Photo (C) Vladek from DepositPhotos.com Used with permission. |
The Strategic Objective of Risk Management
Effective Resource Management
Therefore, if we take the need for strategic alignment to be axiomatic, a law of nature and business, then it stands to reason that risk management activities must also be aligned to support the strategies of the enterprise.
Foundations of Risk Management
- Risk can be avoided by not doing something.
- Risk can be moderated or mitigated, but never to zero or negative values.
- Risk can be transferred or shared, but even this cannot take the impact of risk to zero or negative, even when legal and financial premises argue otherwise, because legal premises can be changed.
- Risk can be accepted. However, acceptance does not imply a fatalistic bowing of the head and acceptance of seppuku[1].
Managing Reserves
And what is failure? It is when an enterprise must be sold or liquidated to pay off the debts it has incurred. Those debts may be the result of ordinary business activities with their associated risks, or from taking extraordinary risks and having those risks become issues.
Risk Management
Risk can be decreased either absolutely or relatively. Absolute risk reduction comes from the cessation of certain activities, or declining to start up certain activities. Relative risk reduction is achieved by increasing reserves as needed to align with increased, or additional risks.
Capacity Management
If, on the other hand, risk management is construed as having as its objective to advise management, rather than making the decisions, then it is likely to focus on rigorously identifying and quantifying the risks associated with the activities of the enterprise.
Decide or Advise
To make informed decisions managers need to not only understand the nominal risk associated with an effort. They must also understand that effort in context with all the other activities and associated risks of the enterprise. Without a clear view of aggregated risk, management is forced to “play the odds” or guess which direction to take the business. Likewise, if risks are presented qualitatively rather than being quantified in terms of financial commitments for both expenses and reserves, then managers are again forced to guess.
I suggest that Risk Management is essentially an advisory function to management. This is because line management, rather than risk management is more likely to be subjected to indictment by regulators if risks are not appropriately addressed. This indictment would still likely land on line management even if the problem was that risk management regimens were faulty or inadequate. Essentially, “the buck” stops with line managers.
Working with Management
Monitoring Risk
Risk Capacity is the maximum amount of adverse risk the enterprise can endure without failing.
Risk capacity is operationally defined because it is a function of the extent of existing and projected reserves are needed to offset existing and projected risks. This includes both the minimal reserves required by regulations and any safety margin imposed by management.
Risk Appetite is managerially defined because it is a function of how much of the risk capacity management want to consume and whether or not they want to either decrease or increase safety margins in the reserves.
Risks, risk capacity, and risk appetite must be fully quantified or reserves are meaningless because they may or may not be aligned with the actual financial impact of the risks. This means that all qualitative risks must be transformed into quantitative risks which can be addressed in terms of monetary costs potentially or actually impacting the enterprise.
- As an example, if the risk of litigation is low and the cost of litigation ranges from $100k to $100mm, then a reserve of 0.05% of $100mm may be appropriate. If the risk of litigation rises to medium, a reserve of 20% may be appropriate. If the risk is high, it may be necessary to reserve 50% or more (up to 100%) of the $100mm potential cost. In this manner the appropriate capital reserve needed to offset the risk is calculated and appropriately set aside to offset the potential risk. The amount of the required reserves can be adjusted by management based upon their risk appetite from either a minimal amount to a maximum amount.
Conclusions
- Financial reserves are the only reliable means to offset accepted risks.
- Risk management exists as a function to inform decision-makers, not to become decision-makers.
- Until risks are fully and realistically quantified, decision-makers are left to doing guesswork rather than making truly risk-informed decisions.
Endnotes
[1] Seppuku is a suicide ritual from the Bushido (warrior) codes of Japan which was intended as a way to preserve some degree of honor in the face of a looming dishonor such as defeat.[2] Reserves are also a key concept of military history, providing a commander the capacity to preserve an army in battle when the enemy either breaks through. When defeat seems to be threatening, the commitment of reserves can change the tide of battle and allow the army to triumph, rather than to be overwhelmed and destroyed.
[3] During the financial crisis of 2007 some enterprises, notably AIG Insurance, were deemed “too big to fail” and the US Government stepped in with financial resources to keep certain companies from failing when the costs of failures were more than those companies could offset with their reserves. The alternative would have been to close those companies and liquidate their assets to pay their creditors – in other words to pay the costs of their failure.