Risk Management From Your Desktop

Imagine the investment-banking arm of a large financial services institution sold a strategy to a major client in the chemical manufacturing industry. The strategy is based on a new derivative product that hedges based on certain raw material market prices. The commercial lending arm of the financial institution also backed the chemical company in the renovation of an existing processing facility. Unfortunately, raw material prices began to move in ways not previously anticipated by the design of the hedging solution. This not only caused the hedge to unwind and generate a significant loss but also revealed a gap in the way that the financial services company explained to the client how the hedge was supposed to work in practice. At the same time, the chemical facility under renovation becomes the subject of an environmental lawsuit, which also names the financial institution. An information leak between the financial institution’s lending and investment arms leads to the sudden sale of substantial shares in the chemical company. The resulting regulatory intervention, loss of a high profile client, public awareness of the security breach, and the noise surrounding the lawsuit are enough to shake market confidence in the financial institution. Because of this, a rival firm was able to complete a hostile takeover.

This is a hypothetical risk scenario, but not an unlikely one. Most industries have at least a few very public examples of companies suffering near catastrophic losses caused by a combination of unexpected events. Many of these companies go to great pains to hire and promote the best people to the management of its operations and activities. These individuals are all experienced and talented people completely deserving of their positions and authority. Individuals like these generally have a long history of applying their experience and judgment to assess the level of risk for a given endeavor or transaction against the level of potential return. Despite this, a sequence of relatively small risks can take effect, rapidly compound, and ultimately end in potentially catastrophic results.

While it’s true that people in business are called upon to apply their talent, instinct or analytical abilities when faced with decisions, it is their experience that most influences their decisions. Our understanding of the business areas we run may be broad, but our ability to perceive certain details (as well as our own blind spots) is governed largely by what we have experienced in the past. How then can we make efficient risk/reward judgments in large or complex situations where there are factors that we cannot see and don’t have the experience to look for? Like dominoes waiting to fall, combinations of risks lay waiting within the elaborate matrix of people, products and processes that make up a company’s operations. These risks can range from weaknesses in the way the company processes information to events with their clients to external conditions in their markets. The potential publicity and negative impact on brand value alone has senior executives demanding to know: “Could that happen here?” Senior managers aren’t the only ones worried. Following infamous failures like Barings bank, Enron and BCCI, legislators, credit rating agencies and industry action groups have also made their messages clear to public companies: Know your business and know your risk.

The standard for corporate accountability has now firmly expanded to understanding and even measuring a holistic exposure to risk that extends outside the four walls of the enterprise. Today’s companies must demonstrate a proactive mitigation strategy to protect shareholders from unexpected risks. In response to some of these pressures, many organisations are spending considerable time and resources to address dozens, sometimes even hundreds, of simultaneous regulatory compliance requirements such as Sarbanes-Oxley and Basel II. The logging and analysis of unexpected losses due to error, managed metrics and reporting, and operational risk self assessments feed company dashboards and statistical models in ongoing attempts to get the right risk information to the right people at the right time. The good news is that the raw information required for this type of facility is becoming available and its quality and completeness is improving exponentially. This information exists in publicly available reports, internal audit findings, process flow documentation, and in the files and minds of people at all levels of a corporation. Still, if the ultimate goal is to prevent or reduce the chances of unexpected risks expressing themselves in business operations, managers need not only quality information but also tools to support the application of this information to successful risk/reward decisions.

Managers in large companies will have information needs as varied as their risk/reward decisions. This means information must be available on an on-demand basis to allow individual control over how the information is pulled and presented. A key challenge here is establishing the context in which information can be stored and used. For example, risk information gathered about the adequacy of a company’s financial reporting control in the data centre of its New York office might be gathered in a way to support only a particular regulatory reporting requirement. The information’s connection and relevance to the success of a new product launch in a different area of the same institution may be invisible to the managers in this other area who would benefit from this data. Moreover, external data on losses incurred by another firm for a similar product in a neighboring region may be available from commercial databases. The data is only relevant and available to the right people if it can be placed in context within the institution’s legal, regional and product taxonomies and made visible to the right managers.

Technology has some significant solutions to offer that can bring the information together in the right way, for the right person at the very instant it’s needed for decision-making.

Technologists and risk managers are confident such a solution (for risk information) exists. This is largely because best practices for the gathering, maintenance and reporting of governance, risk management and compliance information are remarkably consistent. Many who study the field point to a universal set of principles that suggest data gathered properly can be contextualised and used for far more than simply overcoming regulatory reporting hurdles. The right technology system could help people make connections and ask pertinent questions, for example, that may exist outside their own immediate frame of reference.

Imagine that your organisation has an efficient system to take in risk management data from all levels of the company; solicit expert opinions on the real risks from people buried deep in the company machine; and then combine these with internal audit findings, business process maps, corporate taxonomies, metrics and data about unexpected losses and gains. Next, imagine that as people use this system, they further contribute to the system’s ability to store how all these moving parts fit together either directly (e.g. this risk is directly mitigated by the customer on-boarding process) or tacitly (e.g. every time a company experiences a problem with failed trades, people notice high IT overtime in the prior week). Finally, imagine that as a manager in charge of making risk/reward decisions you could augment your personal experience by simply typing in text about the decision you’re trying to make and having the system return information about risks that may affect you (something akin to Googling). Ranked results would be returned as a summary list of reports, issues, findings, measurements and other information that you can quickly navigate to determine relevance. Like the targeted ads you sometimes see to the right of your search engine results, the system would also direct your attention to the status of potential key initiatives or metrics affecting your area or external conditions or events that are potentially relevant.

This level of technology support leverages information that is, for the most part, currently being gathered and makes use of technology concepts that people are already used to. By integrating this into the daily lives of managers, these systems could enhance personal performance and the performance of their groups. The intention is to improve business people’s efficacy in making more informed risk/reward decisions in complex multifaceted business environments, with the ultimate goal of preventing or reducing the chances of unexpected risks expressing themselves in business operations. No technology system can eliminate business risk on its own, but if managers have the tools to enhance their ability to make risk/reward decisions, blind spots can be eliminated.