Enterprise Risk Management (ERM) enables an organization to integrate its risk management strategy with its capital and business strategies, ultimately improving the linkage between operational and financial decision making. ERM consists of four elements: identifying and managing critical risks; quantifying the impact of these risks on capital adequacy and earnings, setting risk appetite and tolerance, and embedding risk management into the strategic decision-making process. Several studies have shown that firms with stable results consistently create more value for stakeholders than those with volatile results.
Identifying Critical Risks
Risk identification is a behavioural process that can be approached top down (strategic in nature) and/or bottom up (tactical). It creates an awareness of risks throughout an organization. The end products are commonly risk ledgers or dashboards, which then can be used to prioritize risk mitigation strategies.
Setting Risk Appetite and Tolerance
Within the language of ERM, risk profile refers to the broad parameters a firm considers in executing its business strategy in its chosen market space. Risk appetite denotes the level of uncertainty a company is willing to assume, given the corresponding reward associated with the risk. Finally, risk tolerance is the stated amount of risk a firm is willing and able to keep in executing its business strategy - in other words, the limits of a company’s capacity for taking on risk. Risk tolerance statements should address all significant risk areas and be used to develop tactics. For example, with risk tolerances such as maintaining the firm’s net exposure to catastrophic loss at 15 percent of capital and maintaining at least a 175 percent regulatory solvency ratio, a company can design specific capital and risk management strategies to stay in compliance.
With properly aligned risk profile, appetite and tolerance statements, a firm’s risk management process can be linked from the direction of the board to the execution of the business units.
Quantifying the Impact of Risk on Capital and Earnings
When quantifying the impact of risk on capital and earnings, it is important to distinguish between balance sheet capital and economic capital. Balance sheet capital is simply the difference between recorded assets and liabilities. Economic capital, on the other hand, is the estimated amount of capital needed to “finance” risk and growth in the enterprise. The higher the amount of risk and uncertainty — in other words, the higher the firm’s risk appetite — the more economic capital is required.
Companies can properly quantify their risks using a dynamic financial analysis (DFA) model. Amongst other benefits, it provides a more complete picture of risk quantification, as it shows the full distribution of results - hence one can evaluate not only solvency risk, but also earnings volatility. However, it takes time to develop a full DFA model. Companies commonly start by developing partial DFA models, followed by stepped improvements to match the robustness of the model with the educational learning of the organization.
Simulation-based DFA models help in building a connection between the relationship of a company’s risk profile, appetite and tolerances and the requisite amount of economic capital. For example, economic capital is often stated in terms of the worst loss to occur within a specific time period such as 200 years — which can derived directly from the DFA model. Additionally, using a DFA model to appreciate both the upside and downside of earnings as opposed to just the target — a company creates an internal awareness about the various earnings possibilities. This awareness can improve understanding of events and influence judgement with, for instance, external communication.
In order to align risk management with financial management, companies strike a balance between actual capital held and the required economic capital. In reality, firms hold excess capital over the modelled “minimum” economic capital, as they want a cushion so that actual capital very rarely will go below the modelled minimum amount. Thus, “required” economic capital is inclusive of the amount of capital that is needed to finance both the risk on a firm’s books as well as the buffer.
If “required” economic capital is more than the actual capital, an organization needs to reduce its risk appetite by hedging significant risks, or potentially by exiting businesses, which may constrain future growth and raise expenses relative to revenue as margins decline. Hedging insurance risk through reinsurance reduces capital strain by allowing a firm to give up some upside potential in exchange for downside (loss) protection.
However, if actual capital is more than the required capital, a firm can increase its risk appetite and use it to fund business expansion, return the capital to its owners (by increasing dividends or setting up price/service concessions), or save it for a “rainy day.”
By aligning risk and capital management, companies can improve operational and financial decision making. Profitable growth begins by identifying each business segment’s contribution to the firm’s overall capital requirement. Since riskier business units consume more economic capital, an enterprise can then benchmark performance relative to capital consumed, giving risk-adjusted returns. This drives capital efficiencies by optimizing the deployment of capital
Challenging Strategic Decision Frames
It is important to keep in mind the unintended consequences of evaluating business choice based on an opportunity’s expected return relative to cost of capital. For example, when firms invest in business opportunities yielding a return above the cost of capital, without verifying that the return is enough relative to the risk, they may unintentionally build a portfolio of high risk exposures. Conversely, firms might reject investments that yield a lower return even though the return is more than adequate, given the risk exposure. The only resolution to these unintended consequences is to accept business opportunities when the return on economic capital exceeds the cost of capital. But of course this requires that the firm knows their economic capital and are capable of allocating economic capital based on the marginal contribution of the business to the overall firm’s risk profile.
With ERM, companies can use allocation of economic capital to equate a risk adjusted amount of capital with an investment. Companies achieve this by first determining their total required capital, given their exposure to various risk sources, and second, determining how much should be assigned to each risk source, given their total required capital — a capital allocation exercise. Though capital allocation can be politically difficult, numerous methods are considered legitimate and a firm’s selected method needs to be aligned with its overall objective. Other desirable features of a capital allocation method are additivity (the allocated capital can be rolled up to the line of business or group level), stable if the exposure footprint changes, easy to update, and easy to explain to a non-technical audience.
The integration of risk management with capital management and business strategy can help firms avoid the unintended incentives to build a high risk portfolio. More so by building an integrated approach towards managing risk, capital and strategy, firms experience consistency in earnings, earn reputation value in the marketplace and are perceived to be transparent.