed earlier in this

chapter. As a result, the ERM metrics of traditional ERM programs cannot

support any decision in the company that involves strategy or operations,

which is the vast majority of important decisions. Essentially, traditional ERM

programs are more like financial risk management programs than holistic ERM

programs, and as such, their metrics are largely relegated to supporting

decisions solely involving financial risks.

Unlike traditional ERM programs, the value-based ERM approach quanti-

fies all types of risk, and does so in an equally robust way. All risks are quantified

on a consistent basis in terms of their potential impact on company value (and

other key metrics). As a result, all types of decisions can be informed by the

value-based ERM metrics, including strategic decisions, tactical decisions, and

transactions.

100 & ERM Framework

C03 01/12/2011 23:58:37 Page 101

Metrics with Both Risk and Return Information Traditional ERM metrics generally provide only half the picture needed for a business decision. Tradi-

tional ERMmetrics are only geared for capturing the downside. For example, in

financial services firms, they use capital loss or the increase in required capital

to measure the impact of a risk. But a business person needs to balance risk and

return to make risk–reward trade-off decisions. A decision cannot be made

without an ability to compare, within the givenmetric(s), the downside and the

upside of a decision.

Unlike traditional ERM programs, the central metric of the value-based

ERM approach—change in company value—is suitable for combining the risk

as well as the return side of the business decision-making equation. Not only

that, this provides the single most rigorous business case one can ever make for

a decision: the expected change in the company’s value, and the level of

certainty around achieving that change.

Are the ERM Models Practical?

Most traditional ERM models are overly complex. ERM models are designed,

built, modified, expanded, and maintained by modelers. And modelers, by their

nature, are like thoroughbreds—they love to run. It’s as if they have all this

pent-up capability and they are itching to unleash it. Modelers are tempted to

go down a rabbit hole of ever-increasing expansion of the model’s level of detail,

in a misguided belief that they are perfecting the model. However, this is

counterproductive to the whole point of the exercise, which is to support

decision making.

In contrast, value-based ERM models are not overly complex; rather, they

have an appropriate balance between robustness and practicality. The value-

based approach is designed specifically for connecting risk management to

business decision making. As a result, every aspect of the approach is tailored

and trimmed to keep it sleek and practical with this singular focus in mind, and

the model itself is no exception.

We will discuss four aspects of ERM model practicality:

1. Reliability. Traditional ERM models tend to be unreliable in terms of

their quality. Traditional ERM models require a large volume of inputs,

which makes them cumbersome to update every period. By the time the

model is refreshed, it is time to update the inputs again. As a result, the

model grows burdensome and the quality of updates deteriorates. In

addition, the voluminous and tangled programming code makes the

model prone to errors.

Overcoming the Challenges by Using a Value-Based ERM Framework & 101

C03 01/12/2011 23:58:37 Page 102

However, value-based ERMmodels are highly reliable in terms of their

quality. These models use a reasonable number of inputs, which makes

them easier to maintain, keeping the quality of the updates high. In

addition, the simplicity of the programming code makes the model less

prone to errors.

2. Speed. The response time for traditional ERM models is too slow to keep

up with the pace of business. In the financial services sector, these models

can literally take weeks to complete a single run. There are not many

decisions in the organization that can wait that long for an answer. In

addition, modifications to the model often require a lengthy time period

and a significant allocation of resources.

However, the response time for value-based ERMmodels is fast enough

to support business decision making even at the highest levels, where a

faster pace is required. Run time is usually kept to within a handful of

hours. With such a quick turnaround time, virtually all decisions can be

feasibly supported. In addition, modifications to the model can be made

rapidly, because the programming code is relatively straightforward.

3. Transparency. With a traditional ERM approach, the quantification

methodology is so murky that it tends to make management skittish at

the prospect of relying on it for use in decision making. For example, risk

scenarios might be based on a convoluted set of formulae, which are used in

conjunction with a stochastic process that generates new and abstract risk

scenarios every time. The lackof tangible risk scenarios canbedisconcerting.

However, with a value-based ERM approach, the methodology is

highly transparent to management, which gives them more comfort in

relying on it for decision-making purposes. For example, the underlying

individual risk scenarios that give rise to the entire set of exposure metrics

are tangible, specific, deterministic scenarios. Management can review

them directly, and even challenge the choice of assumptions, which gives

the approach a very concrete feel. This accelerates management’s adoption

of ERM into decision making.

4. Balance of significant digits. Traditional ERM models have an im-

balance of significant digits in their calculation and presentation of

results (this was discussed in Chapter 2). Traditional ERM models

purport to provide enterprise risk exposure calculated to a high level

of accuracy. However, these models cling to a hyper-accurate measure-

ment of financial risk while giving short shrift to the (more important)

strategic and operational risks, either ignoring them or estimating them

crudely. Yet, studies (discussed in Chapter 2) show that strategic and

102 & ERM Framework

C03 01/12/2011 23:58:37 Page 103

operational risk exposures generally represent the bulk of a firm’s

aggregate enterprise risk exposure. Therefore, claiming such a high

level of accuracy when reporting enterprise risk exposure is a violation

of the significant digits rule.

In contrast, the value-based ERM approach uses an appropriate balance

of accuracy in the calculation and reporting of its results. It uses a consistent

level of accuracy for both the financial risks and the strategic and opera-

tional risks. The value-based ERM approach develops aggregate information

that is correctly presented as approximate, by its nature, and is also

balanced, and thereby respectful of the significant digits rule.

Is There Consensus Buy-In from Business Segments?

In most traditional ERM programs, there is a lack of buy-in by the business

segments that ERM is something that is good for the business. This is all

too often the bane of the ERM program leader, who is faced with the task

of ‘‘selling’’ ERM to the business segments, whose receptivity remains cool.

Sometimes this is due to an ERM program that is, or is perceived to be, per-

petrated on the business segments by the corporate department. Perhaps

there was not enough input by the business segments in the risk identification

or risk quantification stages of the ERM process. Alternatively, the program

may be, or may be perceived to be, too compliance oriented.

This is another area in which the value-based ERM approach excels. There

are two features of the value-based ERM approach that result in rapidly

building consensus buy-in from the business segments:

1. Appropriate level of input by business segments

2. Support of business segment goals and initiatives

Appropriate Level of Input by Business Segments Most traditional ERM programs involve too much development exclusively within the bounds of the

corporate ERM team, particularly risk scenario development. Their thinking is

that if they first build a robust model fully populated with data and assump-

tions, and then unveil it, when people see what it can do, they will buy in to the

process. Unfortunately, this doesn’t work. Those closest to the risks—which are

largely those in the business segments—must be heavily involved, particularly

with risk scenario development.

The value-based ERM approach has an appropriate balance between

business segment and corporate input. The value-based approach uses the

Overcoming the Challenges by Using a Value-Based ERM Framework & 103

C03 01/12/2011 23:58:37 Page 104

FMEA process (described earlier in this chapter). The majority of the inputs

required for the FMEA process involve strategic and operational risks.

Those closest to these risks are mostly associates in the business segments,

who provide the bulk of the input. However, the corporate ERM team has

a right and responsibility to push back on some assumptions, to ensure a

consistent and credible process. For example, corporate ERM may know that

one of the FMEA interviewees is a particularly risk-averse individual, and

may tend to exaggerate the risks; alternatively, they may know that another

FMEA interviewee is a risk taker, and usually downplays the importance

of potential negative events. Or, someone else may be the champion for a

mitigation project under consideration, and that may color his or her

perspective. Knowing the people involved, and also seeing the FMEA exercise

across the enterprise, puts Corporate in a position to provide valuable input.

Support of Business Segment Goals and Initiatives Although most traditional ERM programs speak a lot about linkage to decision making, the

reality is that they are mired in mitigation. Knowing this, the business

segments are leery at the notion of inviting the risk folks into their business

discussions, lest they get in the way by throwing up risk roadblocks to progress.

The value-based approach is the diametric opposite to this. Its focus on decision

making permeates every step in the ERM process. One of the best examples of

this is during the FMEA risk scenario development exercises.

The FMEA interview is usually attended by business segment subject

matter experts who are closest to the risk, the interviewer (an ERM specialist

with experience in FMEA interviews), and representation from the corporate

ERM team. The subject matter experts will often exhibit unreceptive body

language at the outset of the meeting, leaning back in their chairs with arms

folded, looking at their watches, thinking (if not verbalizing):

This is just another corporate effort. You’re going to collect informa- tion and then try to use it to handcuff me in some way, imposing limits or controls on what you call ‘‘risk taking’’ but what I call doing business. So, let me get back to my work of running the business, because I’m generating the earnings that are paying all of your corporate salaries anyway.

This begins to change as the meeting unfolds. From the very beginning of

the FMEA process, the subject matter experts are being asked for all the inputs:

What could go wrong? What do you worry about? How bad might it be? How

104 & ERM Framework

C03 01/12/2011 23:58:37 Page 105

fast would we recover? And so on. The subject matter experts are appropriately

respected for the knowledge they have. Feeling this, they loosen up a little bit.

Arms become uncrossed.

Next, the ERMmodel, which quantifies the risks based on the risk scenario

inputs, is another potential barrier to business unit buy-in. Models are usually a

‘‘black box,’’ or nontransparent to those not in control of it. However, the

value-based approach uses a simpler, more accessible model that can be easily

explained. In addition, subject matter experts gain additional comfort when

they are told that they will have a chance to review the outputs and revisit their

inputs if results appear odd. They determine the inputs. They understand the

internal mechanics. They get to review the outputs. Suddenly, this begins to

feel like they own the model, and essentially they do. The buy-in builds further.

They are now sitting up straight.

Finally, at the end of the meeting, the subject matter experts from the

business segment are asked, ‘‘Is there any mitigation that you feel is needed,

or is there any project you had planned related to this risk scenario?’’ About a

third of them will pound their fist on the table, and exclaim, ‘‘Yeah, we know

we need such-and-such, but we just couldn’t make the business case and

Corporate did not approve it.’’ The corporate ERM folks are in a position to

respond, ‘‘Well, maybe we can help you. The ERM model is written in the

language of changes in company value, which is the strongest business case

possible. We can help you model the proposed decision, including its upside

and downside exposures, based on the marginal impact to the firm (including

any offsets elsewhere in the firm) and show you where the ‘edges’ are—what

revenues or cost savings are needed to make this viable.’’ Now the buy-in

goes into full gear. Now the subject matter experts lean all the way forward in

their chairs. Now they love you, because you are helping them get their

project accomplished. You are helping them achieve their goals, keep their

jobs, and get their bonuses. It is at this point that rather than pushing ERM

into the business segments, there actually begins to be a pull from them, once

they see how it can serve their needs.

The shift in consensus buy-in can be rapid and dramatic. As an example, a

financial firm was piloting the value-based approach in business segment A

before rolling it out to business segments B and C. After witnessing the rapid

shift in consensus buy-in resulting from this process, the CFO told me, ‘‘This is

fun. I thought I would have to push ERM into business segments B and C. But

once they heard what business segment A was getting, they were banging on

my door to get it, too.’’ As a result, the company moved quickly to implement

the value-based ERM approach enterprise-wide.

Overcoming the Challenges by Using a Value-Based ERM Framework & 105

C03 01/12/2011 23:58:37 Page 106

Table 3.3 summarizes the comparison between traditional ERM and value-

based ERM in terms of supporting decision making.

Criterion 7: Balances Risk and Return Management

Traditional risk management was exclusively about downside risk protection.

Though ERM is supposed to equally treat downside and upside volatility, most

traditional ERM programs lack the ability to deal with upside volatility. The

value-based ERM approach easily handles both, through its unifying metric—

changes in company value. Using the same language (value) for both risks

and opportunities clears the path for complete integration of both sides of

risk–return management.

Not only does the value-based ERM approach resolve this historical

problem with traditional risk management and even traditional ERM pro-

grams, but it also solves a problem more generally for business management.

One of the oldest and most used business phrases is ‘‘risk–reward’’ or ‘‘risk–

return’’ management. Incredibly, this is rarely done, at least not in a robust

way. Most companies have their reward or return management (e.g., strategic

planning) completely segregated from their risk management (e.g., internal

audit, corporate risk unit, etc.). Value-based ERM finally fulfills the promise of

TABLE 3.3 Supporting Decision Making: Traditional ERM versus Value-Based ERM

Traditional Approach Value-Based Approach

Do metrics support decision making?

NO & Not for operational or strategic risks

& Only risk, not return

YES & Metrics for all risks & DValue ¼ rigorous

business case

Do ERMmodels work?

NO & Unreliable quality & Slow response time & Lack of

transparency & Violates significant

digits rule

YES & Reliable quality & Fast response time & Transparency & Balance of significant

digits

Is there buy-in from business units?

NO & Corporate-driven & Compliance-

oriented

YES & Business unit-driven/ Corporate for consistency

& Supports business unit goals/initiatives

106 & ERM Framework

C03 01/12/2011 23:58:37 Page 107

balancing risk and return and integrating both into considerations of business

decisions, starting with strategic planning and cascading down through the

organization.

Criterion 8: Appropriate Risk Disclosures

The purpose of financial reporting is to inform investors about the potential

risks and opportunities of the company. As alluded to in Chapter 2, the most

defensible approach is to inform the development of risk disclosures with a

quantification of the potential impact of key risks on company value. After all,

the primary stakeholder is the shareholder, and company value is their

primary metric.

Unfortunately, companies using a traditional ERMapproach are unable to do

this, because they do not measure exposures in terms of the potential impact on

company value. However, companies using a value-based approach are easily

able to inform the risk disclosures with this type of information. The potential

impact on company value is a central output of the value-based approach.

Criterion 9: Measures Value Impacts

The ability to find the actions that truly add value depends fundamentally on the

activity of measuring value. Surprisingly, as discussed earlier in this chapter, few

companies measure company value. So, to fulfill the portion of the ERM

definition that describes its purpose as ‘‘to increase value,’’ an ERM program

would have to bring with it a measurement of value. Unfortunately, traditional

ERM programs do not do this. For example, at financial services companies, most

traditional ERM programs are capital-centric—they use the change in balance

sheet capital or the increase in required capital as the primary metric.

In comparison, the value-based ERM approach is all about value. Company

value is the central metric. The value-based ERM approach fully supports both

measuring the upside of value volatility (reward) as well as the downside of

value volatility (risk). This puts management in the best position possible to

manage value. Because value is fully measured, it can be fully managed.

Criterion 10: Primary Stakeholder Focus

Most traditional ERM programs focus on downside protection, and in that

tradition, they tend to focusmore on satisfying rating agencies than on satisfying

any other stakeholder. This is especially true for financial services companies,

which are, at times, overly focused on capital requirements. Maintaining an

Overcoming the Challenges by Using a Value-Based ERM Framework & 107

C03 01/12/2011 23:58:37 Page 108

appropriate level of capital is critical. However, focusing too heavily on capital

needs does not always lead to decisions that increase company value.

A better approach is to focus on the primary stakeholder, who, for most

public companies, is the shareholder, and treat all other stakeholders as

secondary. Secondary stakeholders should only be satisfied to the extent that

it optimally increases company value. The value-based approach provides the

framework to do just that. Every decision is viewed in terms of how it impacts

company value. See ‘‘Managing Secondary Constraints for Maximal Value.’’

In Chapter 10, we generalize the definition of the value-based ERM

approach to show how it can be adapted for entities that do not have public

shareholders and are not focused on company value or distributable cash flows.

MANAGING SECONDARY CONSTRAINTS FORMAXIMAL VALUE

The value-based ERM approach takes secondary stakeholders into ac-count as constraints to be managed in the process of increasing com- pany value. All types of decisions as to the optimal level of resources to expend in satisfying secondary stakeholders can be evaluated by the impact on company value. There is a ‘‘sweet spot’’ the company must find for the amount of resources to use in satisfying each such secondary stakeholder. The following two examples will illustrate this point:

Rating Agencies

& If the company does too little, in the extreme, then the likelihood of a ratings downgrade increases. A ratings downgrade risk scenario would include an increase in the cost of debt capital (i.e., interest expense), decreasing distributable cash flows, and lowering company value. This risk scenario may rise in the key risk ranking, which would increase the enterprise risk exposure. If the enterprise risk exposure is increased enough, this would imply a higher cost of equity capital, further lowering company value.

& If the company does too much, in the extreme, it may take the form of expensive risk mitigation efforts related to some issue about which the rating agency has expressed concerns, or abandoning plans for aggressive new ventures about which the rating agency had nega- tive, perhaps overly conservative, views. This would directly result in higher-than-expected expenses or lower-than-expected revenues,

108 & ERM Framework

C03 01/12/2011 23:58:38 Page 109

SUMMARY

Traditional ERM frameworks do not satisfy many of the 10 key ERM criteria,

and often fail to achieve most of them. In addition, traditional ERM programs

have three core challenges to successful ERM implementation, which are like

flags, or symptoms, identifying those companies that are using a suboptimal

ERM framework, and as a result, are struggling to satisfy the 10 key criteria.

These three core challenges are:

1. Inability to quantify strategic and operational risks

2. Unclear definition of risk appetite

3. Lack of integration of ERM into decision making

respectively, decreasing distributable cash flows and directly lowering company value.

& There is an optimal balance of efforts that maintains the desired rating at an appropriate cost, which results in the best risk–return trade-off, maximizing company value.

Charities

& If the company does too little, in the extreme, it increases the risk of negative media coverage resulting in reputational damage. This risk scenario may include a decrease in revenues due to loss of cus- tomers, an increase in expenses to fund an expensive public relations advertising campaign to mitigate the damage, or both, decreasing distributable cash flows and lowering company value. This risk sce- nario may rise in the key risk ranking, which would increase the enterprise risk exposure. If the enterprise risk exposure is increased enough, this would imply a higher cost of equity capital, further lowering company value.

& If the company does too much, in the extreme, it will overspend on charitable donations. This would directly result in higher-than-expected expenses, decreasing distributable cash flows and directly lowering company value.

& There is an optimal balance of efforts that satisfies the company’s image as a decent corporate citizen at a reasonable level of donations, which results in the best risk–return trade-off, maximizing company value.

Summary & 109

C03 01/12/2011 23:58:39 Page 110

The value-based approach was designed to address these shortcomings.

Through a synthesis of ERM and value-based management, the value-based

approach offers an advanced yet practical ERM approach that fully satisfies all

10 key ERM criteria, including the three core challenges.

Now that we have provided the recent historical context for ERM (Chapter

1), properly defined both risk and ERM (Chapter 2), and presented the value-

based ERM framework (this chapter), we conclude Part I, ‘‘Basic ERM Infra-

structure.’’ We are now ready to explore Part II, ‘‘ERM Process Cycle,’’ where

we will discuss the four steps in the ERM process cycle: risk identification

(Chapter 4), risk quantification (Chapter 5), risk decision making (Chapter 6),

and risk messaging (Chapter 7).

NOTES

1. Insurance risks are another category, primarily for insurance companies, but

also for other companies offering certain types of guarantees.

2. Some non-key risks also receive quantitative treatment, but not in the same

robust manner as described in the remainder of this section. Identifying

‘‘emerging risks’’—those risks that may become key risks in the future—is

a process that includes some quantitative analysis of risk scenarios for certain

non-key risks.

3. This is very different from traditional ERMmethods, which attempt to generate

risk scenarios from continuous distributions, most of which must be artificially

developed specifically to enable this approach.

4. This only represents the portion of the volatility arising from the key risks,

because these are the only ones quantified.

5. See Chapter 6, ‘‘Integrating ERM into Business Decision Making,’’ ‘‘Dealing

with Soft Assumptions’’ for more detail on this case study.

6. See also The Wisdom of Crowds, a book by James Surowiecki, which discusses

how collective information can improve even the estimates of the smartest

individual expert.

7. Correlation data adjusts for the fact that some risks are more likely to occur

together (positively correlated) than the multiplication of their probabilities

would otherwise indicate, whereas other risks are less likely to occur together

(negatively correlated). Risk correlations are discussed in more detail in

Chapter 5.

110 & ERM Framework

C04 01/12/2011 10:42:5 Page 111

IIPART TWO ERM Process Cycle

C04 01/12/2011 10:42:5 Page 112

C04 01/12/2011 10:42:5 Page 113

4CHAPTER FOUR Risk Identification

The dangers of life are infinite, and among them

is safety.

Goethe

ONCE AN ERM framework is chosen, and after at least some basicrisk governance is established, the four-step ERM process canbegin. Risk identification is the first step in this process, which, as discussed in Chapter 2, is a continuous, evolving, and integrated process.

COMPONENTS OF RISK IDENTIFICATION

There are three components to the risk identification ERM process step, as

performed using the value-based ERM approach:

1. Risk categorization and definition

2. Qualitative risk assessment

3. Emerging risk identification

113

C04 01/12/2011 10:42:5 Page 114

The first time these three components are conducted, they must be

performed in the order shown, because the outcome of each preceding

component is used as input into the following one.

Before we discuss these three components, we will discuss the five keys

to successful risk identification.

FIVE KEYS TO SUCCESSFUL RISK IDENTIFICATION

Many companies have at least begun the ERM process and have at least

completed the first step in the ERM process cycle—risk identification. Therefore,

many believe that common practices in risk identification are, by now, best

practices, and that this step is fairly straightforward. Unfortunately, quite the

contrary is true. There are several aspects of risk identification that are still

routinely performed in a suboptimal way. Not only does this hamper the risk

identification process step, but it also significantly impacts the quality of the

entire ERM program, because every other step in the ERM process is down-

stream from the risk identification step, relying on information from it.

To avoid these problems, ERM programs must employ the following five

keys to a successful risk identification process step:

Key #1: Define risks by source

Key #2: Categorize risks evenly

Key #3: Define metrics clearly

Key #4: Gather data appropriately

Key #5: Identify risks prospectively

The first two keys to success are primarily related to the risk categorization

and definition component of risk identification. The last three keys to success

are primarily related to the qualitative risk assessment component of risk

identification. These keys to success will be discussed later, within the context

of their corresponding component.

We will now discuss the three components of the risk identification ERM

process step, starting with risk categorization and definition.

RISK CATEGORIZATION AND DEFINITION

The risk categorization and definition component of the risk identification

process step consists of constructing a comprehensive list of known potential

114 & Risk Identification

C04 01/12/2011 10:42:5 Page 115

risks. The result is the risk categorization and definition (RCD) tool. The RCD

tool includes a risk categorization hierarchy including risk categories, risk

subcategories, risk divisions, the risks themselves, and a definition clarifying the

scope of the risk. Table 4.1 shows a partial sample of an RDC tool.

TABLE 4.1 Partial Sample of Risk Categorization and Definition (RCD) Tool

Risk

Category

Risk

Subcategory Risk Division Risk Definition

Operational Human resources

Talent management

Ability to recruit or retain

Ability to recruit or retain staff not matching expectations

Operational Human resources

Talent management

Succession planning

Ability to develop new leadership not matching expectations

Operational Human resources

Talent management

Critical employee(s)

Unexpected loss of employee(s) with critical and rare knowledge or skills

Operational Human resources

Talent management

Labor or producer relations

Employees or producers take unexpected action against the company (e.g., union strike)

..

. .. . ..

. .. . ..

.

Operational Technology Data security and privacy

External attack

External attack (e.g., phishing) steals company or customer data, including privacy data, and/or destroys programs or data

Operational Technology Data security and privacy

Internal attack Internal attack steals company or customer data, including privacy data, and/or destroys programs or data

Operational Technology Data security and privacy

Accidental breach

Employee accidentally exposes company or customer data, including privacy data, and/or destroys programs or data

Risk Categorization and Definition & 115

C04 01/12/2011 10:42:6 Page 116

The risk categorization in the RCD tool should be reasonably comprehensive

in terms of categories and subcategories, but certainly not in terms of individual

risks. A full list of categories and subcategories is needed to serve as a prompt

to participants in the qualitative risk assessment interviews, to trigger them to

consider myriad potential key risks that may lie within each category or sub-

category. However, it is not advisable to attempt to construct a comprehensive

list of all potential risks. Even if such a task were possible, the list of risks would be

too long. In addition, any list that purports to be comprehensive in terms of risks

tends to lower the level of imagination used by participants in the qualitative risk

assessment. Rather than meditate for a while on the business and its risks, they

simply look down the list and check off the ones that look relevant.

The main risk categories, and their definitions, are as follows:

Financial risk. Unexpected changes in external markets, prices, rates,

and liquidity supply and demand. This includes market risk, credit risk, and

liquidity risk

Strategic risk. Unexpected changes in key elements of strategy formula-

tion or execution

Operational risk. Unexpected changes in elements related to operations,

such as human resources, technology, processes, and disasters

There is one additional risk category—insurance risk, which generally

applies only to insurance companies. Insurance risk involves poor performance

of the pricing, underwriting, reserving, or setting of required capital for

insurance products.

An example of some common risk categories and subcategories, and their

definitions, is shown in Table 4.2.

TABLE 4.2 Common Risk Categories and Subcategories

Risk

Category

Risk

Subcategory Definition

Financial A category of risks related to unexpected changes

in external markets, prices, rates, and liquidity

supply and demand. See also market risk, credit

risk, and liquidity risk.

Financial Market Unexpected changes in external markets (such as stock markets), prices (such as commodity prices), or rates (such as interest rates), related to (a) general market movements (although the source for this is often economic risk) or (b) a specific asset on the company’s balance sheet. Some examples include equity market risk, interest rate risk, and currency risk.

116 & Risk Identification

C04 01/12/2011 10:42:7 Page 117

Financial Credit Unexpected changes in credit markets (availability), prices (credit spreads), or credit-worthiness of issuers, related to (a) general credit market movements (although the source for this is often economic risk) or (b) a specific issuer of a fixed-income security on the company’s balance sheet or (c) a counterparty to whom the company has extended credit.

Financial Liquidity Unexpected changes in liquidity supply or demand, related to three different levels of impact on the company: (a) untimely asset sales; (b) inability to meet contractual demands; or (c) default. A change in liquidity supply involves an unexpected change in the ability to sell assets as expected in the market, in terms of price, volume, or timeliness. A change in liquidity demand involves an unexpected change in demand for liquidity by option holders, such as bondholders exercising early put options or ‘‘run-on- the-bank’’ situations for financial services companies, where account holders suddenly request the withdrawal of funds from their accounts, en masse.

Strategic A category of risks related to unexpected changes in

key elements of strategy formulation or execution.

This is highly variable by company and must be

customized.

Strategic Strategy Viability of strategy—such as choice of products, distribution channels, markets, or value proposition— does not match expectations. This is highly variable by company and must be customized.

Strategic Execution Strategy is not implemented as expected. This is highly variable by company and must be customized.

Strategic Governance Governance is not functioning as expected.

Strategic Strategic relationships

Unexpected change in strategic relationships, such as a parent company or joint venture partner.

Strategic Competitor Unexpected change in competitive landscape, such as new entrants, aggressive competitor actions against the company, price wars, and so forth.

Strategic Supplier Unexpected changes in supplier environment, such as supplier capacity, supplier failure, or change in the cost of goods or services. This also includes unexpected changes in rating agency ratings or regulatory licenses.

Strategic Economic Unexpected changes in the economy. This is often the source of risk that triggers multiple simultaneous unexpected changes in other items, such as consumer

(continued )

Risk Categorization and Definition & 117

C04 01/12/2011 10:42:8 Page 118

TABLE 4.2 (continued )

Risk

Category

Risk

Subcategory Definition

disposable income (impacting demand for the company’s products or services), employment markets (impacting the company’s fixed expenses), inflation/ deflation (impacting the company’s variable costs), items related to market risk, and items related to credit risk.

Strategic External relations

Unexpected changes in the company’s relationship with external stakeholders with public voices, such as the media, consumer advocates, equity analysts, rating agencies, regulators, and politicians.

Strategic Legislative/ regulatory

Unexpected changes in laws or regulations.

Strategic International Unexpected changes in the business environment of foreign countries in which the company operates, such as unexpected changes in the government’s stability, attitude toward foreign companies, and tariffs.

Operational A category of risks related to unexpected changes in

elements related to operations, such as human

resources, technology, processes, and disasters.

Operational Human resources

Human resources (i.e., people) are not performing as expected, such as unexpected changes in talent management, performance, productivity, and conduct.

Operational Technology Technology not performing as expected. Some examples include data security, data privacy, data integrity, capacity, and reliability.

Operational Litigation Unexpected civil suits or judgments against the company.

Operational Compliance Level of compliance not matching expectations, such as financial reports are not as accurate as expected.

Operational External fraud Unexpected change in the amount of fraud by external parties.

Operational Disasters Unexpected natural or man-made disasters, such as weather-related (such as hurricane, flood, tornado, earthquake, and drought), health-related (such as pandemic), accidental (such as fire), general acts of destruction (such as war, terrorism, and rioting), and specific acts of destruction against the company (such as product tampering, attack on employees, and sabotage). This also includes unexpected man-made disasters caused by company employees or agents, such as environment damage.

Operational Processes Company processes not functioning as expected.

118 & Risk Identification

C04 01/12/2011 10:42:9 Page 119

Nomenclature

Although it is important for the RCD tool to include a comprehensive list of risk

categories and subcategories, it is not particularly important that its nomen-

clature conform to any external standard. What is important regarding RCD

nomenclature is that it be clearly defined and consistently used throughout the

organization. In fact, internally, it is often best not to use an externally defined

standard for RCD nomenclature. External standards are often poorly con-

structed; for example, they are not consistently defined by source. In addition, it

is preferable to customize the nomenclature with terminology already in use by

the businesses, which can help to pave a smoother path toward adoption and

integration of the RCD tool, specifically, as well as ERM generally.

RCD Tool Applications

The RCD tool provides a uniform lexicon for risks throughout the enterprise.

This assists the development of risk culture, which is the integration of ERM

into key company processes. Having a consistent language for risk is critical to

a uniform adoption and integration of ERM into the organization over time. The

importance of having a common language for risk cannot be overstated, and

will be further explored later, during discussion of the first two keys to

successful risk identification. Suffice to say that there are many ways that

the categorization and definition of risks can go awry, and the RCD tool helps

keep this on a consistent track.

As a result of this unifying quality, the RCD tool becomes a natural focal

point for many aspects of the ERM program, and is commonly used in several

ways. The main applications for the RCD tool include the following:

& Catalyst & Collection and coordination & Monitoring & Reporting & Comparative analysis & Recording

Catalyst

Often, the very first use of the RCD tool is as a catalyst in the qualitative risk

assessment phase of the risk identification process step. The RCD tool is part of

the advance communication provided to the qualitative risk assessment survey

Risk Categorization and Definition & 119

C04 01/12/2011 10:42:9 Page 120

participants. This helps trigger survey participants’ imagination of potential

key risks to consider. At a minimum, it confronts survey participants with the

specific risks listed in the RCD tool, and calls on them to consider whether these

are potential key risks for their business or for the enterprise as a whole. In

addition, the reasonably comprehensive nature of the RCD tool reminds survey

participants of risks that they may well know, but that may have otherwise

slipped their mind during the qualitative risk assessment exercise. Finally, for

qualitative risk assessments subsequent to the initial one, the RCD tool shared

with survey participants is often populated to show which risks were identified

as potential key risks in the prior qualitative risk assessment, as well as their

consensus ranking and likelihood-severity scores. This helps survey partici-

pants consider whether, and to what extent, the importance of these previously

identified risks has changed.

This also gets qualitative survey participants to think in terms of risk

defined and categorized in a consistent manner. The RCD tool illustrates the

proper way to define risks by source and to categorize risks evenly.

Collection and Coordination

The RCD tool is useful for the collection of data and coordination of activities

during the qualitative risk assessment. The RCD tool is easy to use as a

template to populate risks as they are identified by survey participants during

the qualitative risk assessment. In addition, it helps interviewers as they

interpret and document the risks provided by survey participants. Often, the

risks, as stated by survey participants, are either not worded clearly or are

not properly defined as a source of risk (see later ‘‘Key #1: Define Risks by

Source’’). By mapping the inputs provided into the RCD tool, interviewers

can quickly identify any problems. When the qualitative risk assessment is

performed via live interviews, the RCD tool helps interviewers identify any

issues in real time, which affords them the immediate opportunity to ask

clarifying questions of survey participants, and to make any necessary

corrections.

In addition, when interviews are used for the qualitative risk assessment,

the RCD tool facilitates coordination among multiple interviewers. In addition to

their uniform interview script, all interviewers have the same RCD tool, which

serves as a central touchstone keeping all interviewers aligned. Also, as new po-

tential risks are identified by survey participants in early interviews, interviewers

canquickly andeasily coordinatewitheachother to include the additional risks in

the RCD template, making them more complete for the remaining interviews.

120 & Risk Identification

C04 01/12/2011 10:42:10 Page 121

Finally, the RCD tool is used to coordinate the qualitative risk assessment

consensus meeting. This is where the individual results of the qualitative risk

assessment are aggregated and shared with all survey participants, and a

meeting is held to clarify any results with significant dispersion and enhance

the level of consensus before finalizing results.

Monitoring

After the qualitative risk assessment, the RCD tool is used to store all the

results—key risks as well as those risks confirmed as risks in the consensus

meeting, but which did not rise to the level of key risks on the basis of their

likelihood-severity scores. In between periodic reperformance of the qualitative

risk assessment, the fully populated RCD tool is used to monitor any potential

changes in the importance of any of the risks listed therein. This is part of

emerging risk identification.

Reporting

The RCD tool can also be used as part of the internal reporting of key risks to

management and to the board of directors. Seeing the key risks listed within the

RCD tool provides a context within which to better understand the key risks.

This highlights those risks selected as key risks, and contrasts them against

those risks not selected as key risks. This provides more information and elicits

the kind of engaged dialogue that builds risk awareness and risk culture at

senior levels. In addition, using the RCD tool for internal reporting provides a

standard report format that can be sustained over time.

Comparative Analysis

Another useful application of the RCD tool is to provide a basis for conducting a

comparative analysis between the company’s own risk disclosures and that of

its key competitors. When available, competitors’ risk disclosures are examined

and the risks are mapped into the RCD tool. This puts the disparate formats and

terminology on a consistent basis, which allows direct comparison. This

analysis often reveals interesting information, such as the following:

& Risks disclosed by the company and by competitors & Risks disclosed by the company but not disclosed by competitors & Risks disclosed by competitors but not disclosed by the company & Relative emphasis placed on certain risks by competitors and how that

differs from the company’s relative emphasis

Risk Categorization and Definition & 121

C04 01/12/2011 10:42:10 Page 122

Recording

TheRCD tool is also useful as a platform for the risk event database,which records

actual occurrences of risk events impacting the organization. The risk event

database captures various information about the events, including, for example,

originating source of the risk, how the event emerged and unfolded, manage-

ment’s actions, and the ultimate financial impacts. This is used for two purposes.

The first is to capture information that can beused to enhance the development of

risk scenarios. Capturing historical experience related to a specific risk can inform

the estimates of future likelihood as well as future severity of impact. A second

purpose is to enhance the entire ERMprogram throughwhat is often referred toas

‘‘risk learnings.’’1 Risk learnings are the lessons learned from the risk event,

including, for example, answers to the following questions:

& Was the originating source for the risk event on our radar? If not, can we

improve our risk identification process? & How did the risk emerge? Should we have caught it earlier on? & How did the risk event unfold, and what financial impacts occurred? Can

we use this information to enhance our risk scenario development process? & Was there any existing pre-event mitigation in place (i.e., fraud detection

systems) to make the event less likely or less impactful, and was it effective? & Was there a management reaction plan in place (e.g., business continuity

plan), did management follow it, and was it effective? & Was there post-event mitigation (e.g., insurance coverage) and did it

perform as expected?

For the RCD tool to be effective, its constructionmust reflect the two related

keys to successful risk identification, listed earlier:

Key #1: Define risks by source

Key #2: Categorize risks evenly

Key #1: Define Risks by Source

Most ERM programs fail to properly define all risks by their source. Typically,

they define some risks by their source, but they define others by their outcome.

For example, here is a sample list of seven risks:

1. Competitor risk

2. Supplier risk

122 & Risk Identification

C04 01/12/2011 10:42:10 Page 123

3. Technology risk

4. Regulatory risk

5. Terrorism risk

6. Reputational risk

7. Ratings downgrade

Unfortunately, these risks are inconsistently defined. The first five risks

are defined by their source, but the last two risks are defined by their

outcome.

Let’s look first at reputational risk. Clearly, protecting their reputation is a

major concern for most companies, and this is a risk that is very commonly

included in company’s key risk lists. However, reputation risk is not a risk.

That is, it is not stated in the form of a source of risk. Rather, reputational

damage is a result, an outcome, which can occur as a direct result of several

distinct sources of risk. Product quality may not be living up to expectations

or to company advertising campaigns. Customer service may have deteriorated

past a tipping point. A significant case of internal fraud may be discovered, or

an internal scandal may become public. Company management of external

relations may have gone awry. There are various risk events that are the

originating sources, or root causes, that lead first to negative media coverage,

and then, possibly, to reputational damage.

In fact, not only is reputational damage not a true source of risk, it is also

not even the true outcome, at least not the outcome that matters most.

Reputational damage is only relevant to the point that it actually causes

financial consequences, which are the ultimate outcome in terms of impor-

tance. To matter, reputational damage must manifest in some financial way,

either in lowering future revenues, increasing future expenses, and/or

increasing the cost of capital. At least one of these must occur for company

value to be reduced. So, reputational ‘‘risk’’ is only a stopover—an interme-

diate outcome—along the way. Figure 4.1 illustrates these relationships in

terms of their flow from multiple true sources of risk to negative media

coverage and then reputational damage, and, finally, to the true outcome of

financial impacts. See ‘‘LifeLock.’’

A similar observation is presented for the second of the two risks from our

earlier example, which was the risk of a ratings downgrade. Companies with

public debt are concerned with their debt ratings assigned by rating agencies.

And it is quite common to find ‘‘ratings downgrade’’ on a company’s key risk

list. Yet, as in the situation for reputational risk, ratings downgrade is not a

source of risk. Rather, a ratings downgrade is an intermediate outcome that

Risk Categorization and Definition & 123

C04 01/12/2011 10:42:10 Page 124

OUTCOME Lower

Revenues

Higher Expenses

INTERMEDIATE

Negative Media Coverage

SOURCE Poor Product

Quality

Poor Customer Service

Internal Fraud or Scandal

Poor External Relations

Reputation Damage

Lower Company Value

Higher Cost of Equity Capital

FIGURE 4.1 Reputational Risk Can Result from Several Different Risk Sources

LIFELOCK

Risk events involving reputational damage do not always result in largefinancial impacts. This is often the case for companies with lesser- known brands, which tend not to generate a sustained level of media interest after a story initially breaks. This is also often the case for risk events for which people tend not to hold the company accountable. However, a risk to avoid would be one that betrays the core branding of the company. For example, if a home security alarm company suffers a break-in at its headquarters, it can be very bad for business. A company called LifeLock got itself into such a situation.

Founded in 2005, LifeLock became one of the leading names in identity theft protection in the United States, using a marketing campaign with CEO Todd Davis’ social security number painted on the side of a truck. In May 2007, the Phoenix New Times, a free weekly newspaper in Phoenix, ran an article indicating that Robert J. Maynard, Jr., a cofounder of LifeLock, may have stolen his own father’s identity to get an American Express card, and used it to make $150,000 in fraudulent charges. Maynard resigned within days. In May 2010, the same newspaper ran another article revealing that Todd Davis had himself been a victim of identity theft at least 13 times since 2007. LifeLock’s earnings are not public, but this could not have been good for business.

124 & Risk Identification

C04 01/12/2011 10:42:20 Page 125

can be triggered by many different sources of risk. The strategy itself may be

flawed. Management may be struggling to effectively implement the strategy.

Management may have a deteriorating relationship with one or more of the

rating agencies.2 These are examples of true sources of risk that can give rise

to a ratings downgrade. The ratings downgrade is a direct result of one or

more of these sources of risk. Once it occurs, the ratings downgrade is merely

an intermediate outcome; it can then lead to financial impacts, including

lower revenues, higher expenses, and/or a higher cost of capital. Figure 4.2

illustrates these relationships in terms of their flow from multiple true sources

of risk, to the intermediate outcome of a ratings downgrade, and on to

financial impacts.

Another example is equity market risk. This is a common risk found on key

risk lists for companies that have equities among their invested assets,

particularly financial services companies. Yet, most of the time, this is not

the source of risk, but rather merely one expression—an intermediate out-

come—of the true source of risk, which is volatility in the economy. Identifying

the true source for market risk has additional implications beyond the earlier

examples of reputational risk and ratings downgrade. In this example, eco-

nomic volatility is not the only possible source driving equity market volatility,

but it is perhaps the primary one. The more important distinction here, though,

OUTCOMEINTERMEDIATE

Ratings Downgrade

SOURCE

Poor Strategy

Poor Execution

Poor Rating Agency

Relations

Lower Revenues

Higher Expenses

Lower Company Value

Higher Cost of Equity Capital

FIGURE 4.2 A Ratings Downgrade Can Be Triggered by Several Different Risk Sources

Risk Categorization and Definition & 125

C04 01/12/2011 10:42:24 Page 126

is that the single source of risk—economic volatility—drives multiple interme-

diate outcomes, many of which impact each other, in complex ways, and all of

which ultimately can impact the financial components of company value. The

intermediate outcomes of economic volatility include, for example:

& Equity market risk (unexpected changes in equity markets) & Credit risk (unexpected changes in credit markets) & Unexpected inflation or deflation & Unexpected changes in employment levels & Unexpected changes in consumer spendable income

Figure 4.3 illustrates the basic order of these relationships in terms of their

flow from the single true source of risk highlighted here, to the multiple

intermediate outcomes, and on to financial impacts.

Failing to define all risks consistently by source lowers the quality of three of the

ERM process steps:

& Risk identification & Risk quantification & Risk decision making

OUTCOMEINTERMEDIATESOURCE

Unexpected Economic Volatility

Equity Market Risk Lower

Revenues

Higher Expenses

Lower Company Value

Higher Cost of Equity Capital

Credit Risk

Unemployment

Consumer Spendable Income

Inflation/Deflation

FIGURE 4.3 Economic Volatility Is Often the Source of Equity Market and Other Risks

126 & Risk Identification

C04 01/12/2011 10:42:27 Page 127

Impact on Risk Identification

Failing to define all risks consistently by their source lowers the quality of the

qualitative risk assessment component of the risk identification process step.

The qualitative risk assessment involves asking survey participants to assess

potential key risks by providing a qualitative ranking (e.g., high, medium, or

low) for both likelihood and severity. To have meaningful survey results, survey

participants in the qualitative risk assessment must have a clear definition and

consistent understanding of the risks they are assessing. Unfortunately, when

risks are defined by their outcome, this often causes confusion. In considering a

given risk defined by its outcome, different survey participants may be imagin-

ing a different corresponding source of risk, and as a result, the likelihood and

severity scores will be provided on an inconsistent basis. This inconsistency is

even more insidious to the ERM process, because it usually goes undetected.

Impact on Risk Quantification

Failing to define all risks consistently by their source also impedes the risk

scenario development portion of the risk quantification ERM process step. It

does so in three ways:

1. Inability to identify subject matter experts. When risks are im-

properly defined by outcome, it is even difficult to identify the appropriate

subject matter experts to begin with, because this depends on the source of

risk. Risk scenarios for reputational damage caused by poor product quality

should involve subject matter experts from the quality or production areas.

However, risk scenarios for reputational damage caused by poor customer

service should involve those from the customer service center.

2. Difficulty imagining risk scenarios. The ambiguity of a risk that is

improperly defined by outcome makes it difficult to imagine individual

deterministic risk scenarios. Something amorphous such as reputation

risk does not immediately bring to mind a specific risk scenario. In fact,

this just leads those responsible for developing the risk scenarios—subject

matter experts—into an attempt to identify a source of reputational risk

on an impromptu basis. Trying to trace this back to a source of risk does

not belong in the risk scenario development exercise. In this forum, the

subject matter experts are likely to omit one or more potential sources

of risk.

3. Incomplete risk scenarios. Defining risks by their outcome can lead to

incomplete risk scenarios. When the true source of risk is not identified, it

Risk Categorization and Definition & 127

C04 01/12/2011 10:42:27 Page 128

is easy to omit other intermediate outcomes that would naturally ac-

company the outcome identified in a given scenario. Consider our earlier

example of equity market risk. As Figure 4.3 shows, if equity market risk

was the only item identified, the risk scenario would include only the

financial impacts from equity volatility. However, in most cases, eco-

nomic risk (unexpected economic volatility) is the true source of risk.

Realistic economic scenarios include impacts on multiple intermediate

outcomes (credit risk, inflation/deflation, etc.), all of which have varying,

and interacting, financial impacts, each of which must be included.

Impact on Risk Decision Making

Failing to define all risks consistently by their source also inhibits the risk

mitigation portion of the risk decision-making process step. Although some

risk mitigation relates to the outcome (for example, insurance coverage),

most mitigation is performed at the source of risk. As a result, it is difficult to

evaluate mitigation options for risks when you don’t know the source. For

example, if management became concerned about a ratings downgrade, their

actions to mitigate this risk would depend on what is driving this concern. Is

it a poor strategy? If so, what aspect(s) of strategy must be corrected? Is it poor

execution of strategy? If so, what aspect(s) of execution must be better

managed? If the source is not identified, then management is hard-pressed to

come up with a vision of the mitigation options to consider.

Consistently defining risks by their source resolves all of these issues. It allows

for consistent scoring provided by survey participants in the qualitative risk

assessment, because they all have a common understanding of the specific

source for each risk. It makes it easy to identify the appropriate subject matter

experts responsible for developing risk scenarios for each individual risk source.

It provides a smooth path for imagining the specific risk scenarios, which can

flow logically from their originating source. It provides the ability to construct

complete risk scenarios. And, finally, it enables consideration of all mitigation

options, which occur mostly at the source.

Now, let’s look at the second key to success, which must be reflected in the

construction of the RCD tool.

Key #2: Categorize Risks Evenly

Many RCD lists do not categorize risks at an even level of abstraction. Some

portions of the RCD tool are often categorized at too high a level, and others are

128 & Risk Identification

C04 01/12/2011 10:42:27 Page 129

often categorized at too low a level. Either one of these problems lowers the

quality of the risk identification process step. Those categorized at too high a

level can lead to failure to consider subcategories (or divisions or individual

risks) within the category (or subcategory or division) identified. As an example

consider the risk division ‘‘Talent management’’ shown in Table 4.1. If the RCD

tool had only identified this division and not identified any of the risks below it,

it is possible that some of the risks under this division may have been missed,

such as ‘‘Critical employee(s).’’

Similarly, some portions of the RCD tool are categorized at too low a level,

which can lead to failure to consider the divisions above the identified risks, as

well as some of the individual risks to which they correspond. As an example,

again consider the risk division ‘‘Talent management’’ shown in Table 4.1. If

the RCD tool had only identified some of the individual risks, such as ‘‘Ability to

recruit or retain’’ and ‘‘Succession planning,’’ it is possible that the overarching

division, ‘‘Talent management,’’ may have been missed. This might result in

omitting other risks within the division such as ‘‘Critical employee(s)’’ or

‘‘Labor or producer relations.’’

QUALITATIVE RISK ASSESSMENT

Once the RCD tool is properly constructed, the main activity in the risk

identification process step can take place: the qualitative risk assessment.

The qualitative risk assessment is the second component in the risk identifica-

tion ERM process step. We will describe the qualitative risk assessment by its

purpose, its process, and its product.

Purpose

The primary purpose of the qualitative risk assessment is to prioritize the list of

potential risks and narrow them down to the list of key risks. The key risk list is

a list of approximately 20 to 30 of the most important risks, which will be

advanced to the next step in the ERM process cycle: risk quantification. A

secondary purpose of the qualitative risk assessment is to support the emerging

risk identification process.

Process

The process of the qualitative risk assessment involves soliciting input from

internal personnel regarding the organization’s key risks, and a high-level

Qualitative Risk Assessment & 129

C04 01/12/2011 10:42:27 Page 130

qualitative scoringofeachpotential keyrisk’s likelihoodofoccurrenceandseverity

of impact. The qualitative risk assessment is conducted in a four-step process:

Step 1: Participant identification

Step 2: Advance communication

Step 3: Qualitative risk assessment surveys

Step 4: Consensus meeting

Step 1: Participant Identification

The first decision in the participant identification step is the number of survey

participants to include. This does vary somewhat by size and complexity of the

organization. However, it is best to keep the number to a manageable size,

keeping in mind that this exercise must be repeated periodically, and possibly

annually, depending on the dynamic nature of the internal and external

environments. For most companies, an appropriate number of survey partic-

ipants may be between 25 and 35. This number may naturally flow from the

second decision, which is selection of the survey participants themselves, but it

is helpful to begin with at least a target number in mind, to prevent the list from

growing so large that the process becomes unworkable.

The second decision is selection of the most appropriate survey parti-

cipants. This is unique to each company. However, a partial list of suggested

individuals to include, as well as the perspectives they offer, is shown in

Table 4.3.

Political concerns are, as always, a consideration. If there is a segment of

the organization, or individual, with whom there is a need or desire to

accelerate the pace of buy-in for the ERM program, it may be wise to include

a key representative from that segment, or the specific individual, as a survey

participant.

Step 2: Advance Communication

After the qualitative risk assessment survey participants have been identified,

the next step in the qualitative risk assessment is to send them an advance

communication. The advance communication should be designed to achieve

the following objectives:

& Request participation & Prepare participants & Schedule time

130 & Risk Identification

C04 01/12/2011 10:42:27 Page 131

Request Participation Although requesting the participation of the invitee may be the most obvious goal of the advance communication, the approach is

not necessarily straightforward. It must be done skillfully. If not crafted

properly, it could have the opposite of its intended effect: it might produce

resistance. However, if constructed carefully, it can garner participation and

begin to build the buy-in process for the ERM program. To do this, the advance

communication must effectively convey the following:

& High-level support for the ERM program & Importance of the qualitative risk assessment & Critical need for their input

TABLE 4.3 Suggested Participants for Qualitative Risk Assessment Survey (Partial List)

Suggested Survey Participant Perspective Offered

Independent director (1 or 2) Objective

Chief executive officer (CEO) Enterprise-wide

Chair of audit committee and head of internal audit

Knowledge gained through audit activities

General counsel Litigation risk

Chief risk office (CRO) or equivalent

Enterprise-wide

Heads of major business segments and one of their lieutenants

Risks in the business segments; lieutenants are often closer to the risks and offer more insights

Head of human resources Human resources risk

Chief technology officer (CTO) Technology risk

Head of marketing Brand risks

Head of investor relations Investor relations risk

Head of compliance Compliance risks

Chief financial officer (CFO) Financial reporting risk

Head of strategic planning Enterprise-wide

Chief investment officer (CIO) Financial risk

Personnel with long experience in the industry (1 or 2)

Industry-related risks

Personnel with longevity in the organization (1 or 2)

Organizational risks

Qualitative Risk Assessment & 131

C04 01/12/2011 10:42:28 Page 132

& Finite time commitment & Level of confidentiality

Communicating the level of endorsement for the ERM program signals to

invitees that this should be given some priority, and to make time in their

schedule. This can include support from the board of directors, the CEO, other

senior executives, as well as any leader(s) of the survey participant’s particular

business segment. Explaining the importance of the qualitative risk assessment

to the overall ERM program provides the context for the exercise and the

linkage of survey participant efforts to the overall ERM program. Stressing the

need for their valuable input—based on their industry knowledge, their

experience, and their expertise—expresses respect for survey participants,

and sets a tone that is conducive to building consensus buy-in. Describing

the specifics of the required activities—before (preparation), during (survey),

and after (follow-up and consensus meeting)—including the logistics and time

commitment, gives invitees a level of comfort that the exercise will not suffer

from ‘‘scope creep,’’ where the time and effort far exceed initial expectations.

Finally, stating the level of confidentiality up front helps establish trust.

Prepare Participants The advance communication should include four types of information to properly prepare the survey participant for the qualita-

tive risk assessment survey:

1. Inputs needed from survey participants. The advance communica-

tion should include a clear description of what survey participants will be

expected to provide during the survey; for example: & The type of key risks they should identify & The number of key risks they should provide (e.g., three to five) & The credible worst-case scenario for each key risk (this will be discussed

later; see ‘‘Key #3: Define Metrics Clearly’’) & The likelihood score for each key risk they identify & The severity score for each key risk they identify & Likelihood and severity scores for the risks identified by other survey

participants

2. ERM background. The qualitative risk assessment survey participants

have varying levels of knowledge of the ERM approach and ERM termi-

nology. To maintain a consistent level of quality in the survey, it is

necessary to provide some background information on ERM, or at least

the portion of ERM relevant to this exercise. A very brief primer on ERM

can be provided. This can be provided in various forms, such as a

132 & Risk Identification

C04 01/12/2011 10:42:28 Page 133

document, a brief video, or a brief webinar. Whatever the form, it is useful

to include the following items: & Basic outline of the ERM framework and process cycle & How the qualitative risk assessment fits into the ERM program & How information from the qualitative risk assessment will be used & ERM approach to defining risk, in general (e.g., by source) & ERM approach to defining key risks (e.g., top 20 to 30 threats) & Explanation of the company value metric & ERM terminology

3. Risks to consider. To get survey participants thinking about the poten-

tial key risks to the enterprise, it is helpful to provide them with the RCD

tool, and this should be done as part of the advance communication. This

serves two purposes: As a prompt to help participants consider key risks,

and to illustrate the ERM approach to defining risk.

As discussed earlier, the RCD tool is a catalyst to help trigger the

participant’s imagination of potential key risks to consider, as well as, at a

minimum, get them thinking about the specific risks listed in the RCD tool.

In addition to providing a reasonably comprehensive list of risk categories,

risk subcategories, risk divisions, and a good number of individual risks as

well, the RCD tool may be used to provide additional fodder. The RCD tool

may indicate the list of risks, including key risks, identified in the prior

qualitative risk assessment (if available). Finally, the RCD may also be

populated with the company’s disclosed risks, and, if available from a

comparative analysis, the disclosed risks of key competitors.

In addition, the RCD tool offers participants a clear illustration of the

proper way to think about risks. Risks are defined by source. Also, risks are

categorized at a consistent level of abstraction. Finally, risks are prospective

future events (discussed later; see ‘‘Key #5: Identify Risks Prospectively’’).

4. Definition of metrics. For the advance communication to be effective, it

must define the likelihood and severity metrics clearly. This was the third of

the five keys to successful risk identification listed earlier: Key #3: Define

metrics clearly.

Key #3: Define Metrics Clearly Survey participants are asked to consider the likelihood and severity of the potential risks, and provide these scores in the

qualitative risk assessment survey. Guidance for these qualitative metrics is

traditionally provided to participants in the form of the likelihood and severity

scoring criteria to ensure a consistent form of input from participants. A typical

example of likelihood and severity scoring criteria are shown in Table 4.4.3

Qualitative Risk Assessment & 133

C04 01/12/2011 10:42:28 Page 134

For the qualitative risk assessment results to be meaningful there must be

consistency in how it is conducted. Participants must have a consistent

understanding of the qualitative metrics and how to assign the qualitative

scores to the risks, for both likelihood and severity. Unfortunately, when

traditional criteria such as those in Table 4.4 are provided without further

clarification, participants do not have a consistent interpretation of either the

likelihood or the severity metrics. To correct this, both the likelihood and

severity metrics must be clearly defined.

Let’s begin with the qualitative likelihood metric. Participants are not

given clear guidance on how to consistently assign the qualitative likelihood

score. Participants are asked to qualitatively score the likelihood of the potential

key risk . . . but there is usually no guidance on the type of risk scenario. Each

risk can occur under a number of wide-ranging scenarios. Is it an Armageddon

scenario? Is it a ‘‘most likely’’ downside scenario? Something else? Each

participant, in considering the same risk, may be imagining, and providing

a qualitative likelihood score for, a different scenario. As a result, the qualitative

scoring of likelihood is inconsistent across participants, significantly lowering

the quality of the survey.

For example, imagine that you are a participant in the qualitative risk

assessment survey, and you have just been asked to provide a qualitative score

for the likelihood of a data breach risk event occurring. The first thing youmust

do is imagine the data breach scenario. But you are given no guidance on this.

You might imagine a disaster scenario, where an unencrypted file containing

the privacy data for all the company’s customers is stolen with intent to use it.

You might estimate that such a rare event has only a 1-in-1,000 chance of

occurring this year. Alternatively, you might imagine a moderately pessimistic

scenario, where an encrypted file containing privacy data for 1 percent of the

company’s customers is merely lost. You might estimate that this event has a

1-in-10 chance of occurring this year. Or, you might imagine any number of

TABLE 4.4 Example of Traditional Likelihood and Severity Scoring Criteria

Likelihood Severity

5 Very high 1-in-5 or greater chance of occurring 5 Very high > $200 million

4 High 1-in-10 chance of occurring 4 High $50 million–$200 million

3 Medium 1-in-20 chance of occurring 3 Medium $20 million–$50 million

2 Low 1-in-50 chance of occurring 2 Low $10 million–$20 million

1 Very low 1-in-100 or less chance of occurring 1 Very low < $10 million

134 & Risk Identification

C04 01/12/2011 10:42:29 Page 135

other risk scenarios across the spectrum of possibilities. The qualitative score

you assign to likelihood will depend entirely on your chosen risk scenario.

Similarly, other participants’ qualitative likelihood scores will depend on their

chosen risk scenarios. Without any guidance, the risk scenarios imagined tend

to vary significantly from participant to participant, rendering the survey

results practically meaningless.

A best-practice solution does exist which can correct the problems inher-

ent in a lack of guidance on what type of risk scenario to envision for the

qualitative scoring of likelihood. Instructing participants to imagine, and then

provide scores for, a credible worst-case scenario tends to ensure a reasonable

level of consistency in scoring, yet is not overly prescriptive to the point of

impinging upon survey participants’ freedom to provide their own input. A

credible worst-case scenario is not the most unlikely of events, but neither is it a

common event. It is somewhat in between, but still represents a fairly

pessimistic scenario with a severe impact. A depiction of the credible worst-

case scenario is shown in Figure 4.4.

One advantage of using a credible worst-case scenario is that it is not a

worst-case scenario that may be so unlikely as to engender a lack of confidence

in the exercise, yet it is a robust enough risk scenario to capture the full impact

Se ve

rit y

| Credible Worst-Case Likelihood

FIGURE 4.4 Credible Worst-Case Scenario

Qualitative Risk Assessment & 135

C04 01/12/2011 10:42:32 Page 136

of this type of risk. Another advantage is that this bit of guidance is flexible

enough to accommodate varying types of risks. A worst-case scenario for one

type of risk, such as technology risk, may be far more likely than a worst-case

scenario for litigation risk, yet they are both within the guidance and both may

be defined as a credible worst-case scenario, even though their consensus

qualitative likelihood scores may differ significantly.

Now, let’s address the lack of consistency involving the qualitative

severity metric and caused by traditional criteria, such as those in Table 4.4.

Typically, participants are not given a clear definition of the qualitative

severity metric. The severity criteria do provide a specific range of dollar

impacts, but they often do not clarify what is impacted. A $10 million impact

on . . . what metric? Is it the balance sheet? Is it earnings? If so, is it just this

year’s earnings or the cumulative impact over multiple years? Is it company

value? Is it revenues? Participants will have varying interpretations of this,

and as a result, the quality of the survey declines precipitously.

A best-practice solution is to clearly define the severity metric, and to

define it using a single, unifying metric, which can fully and appropriately

capture all financial impacts, including those to the income statement,

balance sheet, and cost of capital. The solution is to define the qualitative

severity metric as the financial impact on company value.4 This results in a

subtle but critical change to the severity scoring criteria shown earlier in

Table 4.4. Tables 4.5 and 4.6 illustrate two examples of value-based severity

scoring criteria.

Because most survey participants will not have a firm understanding of

the company value calculation, the ERM primer provided in the advance

communication should include a brief description. However, the company

value metric is surely intuitive—the value of the firm is something that

TABLE 4.5 Value-Based Severity Scoring Criteria: Dollar Form

Severity

5 Very high > $200 million loss in company value

4 High $50 million–$200 million loss in company value

3 Medium $20 million–$50 million loss in company value

2 Low $10 million–$20 million loss in company value

1 Very low < $10 million loss in company value

136 & Risk Identification

C04 01/12/2011 10:42:33 Page 137

everyone understands. To make the company value metric even more tangible,

it may be analogized to market capitalization, which is similar in magnitude.

This may serve the purpose, because the qualitative risk assessment survey is a

broad tool with the sole intent of approximating the relative importance of

potential key risks. Additionally, a couple of examples may be provided to

illustrate how different types of risks can impact company value.

There is another dimension to consider scoring when conducting the

qualitative risk assessment. See ‘‘Time Horizon.’’

TABLE 4.6 Value-Based Severity Scoring Criteria: Percentage Form

Severity

5 Very high > 10% loss in company value

4 High 2.5%–10% loss in company value

3 Medium 1.0%–2.5% loss in company value

2 Low 0.5%–1.0% loss in company value

1 Very low < 0.5% loss in company value

TIME HORIZON

In addition to likelihood and severity, some qualitative risk assessments usean approach where a third dimension is added to the scoring criteria: the time horizon. Qualitative risk assessment survey participants are asked to indicate whether the speed of onset corresponding to the risk is fast or slow, or whether the risk is a near-term risk event (such as in the next three years) or a long-term risk event (such as beyond three years). Although this makes the time-to-onset more explicit, this potentially complicates the interpretation of the likelihood scores. Likelihood of occurrence must correspond to a time horizon. By allowing survey participants to provide a time horizon score, survey participants may also be providing likelihoods corresponding to a variety of time horizons, some near-term and some long-term. For example, risk A may have a 10 percent chance of occurring next year, but risk B may have a 10 percent chance of occurring in 10 years. These likelihoods cannot be compared directly. The survey participant, if asked, may have estimated

(continued )

Qualitative Risk Assessment & 137

C04 01/12/2011 10:42:34 Page 138

Schedule Time There are a few factors to consider when scheduling time with survey participants. Their calendars are usually booked several weeks in

advance; these are busy people. As a result, advance planning is necessary to

avoid having a gap in the ERM implementation time line. Also, if possible, it is

more efficient to schedule all interviews sequentially, rather than having some

simultaneously, because risks identified in earlier interviews may be incorpo-

rated into subsequent interviews. Further, interviews should not be scheduled

back-to-back. An interval of time should be allotted between interviews to

clarify and document meeting notes, and to make any required changes to the

RCD tool prior to the next meeting. Finally, the period over which all the

interviews are conducted—from the first interview to the last one—should be

as short as possible, to reflect a consistent snapshot in time; as time goes by, the

environment may change, which can skew the results between those inter-

viewed prior to the change, versus those interviewed afterward. This is true

even for small changes in the environment that merely change the mood of

personnel; it is best to capture all participants’ impressions when they are in a

relatively similar point in time and frame of mind.

(continued ) the likelihood of risk B occurring in the next year to be less than 10 percent. It is not an apples-to-apples basis of comparison. Allowing a separate time horizon score can still work, but it requires combining two pieces of data, both time horizon and likelihood, to properly interpret.

An alternate approach is to capture the time horizon, but not to use it as an explicit additional dimension in the scoring criteria. In this approach, the time horizon is defined as near-term only (such as the next three years), and whenever possible, just the coming year. For the vast majority of the risks, survey participants provide the likelihood corresponding to the risk occur- ring in the coming year. For those risks not expected to occur until later years, the time to onset is captured in the credible worst-case scenario, and the likelihood corresponds to the earliest possible time of onset, but still limited to the near-term time horizon. For example, the risk of a union strikemight be considered as occurring at the next contract negotiations, scheduled two years from now. For some high-severity risks which develop slowly, over several years, the likelihood of occurrence within the near-term may be zero. These will receive the lowest likelihood score, which is fine, because they will still be accounted for through their high severity score. If the risk does not rank highly enough on a combined likelihood-severity basis to become a key risk, it will remain on the non-key risk list, and will be monitored over time as part of the emerging risk identification process.

138 & Risk Identification

C04 01/12/2011 10:42:35 Page 139

Step 3: Qualitative Risk Assessment Surveys

The third step in the qualitative risk assessment is conducting the surveys. The

last two of the five keys to successful risk identification, discussed earlier, relate

to the qualitative risk assessment surveys:

Key #4: Gather data appropriately

Key #5: Identify risks prospectively

Key #4: Gather Data Appropriately Gathering data appropriately means collecting the right data, at the right time, in the right way. Unfortunately,

most qualitative risk assessment surveys do not satisfy these criteria.

For a survey to be most effective, it must focus its requests exclusively

on the data truly needed. Survey designers are often tempted to include

some of the ‘‘nice to have’’ data, but must be ever-vigilant in identifying and

eliminating extraneous portions of the data request. Survey participants

have limited time and limited patience for unnecessary efforts. Unfortunately,

most qualitative risk assessment surveys have data requests that are far

more extensive than they need to be. These data requests include not only

some ‘‘nice to have’’ data, but also some ‘‘no need to have’’ data. An example

of such a larger-than-necessary data request commonly used in qualitative

risk assessment surveys includes the list of items shown in Table 4.7

requested for each identified risk.

TABLE 4.7 Example of Larger-Than-Necessary Data Request

Item # Data Request Item

1 Likelihood score

2 Severity score

3 Historical experience data

4 Mitigation in place

5 Mitigation planned

6 Person(s) responsible for mitigation

7 Effectiveness of mitigation

8 Name of risk owner

9 Risk and mitigation documentation

10 Other data

Qualitative Risk Assessment & 139

C04 01/12/2011 10:42:36 Page 140

Some of this data is not needed during the qualitative risk assessment,

and most of this data is actually not even needed at all in the ERM process.

The sole purpose of the qualitative risk assessment is to prioritize and rank the

potential key risks. To accomplish this, the only data needed from Table 4.7

are Items 1 and 2—the likelihood and severity scores. One additional item

not appearing in Table 4.7 is needed when employing the best-practice

approach for consistent likelihood scoring: a brief description of the credible

worst-case scenario.

Some of the remaining items in Table 4.7 are needed, but only later, during

the risk scenario development portion of the risk quantification ERMprocess step.

At this later stage, themitigation in place should be captured, which is Item#4 in

Table 4.7. The historical data experience, which is Item #3, is needed as well,

although rather than document this, it is merely drawn upon by the subject

matter expert in estimating the potential financial impacts as part of the Failure

Modes and Effects Analysis (FMEA) exercise.

There are three disadvantages of gathering this data in the qualitative risk

assessment exercise. First, as discussed earlier, making the survey longer than

necessary annoys survey participants, and inevitably lowers the quality of the

survey. In addition, gathering this information earlier than it is needed often

results in portions of it being out of date by the time it is needed; this necessitates

a repeat data request to refresh the information, which, aside from further

aggravating survey participants is also inefficient. Finally, gathering this data

too early—in the qualitative risk assessment survey rather than during the FMEA

risk scenario development interviews—results in more inefficiency, collecting far

more data than is needed. This is because it causes these data items to be collected

for all identified risks, which may be upwards of 80 to 100 risks. However, this

data is only needed for those risks that will advance to the risk quantification

process step—the key risks—which may be between 20 and 30 in number.

A more appropriate data request that is more efficient and effective

includes only the data needed at the time of the qualitative risk assessment

survey. An example of an effective data request is shown in Table 4.8, which

is requested for each identified risk.

TABLE 4.8 Appropriate Data Request

Item # Data Request Item

1 Likelihood score

2 Severity score

3 Credible worst-case scenario

140 & Risk Identification

C04 01/12/2011 10:42:37 Page 141

This data request is all that is needed to prioritize and rank the risks

identified in the qualitative risk assessment survey. Once the key risks are

identified and promoted to the risk quantification ERM process step, additional

data will be needed, but only for the key risks, which are fewer in number. At

that point, during the FMEA risk scenario development interviews, additional

data will be collected.

Now that we have discussed gathering the right data at the right time, we

will address gathering data in the right way. Although there are many

variations employed in conducting surveys, there are two basic methods

that are commonly used. One is templates and the other is interviews.

A template approach to conducting the qualitative risk assessment survey

is the more commonly used of the two survey methods. This involves sending

templates or questionnaires to survey participants and requesting that they

complete and return them. There are some advantages to a template survey:

1. 100 percent consistent communication to participants. Using a

template survey ensures 100 percent consistency in terms of what is

communicated to the survey participants. Unlike interviews, where mul-

tiple interviewers may deviate from a script, or have varying levels of skills,

a template is a controlled and uniform communication.

2. Easily scalable. Templates are easily scalable from the point of view of the

ERM team. Once the template is designed, it is nearly as easy to send it to

60 individuals as it is to send it to 30. Templates also make the collection

and compilation of data easier, from the perspective of the ERM team,

because survey participants must use a standard format within which to

populate the data requested.

Unfortunately, the template survey method has several disadvantages,

which far outweigh the advantages:

1. Not well received. Templates are not well received by survey partic-

ipants. Rather than building buy-in for the ERM program and advancing

the risk culture, they produce resistance and resentment among survey

participants. Consider their perspective. One day, they open an e-mail from

the ERM team and it is a request for data, along with a template and

instructions on how to complete it. Someone, whom they may not know,

just gave them one more task to complete. This is not a good first

impression. The instructions are lengthy, and participants feel like they

are on their own to figure it out and do all the work. This comes across as

impersonal and inconsiderate. Data requests using templates tend to be

Qualitative Risk Assessment & 141

C04 01/12/2011 10:42:37 Page 142

more extensive, because adding items to the request is easy for the ERM

team, and survey participants wonder if all this is really necessary. This

casts a shadow on the credibility of the entire ERM effort.

2. Inconsistent time and effort. There is an inconsistent level of time and

effort given to completing the templates. Some survey participants dili-

gently focus on the exercise, carefully reading the instructions, thought-

fully pondering the business and its potential key risks, and gathering all

the ancillary data requested. Other survey participants just complete it

quickly to get it done and out the door. This results in an inconsistent level

of quality in survey results. Although it is apparent when reviewing the

populated templates that the quality varies, at this point, after the fact,

there is little or no recourse for the ERM team.

3. Difficult to fix errors. Many survey participants, despite the advance

communication provided to them, are not ERM-savvy. Some participants

will identify risks that are not properly defined by source. Some will identify

risks that are clearly not key risks. Others will identify risks that are too

detailed or not detailed enough. Some will identify risks that are retrospec-

tively focused (discussed later; see ‘‘Key #5: Identify Risks Prospectively’’).

Many will misinterpret the definition of ERM metrics and improperly score

the qualitative likelihood and severity metrics. Correcting these errors may

not be feasible for the ERM team, or, at a minimum, will require much

iterative effort.

4. Less confidential. Templates are usually conducted on a nonconfiden-

tial basis. Confidentiality can be achieved with templates, but the nature

of completing documents with names attached and sending them to

another department makes anonymity more difficult to ensure, and offers

survey participants less comfort. As a result, the free flow of information

suffers, and some of the most important risks may remain hidden or

underemphasized.

Rather than use templates, the best-practice method for conducting the

qualitative risk assessment survey is through interviews. First, let’s address the

shortcomings of this method:

1. Less than 100 percent consistent communication to participants.

Unlike the template approach, when using interviews, it is more difficult to

maintain 100 percent consistency in terms of what is communicated to the

survey participants. However, this can be mitigated in one of two ways.

One way is to use a small number of interviewers with similar levels of ERM

142 & Risk Identification

C04 01/12/2011 10:42:37 Page 143

training, experience, and expertise, and having them stay in close com-

munication. Another way is to use just one interviewer, which is feasible

given the reasonable number of interviewees. Though this lengthens the

time required to complete the qualitative risk assessment, the trade-off may

be worthwhile, assuming time constraints allow this.

2. Not as easily scalable. Interview surveys are not easily scalable. To

survey more participants requires more time or more qualified inter-

viewers, and adding more interviewers lowers the consistency of messag-

ing, as discussed earlier. However, this is a minor issue. The scalability of

templates is only gained at the expense of quality. In addition, for most

organizations, 25 to 35 survey participants are usually enough to produce

robust survey results.

Now, let’s discuss the advantages of using interviews as opposed to

templates:

1. Well received. Unlike the template approach, the interviews are well

received by survey participants. Conducting interviews tends to build

buy-in for the ERM program and advance the risk culture. It builds good

will with survey participants. Unlike templates, which feel like an

impersonal request to do work on behalf of the ERM team, the interview

is personal—a face-to-face, one-on-one interaction.5 This gives a good

first impression. Rather than leaving survey participants stuck to figure

out the instructions on their own and do all the work, the interviewer is

present, spending his or her time as well; this is a highly personal

approach. The interviewer reiterates highlights from the advance com-

munication, answers any questions, and dynamically guides the survey

participant through the interview. In addition, rather than requiring the

survey participant to populate a template themselves, the interviewer

takes notes, documents the interview in a set of minutes, and sends them

to the interviewee to confirm accuracy. This creates an atmosphere of

collaboration, and is respectful of the survey participant’s time. Finally,

data requests using interviews tend to be more focused, because adding

items to the request would make more work for the ERM team as well,

and survey participants appreciate the minimalist attitude. This enhan-

ces the credibility of the ERM effort.

2. Consistent time and effort. Using interviews compels a more consistent

level of time and effort by each survey participant. Unlike templates, where

the ERM team is not present to verify the level of care used to complete the

Qualitative Risk Assessment & 143

C04 01/12/2011 10:42:37 Page 144

survey, the ERM teammember is present during the interview, and ensures

that a consistent level of effort is put forth for each survey. This consistency

enhances the quality of the survey results.

3. Easy to fix errors. Interviews provide an opportunity to compensate for

the lack of ERM-savvy among many survey participants. Interviewers can

dynamically correct any errors immediately, during the interview.

Whether someone fails to identify a risk by its source, identifies risks

that are too detailed or not detailed enough, identifies risks that are

retrospectively focused, or misinterprets the definition of ERM metrics,

the interviewer is present to correct it on the spot. This significantly

enhances the quality of the exercise, and is also highly efficient, eliminating

the need for iterative corrections.

4. More confidential. It is easier for interviews to be conducted on a

confidential basis, meaning that survey results are not attached to partici-

pant names, but merely reported anonymously. Compared to templates, a

personal, one-on-one, closed-door interview, where only one set of notes

exists, is easier to conduct on a confidential basis. More importantly, survey

participants feel more confident in the anonymous nature, become more

relaxed, and, as a result, tend to share more information. In particular,

they are most likely to identify risks which are not usually discussed

openly, and these kinds of risks can be of the most value in this exercise.

Ideally, the interviewer is not an employee but rather a consultant, which

offers an even higher level of anonymity.

Key #5: Identify Risks Prospectively The last of the five keys to successful risk identification is to identify risks on a prospective basis during the

qualitative risk assessment. This may seem obvious. Certainly, risks are not

in the past, but in the future. Risk is the uncertainty of achieving our future

goals. However, there are usually some risks that appear which are actually

retrospectively identified, in that they are rooted in the past. This problem is

commonly diagnosed as ‘‘fighting the last battle’’ syndrome. Continuing the

medical analogy, the underlying cause of this disease is an overemphasis,

during the qualitative risk assessment, of recent past risk occurrences. This is

often present when a recent past event caused significant trauma to the

organization, hemorrhaging in the financial results, and psychological scar-

ring tomanagement. Themain symptom is the appearance of identified risks in

the qualitative risk assessment that seem overly specific in nature, that

precisely match the source of risk that caused a recent negative event still

etched in management’s collective consciousness, and that are often already

144 & Risk Identification

C04 01/12/2011 10:42:37 Page 145

well mitigated, possibly even over-mitigated. Despite this being a past event,

management is simply not comfortable unless such risks appear on the risk list.

The prognosis of this disease, if left untreated, is that the qualitative risk

assessment scoring will be skewed, overemphasizing risks with recent occur-

rences. In addition, the inclusion of these risks, many of which should be

excluded, can crowd out some other risks that should be on the radar.

When a risk is suspected of being identified on a retrospective basis, some

simple questioning can be helpful. Ask about the past events that may have

caused this risk to be overweighted in the mind of the survey participant.

What was the event? What were the financial impacts? What did manage-

ment do in response? What mitigation is in place to lower the likelihood or

mitigate the severity of this risk? If the inquiries confirm suspicions that this

risk may not belong on the risk list, presenting the case for its removal to the

participant who raised it may resolve the issue. If not, there are two other

opportunities to resolve this issue: the other participants may not score it

highly, or this may be resolved by raising and addressing the issue at the

consensus meeting.

In addition to the two keys to successful risk identification related to the

qualitative risk assessment survey—Key #4: Gather data appropriately and

Key #5: Identify risks prospectively—there are additional techniques that are

helpful. See ‘‘Additional Techniques’’ for two examples.

ADDITIONAL TECHNIQUES

There are two additional techniques that are helpful when conducting thequalitative risk assessment surveys: 1. Collect two perspectives. The first technique is simply to ask survey

participants to identify potential key risks from two perspectives: the overall enterprise perspective and the perspective pertaining just to their area of responsibility or expertise. Getting survey participants to look from both of these vantage points adds value to the survey. Participants with areas of responsibility or expertise that are not enterprise-wide can identify potential key risks related to their areas of specialty, and they can also bring a fresh perspective that may highlight new potential key risks for the overall enterprise. Consider an example where the survey partici- pant is the head of a business segment. Although most risks that are significant to a single business segment may not rank highly from the

(continued )

Qualitative Risk Assessment & 145

C04 01/12/2011 10:42:38 Page 146

(continued ) enterprise perspective, some do rank highly. For example, a risk origi- nating within a single business segment can impact other business segments or the enterprise as a whole. In addition, a participant usually focused on a single business segment may bring a bit of an ‘‘outsider’’ perspective when viewing the overall enterprise, and may identify an important potential key risk that, once identified, receives a high consen- sus ranking in the qualitative risk assessment.

2. Use a retrospective-outcome provocation. Earlier, we discussed the importance of employing five keys to success when conducting the qualitative risk assessment. We will now briefly discuss a technique that temporarily seems to violate two of these: Key #1: Define risks by source, and Key #5: Identify risks prospectively. It is important to follow these keys for best results, but it is also helpful to step outside of these rules, for a brief moment, to allow for a provocation from a different perspec- tive that may help identify risks as yet uncovered. Although it is always important to categorize and define risks prospectively and by source, and initially ask survey participants to think of risks prospectively and by source, sometimes this may not capture all the known risks, because this is not the usual way in which people think. Toward the end of the survey, once you have captured all the risks

that you can with this ‘‘prospective-source’’ approach, it is helpful to switch, temporarily, to a ‘‘retrospective-outcome’’ approach, using the following provocation: Ask the participant questions such as, ‘‘In the past, what events resulted in a large decrease in revenues? In earn- ings? In company value?’’ These types of questions are more tangible and will lead to very specific discussions. For each such discussion, you must trace the story provided by the survey participant back to the event’s originating source of risk. This reverses the outcome-driven aspect of the provocation, and we arrive, once again, at the source of the risk. Once this is done, you can compare the risks identified by the provocation to the initial list of risks provided by the participant and by others to determine if this technique results in any newly identified risks. For any such newly identified risk, the next step is then to examine whether it is a viable prospective risk, which reverses the retrospective-driven aspect of the provocation. Those risks that ad- vance past both of these reversal stages are then added to the potential key risk list and will be included in the remaining individual surveys, as well as the consensus meeting. One cautionary note for the retrospective-outcome provocation:

Use it judiciously. It should only be used with survey participants who are ERM-savvy and have more immunity to the ‘‘fighting the last battle’’ syndrome.

146 & Risk Identification

C04 01/12/2011 10:42:38 Page 147

Step 4: Consensus Meeting

The fourth and final step in the qualitative risk assessment is the consensus

meeting. The qualitative risk assessment survey produces a list of risks that

typically number in the range of 80 to 100, each of which is scored by both

likelihood and severity. The next step is the consensus meeting, which includes

all survey participants and relevant members of the ERM team. The consensus

meeting has two purposes:

1. Enhance consensus

2. Select key risks

Enhance Consensus The first goal of the consensus meeting is to enhance the level of consensus for qualitative scores, either for likelihood or severity,

which meet both of the following conditions:

& Scoring data has a high level of dispersion & Scoring data corresponds to a risk with a high ranking

The reason for selecting scores with a high level of dispersion is that those

are the scores for which there is not a strong level of initial consensus. The

reason for limiting the focus to those with high rank is to be respectful of survey

participants’ time. The main purpose of the risk identification exercise is to

identify the key risks. The key risks will be those 20–30 or so risks that have the

highest rank. Enhancing consensus on all risks is nice to have, but this is only

necessary for scores corresponding to risks ranked highly enough that they

might become key risks.

To determine which scores meet both of these criteria, the ERM team must

perform the following three tasks:

1. Define the risk-ranking criteria. The ERM team must define the risk-

ranking criteria. The risk-ranking criteria are either rules or guidelines

for combining the qualitative likelihood and severity scores into a single

number which is used to rank all the risks identified in the qualitative risk

assessment. The first step is often to convert the qualitative scores into

numeric scores. An example of a nonproportional conversion is shown

in Table 4.9.

Another approach is to use a conversion scale proportional to the

actual relative values from the midpoint of the ranges in the scoring

Qualitative Risk Assessment & 147

C04 01/12/2011 10:42:38 Page 148

criteria, an example of which was shown in Table 4.4. The conversion

for the highest score must be made somewhat arbitrarily, because it has

no upper bound. An example of a proportional conversion is shown in

Table 4.10.

There are numerous methods for defining the risk-ranking criteria.

One set of methods involves weighting each nonproportional numerical

score separately and then adding them together. Usually, the weights are

either equal—producing a straight summation of the two numerical

scores—or a higher weight is assigned to the severity scores. Another

method involves multiplying the proportional numerical scores together.

This is equivalent to calculating a probabilistic expectation. Another

TABLE 4.9 Example of Nonproportional Conversion of Qualitative to Numeric Scoring

Qualitative Score Numerical Score

Very High 5

High 4

Moderate 3

Low 2

Very Low 1

TABLE 4.10 Example of Proportional Conversion of Qualitative to Numeric Scoring

Qualitative

Likelihood

Score

Numerical

Likelihood

Score

Qualitative

Severity

Score

Numerical

Severity

Score

1-in-5 or greater chance of occurring

25% > $200 million loss in company value

$250 million

1-in-10 chance of occurring

10% $50 million–$200 million loss in company value

$125 million

1-in-20 chance of occurring

5% $20 million–$50 million loss in company value

$35 million

1-in-50 chance of occurring

2% $10 million–$20 million loss in company value

$15 million

1-in-100 or less chance of occurring

0.5% < $10 million loss in company value

$5 million

148 & Risk Identification

C04 01/12/2011 10:42:40 Page 149

method first excludes all risks not meeting a minimum numerical score

for likelihood or severity; the likelihood minimum may be different from

the severity minimum. Yet another method is to plot the average

likelihood and severity scores on a graph and draw a line or a curve

separating out the 20 to 30 risks with the higher scores; an example of

this will be shown later.

2. Rank the risks. The ranking criteria are applied to the risks identified in

the qualitative risk assessment to produce a tentative ranking. The ranking

is reviewed for reasonability by the ERM team, and any odd results are

noted and discussed at the consensus meeting. One example of an odd

result would be a risk that received a low ranking whereas the ERM team,

based on their extensive experience, would have expected it to receive a

high ranking.

3. Conduct a dispersion analysis. A dispersion analysis is performed on

both the likelihood and severity scores to identify any scores for which

there is not a clear initial consensus. These scores are identified by a high

level of dispersion, and generally appear in one of two forms—bimodal or

highly disparate. A bimodal result indicates two distinct opinions within

the group of participants. For example, consider a risk for which survey

participants scored the severity as shown in Figure 4.5. There is clearly not

a single consensus among participants, but rather two distinct clusters of

votes; one group of participants thinks the severity is low but another

group believes the severity is high.

0

2

4

6

8

10

12

14

Very Low Low Moderate High Very High

Pa rti

ci pa

nt s

Severity Scores

FIGURE 4.5 Bimodal Results

Qualitative Risk Assessment & 149

C04 01/12/2011 10:42:46 Page 150

A highly disparate result indicates that there is no consensus at all.

For example, consider a risk for which participants scored the severity as

shown in Figure 4.6. There is no consensus at all among the participants.

Now, the ERM team is in a position to determine which scores meet both of the

criteria specified earlier: scores with a high level of dispersion and that

correspond to a risk with high ranking. The first goal of the consensus meeting

is to examine these results, discuss them, and conduct a second round of

scoring. The discussion is voluntary when the qualitative risk assessment has

been performed with a cloak of anonymity. However, the anonymity is mainly

about who identified which risks, rather than the scoring. It is helpful to solicit

at least one or two opinions from each camp for the bimodal results. More

opinions may need to be brought out for the highly disparate results. A brief

discussion usually resolves some differences in the group, and the second round

of scoring usually produces a tighter consensus.

Select Key Risks Once the level of consensus has been enhanced to the extent possible, the qualitative scores and the resultant rankings are finalized.

The main event can now take place: identifying the key risks. Attendees of the

consensus meeting review the rankings, discuss the highly ranked risks, and

decide on where to delineate between key and non-key risks. The cutoff point

should be in the neighborhood of the 20 to 30 most highly ranked risks. One

0

1

2

3

4

5

6

7

Very Low Low Moderate High Very High

Pa rt

ic ip

an ts

Severity Scores

FIGURE 4.6 Highly Disparate Results

150 & Risk Identification

C04 01/12/2011 10:42:50 Page 151

example of how this is conducted is illustrated in Figure 4.7. Those risks to the

upper right of the line are the key risks. Attendees of the consensus meeting

must decide where, literally, to draw the line: how far to the upper right versus

lower left to draw it, and also at what angle to draw it.

Product

There are three main results, or products, of the qualitative risk assessment.

The first and most important is the key risk list. The second is the tool to

monitor any potential changes in the importance of any of the risks. Both

of these products follow the format of the RCD tool. The third result is an

advancement of the organization’s risk culture. The qualitative risk assess-

ment has involved key personnel from all corners of the enterprise, and

enhanced their knowledge of, and experience with, enterprise risk manage-

ment. This is one of the first steps in developing consensus buy-in for the

ERM program.

An example of a key risk list is shown in Table 4.11. There are three

important characteristics of the key risk list. First, it is a short list—the

example shown has just 20 key risks. Second, it follows the consistent

hierarchical format and nomenclature of the RCD tool. Third, and surprising

to some, it does not include the likelihood-severity scores. It has shed them.

The reason for this is that the likelihood-severity scores are only useful in

helping to identify the key risks. That was their sole purpose, and that has

now been achieved. Going forward, the ranking of the key risks will no longer

1

2

3

4

5

1 2 3 4 5 Likelihood

Se ve

rit y

FIGURE 4.7 Example of Selecting Key Risks

Qualitative Risk Assessment & 151

C04 01/12/2011 10:42:51 Page 152

TABLE 4.11 Example of Key Risk List

Rank

Risk

Category

Risk

Subcategory

Risk

Division Risk

1 Strategic Legislative/ regulatory

Product/services- related

Product Y impacted by new regulation

2 Strategic Economic Economic risk U.S. economic downturn

3 Strategic Supplier Supplier failure Supplier partial failure

4 Operational Human resources

Talent management

Loss of critical employees

5 Strategic Strategic relationships

Joint ventures and alliances risk

Joint venture risk

6 Strategic Execution M&A risk International M&A risk

7 Strategic Execution Product execution risk

Product quality risk

8 Strategic Competitor Struggling competitor(s)

Price war

9 Strategic Supplier Supplier relationships

Cost of goods/services increases

10 Strategic Strategy Channel strategy risk

Change in performance of intermediaries

11 Strategic Competitor Innovation Competitor introduces new features

12 Operational Human resources

Performance Research & development (R&D) risk

13 Operational Human resources

Talent management

Labor relations risk

14 Operational Disasters Environmental damage

Environmental damage at Site X

15 Operational Litigation Litigation risk Class action lawsuit

16 Strategic Supplier Supplier relationships

Change in status of regulatory licenses

17 Strategic Strategy Channel strategy risk

Distribution channel risk

18 Operational Technology Data security and privacy

External attack

19 Operational Human resources

Talent management

Inability to recruit enough to support growth plans

20 Financial Credit Counterparty risk Change in creditworthiness of counterparties

152 & Risk Identification

C04 01/12/2011 10:42:51 Page 153

be based on the qualitative scores. The key risks are now advanced to the risk

quantification ERM process step, which provides quantitative metrics—a far

superior tool for prioritization and ranking.

The second product—the tool to monitor any potential changes in the

importance of any of the risks—is simply the entire list of risks from the

qualitative risk assessment. This list retains the likelihood-severity scores. This

is used in the ongoing emerging risk identification work, discussed next.

EMERGING RISK IDENTIFICATION

Emerging risk identification consists of two components:

1. Monitoring known risks

2. Environmental scanning for unknown risks

Monitoring Known Risks

The first component of emerging risk identification is to monitor known non-

key risks for any changes which might increase their ranking enough to

become key risks. There are two aspects to this. One aspect is monitoring any

changes in the internal and external environment that would make the risk

event more likely to occur. Another aspect is monitoring changes that would

increase the severity of the risk event. Monitoring for severity changes is

sometimes supported by conducting limited quantification exercises for these

risks. These exercises must be kept to a limited effort, because there are a large

number of identified non-key risks, often in the range of 50 to 80. One way to do

this is to simply take the credible worst-case scenario obtained in the qualitative

risk assessment and quantify that one scenario for each non-key risk, or, more

feasibly, for selected non-key risks.

Monitoring known risks is a reasonably straightforward and doable

exercise. It consists of targeted monitoring of a limited and defined set of

risks—those identified in the qualitative risk assessment. As mentioned earlier,

the RCD tool, which houses these risks, is used for this purpose.

Environmental Scanning for Unknown Risks

The second component of emerging risk identification is environmental scan-

ning for unknown risks. Unlike monitoring known risks, this task is not at

Emerging Risk Identification & 153

C04 01/12/2011 10:42:51 Page 154

all straightforward and can never be completed. There is no definitive science

for identifying unknown risks. In addition, the sources of potential risks that

someday might become key risks are virtually limitless.

Unfortunately, a common and dangerous misconception of ERM is that it

can indeed effectively perform environmental scanning for unknown risks,

and afford a good level of protection against such surprises. This false belief is

partly fostered by the fact that these types of risks are the most feared. The

sudden emergence of a risk event that takes us by surprise is a primal fear.

The fact that many people hold the false belief that ERM can protect them

from unknown risks is evidenced by the fact that chief risk officers are often

fired after a major risk event occurs. This would be warranted in cases where

the ERM program was poorly designed or implemented and where the risk

event that materialized was one that should have been known, more highly

prioritized, or more effectively mitigated. Although some firings have taken

place under these circumstances, this has not always been the case. In these

other cases, either senior management falsely believed that ERM can protect

the firm from unknown risks, or they believed that shareholders hold such

a fantasy.6

It is an inescapable truism of our existence that we will always be

exposed to the element of surprise. ERM is not designed to prevent unknown

events from emerging that can damage or even destroy the organization, nor

could it, or any other system, be so designed. It is critical for the CRO and the

ERM team to set proper expectations right from the start of ERM adoption and

implementation. ERM cannot predict the future. It cannot know the un-

known. All it promises is to make better sense out of how we make risk–

reward decisions, and to organize and leverage information about the risks

we do know about.

Unfortunately, because we, as humans, have such a high utility for

avoiding negative surprises, we are tempted to believe those who present a

system that can make us safe. Naturally, there are those that prey on these

temptations, claiming that they have a system capable of identifying un-

known risks. They often present elaborate and esoteric methods and claim

that advanced mathematics can capture hidden information, leading to

better identification of unknown risks. The seduction of such promises

must be strongly resisted. Any system that involves the randomness of

human behavior, such as your business does, can never be reduced to an

automatic mathematical system that can determine unknown risks. Upon

close examination, the faScade of these approaches always falls away to reveal a delicate array of assumptions that must be constructed by the subject

154 & Risk Identification

C04 01/12/2011 10:42:52 Page 155

matter experts to begin with. This leads right back to your people and their

best guesses regarding unknown risks.

Knowing all this, we must resign ourselves to the fact that all we can do

is institute a simple approach in attempt to discover unknown risks as early

as possible. Therefore, this component—environmental scanning for un-

known risks—is a more mundane but realistic approach: conducting vigilant

advance scouting for risks that are not currently on the risk list but that

might suddenly become key risks. This consists of one or more of the

following activities to gather information and intelligence from multiple

sources:

& Attend industry conferences & Research industry journals & Serve on industry committees & Conduct comparative analysis of competitors’ disclosed risks & Read ERM surveys & Make other investments in information and intelligence gathering

KILLER RISKS

There are two particular types of risks that warrant highlighting separately

because of their special nature. These risks share three qualities. They are:

& Politically difficult to introduce & Easily identifiable & A leading indicator of high-severity risk events

Two such risks which we will discuss are arrogance and concentration

risk.

Arrogance

Let’s discuss each of the qualities listed earlier, and then briefly examine

possible risk mitigation.

Politically Difficult to Introduce

Arrogance, whether present in one particular business segment or a char-

acteristic shared enterprise-wide, is certainly a difficult risk to mention to

Killer Risks & 155

C04 01/12/2011 10:42:52 Page 156

management. Who likes to hear that they are arrogant? Even more rele-

vant, who likes to be the one to have to tell someone else that he or she

is arrogant? To suggest such a risk internally is tantamount to challenging

the culture within the organization: not a happy prospect for a corporate

employee.

Easily Identifiable

Another seemingly difficult aspect of this risk is recognizing it in the first

place. What company has the collective clarity and objectivity to recognize

that they are arrogant, as well as the level of maturity to admit it? Fortunately,

arrogance is easily identifiable. The companies or areas that exude arrogance

are usually those that have some basis for it, such as having achieved external

recognition of their superiority. They may have dominant market share,

awards for quality or innovation, or something similar. Internal talking points

are often laced with evidence that there is a belief in their own superiority.

There may be an undue amount of fanfare and celebration of achievements,

which is noticeable by its excess. Thismay also take the form of self-satisfaction

or a lack of self-criticism. This is combined with a dismissive attitude toward

competitive analysis, fueled by the belief that all eyes are on them and that

nothing can be learned from the competition. This can be easily observed as

a lack of participation on industry committees or shrinkage in the budget for

competitive analysis. In addition, there is a marked tendency to overestimate

their strengths and underestimate weaknesses. This can be seen by exami-

nation of the strengths, weaknesses, opportunities, and threats (SWOT)

analysis performed as part of the strategic planning process. Finally, it is often

apparent to those outside the organization or business area that there is

an attitude of arrogance present, and a simple inquiry with external parties

can quickly identify the presence of this risk.

Conversely, it is often easy to spot the companies that do not succumb to

arrogance. They may be leaders in their field but they are never satisfied.

They are always examining what they can do better. They still fear the

competition. They are never complacent. A good illustration is from the

sports world. The team that is excellent but not arrogant has a relentless

focus on areas to improve. Even after a victory by a wide margin, the coach of

such a team will remain focused on what they can do better next time.

Rather than strut or crow about a victory, the team is humble and vigilant,

which is, in part, what keeps them on top.

156 & Risk Identification

C04 01/12/2011 10:42:52 Page 157

A Leading Indicator of High-Severity Risk Events

Arrogance is a leading indicator of one or more high severity risk events. This is

a risk that can do much damage, and often does. This is a natural recurring

cycle that is visible in organizations, in people, and even in countries that

achieve some level of success. The organization begins by struggling to survive.

After a while, it becomes competitive and eventually starts to excel. Eventually,

it gets to the top and begins to really dominate its field. This is where arrogance

can take hold. When it does, it is a leading indicator of failure. This cycle is

exhibited in Figure 4.8.

When arrogance takes root, it can sprout many different types of risk

events. Arrogance is like dropping one’s guard. Once you unknowingly drop

your guard, attacks can come in any form. One example is that it might lead to

a lack of innovation in developing products and services. Another example is

that it might lead to a feeling of entitlement which encourages bad behavior or

abuses by management.

Possible Risk Mitigation

The cycle illustrated in Figure 4.8 is not inevitable. Even for those organizations

or areas already suffering from arrogance, if this is identified in time and

properly treated, it can be corrected. Sometimes, this is only possible after an

embarrassing and public incident that hints at the fact that the organization or

area may be slipping off its perch, and gets people murmuring.

One example of this is the United States, which, after victory in World

War II, had arguably entered into a phase of arrogance, leading to

Time

Su cc

es s

Struggle

Excel

Dominate Arrogance

Failure

Compete

FIGURE 4.8 Arrogance Is a Leading Indicator of Failure

Killer Risks & 157

C04 01/12/2011 10:42:53 Page 158

complacency. In 1957, Russia, the main adversary of the United States at

that time, was first into space with a satellite called Sputnik. This was a wake-

up call for the United States. Through appropriate recognition of the problem,

an ability to admit it publicly, and strong leadership by President Kennedy,

the United States enhanced its math and science curriculums and reinvigo-

rated its space program. As a result, the United States was able to regain a

competitive position in space exploration and related technologies.

Addressing this risk directly is unlikely to succeed. One way to approach

it is to focus attention on the weaknesses resulting from the behavior without

having to mention the behavior itself. An example is to challenge whether

the organization is performing enough competitive analysis. This can be ad-

dressed either directly through the business segments, or indirectly through

the ERM team, via the emerging risk identification exercise. Another example

is to challenge the amount of benchmarking being performed where results

are measured against key competitors. This can help get the culture back a

quantum of realism, and get away from an insular attitude.

Concentration Risk

Concentration risk is another risk that warrants special attention. First, we

must define it. One popular definition of concentration risk is a lack of

diversification in the investment portfolio, resulting in too much risk exposure

in one area. A common example is a high percentage of assets invested in one

particular asset class, such as real estate in one location. Another example is a

concentration of a bank’s loans in one industry sector.

Technically, this definition does not conform to the approach discussed

earlier in this chapter for properly defining and categorizing risks by source.

The level of concentration is no more than an expression of the level of

exposure of a given source of risk. For example, concentration risk related to

equities is properly defined and categorized as equity market risk, where the

concentration aspect of this risk merely points up a concern for the level of

equity market risk exposure.

Nevertheless, we will temporarily depart from our convention of catego-

rizing and defining risks by source, but only for the purposes of discussing a set

of risks that meet our definition of killer risks. However, we will not define

concentration risk in terms of poor diversification of investments. Rather, we

will define concentration risk here as an unhealthy level of internal or external

concentration of power. Power can take many forms, including authority,

information, access to markets, and so on.

158 & Risk Identification

C04 01/12/2011 10:42:53 Page 159

There are two types of power concentration risks: internal and external.

There are numerous examples. We will first discuss two internal examples

followed by three external examples.

1. Rainmaker. A rainmaker is an individual or group that achieves out-

standing results; for example, growing revenues or profits. One example of

a rainmaker power concentration risk is a ‘‘golden boy’’ unit, described in

Chapter 2, which generates such a high level of revenues or profits that its

authority appears to be above the rules.

2. Mastermind. Amastermind is someone who stands out in terms of his or

her intellectual abilities. There are two main types of mastermind power

concentration risks. One is an executive with an entire fiefdom, and the

other is a sole individual, perhaps in middle management.

3. Critical Supplier. A critical supplier is a provider of a necessary set of

goods or services operating in a supplier market without a sufficient level of

competition. An extreme example is a sole-source supplier, which means

there is currently only one active supplier with which the organization

currently has, or is able to have, a business relationship.

4. Large Customer. A large customer is one that represents a significant

portion of the business. One example is a large customer of the organiza-

tion’s core business. However, another example is a minor business

segment’s customer that is so large that its loss could significantly damage

the business and possibly destroy it.

5. Large Distributor. A large distributor is one that controls a significant

portion of the customer’s access to its markets. As with the large customer

situation, this can either relate to a significant portion of a core business,

or a large enough portion of a non-core business such that its loss could

be catastrophic for that business.

Let’s again discuss each of the qualities listed earlier for killer risks, and

then briefly examine possible risk mitigation.

Politically Difficult to Introduce

Clearly, the internal power concentration risks are also politically challenging to

bring up. By definition, you are threatening a very powerful entity. Their

demonstrated abilities in amassing power prove them to be formidable players.

Though external power concentration risks are usually politically easier to

discuss, these can sometimes be treacherous as well; these external entities may

have internal allies with a vested interest in maintaining the status quo.

Killer Risks & 159

C04 01/12/2011 10:42:53 Page 160

Easily Identifiable

There is one easily recognizable characteristic that virtually always accom-

panies any concentration of power, including our five examples: arrogance.

The lack of competition leads to an arrogant attitude, which was discussed

earlier as its own killer risk.

Rainmaker Everyone is aware of the rainmakers in the organization, the special treatment they receive, and the financial rewards lavished on them.

They often have a peacock-like attitude, which makes them nearly impossible

to ignore.

Mastermind Masterminds are highly respected and widely known internally, and often externally, for their knowledge and skill in a specific area of expertise.

Ironically, this risk is often evident by its highly prized nature. It is often touted as

an advantage. Management often feels proud of their mastermind. They feel

comfortable knowing they have this reliable and valuable resource. Yet, having

so much to lose, all in the person of one individual, is itself a risk.

Critical Supplier Management is well aware of their critical suppliers, particularly the sole-source suppliers. Supply chain management is part and

parcel of routine management activities.

Large Customer Large customers are not hard to identify. Management is aware of the large customers of its core businesses, and will often visit with

them to maintain the relationship. Customers large enough to be significant

to individual business segments are top-of-mind to local management, and a

list of them can easily be obtained.

Large Distributor Similar to large customers, large distributors are well known internally, either at the executive or local management level.

A Leading Indicator of High-Severity Risk Events

All power concentration risks are leading indicators of potential high-severity

risk events. The higher the concentration of power, the more severe the

ultimate risk event can be.

Rainmaker There are countless stories of rainmakers, either individuals or groups, that emerge, become highly successful for a time, and then crash and

160 & Risk Identification

C04 01/12/2011 10:42:53 Page 161

burn, sometimes taking the organization with them. The Financial Products

division of AIG is only one recent example. Generating huge growth for AIG

through its sales of credit default swaps (CDSs), the Financial Products division

used this power to ignore internal phone calls from corporate personnel

responsible for oversight . . . until the division bankrupted AIG through mas-

sive losses, contributing to the global financial crisis that began in the United

States in 2007. The natural progression of these types of stories often seems to

be in three steps:

1. Recognition of talent

2. Massive, rapid growth

3. Implosion

Initially, the rainmaker talent is identified by its early success. It is the next

step that fuels the high-severity nature of this power concentration risk.

Growth is difficult to achieve. It is management’s excitement at the prospect

of dramatic growth that leads them to quickly scale up a business producing

dramatic results. Blinded by the potential rewards, they often either ignore the

risks, or, more commonly, they do not thoroughly examine the risks. This urge

to grow quickly is what transforms a simple risk into a killer risk. Often, the

more inordinately large the returns, the more everyone wants to believe that

this is a good business to expand, and yet, the more likely it is that the risks are

also inordinately large.

Just as with arrogance, when a concentration of power exists, it can

result in manifold types of risk events. The risks involved with rainmaker

individuals or groups are mainly a lack of scrutiny, transparency, and

accountability, which encourages bad behaviors or abuses by management.

The normal checks-and-balances of power, such as internal audit or an

ERM program, are not permitted to properly monitor the goings-on within

the unit. Sometimes the high-severity risk event takes the form of internal

fraud or theft. In the aftermath of an investigation uncovering such events,

and the ensuing criminal prosecution, it is common for the perpetrators of

the crime to convey feelings of entitlement that led them to believe the

normal rules did not apply to them. In many cases, this is such a compelling

factor leading to the crime, that even after a criminal conviction, the

wrongdoers rationalize that their contribution to the company entitled

them to what they usurped.

Other times, this takes the form of excesses in terms of perquisites.

Management is often overly trusting of rainmakers, giving them anything

Killer Risks & 161

C04 01/12/2011 10:42:53 Page 162

and everything they desire. Once exposed, these excesses can lead to negative

media coverage, potential reputational damage, and the resultant negative

financial impacts.

In addition, the sheer nature of the pressure to continue to perform at a

consistently miraculous level can lead to excessive risk taking or even outright

fraud. It is human nature to want to avoid falling off from a peak performance

period, which means losing the high level of recognition and financial rewards.

Sometimes, this leads to desperation and an at-all-costs mentality to maintain

personal status.

Mastermind Masterminds are also common; most companies have at least one. The existence of a midlevel manager mastermind is not as risky as an

executive mastermind with a fiefdom. A larger level of responsibility leads to a

higher level of risk severity. The high level of dependency the organization

has on this individual can lead to an imbalance in leverage, resulting in

similar risks as with the rainmaker: a lack of scrutiny, transparency, and

accountability, which can lead to bad behavior or abuses by the mastermind

or his or her staff. Another example of risk exposure is a sudden and hard-to-

fill vacuum in this area of expertise should the mastermind fall ill, pass away,

or retire. Worse still, this can also lead to competitive risk if the mastermind

is lured away by a competitor. An example will help illustrate the level of

potential damage.

A Fortune 500 company was very proud of their chief financial officer

(CFO). He was well known in the industry. He was highly respected

internally. He was a high performer. The company considered him a

competitive advantage, and thought they were getting quite a lot for their

money. They were aware, however, that his interpersonal skills chased away

many others with whom he worked. He was very arrogant and often verbally

abusive of others. Nevertheless, the company figured he was well worth the

trade-off.

One day, the CFO left the company. He retired. In addition to the large

hole he left in the CFO position, the company learned, over time, that

there were many other holes. The CFO didn’t like to be challenged, and

filled all his supporting positions with weak players. When the CFO retired,

the entire department virtually collapsed. Several of the individuals simply

could not perform their jobs without the prior CFO around. Many projects

languished for months or years. It took the company several years to fully

recognize what had happened and to effectively repair and rebuild the

department.

162 & Risk Identification

C04 01/12/2011 10:42:53 Page 163

Critical Supplier A power concentration in a single critical supplier exposes the organization to high-severity risk events. Three examples are

discussed here. The first example is a temporary loss of the critical supplier’s

capacity, for example, due to a fire. This can result in a temporary inability to

sell goods and services and/or a temporary failure to adequately serve the

existing customer base or even honor contractual commitments. This can

result in decreased revenues due to a lack of sales for a period of time, and

increased expenses due to attempts to work around the situation or due to

litigation. An even more damaging possibility is a permanent loss of mar-

ket share due to reputational impacts: The market may interpret the event

not as a one-time incident, but as an instability in the organization or its

management.

The second example is a permanent loss of a sole-source supplier. Where

other suppliers are available, it may take a while to establish a business

relationship. This down time can result in the same financial impacts described

earlier for the temporary loss example. In addition, expense margins will

increase further due to the lack of negotiating leverage with the new supplier.

However, in some cases, a backup supplier simply may not exist. This may

require a major change to the goods or services sold by the company, which

can dramatically exacerbate the severity of the event.

The third example involves a supplier to whom the company has

extended a large amount of credit, or who holds a large amount of company

assets. One recent example of such a situation has the distinction of also

satisfying our definition of both a rainmaker and a mastermind, except that it

was not an internal entity. For decades, Bernie Madoff supplied asset

management services to companies as well as individuals. For many inves-

tors, Madoff was a critical supplier with whom they had an extremely high

concentration risk. Some individuals even invested all of their assets with

Madoff. The high level of returns Madoff appeared to generate qualified his

business as a rainmaker. In addition, the ability to generate these returns

routinely, with little or no volatility, despite turbulent market conditions,

made him seem like a legitimate mastermind. According to Business Insider7,

HSBC had approximately one billion dollars invested with Madoff. This is

significant exposure, even for a bank the size of HSBC; it represented

approximately 15 percent of HSBC’s post-tax profits for 2008. According

to Bloomberg, Ascot Partners LLC, a money management firm, had invested

nearly all of its $1.8 billion in assets with Madoff.8 There is a long list of other

companies and individuals that had large concentration risk exposure to

Madoff’s firm. Bernie Madoff was arrested in December 2008 for what is now

Killer Risks & 163

C04 01/12/2011 10:42:53 Page 164

known as the largest Ponzi scheme in history. The consequences for the

companies and individuals whom Madoff served as a critical supplier were

high-severity events, and often catastrophic; some companies, including

Ascot, went bankrupt, and some individuals committed suicide.

Large Customer Having a large customer brings with it great risk. The loss of a large customer immediately leads to a loss in company value equal to the

corresponding loss of future profits. In addition, if the customer is lost to a

competitor, this may be taken by the market as a signal that something is

amiss, leading to a lack of confidence in management, a further loss of market

share, and possibly an exodus of key employees. This can lead to a downward

spiral, magnifying the loss further.

Large Distributor A large distributor is an example of a concentration of power in the form of access to markets. The loss of a distributor can instantly

destroy a large amount of value. First, there is the loss of value corresponding

to the proportion of expected future sales through that distributor. In

addition, depending on the nature of the goods or services the company

provides, the distributor may be able to immediately move the entire existing

book of business to a competitor. For example, an association promoting a

service to its membership base might encourage members to immediately

switch over to its new provider. In addition, just as with the loss of a large

customer, the loss of a large distributor may be taken as a negative signal by

the market and/or by key employees, leading to a downward spiral that

magnifies the loss.

Possible Risk Mitigation

Let’s briefly explore risk mitigation possibilities for each of our five examples of

power concentration risks.

Rainmaker As with arrogance, addressing the rainmaker power concentra- tion risk directly is tantamount to corporate suicide. Even addressing it

indirectly is still a rough road. There are only two indirect mitigation

approaches discussed here that may be of some, although still limited, use.

The first mitigation approach is intended to combat the lack of scrutiny,

transparency, and accountability that often protects rainmakers. An indirect

form of mitigation is to embed, in the audit plan or ERM program, an explicit

recognition that rapid growth, in and of itself, generates risk, and therefore

164 & Risk Identification

C04 01/12/2011 10:42:53 Page 165

must be subject to additional examination. It is a fundamental precept in

finance that risk and return go hand in hand. You cannot have higher returns

without higher risk (except for arbitrage opportunities, which evaporate

quickly in a reasonably efficient market). Capturing the rainmakers, including

any golden boy units, under the umbrella exercise of examining all high-

growth areas, may make it slightly easier to penetrate the cloak of secrecy that

usually envelops rainmakers.

The second mitigation approach is intended to negate arguments such

as, ‘‘Don’t worry about the risks here, we are generating far more value than

other departments.’’ An indirect form of mitigation is for the ERM team to

offer to measure the value as well as the risks. This is possible when the ERM

program employs a value-based ERM approach, which is described in Chapter

3. The value-based ERM approach measures risk and return on an integrated

basis, because risk is defined as volatility—both upside and downside—in

company value. This approach can provide the proper analysis as to whether

the extra returns generated are indeed worth the additional risk exposures.

Mastermind For the mastermind power concentration risk, one way to approach it is to highlight this type of problem generally as a talent manage-

ment issue, and define an approach to identify and remediate such situations.

Getting broad buy-in for the approach can then lead to a committee or team to

implement it. The implementation might scan the enterprise to identify all

such areas of ‘‘rare talent concentration risk,’’ emphasizing the invaluable

nature of the individuals identified. Committee suggestions for mitigation

might include ensuring the development of a strong cast of supporting players

for succession planning.

Critical Supplier For the critical supplier power concentration risk, there is likely to be a fatalistic attitude in the company. Management is well aware of

the situation, and the feeling may generally be that not much can be done

about the situation. This is another area where a value-based ERM approach

can enhance mitigation efforts. Once this risk is quantified, in terms of the

devastating impact it can have on the value of the firm, it tends to ratchet up

the level of attention and spurs more urgent and aggressive actions. An

example of this is given in a case study discussed in the section titled ‘‘Case

Studies’’ in Chapter 5. Mitigation efforts certainly include the obvious: attempt-

ing to get one or more additional suppliers, or at least to line up a backup

supplier. When this is not possible, and where the likelihood and severity of

losing the supplier is dire enough, it may be worthwhile to at least explore the

Killer Risks & 165

C04 01/12/2011 10:42:53 Page 166

possibility of deliberately diversifying the strategy—new goods and services,

other markets, different distribution channels, and so forth—to dampen the

risk. Alternatively, the company could explore the possibility of increasing its

scale, through a merger or acquisition, to decrease the severity of this risk to a

more acceptable level.

Large Customer For the large customer power concentration risk, man- agement is usually focused on preserving the customer relationship. Business

segment management is aware of their largest customers, and their incentives

are highly aligned to keeping this business. However, upper management may

not always appreciate business segment management concerns about these

large customers, and may not always approve unusual measures proposed to

keep these customers happy. What can help, similar to the critical supplier

risk, is to quantify the impact of this risk on company value. Putting the risk

in terms of the potential value lost allows a proper assessment of which miti-

gation actions are worthwhile.

Large Distributor The mitigation suggested here for large distributor power concentration risk is similar to a combination of that proposed for

the prior two examples of power concentration risk. There may be a perva-

sive feeling that not much can be done about this risk. However, once this

risk is quantified, in terms of its potential disastrous impact on company

value, it tends to precipitate action. Efforts to gain additional distributors are

undoubtedly constantly underway, because this increases revenues and is

fully aligned with incentives. Barring that, mitigation to consider may

include diversifying the strategy or increasing scale through merger or

acquisition. Either of these can decrease the severity of this risk exposure

to a more acceptable level. In addition, the quantification of this risk high-

lights another mitigation opportunity. Framing the risk in terms of the

potential impact on value allows for a more informed decision by manage-

ment as to which mitigation actions, intended to maintain a beneficial

relationship with the distributor, are advisable.

SUMMARY

Risk identification, the first step in the ERM process cycle, consists of three

components: risk categorization and definition; qualitative risk assessment;

and emerging risk identification. Despite being the most commonly

166 & Risk Identification

C04 01/12/2011 10:42:53 Page 167

performed ERM process step, there remain several aspects of risk identifica-

tion that are routinely performed in a suboptimal way. This significantly

impacts the quality of the entire ERM program, because every other step in

the ERM process is downstream from the risk identification step. To avoid

these problems, ERM programs must employ the five keys to a successful risk

identification process step: define risks by source; categorize risks evenly;

define metrics clearly; gather data appropriately; and identify risks prospec-

tively. The first two keys to success relate to the risk categorization and

definition (RCD) tool, which has several applications in an ERM program. The

remaining three keys to success relate to the qualitative risk assessment. In

addition to taking care to employ the five keys to successful risk identification,

there are two killer risks that companies must be vigilant against: arrogance

and concentration of power.

With the conclusion of risk identification, the ERM program arrives at a

major milestone: identification of the key risks. The key risks are those that

will advance to the next step in the ERM process cycle, which is the topic of

our next chapter: risk quantification.

NOTES

1. Standard & Poor’s uses this term in their ratings guidance.

2. This refers to deterioration in the relationship itself, due to personal friction, as

opposed to, for example, impatience with management’s ability to address

issues raised by the rating agency. This indicates a failure of external relations.

3. The absolute amounts in the severity column will vary by size of the

organization.

4. In the qualitative risk assessment, both severity and likelihood are typically

scored on a net risk exposure basis.

5. Some interviews may need to be conducted by videoconference or phone, due

to the remote location of some survey participants.

6. Of course, other possibilities include the political expedience of offering a

scapegoat to deflect criticism, as well as the psychological benefits of taking

some action that gives the appearance of restoring safety and preventing a

recurrence.

7. Businessinsider.com, Henry Blodget, December 23, 2008.

8. Bloomberg.com, Joshua Fineman, December 19, 2008.

Notes & 167

C05 01/12/2011 11:1:3 Page 168

5CHAPTER FIVE Risk Quantification

Any intelligent fool can invent further complica-

tions, but it takes a genius to retain, or recapture,

simplicity.

E.F. Schumacher

T HE RISK QUANTIFICATION ERM process step is the lynchpin of theERM process cycle. It enhances the key risk ranking and prioritizationperformed in the prior ERM process step—risk identification—and it also provides the information necessary to perform the next ERM process

step—risk decision making. The key linkage performed in this step is the

connection of risk and value by quantifying risk in terms of its value impact.

This is the bridge between risk and return.

In this chapter, we will address risk quantification as performed using

the value-based ERM approach. Risk quantification is performed with the

value-based ERM model. By model, we mean a financial model in the form of a

spreadsheet-based tool. The model receives input of data and assumptions,

performs calculations, and produces output of results.

Before we discuss the risk quantification activities, we will emphasize the

most critical overriding characteristic of the value-based ERMmodel: practicality.

168

C05 01/12/2011 11:1:3 Page 169

PRACTICAL MODELING

The single most important characteristic of the value-based ERM model is that

it is practical. All aspects of the model—inputs, calculations, and outputs—are

kept simple, with the sole purpose, constantly in mind, of supporting decision

making. As was discussed in some detail in Chapter 3, there are four aspects

to this practicality:

1. Reliability. The inputs are few in number and so are more easily main-

tained at a high level of quality. In addition, simplicity in the calculations

reduces the number of errors.

2. Speed. Simplicity in the calculations also translates to fast run times. The

model provides answers in hours rather than the typical days or weeks

for traditional ERM models.

3. Transparency. Simplicity in methodology means easier scrutiny by

management. For example, tangible individual deterministic risk sce-

narios can be reviewed directly, unlike formula-generated, difficult-to-

understand, and ever-changing stochastic risk scenarios. Deterministic

and stochastic scenarios are discussed later in this chapter (see ‘‘The

Power of Deterministic Risk Scenarios’’).

4. Balance of significant digits. The level of rigor is balanced with the

inherent lack of precision in the assumptions. The value-based approach

recognizes that a high level of complexity is simply not warranted, in light

of the significant digits rule.

It is paramount to keep these four aspects of practicality constantly in mind

when building the model. A perpetual vigilance is required against adding

complexity. There is a natural tendency to build out additional complexity,

often merely because the person trained in modeling is able to do it, enjoys

doing it, and, it is actually much easier than keeping it simple. It is good to keep

the following quotes in mind:

Perfection is achieved, not when there is nothing more to add, but when there is nothing left to take away.

Antoine de Saint-Exup!ery

Simplicity is the ultimate sophistication.

Leonardo da Vinci

Practical Modeling & 169

C05 01/12/2011 11:1:4 Page 170

There is also another force that continually pushes people toward

over-modeling. Those performing the modeling find it difficult to believe

that something simpler can be better. See ‘‘Can Simpler Actually Be Better?’’

CAN SIMPLER ACTUALLY BE BETTER?

Technical professionals, including modelers, tend to want to add com-plexity. It’s encouraged by their training. It’s aligned with their skills. It’s in their DNA. Additional technological sophistication is useful, but only if it increases utility (it is used more) and enhances performance (results im- prove). However, technological complexity is often in direct opposition to those two criteria. One such example, highlighted in an article by The New Yorker,1 is presented here, and comes to us from the field of obstetrics.

In the United States, in the 1950s, the field of obstetrics was in poor shape. One out of every thirty babies was stillborn (3.3 percent). Despite the availability of an abundance of individual detailed metrics on the health of the baby, there was poor care of newborns deemed ‘‘too sick to live.’’ This included babies that were thought to be too small or had poor coloring or were not breathing well at the time. These babies were simply listed as stillborn, placed out of sight, and allowed to die.

In 1953, Dr. Virginia Apgar introduced a new metric to gauge the viability of newborns in an attempt to improve newborn care and, as a result, the mortality rate. The Apgar score was a zero-to-10 point scale: two points for pink all over, two for crying, two for good breathing, two for limb movement, and two for a heart rate over one hundred beats per minute.

Imagine the reaction of the technical professional in obstetrics at the time: ‘‘This metric is ridiculously simplistic and cannot possibly capture a baby’s viability. It oversimplifies the complexities of each individual metric already available to us, and equates them all to each other in importance. Is breathing really only as important as crying? How could the Apgar score be of any value?’’

In fact, the Apgar score is widely credited with revolutionizing the field of obstetrics. It was adopted globally, and succeeded in its goals to improve newborn care and themortality rate. How can this be? How could simpler have been better? Simplicity translated into practicality, and practicality drove results. The Apgar score was easy to measure without sophisticated tools or know-how. It could be calculated by anyone that could count to 10. It was easy to compare results, from one baby to the next, from one doctor to the next, and from one hospital to the next. Availability and comparability drove competition to improve scores. This led to experimentation and eventually to

170 & Risk Quantification

C05 01/12/2011 11:1:5 Page 171

There are a few guidelines to help achieve and maintain a practical level of

ERM modeling. If these guiding principles can become a mantra to those

performing the model building, then the ERMmodel can become, and continue

to be, a valuable element supporting decision making:

& Start fresh & Expand judiciously & Consider practicality

Start Fresh

When building the value-based ERM model for the organization for the first

time, the model must be built anew, using basic principles as opposed to using a

generic model. Generic models are, by their nature, overly complex. A generic

model is designed to handle all the different types of businesses that it may

standardized improvements. The Apgar score led to hundreds of improve- ments in newborn care now known as the ‘‘obstetrics package.’’ One example was the shift away from general anesthesia to epidural anesthesia during childbirth once this was shown to improve Apgar scores. To date, in the United States alone, the Apgar score has saved literally millions of lives; for full-term babies, the stillborn rate is now just 1 in 500 (0.2 percent).

What is the lesson here? It’s partly about seeing the bigger picture, staying focused on how technical information will work in practice, and, when necessary, letting go of unnecessary detail and complexity. Rather than getting caught up in the detailed individual pieces of data, and the new and more advanced equipment available to some hospitals and usable by some doctors, Apgar realized that a less accurate but more accessible metric could drive improvements and save lives. Whereas technical professionals often indulge personal desires to employ their most complex techniques, the businesspeople they serve more often just need practical metrics that are easy to calculate, easy to understand, and easy to use in practice. The lesson for those building ERM models: Trying to perfect the model by increasing its complexity may in fact kill it. If they choose to downshift their intellectual capabilities a bit, they may actually gain more traction. Or, using a different analogy, when ERM model builders are invited to the business table, they need to bring more than their stochastic forks and knives. They need to develop practical, market- able solutions that will catch on.

Practical Modeling & 171

C05 01/12/2011 11:1:6 Page 172

encounter. As a result, generic models contain a lot of excess coding and

functionality that is not needed for the specific entity that uses it.

Expand Judiciously

When building the value-based ERM model for the first time, or expanding the

model over time, the model must be expanded judiciously. Model capabilities

should only be developed to the extent needed to match their intended usage.

Consider what decisions the model must support, and how quickly the results

must be provided.

Although it is important to be vigilant against unnecessary model expan-

sions, there are three main types of expansions that are both valid and natural

to the development of the value-based ERM model:

1. Business segments

2. Value drivers

3. Outputs

Business Segments

The value-based ERM model must be expanded to include detail at the level of

business segments or sub-segments appropriate to the risk quantification

exercise. At one level, it is important to include the same breakdown as

that used in other key business processes, such as strategic planning or internal

reporting. This makes it easier to integrate ERM into key company processes. At

another level, a more detailed breakdown may be required depending on key

risk scenarios. For example, if a risk scenario impacts a major product line

within a business segment, it may be necessary to break the business segment

projection into two parts—one for the major product line and one for the

remainder of the business segment.

Value Drivers

The model must also be expanded to include a level of detail sufficient to

support the dynamic nature of the business by including value drivers. For

example, if the company has salespeople, rather than model revenues as a

single line item, revenues should be broken up into its detailed value driver

components, such as:

& Number of new salespeople hired & Retention rate of salespeople

172 & Risk Quantification

C05 01/12/2011 11:1:6 Page 173

& Average number of items sold per salesperson & Average price of items sold per salesperson

In addition, more detail may be required if some of these components are

not homogeneous enough; for example, retention and productivity may vary

significantly by salesperson experience level.

Outputs

The company value metric is the dominant metric, and the primary set of

outputs is expressed in these terms. However, management usually requests

that outputs be expressed in terms of at least three or four additional key

metrics. The model must be expanded to accommodate these. Examples of

additional key metrics include revenue growth rate, net income growth

rate, earnings per share growth rate, and, for financial services companies,

capital ratio.

Consider Practicality

When faced with each new request or decision point related to potentially

increasing the level of model complexity designed to ‘‘increase accuracy,’’

consider its appropriateness. Stop, take a breath, and carefully think it

through. Ask yourself, ‘‘Is it worth it?’’ Balance the desire for robustness

against the need for practicality. Is the enhancement truly needed? What

is gained and what is lost? Consider that every time the model is made

more complex to better address one specific additional item, it puts the

overarching goal of practicality slightly more at risk. Does the change

make the model less reliable? Does it slow down the response time? Does

the methodology on which calculations are based become less transparent?

Is the added complexity mathematically appropriate in light of the significant

digits rule?

This last question in particular—regarding significant digits—should

always be top-of-mind. Consider the weakest link in the calculation chain,

the lowest common denominator of inaccuracy, if you will. Is the en-

hancement merely an illusion of more accuracy, because the approxi-

mate nature of one of the assumptions overwhelms the equation anyway?

Would it be insincere, and potentially misleading, to embed model calcula-

tions implying a higher level of accuracy than can possibly be achieved in

the result?

Practical Modeling & 173

C05 01/12/2011 11:1:6 Page 174

COMPONENTS OF RISK QUANTIFICATION

There are three distinct components in the risk quantification ERM process step:

1. Calculate baseline company value

2. Quantify individual risk exposures

3. Quantify enterprise risk exposure

The value-based ERM model evolves with each of these sequential

activities.

CALCULATE BASELINE COMPANY VALUE

The first activity in the risk quantification ERM process step is to calculate the

baseline company value. In the value-based ERM approach, risk is defined and

quantified in terms of a deviation from expectations. A company’s expectations

are represented by its strategic plan. The baseline company value is an internal

valuation based on achieving the strategic plan.

We will discuss three aspects of calculating the baseline company value:

1. Input of data and assumptions

2. Model calculations

3. Output of results

Input of Data and Assumptions

The data and assumptions needed to calculate the enterprise baseline value

include the following three items:

1. Strategic plan financial projection. The first item needed as input for

the calculation of the baseline company value is the strategic plan financial

projection. This is a financial projection that extends out to the end of the

formal planning period; for example, a three-year period. This should

include the latest version of the official strategic plan projection as well as

any detailed supporting documents. This should also include any informa-

tion available internally regarding projections or expectations beyond the

formal planning period; this is often limited to additional revenue growth,

expense reduction, and known or scheduled changes in investments.

174 & Risk Quantification

C05 01/12/2011 11:1:6 Page 175

2. Recent financials. The second item needed as input for the calculation of

the baseline company value is recent financial results that are normalized

for any one-time or anomalous items. This includes the income statement,

balance sheet, cash flow statement, and, for financial services companies,

required capital calculations. In addition, this includes the detailed data

supporting the construction of the financials; for example, rates of returns

on invested assets, tax rates, and so forth.

3. Discount rate. The third item needed as input for the calculation of the

baseline company value is the discount rate, or cost of equity capital. This

is the rate that will be used to discount all future distributable cash flows

back to the present time in the calculation of company value. This is the

return on investment assumed to be demanded by the collective share-

holders. This is based on the long-term average required return. For a

discussion on determining an appropriate discount rate, see ‘‘Setting the

Discount Rate.’’

SETTING THE DISCOUNT RATE

There are numerous methods of determining an appropriate discountrate. One popular method is to use the capital asset pricing model (CAPM).2 The various methods will not be explored here for three reasons. One reason is that this is basic corporate finance, and is not unique to enterprise risk management. A second reason is that the discount rate is readily available, because it is already used in routine corporate budgeting decisions as a hurdle rate.

A third reason that it is not worth spending much time on this is, again, the significant digits rule. Much time and effort can be spent tinkering with different methodologies for estimating the cost of equity capital, yet its true value cannot really ever be known with much accuracy. The cost of equity capital is the weighted average of the return required from every single shareholder, ranging from day traders to institutional long-term holders, and everyone in between. Even if you were able to individually ask each of these investors, ‘‘What is the return you require from your investment in our stock?’’ the following would be true:

& The answers would vary from investor to investor.

& The answers would probably change from day to day.

& Many investors would not be able to give you a definitive answer. (continued )

Calculate Baseline Company Value & 175

C05 01/12/2011 11:1:7 Page 176

Model Calculations

The baseline company value calculation involves a common valuation ap-

proach and can be considered in three parts:

1. Build a dynamic reproduction of the strategic plan financial projection to

project financials to the end of the formal planning period (e.g., three

years), and modify it to create a distributable cash flow projection.

2. Project the distributable cash flows beyond the formal planning period

(e.g., up to model year 20) and add a terminal value.

3. Discount the distributable cash flow projection back to time zero using the

discount rate.

Before we present an illustrative example, we will discuss three aspects of

this calculation:

1. Company value formula. We will discuss four aspects of this formula:

1. General formula. The general formula for the calculation of company

value was presented in Chapter 2 (see ‘‘Company Value’’), and is

repeated here:

Company value ¼ X1

n¼1 DistCFn ð1þ dÞn

Where:

& n¼ year of projection & DistCFn¼ distributable cash flow for projection year n & d¼ discount rate, which is management’s estimate of the rate of

return required by the shareholders for their investment, i.e., the

cost of equity capital

There are many variations of this formula. Different companies

define value differently. It is up to management to determine what

is appropriate, based on the unique characteristics of the organization.

(continued ) Given the elusive nature of the discount rate, and in consideration of the

high level of uncertainty in so many of the inputs into the value-based ERM model, it is a much better use of time to simply estimate the discount rate using some reasonable approach or use the readily available hurdle rate, and move on.

176 & Risk Quantification

C05 01/12/2011 11:1:9 Page 177

2. Distributable cash flow. Distributable cash flow is king. To investors,

it is distributable cash flow that matters, as opposed to representations

made by any particular accounting system. Cash flow is the universal

equation for value. If I ask you to invest in my business, you will only

take into account the following factors in valuing the opportunity3: & How much cash you must give me & When you must give cash to me & How much cash I plan to give to you in the future & When I plan to give cash to you & How likely you think I am to achieve my plans to give cash to you (in

terms of amount and timing)

Whatever accounting basis is used for the strategic plan financial

projection, the distributable cash flow formula essentially removes the

accounting and reduces everything to cash flows.

Distributable cash flow (DistCF) is calculated as:

Net incomeþ Depreciation and amortization% Increase in working captial % Capital expenditures

3. Truncated formula. As a practical matter, to limit the projection to N

years, a terminal value is used to truncate the calculation:

Company value ¼ DistCF1 ð1þ dÞ1

þ DistCF2 ð1þ dÞ2

þ & & & DistCFN ð1þ dÞN

þ TVN ð1þ dÞN

Where:

& DistCFn ¼ distributable cash flow for period n & TVN ¼ terminal value at end of period N & d ¼ discount rate & N ¼ final year of projection

4. Terminal value formula. The terminal value represents the value

remaining at the end of the projection period. This is used as a trunca-

tion, to limit the number of years projected in the model. There are

various methods of calculating the terminal value. One common ap-

proach is to assume that the distributable cash flow from the final year of

the projection, year N, continues to grow annually, in perpetuity, at a

constant growth rate. This results in the following shorthand formula:

TVN ¼ DistCFN ' ð1þ gÞ

ðd % gÞ

Calculate Baseline Company Value & 177

C05 01/12/2011 11:1:9 Page 178

Where:

& TVN ¼ terminal value at end of period N & DistCFN ¼ distributable cash flow for period n & g ¼ growth rate & d ¼ discount rate & N ¼ final year of projection

As with calculations of the discount rate, we will not further explore

the alternate methods for calculating the terminal value. Terminal

value is a standard component of valuation techniques and is not

unique to enterprise risk management.

2. Projection. The distributable cash flow projection derived from the

strategic plan financial projection only extends to the end of the formal

planning period. The model calculations must project beyond that for

several more years. For example, if the formal planning period is three

years, and there is a desire to project distributable cash flows for 20 years,

the projection must be extended an additional 17 years.

To do this, we must build two features into the model calculations:

1. Dynamic relationships. Developing a dynamic relationship involves

identifying the financial line items in the distributable cash flow

projection, or the value driver components, that drive other financial

line items, and finding a way to dynamically estimate their relationship.

One simplified example is identifying revenues as a driver of variable

expenses, and representing future variable expenses in the projection as

a percentage of revenues. Another example is identifying that one

year’s fixed expenses are a driver for the following year’s fixed expenses,

along with inflation, and representing future fixed expenses in the

projection as the prior year’s fixed expenses increased for inflation.

2. Reasonable trend lines. The distributable cash flow projection must

have reasonable trend lines for key financial line items such as revenues

and expenses. There are two projection periods involved—the strategic

plan projection period and the period beyond that. Strategic plan

projections have a tendency to include revenue growth that exceeds

that achieved in recent years. In addition, strategic plan projections

have a tendency to be overly optimistic in the ability to achieve sudden

expense reductions that have not been possible previously. Examining

the trend lines in the recent financial data and comparing them to those

of the projection during the strategic planning period can serve as a

reasonability check.

178 & Risk Quantification

C05 01/12/2011 11:1:9 Page 179

For the period beyond the financial plan projection period, the trend

lines must be created. This is done using a combination of the recent

financial data, the strategic plan projection, and information about

expectations for the industry sector, such as growth prospects. A con-

servative set of steady trend lines are then developed for projecting

beyond the strategic plan period.

3. Reasonability check. A reasonability check can be performed on the

baseline company value calculation by comparing it with market capitali-

zation. Market capitalization is the market’s estimate of the company

value, and is calculated as follows:

Market capitalization ¼ Outstanding shares' Stock price per share

The relationship between the baseline company value and market

capitalization varies by situation. However, in many cases, the baseline

company value is 5 to 15 percent higher than the market capitalization.

Whatever the percentage, the relationship should make sense in light of

the company’s circumstances and market conditions.

Illustrative Example: Pear Inc.

Pear Inc. is a hypothetical competitor to Apple in the handheld electronic

device market. Pear manufactures smartphones and sells them through

retail outlets in the United States. Its major competitive advantage is a

more sophisticated network called InfinityG.

Input of Data and Assumptions Last year, Pear had 5,000 salespeople, each selling an average of 750 units annually, based on a $250 purchase

price per unit. The purchase price is expected to remain constant in the

future. Pear tends to lose 15 percent of its salespeople each year. Last year,

Pear hired 1,000 new salespeople. Starting this year, Pear plans to grow

more aggressively. Each year going forward, Pear plans to hire 100 more new

salespeople than the year before. Pear earns net investment income at an

earned rate of 4.5 percent on invested assets of $150 million.

Pear’s variable costs—its costs of goods sold (COGS)—are equal to

67 percent of sales. Last year, research and development costs (R&D)

were $50 million, and this is expected to remain constant in the future.

Last year, Pear’s fixed expenses—its selling, general, and administrative

(SG&A) expenses—were $35 million, and are expected to increase with

an annual inflation rate of 3.5 percent. Pear pays interest expense of

Calculate Baseline Company Value & 179

C05 01/12/2011 11:1:9 Page 180

6 percent on long-term debt of $150 million. Pear’s effective tax rate is

35 percent.

Pear uses a discount rate of 13 percent for internal valuations, believing

that this fairly represents the long-term average required return of the collec-

tive shareholders.

Pear has 200 million shares outstanding. The current stock price is $8.75

per share, resulting in a market capitalization of $1.75 billion.

Calculation of Baseline Company Value For our illustrative example, we will make the following simplifying assumptions:

& There are no items of depreciation, amortization, change in working

capital, or capital expenditures; this equates net income with distributable

cash flow. & All net income is paid out in shareholder dividends. & The extension of the strategic plan projection beyond the formal planning

period uses the same trend lines as the strategic plan projection itself. & The projection period is twenty years. & The growth rate for distributable cash flows beyond the projection period

(used for calculating terminal value) is 0 percent.

The first three years of Pear’s distributable cash flow projection is shown in

Table 5.1.

Pear’s baseline company value calculation is as follows:

Company valueBaseline

¼ DistCF1 ð1þ dÞ1

þ DistCF2 ð1þ dÞ2

þ & & & DistCFN ð1þ dÞN

þ TVN ð1þ dÞN

¼ DistCF1 ð1þ dÞ1

þ DistCF2 ð1þ dÞ2

þ & & & DistCFN ð1þ dÞN

þ DistCFN ' ð1þ gÞ=ðd % gÞ ð1þ dÞN

¼ $147M ð1:13Þ1

þ $155M ð1:13Þ2

þ $165M ð1:13Þ3

þ & & & $468M ð1:13Þ20

þ $468M=0:13 ð1:13Þ20

¼ $1:91B

Performing a reasonability check by comparing baseline company value

to market capitalization reveals that the former is higher than the latter by

9.0 percent:

1:91B

1:75B % 1 ¼ 9:0%

180 & Risk Quantification

C05 01/12/2011 11:1:10 Page 181

Although we are not given enough information in this illustrative example

to determine if this is within reasonable bounds, it is within the common range

provided earlier of 5 to 15 percent.

Output of Results

The main output is the baseline company value itself. This is the price that

investors would pay today if they believed that the organization was going to

perfectly execute its strategic plan and that everything was going to go its way.

The first time this is calculated is an exciting moment. For most companies, the

most important metric is company value. Up until this point in time, manage-

ment has relied on equity analyst valuations or market capitalization as a proxy

for company value. Now, management has their own valuation, which has

three main advantages over external estimates of company value. It is:

1. More accurate

2. More detailed

3. More dynamic

TABLE 5.1 Pear’s Distributable Cash Flow Projection

(in $ millions)

Projection

Year 1

Projection

Year 2

Projection

Year 3 . . .

Projection

Year 20

Sales 955 995 1,045 2,552

Net Investment Income 7 7 7 7

Total Revenues 962 1,002 1,052 2,559

Cost of Goods Sold (COGS) 640 667 700 1,710

Research & Development (R&D)

50 50 50 50

Selling, General & Administrative Expenses (SG&A)

36 37 39 70

Interest Expense 9 9 9 9

Total Expenses 735 763 798 1,839

Income Taxes 79 84 89 252

Net Income 147 155 165 468

Distributable cash flow 147 155 165 468

Calculate Baseline Company Value & 181

C05 01/12/2011 11:1:11 Page 182

More Accurate

The baseline enterprise valuation has the potential to be a more accurate

estimate of company value than market capitalization or analyst valuations.

As discussed in Chapter 3, the internal baseline enterprise valuation leverages

inside information—the information so valuable that rogue stock traders want

to get their hands on it. Nobody can know with certainty what the future

financial results will be. However, each local manager is in the best position to

make an informed estimate as to what their part of the business is likely to

generate, as well as ranges around that estimate. Collecting these estimates and

ranges from local managers all around the company, in a consistent manner

and in as unbiased a way as possible, and aggregating them into a single

valuation model, results in a powerful tool and a more accurate estimate of

company value.

The baseline company value calculation is also less volatile than external

valuations such as market capitalization. This is a direct consequence of its

being more accurate. The market tends to initially overreact to new infor-

mation in both directions, causing additional volatility. Sometimes the

market initially reacts broadly, for example, regarding bad news in an

industry sector, and only some time later differentiates the reaction between

individual stocks. The baseline company value calculation doesn’t share this

extra volatility. Management is more knowledgeable about the impact of new

information on the company, and therefore doesn’t overreact.

Virtually every time I have seen this done, the initial internal calcula-

tion of the baseline company value exceeds the market capitalization. This

makes sense. It is the job of management to grow the value of the firm.

Management sets the strategy and supporting objectives that, if and when

achieved, will increase company value. However, an excessively optimistic

strategic plan projection produces a baseline company value that is less,

not more, accurate than external valuations. Later activities in the risk

quantification ERM process step, such as the calculation of enterprise risk

exposure, serve to strengthen the strategic planning process. These activi-

ties can help identify an achievable strategic plan, as well as a separate

strategic plan that is most likely and which facilitates a baseline company

value calculation that delivers on the promise of a more accurate measure

of company value.

There are numerous applications of a more accurate calculation of

company value. Two are discussed here. One application is to support better

decision making. For example, having a more accurate estimate of company

182 & Risk Quantification

C05 01/12/2011 11:1:11 Page 183

value than the general market supports more advantageous decisions

regarding stock issuance or buy-back. A more advanced version of this basic

company value model, in the form of the fully evolved value-based ERM

model, and its ability to support decision making, is discussed in Chapter 6.

Another application is to support better communications with external

stakeholders. For example, having an internal stock valuation that is

more accurate than the one used by equity analysts supports more effective

communications with them. This will be further discussed in the section titled

‘‘Communications with Stock Analysts’’ in Chapter 7.

More Detailed

Unlike an external valuation of the company, which offers one number

representing firm value, the value-based ERM model provides more detail.

The value-based ERM model provides an ability to estimate the portion of

company value attributable to parts of the company below enterprise level.

Each business segment or sub-segment for which the value-based ERM model

has detail has its own valuation. In addition, if desired, a valuation can be

produced for any portion of business, or even individual projects, for which the

corresponding financial information can be isolated and incorporated into

the value-based ERM model.

This information offers a new way to look at the business that can result in

a shift in management focus and attention. Consider the following hypothetical

example. A technology company, SFX Computers, manufactures computers

and accessories and has five business segments:

1. Laptop

2. Notebook

3. Workstation

4. Server

5. Accessory

Historically, SFX has given priority, of attention and budget, to each

business segment roughly in proportion to recent earnings. This relative

emphasis is shown in Figure 5.1, which highlights business segment earnings

for the prior year. SFX management had been giving about half of its time

and attention to the Laptop business segment, which represented half of

its earnings, with the remainder evenly split between its other business

segments.

Calculate Baseline Company Value & 183

C05 01/12/2011 11:1:11 Page 184

However, recently SFX performed a baseline company value calculation,

with details supporting valuations for its five business segments. The results of

the calculation are shown in Figure 5.2.

The attribution of SFX’s company value into its five business segments

reveals the true relative value of the segments. The Laptop and Workstation

Laptop 50.0%

Notebook 12.5%

Workstation 12.5%

Server 12.5%

Accessory 12.5%

FIGURE 5.1 SFX Prior Year Earnings by Business Segment

Laptop 35.0%

Notebook 30.0%

Workstation 5.0%

Server 20.0%

Accessory 10.0%

FIGURE 5.2 SFX Company Value by Business Segment

184 & Risk Quantification

C05 01/12/2011 11:1:16 Page 185

segments are less important than their prior year earnings would indicate,

reflecting SFX’s expectation, contained in the strategic plan projection, that

demand for laptops and workstations will decline over the next several years.

Similarly, the Notebook segment is more than twice as important as prior year

earnings might suggest, reflecting SFX’s expectations that demand for note-

books will increase significantly in the coming years. Changes in the relative

importance of the Server and Accessory segments reflect SFX expectations

related to shifting trends in revenue growth and profit margins.

With a clear picture of the relative contributions to company value

made by each business segment, SFX management has since shifted its focus.

This shift is reflected in the amount of attention and budget now afforded

to each segment.

More Dynamic

External estimates of company value are not as dynamic as internal calcula-

tions of company value. External valuations only reflect information that is

publicly available, whereas internal valuations reflect any inside information

available to management. Having an internal valuation model allows man-

agement to revise the baseline company value calculation for new develop-

ments or decisions that change future expectations. New developments in

the external or internal environments may either be unknown to the public

or the public may not yet realize, or appreciate, the significance of the infor-

mation vis-"a-vis a specific company’s future prospects. However, manage- ment may have this information, is in a better position to interpret its impact

on the company’s future distributable cash flows, and can revise its internal

calculation of the baseline company value as necessary.

This dynamic internal valuation model can be used for decision making.

For any decision, management can determine its marginal impact on the

distributable cash flow projection, or the discount rate, and then recalculate

the baseline company value. Having a valuation of the enterprise on a pre-

and post-decision basis provides a dynamic basis for decision making.

QUANTIFY INDIVIDUAL RISK EXPOSURES

The second step in the risk quantification ERM process step is to quantify the

individual risk exposures. This involves the quantification of multiple determi-

nistic risk scenarios for each key risk, in terms of its potential impact on the

Quantify Individual Risk Exposures & 185

C05 01/12/2011 11:1:16 Page 186

baseline company value. The baseline company value represents the expec-

tations embedded in the strategic plan. Risk, in the value-based ERM approach,

is defined in terms of deviation from expected. We will first discuss three aspects

of quantifying individual risk exposures:

1. Input of data and assumptions

2. Model calculations

3. Output of results

Following this discussion, we will present several case studies.

Input of Data and Assumptions

We will discuss the following aspects of developing inputs for the individual

risk quantification exercise:

& The power of deterministic risk scenarios & Range of individual risk scenarios & Labeling of individual risk scenarios & Approaches to developing individual risk scenarios

The Power of Deterministic Risk Scenarios

There are two basic approaches used to generate risk scenarios: stochastic and

deterministic. The stochastic approach involves some type of automation. It

is designed to generate a large number of random scenarios without human

involvement beyond setting up the process. Setup involves developing a

formula, which attempts to capture the shape of the risk distribution, and a

random number generator. The deterministic approach involves human

judgment to select and define each individual risk scenario.

Deterministic scenarios offer four advantages over stochastic scenarios.

Deterministic scenarios produce more robust scenarios, produce more accurate

scenarios, enhance risk culture, and support decision making.

1. Produce more robust scenarios. The stochastic approach automates

scenario generation, which means that it doesn’t require additional

thinking. Unfortunately, additional thinking is precisely what is needed

to develop robust risk scenarios. There are numerous variables that require

consideration, and these can only be brought to light by having subject

matter experts think through each risk scenario individually. This is what

186 & Risk Quantification

C05 01/12/2011 11:1:16 Page 187

the deterministic approach does best. Subject matter experts are asked to

think through, step by step, the downstream consequences flowing from

an originating risk source. Having a specific, deterministic scenario to work

with is a powerful catalyst in sparking dialogue with the subject matter

experts and in extracting their good knowledge of how the specific

situation would likely play out. Imagining a specific event actually

occurring makes it easier for them to think through the sequential

progression of likely events and the consequences to the organization.

One type of variable to consider is that each risk scenario may trigger

different types or levels of mitigation. For example, different levels and/or

causes of damage to company property may activate different levels of

insurance coverage. Another example is that each scenario, for a given

risk, may involve a different level of management response; higher levels of

management may be involved at higher levels of severity, bringing more

corporate resources to bear in mitigating the impacts of the risk event.

Another type of variable to consider is that certain scenarios, particu-

larly those of extreme severity, may trigger secondary events that are

usually associated with separate risk sources. This allows for the incorpo-

ration and reflection of correlations between risks, within the risk scenario

itself. For example, a worst-case pandemic scenario may trigger an

economic downturn.

2. Produce more accurate scenarios. A deterministic approach results in

more accurate risk scenarios by reducing errors and bias, avoiding

unrealistic scenarios, and producing better ‘‘tail’’ scenarios.

1. Reducing errors and bias. With a stochastic approach, risk sce-

narios cannot be easily documented and shared with others. The risk

scenarios can change with every run of the model; documentation

would involve providing formulae rather than specific scenarios.

However, with a deterministic approach, risk scenarios can be easily

documented and widely shared, because they are specific and well

defined. This reduces errors and bias in deterministic scenarios.

Dissemination of deterministic risk scenarios leverages the knowledge

of the wider group, providing opportunities to identify and correct

errors. For example, a risk scenario may include an assumption about

mitigation in the form of an insurance contract, and the risk manager

in charge of these contracts can review the documentation and

provide any needed corrections (e.g., the insurance coverage may

have recently been modified). In addition, the enhanced transparency

reduces bias. The subject matter experts developing the risk scenarios

Quantify Individual Risk Exposures & 187

C05 01/12/2011 11:1:16 Page 188

are aware that their assumptions will be reviewed by others, which

provides an extra incentive to be as accurate as possible.

2. Avoiding unrealistic scenarios. The stochastic approach often uses

interpolation, particularly for strategic and operational risks, for which

there is less data. The stochastic formula automatically generates future

risk scenarios by relying on interpolation to construct risk scenarios in

between available data points. Unfortunately, this can produce unrealis-

tic scenarios. Some risks, or aspects of risks, can only occur in two dis-

crete states. For example, a scandalous internal event either becomes

public knowledge or it does not. The severity of the former can be much

higher than the latter, with media coverage causing reputational dam-

age. Interpolating between these two, in terms of impact severity, is not

realistic. In contrast, the deterministic approach avoids producing such

unrealistic scenarios. It does not rely on unthinking interpolation based

on historical data points. Each risk scenario is consciously, thoughtfully,

and prospectively developed by subject matter experts.

3. Producing better ‘‘tail’’ scenarios. Stochastic approaches have be-

come less popular since the global financial crisis that began in the United

States in 2007. A major reason is that they failed to produce good ‘‘tail’’

scenarios—extremely pessimistic scenarios that are in the tail portion of

the distribution. Stochastic methods rely on formulae to represent the

shape of the risk distribution. The inherent inaccuracy of formula-fitting

to historical data is exacerbated when this is blindly followed into areas

with very few data points, of which the tail portion of the distribution is an

example. Leading up to the financial crisis, scenarios that were described

by stochastic methods as extremely rare were actually occurring fairly

routinely, exposing a glaring weakness of this approach. Rather than

follow a mathematical method into statistical silliness, the deterministic

approach relies on subject matter experts to individually think through

each tail scenario, and to assign a reasonable likelihood. Although

the experts do review the limited historical data points, the tail scenarios

relymore on their judgment, which results inmore sensible tail scenarios.

3. Enhance risk culture. The stochastic approach, by its design, engages

fewer people from the business segments. It relies more on a few financial

personnel, leveraging historical data and mathematical formulae to

produce a scenario-generating machine. In contrast, the deterministic

approach engages more people. This is a good thing. This enhances the

risk scenarios by leveraging the knowledge of the subject matter experts,

those closest to the risks. However, this also enhances the organization’s

188 & Risk Quantification

C05 01/12/2011 11:1:16 Page 189

risk culture. The deterministic approach to risk scenario development

involves a broad range of people throughout the organization, exposing

them to ERM and getting them thinking more about risk in general. This

is particularly true for strategic and operational risks, which require

subject matter experts beyond the finance departments into human

resources, strategic planning, legal, information technology, external

relations, and other areas. In addition to educating personnel about

ERM concepts, the interactive dialogue generated in the risk scenario

development exercises helps build buy-in for the ERM program.

4. Support decision making. There are two critical characteristics that

scenarios need to effectively support decision making:

1. Transparency. Stochastic scenarios are not easily accessible to man-

agement. They involve formulae andmathematics that are not intuitive

to non-financial personnel. The mysterious nature of a risk scenario

generator, humming away in a ‘‘black box,’’ generates more than

scenarios . . . it generates suspicion. Management cannot ‘‘touch and

feel’’ the risk scenarios and see how they are developed. Without the

ability to scrutinize, management hesitates to use the information for

decision making.

However, scenarios produced with a deterministic approach are fully

transparent. Each specific individual risk scenario, along with all of its

assumptions, is clearly laid out in easy-to-read, concise documentation.

The scenarios are tangible, and resonate with management. The

scenarios can easily be reviewed, and management can challenge

and sensitivity-test any assumption. This engenders trust. As a result,

management becomes comfortable relying on the information and

using it for decision-making purposes.

2. Stability. Risk scenarios generated by a stochastic approach tend to

change every time the ERM model is run. That is the nature of the

randomizing function. This produces ‘‘noise’’ in the ERM model results.

This causes some discomfort with management. Eyebrows are raised

when they see changes to results when no explicit changes have been

made to the model. The ever-shifting nature of the stochastic risk

scenarios causes an uneasy sense of instability and a decreased desire to

use the information in decision making. In contrast, deterministic

scenarios have stability. They tend to remain unchanged, unless a

change to the business occurs, necessitating valid updates. This con-

sistency gives management the comfort they need to incorporate the

information into decision making.

Quantify Individual Risk Exposures & 189

C05 01/12/2011 11:1:16 Page 190

Range of Individual Risk Scenarios

There are often several risk scenarios for each key risk. Some key risks will have

both upside and downside scenarios, some will not have any upside scenarios,

and all will have a baseline scenario.

Upside and Downside Scenarios Some key risks will have both upside and downside scenarios. One example is competitor risk. New competitors may

enter the field, whichmay be a downside risk scenario, or a competitor may fail,

which may be an upside risk scenario. Several risk scenarios might be

developed for this risk, such as:

& Extremely pessimistic & Moderately pessimistic & Baseline (represents no risk occurring) & Moderately optimistic & Extremely optimistic

No Upside Scenarios Some risks will not have any upside scenarios. These are risks for which there is no expectation (in the strategic plan) for the event to

occur. One example may be a terrorist attack. There is usually no expectation

that a terrorist attack will occur that will directly impact the company. The risk

scenarios might include the following:

& Extremely pessimistic & Moderately pessimistic & Mildly pessimistic & Baseline (represents no risk occurring)

Although most companies will not have any upside risk scenarios for

terrorist attacks impacting the company, this would not be true for all

companies. A company that operates in a conflict region may well have a

baseline expectation built into their strategic plan, and resulting distributable

cash flow projections, that a certain number of terrorist attacks will occur. In

such a case, downside risk scenarios are those where the experience is worse

than expected—higher than expected frequency and/or larger than expected

impact. The upside risk scenarios here would be those where the experience is

better than expected—lower than expected frequency and/or smaller than

expected impact.

190 & Risk Quantification

C05 01/12/2011 11:1:16 Page 191

Another example of a company that might have upside risk scenarios for

terrorism risk is an insurance company that provides coverage for this risk. The

insurance company will have expectations, reflected in its pricing and

embedded in its strategic plan and resultant distributable cash flow projections,

regarding the likelihood and severity of terrorist attacks. Downside risk

scenarios are those where the experience during the period is worse than

expected, resulting in higher-than-expected claims payments. Upside risk

scenarios are those where the experience during the period is better than

expected, resulting in lower-than-expected claims payments.

Baseline Scenario All key risks have a baseline scenario. This is the scenario when no risk event occurs, but instead, the expectations of the strategic plan,

and resultant distributable cash flow projection, aremet. Technically, this is not

a risk event at all. However, it is important to keep this as a placeholder. This

will be useful in the next, and final, activity in the risk quantification ERM

process step: quantifying enterprise risk exposure. At that point, we will address

simulations where multiple risk scenarios can occur simultaneously. One of the

inputs needed for this is the likelihood of each individual risk scenario, and

the baseline scenario has its own likelihood to take into account. In addition,

the mechanics of the calculation are easier to visualize and perform if the

baseline scenario is treated as just another individual risk scenario.

Labeling of Individual Risk Scenarios

The ranking of an individual risk scenario implied by its label, such as ‘‘worst-

case,’’ may not always be borne out by the risk quantification. When initially

crafting the individual risk scenarios, the labels attributed to each risk scenario

are based on an early impression of the severity of impact. However, this does

not necessarily match the actual calculated financial impact. The risk quanti-

fication is a complex calculation. It involves projecting financial impacts into

future years, interactivity between dynamic financial line items, and the effect

of discounting for the time value of money over multiple years. In addition,

different mitigation arrangements come into play. Finally, risks impact different

business segments differently; for example, some regulations may negatively

impact one business segment, while simultaneously positively impacting

another business segment. How all these complexities play out is not always

apparent at the outset.

The good news is that the labeling of individual risk scenarios doesn’t

matter. All that is needed here is to produce an array of individual risk scenarios

Quantify Individual Risk Exposures & 191

C05 01/12/2011 11:1:16 Page 192

that adequately represent a robust range of possible events for each key risk.

The results of the individual risk quantification—quantifying each risk scenario

in terms of its potential impact on the baseline company value—will determine

its ultimate rank position.

Approaches to Developing Individual Risk Scenarios

There are two different approaches to developing individual risk scenarios:

1. Approach for risks with mostly objective inputs. The risks with risk

scenario inputs that are mostly objective are those for which a large

amount of objective external quantitative experience data is readily

available. These are typically financial risks. One example is equity

market risk, which is a financial risk for which there exists decades of

experience with daily (and intraday) data on its volatility (i.e., the

volatility of the major stock markets).

Developing discrete risk scenarios for these risks is relatively

straightforward. A richly detailed distribution of historical risk scenarios

is available from which to choose discrete risk scenarios. This distribution

provides fodder for both the individual risk scenarios themselves as well

as their likelihood. Several discrete risk scenarios are selected to repre-

sent the shape of the distribution, including its inflection points. The

likelihood of each discrete scenario is obtained by mapping it to a portion

of the nearly continuous historical distribution and summing the corre-

sponding likelihood.4

2. Approach for risks withmostly subjective inputs. The risks with risk

scenario inputs that are mostly subjective are those for which a large

amount of objective external quantitative experience data is not readily

available. These are typically strategic and operational risks. One example

is execution risk, which is a strategic risk, and for which there is no

external objective data available. The ability to execute the strategic plan

as expected is a completely unique risk to each company.

Developing discrete risk scenarios for these risks is relatively more

involved, in that it requires expertise in a specific technique. The tech-

nique used to do this is an adaptation of a technique from the manu-

facturing sector called Failure Modes and Effects Analysis (FMEA), which

was described in Chapter 3. The technique involves identifying the

appropriate internal subject matter experts and interviewing them to

define the risk scenario event, assign likelihood, and estimate the

192 & Risk Quantification

C05 01/12/2011 11:1:16 Page 193

quantitative impacts. An example showing a summary of the results of a

FMEA interview is shown in Figure 3.5 in Chapter 3. The results of the

FMEA interviews include all the inputs needed for quantifying individual

risk scenarios, including changes, or shocks, to the items impacting the

distributable cash flow projection. For most key risks, this typically

includes the following: & Changes to revenues, for one or more years & Changes to variable expenses, for one or more years & Changes to fixed expenses, for one or more years

For risks that materially change the company’s risk profile, a change in

the discount rate is also included.

The subject matter experts will often provide these inputs in terms of

ranges. For example, they may estimate that revenues next year would be

decreased by ‘‘approximately 10 to 20 percent.’’ The midpoint of the range

is typically used as the main input for the quantification and the endpoints

of the ranges are used for sensitivity analysis.

To enhance the development of risk scenarios, the ERM team supple-

ments the subject matter experts’ knowledge, where appropriate, with the

information collected in the risk event database. This information will

include, for the risk in question, the historical occurrences of the risk event

at the company (which helps form the likelihood assumption), how the

event unfolded as well as management’s actions (which helps form the risk

scenario event itself), and the ultimate financial impacts (which helps form

the impact assumptions).

Model Calculations

The value-based ERMmodel evolves along the waywith each of the activities in

the risk quantification ERM process step. In this activity—quantifying individ-

ual risk exposures—the model from the prior activity—calculating baseline

company value—is expanded to include two new capabilities: (1) shocks to

baseline and (2) stakeholder actions.

Shocks to Baseline

We have now finally arrived at the most fundamental element in the value-

based ERM approach: quantifying individual risks. Individual risks are quanti-

fied by their potential impact, or shock, to the baseline company value (and

other key metrics, also derived from the distributable cash flow projection). Our

definition of risk is any deviation from expectations. Expectations are defined as

Quantify Individual Risk Exposures & 193

C05 01/12/2011 11:1:16 Page 194

the baseline company value (or, equivalently, its baseline projected distrib-

utable cash flows).

The value-based ERM model is expanded to reflect shocks to the baseline

company value. This involves shocks to any element in the value-based ERM

model that impacts the baseline company value, which includes the distribut-

able cash flow projection and the discount rate. This affords a before-and-after

look at the baseline company value (and supporting key metrics).

Although this can be done manually by editing the baseline company

value model, that would be a crude, tedious, and error-prone approach. In

addition, it would not support the evolution of the model needed for the

next risk quantification activity—quantifying enterprise risk exposure—

where an efficient mechanism is needed to run numerous simulations

that include multiple simultaneous shocks. Therefore, it is necessary to

modify the value-based ERM model to efficiently accommodate shocks in

an elegant manner.

A key aspect of having an efficient ability to shock the baseline is to isolate

and highlight any elements that may change. By necessity, this evolves as the

work progresses to develop risk scenarios for the key risks. As new risk

scenarios are developed, new elements will be identified that will require

‘‘shocking’’ in the model. One example of this is where a risk scenario only

impacts a sub-segment of one of the business segments, in a situation where

the model had, up to this point, only included detail broken out at the business

segment level. In some cases, it may be advisable to modify the model to

include the additional detail, breaking out that one business segment into two

components, to isolate the business impacted by the risk scenario. Another

example is where a risk scenario impacts the different strata of salespeople in

different ways. Imagine that the strata differentiation is related to experience

level. It may be necessary to expand the model to separately track and project

recruitment, retention, and production levels for each stratum separately, to

efficiently handle the related risk scenarios.

Stakeholder Actions

In quantifying individual risk exposures, we are shocking the baseline

company value for those elements identified in the risk scenario develop-

ment exercise. This is no longer a static projection like the baseline valua-

tion model used to calculate the baseline company value. We are shocking

the system, moving from a baseline scenario to a new, post-risk event

scenario, or shock scenario. However, there is more to producing a shock

194 & Risk Quantification

C05 01/12/2011 11:1:16 Page 195

scenario than merely adjusting for the elements identified in the risk scenario

development exercise. We must also adjust for the dynamic reality of stake-

holder actions.

Stakeholder actions are reasonably predictable actions expected to be

taken by internal stakeholders, such as management, and external stake-

holders, such as rating agencies, in response to triggers created in shock

scenarios. An example of internal stakeholder actions is where, as a result of

the risk scenario, the amount of available capital falls to a level that

precipitates management actions to raise capital. The value-based ERM

model must take into account this reality, and modify the calculations to

dynamically reflect this. An example of external stakeholder actions is where

revenue declines to a level that precipitates a ratings downgrade by rating

agencies. Again, the value-based ERM model must reflect such dynamic

actions, triggered not from the individual risk scenario itself, but from the

fallout of its impact on other key financial line items, such as capital, revenue,

expenses, and such.

Output of Results

There are three main types of outputs we will discuss for the individual risk

quantification activity:

1. Shock of key metrics

2. Attribution of shocks

3. Comparative ranking of shocks

Shock of Key Metrics

The output of results from quantifying one individual risk scenario typically

includes the values for the key metrics, on both a baseline and a shock scenario

basis. To illustrate some common outputs, we continue our earlier example of

Pear, Inc., and consider the following individual risk scenario:

Risk: Execution of product strategy

Risk scenario: InfinityG, Pear’s sophisticated network, is found to have

technological problems

Partial summary of impacts from FMEA risk scenario development

exercise:

& Pear is forced to permanently lower its average price per unit from $250 to

$225.

Quantify Individual Risk Exposures & 195

C05 01/12/2011 11:1:16 Page 196

& Annual sales per salesperson permanently decrease from 750 to 725. & Pear is forced to permanently increase SG&A expenditures 10 percent, to

fund additional marketing.

Some common individual risk scenario quantification outputs are shown

in Table 5.2 for this risk scenario.

At this point, all we have done is individually quantify the risk scenarios.

We have not yet calculated any interactivity between risk scenarios, which is

part of the next risk quantification activity—calculating enterprise risk expo-

sure. Yet, this is still quite valuable information, and it immediately spurs

management action. Once management sees the potential impact to company

value, they take actions. These actions are further informed by the attribution

information discussed next. In addition, several case studies illustrating this

point are presented later.

Attribution of Shocks

By itself, calculating the shock impact of individual risk scenarios on

company value is powerful information. It shows management the con-

nection of risk to value, focusing priorities and clarifying a business case

for decision making involving mitigation. However, specific mitigation

actions are further informed by calculating an attribution of the individual

risk scenario shocks to company value. This reveals how much each com-

ponent risk driver contributes to the overall shock to company value. For

example, assume a risk scenario includes two component drivers—one being

a reduction in revenues and another being an increase in variable expenses.

The attribution would show how much of the total value shock was

separately caused by each component driver: the value shock from the

TABLE 5.2 Individual Risk Scenario Quantification Outputs: Pear’s Product Strategy Execution Risk Scenario

(in $ millions)5 Enterprise

Value

Five-Year Revenue

CAGR6 Five-Year eps7

CAGR

Baseline Scenario 1,907 7.98% 10.86%

Shock Scenario 1,571 5.03% 6.39%

Absolute Change %336 %295 bps8 %447 bps

Percentage Change

%17.6% %37.0% %41.2%

196 & Risk Quantification

C05 01/12/2011 11:1:18 Page 197

revenue decrease and, separately, the value shock from the variable

expense increase.

There are several ways to calculate attribution for each component driver.

Two examples of methodologies are as follows:

Method #1. Each component driver can be introduced, by itself, into

the baseline model, and the value shocks recorded separately; if the

component value shocks do not add up to the total value shock (due to

interactivity) then the remainder is allocated to the drivers, in pro-

portion to the magnitude of each component driver. Some component

drivers may be judiciously excluded when it is clear that allocation to

those drivers is not warranted.

Method #2. Each component driver can be cumulatively introduced into

the model, one at a time, in some chosen order, with each marginal

value shock attributed to the newly introduced driver.

As an illustration, we will perform an attribution calculation using our

earlier example of Pear’s product strategy execution risk scenario. The attribu-

tion is detailed in Table 5.3. We use attribution method #1. The initial attri-

bution’s results, prior to allocation of any interactivity, are shown in Column 1.

The sum of the individual component driver shocks to company value add up

to a reduction of $344 million, which does not equal the total company value

shock from our earlier example, which is a reduction of $336 million. This is due

to the interactivity of the component drivers. In this case, the combined impact is

less than the sum of the parts. We allocate the interactivity only to the first two

component drivers: reduction in average price per unit and reduction in annual

sales per salesperson. These two are the cause of the interactivity: The first one

lowers the average revenue on sales, but the second one reduces the amount

of sales, which offsets the impact somewhat. Column 2 in Table 5.3 shows an

allocation by magnitude between the first two component drivers. Column 3

verifies that the final attribution does indeed sum to the total company value

shock of $336 million. Column 4 shows the relative percentage contribution,

in percentage form, of each component driver to the company value shock. This

attribution helps management focus as they consider mitigation opportunities.

The case studies presented later will expand on this point.

Comparative Ranking of Shocks

Once the calculations are completed for all the individual key risk scenarios,

comparative outputs can be produced. The most important of these is a

Quantify Individual Risk Exposures & 197

C05 01/12/2011 11:1:18 Page 198

TABLE 5.3 Attribution of Company Value Impact: Pear’s Product Strategy Execution Risk Scenario

Column:

(in $ millions)

(1)

Initial

Attribution

(2)

Allocation of

Interactivity

(3)

Final

Attribution

(4)

Percentage

Reduction in average price per unit

%240 þ6 %234 70%

Reduction in annual sales per salesperson

%80 þ2 %78 23%

Increase in SG&A due to marketing costs

%24 — %24 7%

Sum of component drivers

%344 þ8 %336 100%

–25.0%–20.0%–15.0%–10.0%–5.0%0.0%

Modified Case Study

Individual Risk Quantification Company Value Impact

Consumer Relations Risk

Competitor Risk 1

Union Negotiations

International Risk 2

IT Risk 2

Loss of Key Distributor

Loss of Key Supplier

International Risk 1

Execution Risk

M&A Risk

Loss of Critical EEs

Legislation Risk

IT Risk 1

FIGURE 5.3 Ranking of Individual Risk Scenario Exposures

198 & Risk Quantification

C05 01/12/2011 11:1:22 Page 199

ranking of all individual risk scenario exposures in terms of their potential

impact on the baseline company value. This was illustrated in Figure 3.2 in

Chapter 3, and is repeated here as Figure 5.3. Once this is available for the

company value metric, it is also immediately available on the basis of the

other key metrics.

This is a very important output, as was discussed in Chapter 3. This is the

first time management sees a holistic view of all key risks—from all sources

including strategic, operational, and financial—quantified in terms of their

impact on a single consistent metric. This immediately shifts management

attention to the most highly ranked risks. In addition, this replaces the

rudimentary ranking produced by the qualitative risk assessment exercise

performed in the risk identification ERM process step. The first time this is

done, there are typically some surprises: Some risks thought to be large

turn out to be quite small or negligible, and other risks thought to be minor

end up ranked highly, sometimes even in the top five.

Case Studies

Five case studies are presented here to illustrate the quantification of

individual risk scenarios using the value-based ERM approach. These case

studies will illustrate the approach as well as the impact of the information:

the power of quantification, particularly in terms of the potential impact on

the baseline company value, to support management decision making. The

case studies presented focus on strategic and operational risks rather than on

financial risks, because approaches to quantifying the latter are fairly

straightforward, whereas a practical approach to quantifying the former

has been, up to this point, elusive for most ERM practitioners.

Case Study #1: Technology Data Security and Privacy

This case study involves an operational risk related to technology data

security and privacy. A midsize financial services company was surprised

to see that a risk scenario involving an external attack on their technology

ranked #3 in terms of its potential impact on company value. The risk

scenario envisioned a computer worm entering an unprotected device such

as a handheld device. The company had a policy in place to protect all such

devices but was aware that the policy was not widely enforced, leaving them

Quantify Individual Risk Exposures & 199

C05 01/12/2011 11:1:22 Page 200

vulnerable. The risk scenario illustrated here is an extremely pessimistic one,

which involved almost every bad event imaginable:

& Entire e-mail system disabled & All programs and files, and their backups, deleted & Customer lists stolen and sold to competitors for poaching & Customer credit card data stolen and fraudulent purchases made & Customer privacy data stolen

However, upon examining the attribution, it was immediately apparent

that the vast majority of the impact on company value was due to the last

item—customer privacy data stolen—and took the form of notification and

monitoring9 costs. The reasoning, as thought through during the FMEA risk

scenario development exercise, was as follows: Customer privacy data for

millions of people resides on several dozen computers, though the company

was unsure which computers they were. Because all programs and files would

be deleted, it would be impossible to determine whether all or only a portion of

the privacy data was actually stolen. As a result, the company would have to

pay for notification and monitoring costs for all those whose privacy data was

on their computers.

As a result of this individual risk quantification information, management

immediately made two decisions, both related to mitigation. They launched an

initiative to identify and secure the several dozen computers on which resided

the customer privacy data. This lowered the likelihood of the risk scenario. In

addition, realizing that they had unnecessarily maintained privacy data for ex-

customers, they decided to purge this data from their computers. This imme-

diately reduced the severity of the risk scenario by nearly half.

There are three main lessons illustrated by this case study. The first

lesson is that quantifying risk scenarios in terms of their potential impact on

value supports decision making. This risk exposure existed at the company

for some time, but management did not take action until they were shown

the magnitude of the risk expressed in terms of the potential impact on value.

The second lesson is that calculating the attribution by component driver

focuses management on mitigation opportunities. The attribution clearly

highlighted the privacy data on the computers as the largest driver of the

magnitude of this risk. As a result, management was able to immediately

focus mitigation efforts on this area, leading to two initiatives to mitigate the

risk. The third lesson is that the FMEA risk scenario development process

develops robust scenarios. This risk scenario reveals the kind of thoughtful

200 & Risk Quantification

C05 01/12/2011 11:1:22 Page 201

detail that can only be gotten by getting the internal subject matter experts to

think through specific risk scenarios, as well as the valuable nature of such

an exercise.

Case Study #2: Loss of Critical Employees

This case study involves an operational, human resources risk related to losing

critical employees. A large insurance company was quantifying risk scenarios

of situations where valuable employees are gathered together, leading to a high

concentration of exposure. In particular, they began to focus on the risk

scenario involving a plane crash on the way to a conference for sales leaders.

The company had a policy limiting the number of key employees on any one

flight but was aware that the policy was not always enforced, particularly for

these conferences. The sales leaders’ conferences were attended by high-

powered individuals who often wanted to fly on the same aircraft together.

In addition, these conferences were usually held at exotic locations for which

fewer flights were available. The risk scenario included the loss of the following

types of individuals:

& Top salespeople & Sales managers & A few senior executives

Upon review of the attribution, it became clear that, although the loss of

the top salespeople was significant, the larger portion of the value impact came

from losing their sales managers. The reasoning, as thought through during

the FMEA risk scenario development exercise, and as quantified by the value-

based ERM model, was as follows: Sales managers are the most difficult to

replace. They are extremely rare individuals. The salespeople are very loyal to

their sales managers, andmay have even come to the company in the first place

by following the sales managers. As a result, the retention of salespeople would

suffer in those offices where a sales manager is lost. The productivity of the

remaining salespeople in that office would also deteriorate.

As a result of this individual risk quantification information, management

immediately made a decision related to mitigation. They decided to strengthen

the enforcement of the travel limitations policy for concentration of key

employees on flights, particularly in relation to sales managers. In addition,

they reviewed other travel policies to uncover any additional mitigation

opportunities related to other modes of transportation.

Quantify Individual Risk Exposures & 201

C05 01/12/2011 11:1:22 Page 202

There are three lessons illustrated by this case study. The first is that

calculating attribution by component driver focuses management on mitiga-

tion opportunities. It was not at all clear, until this exercise, that the sales

managers represented the largest part of this risk exposure.

The second lesson is that value-based quantification is superior to the

traditional capital-based quantification common at insurance companies. Had

the insurance company used a traditional approach to quantifying risk, using

an economic capital model, it likely would have significantly underestimated

the impact of this risk scenario, causing it to remain unmitigated. This is

because most economic capital models ignore future revenues and expenses

related to new business in their baseline projection; instead they simply project

revenues and expense for the ‘‘inforce,’’ which is the business currently on the

books. Unfortunately, for this risk scenario and for the majority of strategic and

operational risk scenarios, the impacts are largely on future revenues and

expenses, as opposed to capital.

The third lesson is that despite the fact that the arithmetic is simple a value-

based ERM model is needed to project out the risk scenario impacts on value,

discount them to the current time, and produce a final calculation, including

attributions. An intuitive estimate cannot suffice. It is impossible to correctly

rank the risks, identify the largest component driver, and take appropriate

mitigation actions without crunching the numbers.

Case Study #3: Money Laundering

This case study involves an operational, human resources risk related to a

potential money-laundering incident. A leading U.S. nonpublic insurance

company was spending a significant amount of money on mitigation known

as anti–money laundering (AML). The spending got to the point where a senior

executive halted all further mitigation activities pending an analysis. He

thought that the mitigation might be excessive, particularly in light of the

risk in question. He asked, ‘‘How bad could this risk even be?’’ As a result, the

company requested a quantification of this risk. The risk scenario illustrated

here is a very pessimistic one:

& A severe money-laundering violation occurs & Fines are levied on the company & Criminal prosecutions follow & Media coverage is triggered

202 & Risk Quantification

C05 01/12/2011 11:1:22 Page 203

& Customer retention decreases significantly, more than what would be

expected at other companies, because the violation shatters the company’s

brand positioning as one of high integrity

The quantification revealed that the event would destroy nearly half

(45 percent) of the company’s value. When management learned of the

magnitude, their response was decisive: they immediately resumed their

spending on anti-money laundering efforts. They instantly became comfortable

with this decision. They didn’t ask about the level of precision in the calcula-

tion. They also did not even ask, nor care, about the estimated likelihood of the

risk scenario. It didn’t matter. Until this risk quantification exercise, they had

no idea that the potential impact on value was even on this order of magnitude,

which was a level for which they had the proverbial ‘‘zero tolerance.’’10

There are two lessons highlighted by this case study. The first lesson is that

the value metric leads to decision making. The shock to company value is one

that hits home. Value is the language of business decision-makers, and when

you speak their language, they understand: There is a significant threat to

something they have to care about. The second lesson is that the risk

quantification exercise adds value, despite its lack of precision. In this case,

the approximate nature of the calculation did not inhibit the usefulness of the

information to senior management. They became comfortable with their

decision and acted swiftly.

Case Study #4: Supplier Disruption

This case study involves a strategic risk related to a potential supplier failure. A

leading U.S. cleaning products manufacturer was quantifying their key risks.

One of the risks included losing a sole-source supplier to a fire. Some time

earlier, management had made a strategic decision to eliminate a backup

supplier for one of their minor product lines. This resulted in a sole-source

supplier situation, but this did not engender much concern, and was allowed to

continue unchecked for a long time. Just prior to the risk quantification

exercise, management was querying the sole-source supplier about their

mitigation procedures against fire damage. Their response was, ‘‘Hey, we’re

great at it. In fact, we’re so good at it that we cannot even share the details with

you, because it is highly confidential. We consider it a competitive advantage.’’

In reaction to this, management decided that, as part of their fiduciary duties,

perhaps they should quantify this risk.

Quantify Individual Risk Exposures & 203

C05 01/12/2011 11:1:22 Page 204

The quantification of a risk scenario in which a fire totally destroys the

supplier’s facilities revealed that this was, by far, the number one risk of

the company, in terms of its potential impact on company value. The impact

was approximately 12 percent of company value, whereas the next most

impactful risk had a potential impact of only about 9 percent. The reasoning,

as thought through during the FMEA risk scenario development exercise,

and as quantified by the value-based ERM model, was as follows: The loss of

the sole-source supplier would completely wipe out one of their minor

product lines. However, in addition, this would result in a loss of market

share in one of their major product lines. This major product line was in a

market with a very tough competitor who would swoop in and take away a

significant portion of their market share, which they would never fully

recover. The leveraging impact of the loss of market share on a permanent

basis, for all future projection years, is quite large, even after discounting to

the present time.

Management was surprised by this information, but also pleased. This was

good news. They immediately made a mitigation decision to begin the process

to qualify a backup supplier. This would take about one year and only about

two million dollars, which for them was very minor. This meant that they

would be able to report the #1 key risk, along with the others, to the board of

directors, and then within a relatively short time frame they would be able to

virtually eliminate the #1 key risk. With a backup supplier in place, the

likelihood of this risk scenario becomes so remote that this would be removed

from the key risk list.

There are two lessons demonstrated by this case study. The FMEA process

is an invaluable way to translate and share the knowledge of the subject matter

experts, those closest to the risks. In addition, the value metric is needed to fully

quantify risks. In this case, the full projection of lost revenues is required to

appropriately quantify this risk scenario.

Case Study #5: Poor Strategic Planning

I am often asked the question, ‘‘Aren’t there some risks that just cannot be

quantified?’’ The traditional notion that some risks simply cannot be quantified

seems to permeate much of the ERM literature and is pervasive among

traditional ERM practitioners. As discussed throughout this book, a value-

based ERM approach, in theory, allows for the quantification of any risk. This is

also borne out by actual experience, rather than mere theory. The case studies

above offer some evidence of this. However, one of the risks that may appear to

204 & Risk Quantification

C05 01/12/2011 11:1:22 Page 205

be the most difficult to quantify is the risk of a poor strategic plan. After all, how

can one gauge whether their strategic plan is poorly devised? That is why this

case study is one of my favorites. It illustrates one such situation, and how this

was done.

This case study involves a strategic risk related to poor strategic planning.

A global leader in the technology sector began implementing an ERM program.

They had just completed the risk identification ERM process step and wanted

to pilot a value-based ERM approach for the risk quantification ERM process

step. To test its viability, they chose what they believed to be one of the most

difficult risks to quantify: the risk of poor strategic planning. Management

was aware that they had a very entrepreneurial culture, and that they tended

to develop strategic plans that were extremely aggressive. They were usually

unable to achieve the strategic plan goals, but this failure was a result of

unrealistic goals, rather than poor execution of the strategy.

The quantification of this risk was elevated to an even higher level of

difficulty, like an Olympic high diver adding another twist to the dive, by the

fact that the company refused to provide us, their consultants, with their

strategic plan. Despite our having signed a nondisclosure agreement, their

strategic plan was deemed too confidential to share, as a matter of policy.

Because the first step in the value-based ERM quantification approach is to

develop a baseline valuation model, this was not the best of news. However,

we did have their public financial reports, and management did provide some

public statements they had made about their growth prospects. Using this

information, we developed a high-level baseline valuation of the company, as

well as a value-based ERM model to quantify the risk.

The risk scenario development meeting was conducted using the FMEA

method. The risk scenario illustrated here involves failures related to four

specific strategic plan elements that management knew were particularly

questionable in terms of their feasibility. One was an inability to achieve and

maintain the same price premium, which they had been able to charge in

their main market, in the new markets into which they had recently

ventured. Another was weaker-than-expected supplier relationships. The

remaining two elements were related to an inability to achieve expense

reductions expected from the integration of acquisitions. The quantification

of this risk scenario revealed a potential decrease of 20 percent of their

baseline company value.

There are two interesting aspects of this case study. The first one relates

to an interaction that occurred at the meeting where we first presented the

baseline valuation. On seeing the baseline valuation, including the

Quantify Individual Risk Exposures & 205

C05 01/12/2011 11:1:22 Page 206

distributable cash flow projection, the project leader pulled her team aside for

a hushed discussion. Following this sidebar, they expressed their concern

that perhaps we had somehow obtained a copy of their strategic plan.

Apparently, the baseline valuation resonated so well, even though it was

constructed at a very high level and relied on even more simplifying

assumptions than usual, that they found it difficult to believe we did this

without their actual strategic plan. We were able to persuade them that, in

fact, we only used public information. The interesting point here is that, as

discussed earlier, many modelers believe that ERM models must be highly

detailed, and use only precise assumptions, to be at all useful. This is simply

untrue, both in theory and in practice.

The second interesting aspect of this case study relates to the quantifi-

cation of the risk scenario. The magnitude of the shock—a 20 percent

decrease in baseline company value—was just about equivalent to how

much their employee stock options were out-of-the-money.11 This revealed

the level of bias in the strategic planning process. It is management’s job

to grow the value of the company, and in this case, one of their deep-

seated needs was to increase the stock price to the level at which the

stock options would be back at-the-money12. In other words, the market

was implicitly saying, ‘‘We don’t believe in your strategic plan,’’ to the extent

that they inferred what it was, ‘‘but rather we think you will fail to achieve

key elements of it’’ (perhaps the very same four strategic plan elements of

which management was skeptical). Essentially, management, through their

strategic plan, was saying, ‘‘We think we are worth our baseline company

value,’’ and the market was saying, ‘‘No, we think you are worth about 20

percent less.’’ Who is right? If management perfectly executes its strategic

plan, then they will have been correct, and the market capitalization should

increase about 20 percent. If the risk scenario discussed here ends up

occurring, with management missing four of its strategic plan elements,

then the market’s valuation will have turned out to be accurate. The truth

may turn out to be somewhere in between. However, the cost of not

achieving the strategic plan was now quantified. In addition, the attribution

revealed the relative contribution of achieving each of the four strategic plan

elements in question. This gave management insights into the added value of

additional efforts to achieve strategic plan goals, in the aggregate, as well as

the marginal relative benefits of focusing on any one of the four individual

strategic plan elements. This helped prioritize management efforts, as well as

make the business case for any proposed additional initiatives to support the

strategic plan goals.

206 & Risk Quantification

C05 01/12/2011 11:1:22 Page 207

There are four lessons highlighted by this case study. First, any risk can

be quantified, even one as challenging as the risk of poor strategic planning.

Second, the quantification of individual risk scenarios, including the calcu-

lation of baseline company value upon which it is predicated, need not be

hyper-accurate to achieve their purpose. In this case, the ERM model

resonated with management to a high degree, despite its total lack of inside

information in constructing the baseline enterprise valuation. Third, using

the value metric allows ERM information to be related to other key metrics,

such as, in this case, employee stock options (and their strike price). This

makes a smoother path for integrating ERM into key company processes,

including decision making (Chapter 6) and risk messaging (Chapter 7).

Fourth, the attribution of shocks into their component drivers facilitates

management focus and prioritization of actions.

QUANTIFY ENTERPRISE RISK EXPOSURE

The third step in the risk quantification ERM process step is to quantify

enterprise risk exposure. We will discuss three aspects of quantifying enterprise

risk exposure:

1. Input of data and assumptions

2. Model calculations

3. Output of results

Input of Data and Assumptions

Enterprise risk exposure, in its graph form (see Figure 3.3 in Chapter 3),

represents the full range of possible outcomes:

& Baseline is achieved (no risk events) & One risk scenario at a time & Two risk scenarios at a time & Three risk scenarios at a time, and so forth

The graph is a distribution where the horizontal axis represents severity, or

impact on baseline company value (or some other key metric), and the

vertical axis represents likelihood. Therefore, the enterprise risk exposure cal-

culation requires two types of inputs—those related to quantifying the severity

Quantify Enterprise Risk Exposure & 207

C05 01/12/2011 11:1:22 Page 208

of individual risk scenarios and those related to likelihood. Data and assump-

tions related to severity are already available, because they were developed

as inputs to the individual risk quantification.

There are two types of inputs related to likelihood:

1. Likelihood of individual risk scenarios

2. Correlation between individual risk scenarios

Likelihood of Individual Risk Scenarios

The first input related to likelihood—the likelihood of each risk scenario—is

also readily available. The more difficult part—estimating the likelihood of

each individual non-baseline risk scenario, for each key risk, was developed

in the risk scenario development exercises, which utilizes the FMEA tech-

nique. The easy part is estimating the likelihood for the remaining scenario—

the baseline scenario. This is calculated as 100 percent less the sum of the

likelihoods of the other individual non-baseline risk scenarios.

Correlation between Individual Risk Scenarios

The second input related to likelihood is the correlation between individual risk

scenarios. This must be developed. Most traditional attempts to incorporate

correlations into risk modeling have been debunked during the global financial

crisis that began in the United States in 2007. Most traditional approaches are

used in combination with stochastic risk scenarios, and, as a result, require a

generic automatic assumption about correlations between risk sources, which

is assumed valid across all of their corresponding individual risk scenarios,

rather than customizing the correlation assumptions for each pair of individual

risk scenarios. This means that traditional methods are attempting to encap-

sulate the correlation between two distinct risk sources using a single correla-

tion assumption. This would require that all risk scenarios resulting from those

two risks share the same correlation behavior. This is too crude of an estimate.

During the financial crisis, it was demonstrated that, when extreme risk

scenarios are at play, such correlation assumptions break down. Correlations

between risks behave quite differently ‘‘in the tail,’’ that is, at the extreme

negative edge of the distribution, which corresponds to the realization of two or

more simultaneous highly pessimistic risk scenarios.

With a value-based approach, which is used in combination with

deterministic risk scenarios, we avoid this difficulty. Rather than attempt

208 & Risk Quantification

C05 01/12/2011 11:1:22 Page 209

to paint correlations broadly, as if they are uniform by risk source, we produce

an assumption for each pair of individual risk scenarios. This may initially

appear to be a daunting task, because there may be over 100 individual risk

scenarios. However, the vast majority of individual risk scenario pair combi-

nations are independent, which means they are uncorrelated, that is, they

have a correlation of zero. The vast majority of key risks are strategic and

operational risks, as opposed to financial risks. Most strategic and operational

risks are independent of each other. For example, the risk that the strategy is

flawed is uncorrelated with an information technology failure, which is

uncorrelated with a regulatory change, and so on. Although it is necessary

to consider each pair-wise combination, wide swaths of this work are

instantly completed using this realization.

For those individual risk scenario pairs that are correlated, the cor-

relation must be estimated. For those risks for which objective external data

is readily available, which are usually financial risks, the correlation data

is available from the investment department. For the remaining ones, a

simple approach is to simply guess at it, using the appropriate sign and

rough magnitude.

Why is this reasonable? Because correlations in general, and even corre-

lations for risks for which objective external data is readily available, are

mysterious relationships that (a) nobody can honestly claim to know with

much certainty, particularly in regard to how they behave when you most

need to know this, that is, ‘‘in the tail,’’ and (b) do exist, and should at least have

some accounting for them in the calculation of a distribution of outcomes, such

as enterprise risk exposure.

So, if two individual risk scenarios are thought to be moderately positively

correlated, assign a value to the correlation. It is naturally going to be a fairly

arbitrary value, but it should at least reflect the direction of the correlation (in

this case, positive), and the correlation’s magnitude should at least reflect, in

relative terms versus the assignment of other correlations, the degree of

correlation (in this case, moderate).

Model Calculations

The calculation of enterprise risk exposure consists of the following three steps:

1. Selecting simulations

2. Calculating impact

3. Calculating likelihood

Quantify Enterprise Risk Exposure & 209

C05 01/12/2011 11:1:23 Page 210

Selecting Simulations

Each simulation represents one possible future for the organization. A simula-

tion may be visualized as a vector, whose length is equal to the number of key

risks, and where each vector position indicates the risk scenario selected for its

key risk. An example of this is shown here:

Simulationi ¼ ðRisk1Sceni; Risk2Sceni; . . .RisknSceniÞ

Where:

& i ¼ the simulation number & RiskxSceni ¼ the risk scenario from key risk x that was selected in

simulation i; this can include one of the pessimistic scenarios, one of the

optimistic scenarios (if any exist), or the baseline scenario for this key

risk (which means that no risk event occurred) & n ¼ the number of key risks

The number of simulations required to run every possible combination of

risk scenarios developed, for the key risks selected, gets prohibitively large very

quickly after a handful of key risks and risk scenarios. Shortcuts are used to

select the set of simulations that will produce a representation of the enterprise

risk exposure distribution that is sufficiently robust as well as stable. This is

somewhat of an art form, and various techniques can be used to do this.

One example of a practical approach to selecting an appropriate but

manageable set of simulations involves the following three steps:

1. Set maximum run time. The first step is to decide on the maximum

desired model run time. Ideally, the value-based ERMmodel should be able

to perform the enterprise risk exposure calculation within a matter of six to

eight hours, although some companies find a run time of up to 12 or even

24 hours an acceptable time frame. The run time must be short enough to

be practical in terms of running multiple iterations of the model when

needed. In addition, it must be rapid enough to be practical in terms of

effectively supporting decision making, particularly at the highest levels,

where speed is of utmost importance.

2. Determine maximum number of feasible simulations. The maxi-

mum run time decided on in the first step is used to back into the maximum

number of simulations that can be feasibly calculated within that time

frame. For example, assume the maximum run time is set at six hours. Run

the model with 10,000 simulations, and record the run time. If the run

210 & Risk Quantification

C05 01/12/2011 11:1:23 Page 211

time is one hour, then 60,000 is the maximum number of simulations that

can be run within the six hour maximum time frame.13

3. Determine simulations needed for stability. In this step, an initial

number of simulations—well below the maximum number of feasible

simulations—are randomly generated, using stochastic techniques, and

then run through the value-based ERM model to calculate a first value

for enterprise risk exposure. It is important to note that the stochastic

element here is only involved with the selection of which deterministic

risk scenarios will populate the simulation vectors, rather than using

stochastic techniques to actually construct the risk scenarios. After this

first value is calculated, a second value is calculated using a new set of

randomly generated simulations. The values are then compared to see if

they are within a reasonable tolerance level of each other. If there is

reasonable stability, then the initial number of simulations becomes the

final number of simulations. However, if the first value is not within an

acceptable tolerance level from the second value, the process must be

repeated, each time increasing numbers of simulations, until stability is

achieved.

If the final number of simulations required for stability exceeds the

maximum number of feasible simulations, there are a few options. If the

increase in the number of simulations required results in aminor increase in

run time, management may simply choose to accept this. However, if the

run time is unacceptably long, one option is for management to allocate

more computing resources, using parallel processing to shorten the run

time to a reasonable level. Another option is to revise the calculation to

include a number of deterministic simulations, along with the stochastic

ones, to make the calculation more stable with fewer numbers of stochastic

simulations. Such deterministic simulations typically include those simu-

lations which are more significant, either due to high likelihood and/or

high severity.

Once the simulations are selected, they are locked into the model,

and not allowed to change from one model run to the next.14 This adds

further stability, by avoiding the ‘‘noise’’ that would be present if the

stochastic simulations were refreshed with each model run.

Calculating Impact

Once the simulations are determined, each simulation is run through the

value-based ERM model to calculate its impact on the baseline company

Quantify Enterprise Risk Exposure & 211

C05 01/12/2011 11:1:23 Page 212

value (and other key metrics), and the results are recorded. Simulations that

have more than one risk scenario occurring simultaneously will have their

shock inputs, from the FMEA risk scenario development exercises corre-

sponding to each risk scenario, aggregated together. The value-based ERM

model will then calculate the integrated impact of the multiple risk scenarios

occurring together. This is a powerful aspect of the model: the ability to see

how multiple risk scenarios interact, and to measure the net impact on the

organization.

Calculating Likelihood

The likelihood of a simulation is calculated bymultiplying the likelihood of each

individual risk scenario in the simulation vector, initially assuming indepen-

dence of all risk scenarios, and then multiplying this by a correlation adjust-

ment factor.

PðSimiÞ ¼ PðRisk1SceniÞ ' PðRisk2SceniÞ . . .' PðRisknSceniÞ ' CAF

Where:

& P(x) ¼ probability of x & Sim ¼ simulation & i ¼ the simulation number & RiskxSceni ¼ the risk scenario, from key risk x, that was selected in

simulation i; this can include one of the pessimistic scenarios, one of

the optimistic scenarios (if any exist), or the baseline scenario for this key

risk (which means that no risk event occurred) & n ¼ the number of key risks & CAF ¼ correlation adjustment factor

Adjustments must be made to account for correlations wherever the

simulation includes the occurrence of two risk scenarios that are not

independent. There are numerous methods that may be used to do this,

ranging from the simple to the complex. A simpler approach is preferable,

because it avoids the pretence that the true correlations can really be known

with much certitude. This is another example where the rule of significant

digits comes into play. Many risk modelers spend a significant amount of time

and effort refining their correlation approaches and assumptions further and

further, as if this is the differentiator between success and failure of an ERM

program. Although the interaction between multiple risks is a key factor in

212 & Risk Quantification

C05 01/12/2011 11:1:23 Page 213

ERM, there is more than one way to reflect risk interactivity, and the

correlation adjustment is the least important of all of them. See ‘‘Capturing

Interactions.’’

One simple way to perform this adjustment is to use a correlation

adjustment factor that is the multiplicative product of individual pair-

wise correlation factors. For example, if a simulation includes only one

pair of risk scenarios that are correlated, a single individual pair-wise multi-

plicative factor is applied to the simulation probability. When a simulation

includes more than one pair of risk scenarios that are correlated, each

individual pair-wise correlation adjustment factor is similarly applied multi-

plicatively to the simulation probability. The formula showing the correlation

adjustment factor as the multiplicative product of individual pair-wise corre-

lation adjustment factors is shown below:

CAF ¼ IPCAFRiskdSceni;Riskf Sceni ' IPCAFRiskrSceni;RiskmSceni ' . . .

Where:

& CAF ¼ correlation adjustment factor & IPCAFRiskxSceni;RiskySceni ¼ individual pair-wise correlation adjustment fac-

tor, for the combination of risk x scenario i occurring simultaneously with

risk y scenario i

There are four different situations involving the individual pair-wise correlation

adjustment factor (IPCAF):

1. If the two risk scenarios are positively correlated, then the IPCAF will

increase the simulation probability (i.e., the IPCAF will be greater than 1).

2. If the two risk scenarios are uncorrelated, then the IPCAF will not change the

simulation probability (i.e., the implied IPCAF will equal 1, though

technically no IPCAF applies unless the pair are correlated).

3. If the two risk scenarios are somewhat negatively correlated, then the IPCAF

will decrease the simulation probability (i.e., the IPCAF will be greater than

0 but less than 1).

4. If the two risk scenarios are 100 percent negatively correlated, meaning that

it is impossible for them to occur together, then the IPCAF will zero-out the

simulation probability, eliminating it entirely (i.e., the IPCAF will be zero

and therefore the CAF will also be zero).

Quantify Enterprise Risk Exposure & 213

C05 01/12/2011 11:1:23 Page 214

CAPTURING INTERACTIONS

Traditional approaches to ERM determine risk scenarios, and measurethem, in silo form, or one at a time. After that, there is an attempt to capture all the risk interactivity through a correlation adjustment to likeli- hood. This is not enough. One of the key ERM criteria is to have an integrated approach that fully captures the interaction between two or more risks. This was discussed as Criterion 4 in Chapters 2 and 3. There are three techniques that the value-based ERM approach uses to account for these interactions:

1. Risk scenarios

2. Impact calculations

3. Correlation adjustments

Risk Scenarios

The first technique to address risk interactivity is to reflect it directly in the risk scenarios themselves. In the value-based ERM approach, deterministic risk scenarios are developed using the FMEA technique. This involves a thought- provoking process where subject matter experts are asked to think through individual risk scenarios for key risks that are defined by their source. This allows the experts to consider all the downstream impacts flowing from the risk source, including those that are primary, secondary, and so on. Some of these impacts include triggering other risk scenarios related to different risk sources, which are then incorporated directly into the risk scenario. For example, an extremely pessimistic pandemic risk scenario may be assumed to trigger an economic downturn risk scenario, which then has its own set of cascading impacts and implications, which will be embedded directly in the pandemic risk scenario.

This is one of the two most powerful ways to reflect the interaction between risks. It provides a realistic portrayal of the risk interaction and how it would occur in the real world. This draws out the knowledge of the subject matter expert, who is closest to the risk and to the business. In addition, this provides a tailored approach to examining risk interactivity. As opposed to a formulaic approach using a single correlation metric across all risk scenarios for a given risk, this allows us to incorporate customized risk interactivity assumptions for each specific risk scenario.

Impact Calculations

The second technique to address risk interactivity is to reflect it directly in the calculation of the impact on company value (and other key metrics). The value-based ERM approach allows the quantification of two or more risk scenarios directly within the value-based ERM model.

214 & Risk Quantification

C05 01/12/2011 11:1:24 Page 215

Output of Results

There are four types of outputs from the enterprise risk exposure quantification:

1. Enterprise risk exposure—graph form

2. Enterprise risk exposure—table form

3. Downside standard deviation

4. Other outputs