Running with Risk

Tweet

Finally, business-volume risk, stemming from changes in demand or supply or from competition, is exposure to revenue volatility. The leading US carrier United Airlines, for instance, filed for protection under Chapter 11 of the US bankruptcy code this year after falling demand hit its revenues.

Lining up the essential elements

To manage risk properly, companies must first understand what risks they are taking. To do so, they need to make all of their major risks transparent and to define the types and amounts of risk they are willing to take--goals often facilitated by the creation of a high-performing risk-management organization that accurately identifies and measures risk and provides an independent assessment of it to the CEO and the board. Although these steps will go a long way toward improving corporate risk management, companies must also go beyond formal controls to develop a culture in which all managers automatically look at both risks and returns. Rewards should be based on an individual's risk-adjusted--not simply financial--performance.

Achieving transparency

To manage risk properly, companies need to know exactly what risks they face and the potential impact on their fortunes. Often they don't. One North American life insurance company had to write off hundreds of millions of dollars as a result of its investments in credit products that were high-yielding but structured in a risky manner. These instruments yielded good returns during the economic boom of the 1990s, but the severity of subsequent losses took top management by surprise.

Each industry faces its own variations on the four types of risks; each company should thus develop a taxonomy that builds on these broad risk categories. In pharmaceuticals, for instance, a company could face business-volume risk if a rival introduced a superior drug and higher operational risk if an unexpected product recall cut into revenues. In addition, the company would have to consider how to categorize and assess its R&D risk--if a new drug failed to win approval by the US Food and Drug Administration, say, or to meet safety requirements during clinical trials.

A company must not only understand the types of risk it bears but also know the amount of money at stake. Less obviously, it should understand how the risks different business units take might be linked and the effect on its overall level of risk. In other words, companies need an integrated view. American Express, for example, might discover that a sharp slump in the airline industry had exposed it to risk in three ways: business-volume risk in its travel-related services business, credit risk in its card business (the risk of reimbursing unused but paid-for tickets), and market risk from investments made in airline bonds or aircraft leases by its own insurance unit.

One way of gaining a transparent, integrated view is to use a heat map: a simple diagram showing the risks (broken down by risk category and amount) each business unit bears and an overall view of the corporate earnings at risk. The heat map tags exposures in different colors to highlight the greatest risk concentrations; red might indicate that a business unit's risk accounted for more than 10 percent of a company's overall capital, green for more than 5 percent. (Exhibit 2 shows a risk heat map that flags high credit risk in two units.) To make risks transparent--and to draw up an accurate heat map--companies need an effective system for reporting risk, and this requires a high-performing risk-management organization.

A heat map is a tool to foster dialogue among the board, senior management, and business-unit leaders. It should be reviewed frequently (perhaps monthly) by the top-management team and periodically (for instance, quarterly) by the board to help them decide whether the current level of risk can be tolerated and whether the company has attractive opportunities to take on more risk and earn commensurately larger returns. Are high concentrations of risk generating high returns or simply depressing shareholder value? Can the company adequately manage the types of highly concentrated risks it bears? If some risks are deemed too great, should they be handled through hedging contracts, say, or mitigated in some other fashion? A technology company, for example, might decide that its R&D portfolio had too many high-risk blockbuster projects and too few projects to enhance its existing products.

Deciding on a strategy

High concentrations of risk aren't necessarily bad. Everything depends on the company's appetite for it. Unfortunately, many companies have never articulated a risk strategy.

Formulating such a strategy is one of the most important activities a company can undertake, affecting all of its investment decisions. A good strategy makes clear the types of risks the company can assume to its own advantage or is willing to assume, the magnitude of the risks it can bear, and the returns it demands for bearing them. Defining these elements provides clarity and direction for business-unit managers who are trying to align their strategies with the overall corporate strategy while making risk-return trade-offs.

The CEO, with the help of the board, should define the company's risk strategy. But more often than not, it is determined inadvertently, every day, by dozens of business and financial decisions. One executive, for example, might be more willing to take risks than another or have a different view of a project's level of risk. The result may be a risk profile that makes the company uncomfortable or can't be managed effectively. A shared understanding of the strategy is therefore vital.

 PREV  1 | 2 | 3 | 4  NEXT