Enterprise Risk Management in a Nutshell

Dennis Cox

• Publisher: Business Expert Press
• Year: 2017
• Print ISBN: 9781947098442
• eBook ISBN: 9781947098459
• Topic: Business
• Subtopic: Finance
• Index: Business

Risk management is an often-used phrase that is rarely fully embedded within the business process and procedures of firms. This book looks at the challenges faced in implementing a risk management framework as well as the key elements of such a framework. It is designed for the business professional that is not an expert in risk management and addresses all of the major risks that are likely to be faced in practice, considering the risk mitigation and measurement techniques that are most likely to be relevant. This is an intermediate book and accordingly does not focus on the mathematical elements but rather provides a readable entry text for anyone seeking information on this important subject.

CHAPTER 1

What Is Risk?

In business, everything you do is related to a consideration of risk and reward. Businesses take risks all the time. Risk is not a four-letter word and is not to be avoided. Rather, it is to be managed and controlled. Businesses need to take the risk that it is appropriate for them to take while, at the same time, measuring and managing that risk to ensure that it is effectively aligned with stakeholder expectations.

Let us consider what that is likely to mean in practice. Any business intends to deliver something to someone. Whatever they deliver needs to be of some perceived benefit to the recipient or they would not purchase the goods or service. They could just copy what is on the market already, but there is a risk that the existing product already has an established brand and customer loyalty, forcing the new market entrant to what might be a lower price strategy. They could produce a cheaper version, but it could be less reliable, damaging the new entrant brand. They could try to make the product better than the current market product, but this could involve excessive costs, and the market may not perceive value in the improvement. They could just copy the cost structure and product of the incumbent firms, but this may result in an infringement of patents or copyright.

Every option includes some level of risk, which the firm needs to take to achieve a reward. So, risk is everywhere and needs to be considered appropriately.

By saying that risk is not a four-letter word, I am suggesting that risk should not always be avoided. If a firm takes no risk at all then it cannot do any business, have any staff, or premises, or any customers. It is not possible for a business to operate without taking risks.

All of you reading this book will have taken some risk today, risks that are acceptable to you. You will have woken up. I can be sure of that because sleeping people do not tend to read many books! Having woken up, your first decision of the day is whether or not to get up. You could read the book in bed or read it somewhere else. That is a decision, but what are the risks? If you read this book in bed as soon as you wake up, apart from being a rather sad individual, you will also not have had any breakfast. If you get up and have breakfast, then you may not read the book.

Life is full of decisions and each of these has a risk assessment that needs to be taken into account. To do this, you use the world’s greatest neural modeler, which is sitting between your ears.

How does this play out in business? If you decide you want to start a business, you are immediately confronted by a range of questions.

Even the initial question is fraught with risk. Leaving a full-time employed role to start your own business is clearly a risk. However, if you did not have a job, then starting your own business could be seen to be less of a risk. In the first case, the entrepreneur gives up certainty of income and the support of an existing company for the hope of a more successful future. So, what are the risks? They are many, including the following:

• The risk that the new venture will be unsuccessful and will fail because the idea or its implementation are poor
• The risk that the new venture will not be able to raise the funds it needs to meet its liquidity or capital needs
• The risk that the new venture will not have the skills necessary to be successful
• The risk that the entrepreneur will not be able to get a role of equal level once the new venture has failed
• The risk that the partner of the entrepreneur may not share this risk-taking spirit and prefers food on the table and shiny red bicycles for the children, rather than hoping for a future nirvana

So, poverty, loss of status, divorce, and depression are all risks that the entrepreneur needs to face. Of course, the entrepreneur who starts without a job is also taking risks, although some of these may be seen as being lower than that of the successful employee. In this, the final two risks still exist although they could potentially be a little lower. How could you get a lower salary if you do not have a job? Would you be as worried about your future if you were unemployed and did not appear to have much of a future? Without answering any of these issues, it is clear that unemployment and career change can be the catalysts for someone deciding to become an entrepreneur.

Having achieved that transition, I know this to be true.

So, everything in business focuses on the taking and managing of risk. Indeed, I view risk as being the currency of human activity, not money. Making money is often a consequence of risk-taking, not its cause. A gambler putting $400 on 15 at a casino is not doing it with the expectation that they will generally win. There is the balance of hope over experience and money is how the risk is expressed. The risk is better shown through using probability, the probability that the next number will be 15. The gambler knows it probably will not be, but that the return will be great if it is. This return is not only expressed in pure monetary terms, but also in the feeling of wellbeing and elation that the gambler feels. It therefore is not to be measured purely in terms of monetary value. So, risk is a concept that encompasses many things and it is only through obtaining a thorough understanding as to how risk impacts on your business that you will get to the heart of effective enterprise risk management. Indeed, the failure of many firms to fully understand their risk profile and the uncertainties that are inherent in their business is why so many companies fail in practice.

CHAPTER 2

The Role of Enterprise Risk Management

Enterprise risk management has, at its core, a simple concept, that is, that a business needs to at least understand all the risks that it is currently facing or is likely to face in the future. Some of these risks, it will be able to measure and manage; whereas others it will need to react to. Let us start with what is perhaps the normal summary of risks and consider how this leads to enterprise risk management. Generally, risks may be analyzed into the following categories:

• Credit risk
• Market risk
• Liquidity risk
• Operational risk
• Strategic risk
• Reputational risk

As soon as you start with any such analysis, you need to ensure that all of the risks that your firm faces are analyzed and classified under these risk headings. Of course, these risks are all different and they could consequently be measured and managed differently. However, there is a problem with managing risks in silos and this results from the different ways in which they are managed. One of the challenges of effective risk management is to ensure that all risks are managed on a consistent basis enabling management to understand the nature of their risk environment in total.

There is also a concern that there could be a disconnect between the risk function and the management of the enterprise. It is incumbent upon risk professionals to provide their reporting and information in a format and with explanations that are intelligible by their audience and not by other risk professionals.

Returning to the risk analysis, let us consider each of these risks individually. You will then see the issue regarding modelling and data consistency.

Credit Risk

Credit risk is the risk that someone is not going to fully meet their financial or debt obligations. The firm may have sold goods or services to someone. There is then a risk that they will not make the payment in accordance with your payment terms. Credit risk is not just that they may not pay, it is also that they may pay late. If you lend money to a friend, you know you are unlikely to get it back. Again, that is credit risk except that the accounting in this case is debit cash, credit experience.

For credit risk to occur, you will need to be owed something; which, of course, does not need to be cash. If you are building a machine for a customer you may not be able to raise an invoice until the equipment is completed. However, the knowledge that you intend to sell the equipment to a customer means that you are already incurring credit risk even though the invoicing date has not been reached.

If you lend your car to a friend and they do not return it, then this again is probably credit risk. You have lost the monetary value of the car and this is still held by the former friend. In this case, the accounting treatment is debit cash, credit stupidity.

In terms of measuring credit risk, you need to know what you are owed, and this will typically need to be measured in monetary form. By looking at what has happened before, as shown in historic databases, perhaps supplemented by external information which could include agency data, the company is able to assess the likelihood that the customer will meet their obligations. This likelihood is passed on to the clients typically by providing a lower price or discount to the better credit quality customer, and this is what is referred to as differential pricing.

Essentially, credit risk management uses historic data to try to predict the future. That of course leads to the conclusion that credit modelling is at its best when future performance is clearly related to historical loss experience, a theme we will return to later in later chapters.

Market Risk

Market risk arises typically from a change in the price of something. It is not about a change to the market itself since that is actually included within strategic risk, as we shall see later. So, where does market risk tend to turn up? If a company has a commodity that forms part of their product, copper wire for example, or oil, then they will need to acquire the copper or oil before they make their product. The price they will have to pay will fluctuate, based upon the market movements. In the case of commodities there are markets on which these assets are quoted, which can provide a base price, the London Metals Exchange (LME) and the International Petroleum Exchange (IPE), for example.

By looking at movements in price of the specific commodity on the relevant exchange, the firm can see whether the cost of their commodity is rising or falling. The impact of reprising the commodity to market price is market risk, as indeed is the impact of any future change in the price.

Another place where this turns up is in the area of currency risk. Currencies vary considerably, as anyone going on holiday away from their own currency zone knows only too well. If a firm is in the U.S. dollar zone, that is they report in U.S. dollars and the majority of their costs and income is in dollars, then anything they do in a currency other than U.S. dollars is a foreign currency transaction.

If the U.S.-based firm is selling to Germany, they will perhaps have been required to quote their price in Euros. As the rate of exchange between the U.S. Dollar and the Euro varies, the firm will either receive more or less U.S. dollars as a consequence of currency movements. This loss is also market risk. To illustrate this risk, consider the following:

A U.S. company sells industrial equipment to a German company for €125 million. If there is Euro–Dollar parity (in other words $1 = €1), then the U.S. firm will receive $125 million, which is perhaps what they budgeted for. However, if the exchange rate changes to €1.25 = $1, then they will receive only $100 million, a market risk loss of $25 million or a margin loss of 20%.

So just as failing to receive the €125 million payment from the German company would be credit risk, an adverse movement in the Euro/dollar exchange rate would be market risk.

In terms of judging market risk, the required information is generally available on exchanges and markets, with it then being published in public information sources. There is no shortage of information about the past again the past is often used to predict the future. However, this is also supplemented by information about future expectations as shown in forward prices and contracts.

Another area where market risk arises is in equities and bonds. Equities are shares in the ownership of a company normally traded on an exchange. Bonds are essentially loans or debts issued by a firm, which can be traded on a secondary market. Both of these instruments trade on exchanges such as the New York Stock Exchange (NYSE). The NYSE will show the trading price of the instrument in real time, so finding a current market value is not a problem.

Firms hold equities and bonds in two main places. They can hold them directly in their balance sheets or in their pension funds. You could mark these positions to market by working out how much you would actually receive for the position held today by revaluing using the current price on the exchange. The price will have either gone up or down, or stayed the same. Any difference that arises is the consequence of market risk. It is an important concept to understand that market risk is not always negative and that you can be paid for the risks that you are taking, even in an investment environment.

Liquidity Risk

Liquidity risk is another main risk category and is distinct from market risk. Whereas market risk is essentially looking at the impact of an asset or liability being reprised, liquidity risk is dealing with a much simpler concept, that of running out of money.

We all know what running out of money means. You have gone out for an evening with a certain amount of folding currency and some credit cards. Suddenly, you find that you have used all of your currency and your credit cards are being rejected. You have become illiquid.

In companies, this can happen in many ways and some of these are a little counterintuitive. Companies are funded in many different ways, including by the following:

• Equity issuance
• Bond issuance
• Not distributing reserves
• Loans
• Overdrafts
• Credit cards
• Creditors

Any excess assets that the firm holds will be held in some form of investment or cash account.

If the firm is unable to pay its debts, then at some stage, it will have difficulties. It could potentially delay paying creditors or raise more funds from investors or its bank. If it is not able to do any of this it may have a real problem, but there may be other things they can do. It could be that they own a property and can sell this to an investor, leasing it back. The accounts receivable book could also be used to support funding through using either invoice discounting or factoring.

Cash is king in any business and its close management is always important. However, the growing business also requires support. As it grows it takes on more inventory or stock and has increasing debtors or accounts receivable, as well as creditors and accounts payable. Smaller firms are generally paid later by larger firms, which exacerbates the problems for the developing business since it needs to ensure that its staff and suppliers are paid on a timely basis.

The consequence of this is that it is the growing firm that often runs out of cash, rather than the failing firm, which perhaps bizarrely releases cash as it fails. As the firm declines, it uses up its inventory, which it does not replace. Its accounts receivables slowly do pay, but they are also not replaced. At the same time, it does not take on new accounts payable since it will not need new inventory. It is when things turn for the better that the firm tends to have liquidity problems.

How do firms manage liquidity? Market risk looks at the current asset prices and takes that price supplemented by future data if that is avai...

Table of contents

• Cover
• Half Title Page
• Title Page
• Copyright Page
• Contents
• Background
• Chapter 1 What Is Risk?
• Chapter 2 The Role of Enterprise Risk Management
• Chapter 3 The Key Building Blocks
• Chapter 4 Risk Governance
• Chapter 5 Embedding Risk Management in the Business
• Chapter 6 The Problem of Quantification
• Chapter 7 Risk Appetite
• Chapter 8 Risk Register
• Chapter 9 The Three Lines of Defense Model
• Chapter 10 Risk Training
• Chapter 11 Risk Metrics
• Chapter 12 Internal Loss Data
• Chapter 13 Risk and Control Self-assessment
• Chapter 14 Stress Testing
• Chapter 15 Liquidity Risk
• Chapter 16 Credit Risk Management
• Chapter 17 Putting It All Together
• Index