Reporting on Risk and Risk Management
Risk is a fact of business life. Taking and managing risk is part of what companies must do to generate sustainable growth of shareholder value. However, it appears that many top management teams and boards have not come to grips with this proposition. Increasing volatility in corporate performance, numerous examples of material business misjudgement – some leading to company temporary collapse or even demise – and a handful of high-profile scandals suggest that many companies neither manage risk well nor fully understand the risks they are taking. The requirement to report on risk and risk management practices can actually help clarify the notion of risk.
Lack of common understanding about risk-taking is not confined to executive management teams but can also be observed at the supervisory board level. The increased importance of the role of independent, non-executive directors has highlighted the need for better understanding. Even regulatory agencies have their own notions of risk that are sometimes obscure and tough to follow. Why is there such a lack of understanding of risk? The explanation is simple: the notion of risk is complex at a theoretical level and even more so when applied to real-life decision-making. A large element of the complexity lies with the lack of a generally-accepted language of risk and risk management practices. The relative paucity of clear-cut, standardised definitions means that many important decision-makers (and supervisors of such decision-makers) can be found, post facto, to have been talking at cross-purposes with each other (and with interested stakeholders) because of a lack of shared understanding of the terminology being used.
The diversity of definitions of risk is one of the problems. In today’s business environment some would define it as ‘a measure of the deviation from a range of expected outcomes’. Others would include in the definition the notions of return or reward. Still others talk about risk management as a process without really attempting to nail down a definition of risk. This lack of precision encourages a focus on loss prevention and loss reduction techniques and tends to overlook the contribution that the risk management process can make with respect to exploiting business opportunities and enhancing profit margins. The definition of risk is a major issue for risk (risk return) management practitioners – and represents one of the principal difficulties with corporate risk reporting requirements.
The colloquial meaning ascribed to risk is that of an undesirable or unpleasant occurrence or event that leads to loss, damage, injury or disruption. Most people, when asked about risk will instinctively respond that risk is undesirable. If asked about risk management, they may even go on to state that the goal of risk management is to prevent or reduce risk.
It is curious how many managers, and even senior executives, in publicly-quoted companies hold similar views. In a business context, such a view is generally too limited – except with respect to the preservation of human life, the environment or ethical standards. Publicly-quoted companies are mandated to take risk. It is the key to their survival. Their success lies in the intelligent selection of risks/opportunities to take.
The mandate to take risk can be described in terms of capital access and cost. Most companies’ capital structure consists of a combination of equity and debt – both of which have a cost and which are combined in the notion of weighted average cost of capital (WACC). It would not be unusual, today, for a representative large, multinational company’s WACC to range from 8-11 per cent per year. It is axiomatic that a company’s business activities should generate returns that consistently exceed the cost of the capital employed. The risk-free rate of return today is very low, say, for the sake of argument, between 1-2 per cent per year. The difference between 2 per cent and, say, 10 per cent is the risk premium. Of course, most shareholders expect the company to generate a total risk-adjusted return that exceeds the company’s WACC. The perceived degree of risk attaching to the company’s activities will be a key element of that risk-adjusted return. Companies must generate annual returns that exceed the annual costs of financing those activities, perhaps not every year, but at least on average. Such returns are generated by:
The old adage ‘nothing ventured, nothing gained’ captures the spirit of this notion of risk.
It then follows that the business proposition of risk management lies with encouraging intelligent risk-taking at least as much as it addresses techniques for dealing with unwanted risk or volatility. Risk management, which, as previously suggested, might more usefully be referred to as ‘risk-return management’ is a process that helps:
Outside the financial services business sector (where the nature and magnitude of the exposures and the imposition of regulation has spurred the development of risk management practices and tools), corporate management teams still focus on traditional performance metrics, such as net income, earnings per share, or projected growth targets, whether their own, or those of financial analysts. Risk-adjusted performance metrics. seldom figure in these senior executive teams’ targets. This makes the justification for investment in risk-return management initiatives more difficult than it needs to be. It should be possible to demonstrate that the absence of the notion of risk-adjusted returns produces, over time, a pattern of suboptimal decision-making. Not only may undesirable and unnecessarily costly surprises arise from time to time as a direct result of miscalculated project or business activity outcomes, but significant project or business opportunities may also be missed because of irrational perceptions of the risk(s).
Relatively few business managers actively seek to put risk management on the agenda at a project or business activity review meeting. Risk management is still often seen as a potential constraint on a commercial initiative and an additional cost. By way of example, a multi-industry project management maturity study, conducted at the University of California at Berkeley in 1999, (project management maturity was measured principally in terms of metrics such as cost management; quality management; and human resources management) reportedly found that risk management is the least practiced of all project management disciplines across all industries. In particular, it found that the software development respondents practiced risk management least of all! Perhaps there is a lack of appreciation of the business contribution that the effective application of many risk management techniques can bring to a project. Maybe MBA and executive management training courses and/or internal risk management team communication efforts have failed to get the message across clearly enough in the past.
Risk aversion is also fuelled by a need to demonstrate improving business performance in repeated, short-term increments. Such a pattern is unrealistic to the risk-taker/enhanced return-seeker. Risk-takers understand instinctively that risk-taking involves losing out/failing to produce the returns at least some of the time. Corporate management teams in many industry segments are frequently overly-focused on short-term performance, and the perceived need to protect the result at every step of the project feedback reporting cycle breeds an aversion to risk. Perhaps this stems from overly-ambitious customer expectations of project performance and/or overly-ambitious market expectations with respect to quarter-on-quarter overall financial performance. In addition to the inefficiencies brought about by unnecessary risk aversion and conservatism in decision-making, it should be underscored that the return on investment for many risk-return management initiatives cannot be effectively measured over the short-term. Such investment is analogous to investment in R&D – a contribution to the long-term preservation and growth of shareholder wealth.
Another important risk aversion driver lies with over-zealous regulatory authorities who seek increasing volumes of information. They seek information concerning a company’s risk and risk management practices without necessarily giving sufficient consideration to the target audience’s need for the information and the possible uses of the information. Significant reporting costs have been imposed on publicly-quoted companies both in the US and Europe over the last five years without any real attempt to calculate:
Notwithstanding the handful of high-profile corporate aberrations that the market has reacted quickly to sanction and correct, many businesses are now being resource constrained by hurriedly promulgated reporting regulations addressing issues such as internal control systems and risk management policies and practices.
There is a significant difference between disclosure – the latter implicitly including the notion of some degree of comprehension on the part of the addressee. Companies that communicate, rather than merely disclose, take some degree of trouble to prepare information in packages that are likely to be useful to the stakeholder recipients. The stakeholders who read these communications represent a heterogeneous category of varied and changing interests that are not necessarily perfectly aligned, all, or even much, of the time. Even the interests of shareholders – probably the most prominent stakeholder sub-group from a reporting point of view – are far from homogeneous. Shareholder differences include:
It should be apparent that, quite apart from any consideration of important legal consequences with respect to inaccurate or inadequate communication, satisfying the information needs of a wide variety of different interest groups on a regular and timely basis demands significant resources and initiative.
The development of corporate websites has witnessed a significant growth in both quantity and quality of corporate publications aimed at the whole cross-section of stakeholders – actual or prospective. The nature of the information provided is no longer limited to retroactive financial performance review, but provides current, segmental and matrix detail with respect to geography, production and service operations, technologies and personnel. This is a very positive development for interested parties, but it is still largely an exercise in disclosure rather than meaningful communication.
Reporting/disclosing facts is one thing. Communicating about the significance of concepts, such as ‘risk’, is another. Communication about risk is hampered by:
Under such constraints, significance takes on a different meaning altogether. Risk is a concept that needs to be treated gingerly and prudently by communication professionals – to avoid the real danger of confusing or misleading the readers. Unfortunately, such sensitivity of approach is not the hallmark of much recently enacted and, sometimes, rushed, legislation and market regulation. There is a genuine concern that overly-zealous demands for company information are leading to a ‘tyranny of transparency’1that will prove to be counterproductive for the stakeholders’ overall interests. This is of particular relevance to new risk reporting requirements.
Publicly-quoted companies are called upon to express opinions about the sources of material volatility in their businesses and explain, in general terms, how those volatilities are addressed. This is neither new nor should it be considered to be particularly controversial. However, much of the new regulatory reporting requirements address immaterial technical detail that is not particularly useful to the investment community or other stakeholder groups – and which is extremely time-consuming and costly for the companies to produce. Somehow the notion of cost-benefit needs to be reintroduced to the corporate reporting process.
Reporting of market exposure (interest rate, currency exchange rate, and commodity price fluctuations) and credit exposure has been standard practice for some years, with more attention paid in recent times to the identification and explanation of hedging strategies and the use of a variety of derivative instruments. However, the reporting of risk more broadly has not been a requirement, and has not been performed except in the most general of terms, for example, with respect to the annotation of material contingent liabilities – typically threatened or actual litigation, fines or penalties.
A notable exception to this general practice occurs during an IPO or a bond issue, when a company is looking for fresh equity or debt. In such cases, the company prospectus includes an often lengthy list of risk factors. This can be informative up to a point but there is a tendency for such lists to include boilerplate language with respect to the most obvious of exposures – primarily motivated by fear of being held liable for the consequences of omission. Here are some examples taken from S1 and S4 Form SEC filings:
Long lists of risk factors may meet the new risk disclosure requirements, but provide relatively little meaningful risk communication for the potential investor seeking differentiation on the basis of the risk and risk management attributes of the business.
Meeting new stock exchange and regulatory requirements for risk information that has not previously been gathered into databases is proving to be both costly and stressful for many executive management teams. This is largely due to the fact that there is no general agreement on format, content or depth of detail that should be provided. Some securities regulators grant considerable latitude to member companies to formulate their own reporting style on risk analysis and risk response – essentially relying on the markets to differentiate and define ‘best reporting practices’ over time. Others are more proscriptive and lay out at least the core risk information requirements – with a view to providing as much directly comparable information as possible.
While easy comparability would be a benefit to actual and potential investors, it is quite a challenge for companies to provide comparability with respect to a complex, conceptual notion such as risk. There are two dangers in seeking easy comparability. The first lies with focusing on those risk factors that have definable parameters and that are measurable – at the expense of the less-easily measured ‘soft’ risk factors. The second concerns incorrectly imputing quantitative characteristics/interpretations to essentially qualitative input.
One example of potentially misleading risk disclosure concerns reporting on investment in assets. Many companies now report tangible asset value concentrations and geographical distributions in some detail. Some even identify strategic locations and key dependencies, though this borders on commercially-sensitive information. They also report quite effectively about property loss prevention and loss reduction initiatives and risk financing/transfer protection linked to those tangible assets. But what about the value and protection of intangible assets, which represent a very significant percentage of the overall market value of many publicly-quoted companies these days? Because of the difficulties involved in defining and measuring/quantifying the elements of intangible asset value, the exercise is frequently not attempted.
The search for quantifiable metrics for purposes of comparison can lead to unrealistic and impractical information demands too. One European stock exchange (the AMF in France) requires companies to publish extensive details of their commercial insurance programmes – primarily because of access to, prima facie, comparable numbers. This requirement is based on the erroneous assumption that commercial insurance programmes are normalised and comparable – across industry segments and companies with radically different management styles, financial strength and non-insurable exposures. The costs involved for the companies, that are subject to such information requirements, are significant and put them at a competitive disadvantage with their European and international competitors. In any case, for many of the larger companies, insurable (not necessarily insured) exposures represent only a relatively small percentage on their overall exposure profiles. So, what is the point?
Another example of the dangers of producing risk misinformation lies with the popular, current practice of company-wide risk mapping. Risk mapping is an excellent process for cross-functional reflection about operational strengths and weaknesses. However, there is a tendency to place too much importance on the final risk map (especially if multiple maps are refined and consolidated into an overall corporate ‘top 20 risks’ list) and this detracts from the real value of the risk mapping exercise itself. The real value is in the cross-functional, qualitative brainstorming and resulting action plans. In many respects, a consolidated corporate risk map is potentially dangerous since it will necessarily be synthetic and will probably be out of date by the time of publication. The process of production of frequent risk map/exposure profile snapshots within the business segments is likely to be more valuable than the production of what purports to be an overall, composite, corporate picture of risk in a volatile geopolitical and business environment. Aesthetic considerations and the appeal of a top-level, master control panel of key performance indicators – including risk – should not overshadow the design limitations in the process itself. Risk mapping is not a short-cut to communicating risk information. Communication can so quickly and easily become miscommunication.
Communicating about risk is not easy or obvious. However, there may be a better way to start than by playing ‘spot the risk’ at the top level of the company. The creation of ‘risk registers’, and undertaking ‘risk mapping’ from the ‘bottom up’, makes a good deal of sense for the reasons outlined in the previous paragraph. But it is only a start. From a ‘top down’ perspective perhaps it would make more sense to adopt a different approach – one that describes the capacity to assume risk/volatility and, separately, the management team’s willingness to assume such risk/volatility.
The concept of ‘risk tolerance’ can be reasonably cleanly defined in terms of a number of key financial ratios – including many of those that are used by credit rating agencies to rate corporate debt. Instead of trying to anticipate the source of volatility at the corporate level, it might be more useful to communicate in terms of the corporate ability to withstand shock – from whatever source(s) – during a particular period of time. As a subset of ‘risk tolerance’, a top management team may decide, for a whole variety of market condition factors, that the company’s ‘risk appetite’ at any one time is a certain percentage of its ‘risk tolerance’ – and can then go on to explain the key features of the risk management strategy that is geared to sustaining that risk appetite. It is then up to each company to design its overall communication strategy and to decide how much information about the risk management initiatives, that underpin the risk management strategy, should be published. The objective should be to demonstrate an innate resilience when faced with unexpected situations or conditions – to explain why the company believes that it can ride the waves of change and respond effectively and credibly to the vicissitudes of the business cycles.
With this approach, we come full circle – back to the notion that publicly-quoted companies are mandated to take risk – and back to the utilitarian definition of risk, not in terms of an event or an occurrence or an accident with exclusively negative connotations, but in terms of a measure of deviation from a range of expected outcomes. Companies that decide to rethink/refresh their risk management language and reporting style will end up communicating more effectively with all their stakeholders – and should be rewarded over the long term by the markets for so doing.
1 Idea borrowed from ‘Les Enjeux des Echos’, February 2005.