The New Risk Toolkit

Risk management has long been viewed as a process involving several well-defined steps including:

* Risk identification

* Risk assessment and/or quantification.

* Identification

* Evaluation of mitigating options.

* Implementation of the preferred mitigating option(s)

* Monitoring the results

In recent years, discussion has related to improvements in risk assessment (for example, computer simulation and risk mapping exercises) and greater choice in risk mitigation tools (including Alternative Risk Transfer (ART) forms such as captives, finite risk and securitization). However, firms failing to properly identify risks do not reach the point in the process where they are able to take advantage of these advancements.

It is important to recognize what risk identification tools are available for use prior to undertaking the widely-accepted approach of risk mapping exercises. Risk mapping in the context of this article consists of ranking significant risks along a two-dimensional grid. One dimension is usually labelled as the “frequency,” is should more accurately interpreted as the likelihood of an exposure resulting in an event that will most likely be negative. The second dimension is “severity,” or the magnitude of the impact of such an event on the organization. Given such a grid, the organization can then prioritize with regards to what risks to address first.

Information about these risks and their associated frequency and severity is gathered through interviews with key decision-makers within the organization. This is a resource-intensive methodology, but it is considered it to be one of the best ways to get a complete view of how risk impacts the firm. It is time to explore how this traditional risk mapping process can be made more efficient with tools adopted from accounting, corporate finance, and strategic planning. These tools include:

* Income statement analysis

* DuPont five-part decomposition

* Michael Porter’s five-force industry analysis (an adaptation)

RISK MANAGEMENT AND STRATEGIC PLANNING

All events, positive and negative, will eventually manifest themselves in some form of financial impact. The relationship between risk management and accounting may therefore be intuitive. However, the relationship between risk management and strategic planning deserves some elaboration.

One approach to strategic planning is the analysis of an organization’s strengths, weaknesses, opportunities and threats – the so-called SWOT analysis. In this context, the objectives of risk management are to minimize the likelihood and/or impact of:

* The organization’s strengths being impaired.

* The organization’s weaknesses being exposed and/or exploited by competitors.

* Failure by the organization to fully realize its opportunities.

* The materialization of threats from internal or external sources.

In summary, strategic planning focuses on the maximum realization of the organization’s earning potential, with the emphasis being on “offence.” Risk management, on the other hand, focuses on the minimization of any impairment to the organization’s earning potential, with the emphasis being on “defence.” In addition to addressing how to respond when negative events befall the organization, risk management also takes the initiative to anticipate what can go wrong; it helps determine when, where, why and how the organization’s strategic plan may be vulnerable. It’s a small wonder, then, that the following tools – which have long been applied to strategic planning – are now being adapted as part of the analytical arsenal for risk management.

INCOME STATEMENT ANALYSIS

Income statement analysis has long been used as a source for deciphering an organization’s cost structure and its profitability margins. In this approach, all items in the income statement are expressed as a percentage of total sales. This indicates how gross revenues are attributed to the various cost and applicable tax components on a percentage basis. The portion left over, after all costs and taxes have been accounted for, is available for net profit.

This methodology provides a very quick and convenient way to identify major cost items. If the analysis is repeated using several years of data, it also provides a good illustration of relative cost trends over time.

One approach the risk manager can take is to focus on the major cost items that take up the greatest portions of the total sales revenue. The premise here is that the factors contributing to these major cost items, if neglected, have the greatest potential to erode profitability. Risk managers can therefore use income statement analysis to identify and further investigate the volatility of these factors at the risk-mapping interview stage.

If these analyses are performed on several industry participants, an organization can obtain an indication on how well it is performing with respect to its peers. Such benchmarking can often indicate the relative strength or weakness of an organization; based on this information, the risk manager can adopt a more focused approach at the risk mapping interview sessions.

For example, in preparation for risk mapping interviews with Company XYZ (see Chart A), one might address these questions:

* What might affect, positively or negatively, the four significant revenue sources for this company (petroleum and chemicals; forest products; grain and fertilizers; and intermodal)?

* What might affect, either positively or negatively, the company’s two major cost components (labour and fringe benefits, and purchased services and materials)?

When possible, income statement analysis can also be performed on segmented information. This allows a better understanding of the significant drivers in each business segment of the enterprise. Early indications from these pre-interview analyses, based on publicly-available information, can help define and refine the direction of the risk-mapping interviews with key internal decision makers and hence to “insider” insight.

DUPONT 5-PAR DECOMPOSITION

DuPont five-part decomposition is another tool adopted from the financial disciplines. The objective is to focus on profitability numbers, breaking down the usual measure of return on equity (ROE) into five contributing factors. By representing ROE as the product of five key ratios, one can then analyze how each of these factors affects the overall profitability of the organization. As each ratio increases or decreases, so too does the ROE. In order to detect trends over time, this analysis is usually performed on historical financial data over a continuous period, say for three to five years.

From a risk management perspective, the key is to evaluate how each of the five ratios has performed over time. Ratios with consistently high values may point to organizational strengths, and those with consistently low values may suggest areas for improvement. A risk manager’s task is to protect the “high” ratios against impairment, while at the same time reducing the volatility of ratios that vary substantially over time. The DuPont analysis highlights “high”, “low” and “volatility” ratios; in doing so, it provides areas on which the firm might focus its risk-mapping interviews.

Mathematically, the DuPont five-part decomposition is usually represented by the formula:

Return on equity (ROE) =

[Net income/earnings before tax (EBT)] x

[EBT/earnings before interest and tax (EBIT)] x

[EBIT/gross sales revenue ] x

[Gross sales revenue/total assets ] x

[Total assets/shareholders’ equity]

It is integral to understand each ratio in order to properly utilize the formula:

Ratio 1:

Net income/earnings before tax (EBT) This ratio indicates how well the organization manages its tax efficiencies. The higher the ratio, the more tax-efficient the organization is. A tax-efficient organization retains a greater portion of its before-tax earnings as net income.

Ratio 2:

EBT/earnings before interest and tax (EBIT)

This ratio indicates how well the organization manages its financing charges. The higher the ratio, the more efficient the organization is in financing its debts.

Ratio 3:

EBIT/gross sales revenue (sales) This ratio indicates how well the organization manages its input and operating costs. The higher the ratio, the more efficient the organization is in controlling its costs. This, in turn, results in a greater portion of sales revenue flowing into EBIT.

Ratio 4:

Gross Sales Revenue/ Total assets

This ratio indicates how well the organization deploys its assets to generate sales revenue. The higher the ratio, the more sales revenue the organization generates from each unit of asset.

Ratio 5:

Total assets / Shareholders’ equity This ratio indicates how well the organization leverages shareholders’ equity into total assets. This identifies the organization’s strategy regarding the issuance of debt. The higher the ratio, the more debt generated from each unit of equity.

The example in Chart B (see page 29) indicates the key risk management focus may be on how Ratio 2 (EBT/EBIT) and Ratio 3 (EBIT/Sales) might be impaired; or more accurately, how the rising trend of these two ratios might be impeded by chance events.

ADAPTING PORTER’S 5-FORCE MODEL

Michael Porter’s five-force model (Chart C, see page 29) is a valuable framework for analyzing competitive positions within and among industries. The adapted Porter framework examines the following five relationships:

* The relative bargaining power among an industry’s participants.

* The relationship between each industry participant and its suppliers.

* The relationship between each industry participant and its customers.

* The relationship between each industry participant and potential new entrants to the industry.

* The relationship between each industry participant and producers of substitutes to the industry’s products.

In this context, a participant may decide to compete on price (low cost leader) or on perceived value based on product differentiation.

ADAPTATION OF PORTER’S FIVE-FORCE MODEL

In the application to risk management, three additional factors are added:

* The overall governmental and

regulatory environment.

* The general state of the economy.

* The general state of technology.

These factors are implicit in the Porter model, but they are mentioned explicitly in the risk management process as organization’s have less direct control over these factors. They represent potential sources of risk (and uncertainty) that are more challenging for mitigation.

For the purpose of risk management – and especially risk mapping – the application of the adapted Porter model lies in examining each of these five relationships. The focus here is on avoiding the impairment of the organization’s position relative to its counterparty in each of these relationships. The risk-mapping interview can be designed along these lines to explore the possible factors that might bring about such impairment.

Depending on the complexity and diversity of an organization’s business, this framework can be used for the organization as a whole or, for more diverse organizations, each business segment within the organization. In either case, the framework can serve as a “roadmap” to guide the general direction and content of the risk mapping interview process.

CONCLUSION

While traditional methods of risk identification – checklists, historical analysis, site visits – are still the bases for operational risk management, the tools discussed may help to streamline the risk mapping process and make it more focused and time-efficient.

These tools are by no means exhaustive when it comes to risk identification. When used on a stand-alone basis, they will not provide a complete list of risks for the organization. However, they might help to highlight areas of concern; in this way, they help the discerning risk management professional focus the design of their questions for risk-mapping interviews.

In addition, these tools provide an opportunity for risk managers to do an analysis that is much broader than that of their predecessors.

They contribute to an inter-disciplinary awareness that risk management, strategic planning, and corporate finance are complementary functions.

Each is a key component in the analysis, formulation, and implementation of strategic organizational decisions. All departments within a firm have the same basic function, and using these tools is a step in the right direction towards that realization.