Enterprise risk management: from compliance to value; A unifying framework can help companies identify and articulate risks consistently across the enterprise and evaluate alternative capital structures to bear those risks.

Businesses take risks every day to create value for their shareholders. Managing those risks has always been an important element of running any enterprise, although the link to value creation has not always been clear. But growing demands from shareholders for senior management to take enterprise risk management (ERM) more seriously has at last formalized the essential connection between a company's business operations and its overall risk management program.

Until now, these functions have operated as silos within many organizations. For non-financial companies, in particular, the latest wave of corporate scandals and breakdowns in corporate controls has been a catalyst for revolutionary changes.

Inevitably, the initial stages of ERM have been mostly about compliance and corporate governance. New rules and responsibilities have been imposed on senior management and boards, which have resulted in higher costs, resource constraints and many questions about whether these new regulations are really the answer. But we are now entering a new era, where leading companies wish to harness ERM as a strategic tool that will help them increase shareholder value.

What follows describes a unifying framework that can be used to articulate risks consistently across an organization and evaluate alternative capital structures--comprising equity, debt, insurance and hedging--to bear those risks. Ultimately, ERM is about communication. Senior management must have well-developed, current information and credible insights to communicate the basis for its actions in both good times and bad.

Evolution of ERM

This framework is, in effect, the next step in the evolution of attempts to quantify and manage risk. And much of that effort has taken place in the financial services sector, among banks and insurers. While we often think today of banks as the leading risk managers in financial services, in fact, the evolution of ERM techniques owes a great deal to the insurance industry.

In the 1950s, the actuarial profession developed a formal asset/liability management (ALM) method for assessing and managing the interest rate risk embedded in the long-term products of life insurers. This method, known as "immunization," has since become the foundation of several risk management techniques in life insurance, pensions, banking and derivatives. The volatile interest rate environment of the late 1980s led to the development of more sophisticated ALM analysis, including the simulation of a wider set of risks and their financial impact over a variety of scenarios and time horizons.

Much of what we know about managing "event" risks, often with the challenge of sparse data, has come from the property/casualty (PC) insurers, where the principal questions about an event are "if" and "how big." PC insurers have developed increasingly sophisticated tools to manage their portfolio of risks and assess the capital they need to run their businesses. The most notable tool is dynamic financial analysis (DFA), which has the same underlying principles of ALM but addresses a wider range of risks to the business entity.

Banks, like insurers, have developed sophisticated risk management techniques to assess whether they have sufficient capital--spurred in part by the growth in the derivatives markets in the last 20 years. For the most part, these risks are actively traded, with a wealth of data available to validate and calibrate pricing and hedging models.

More recently, all enterprises have been challenged to find a robust way to qualify, quantify and manage operational risks. The highly publicized failures of companies in North America, Europe and Asia indicate that lapses in good management can happen anywhere and in any industry. These failures have led to new sets of regulations across the globe, intended to increase transparency, accountability and good corporate governance.

The effect has been to formalize risk management with a more comprehensive scope. ERM embraces both the compliance and governance environment of a company, as well as the financial management of the enterprise risks.

Now, leading companies are doing more than complying with new corporate governance regulations. They are using ERM to create value.

From Compliance to Value

The value of ERM is the ability to optimize the value created from the joint management of risk and capital. That is easier said than done. While the relationship between risk and capital management seems clear enough in principle, the question is, how does a company put that principle into action?

To do so, management needs a unifying framework that is valid for the financial management of the full range of risks that it faces and that can be used at the tactical (product line) or strategic (senior executive) levels. This can be achieved if the risk capital management (RCM) framework:

1. combines actuarial techniques with the capital markets perspectives of corporate finance; and

2. explicitly recognizes that risk financing instruments such as insurance and derivatives act as equity substitutes.

The actuarial perspective begins with a bottom-up evaluation of each individual risk explicitly and then aggregates that information into an overall assessment of the portfolio of risks. This analysis leads to a determination of the amount of capital needed to support the portfolio of risks.

The corporate finance perspective focuses on the company's capital structure. Its purpose is to increase shareholder value by delivering the optimal balance sheet composed of equity and debt that minimizes the cost of capital, not just in absolute terms, but relative to the price of risks it bears.

Both actuaries and corporate finance managers know intuitively that "risk" and "capital" are related. Their joint perspective leads naturally to the question of how insurance and hedging instruments should be treated in the analysis of risk financing alternatives. There are essentially two choices that can be made: either treat them as offsets to risk, or treat them as capital.

Conventionally, capital is defined as only those instruments that provide immediate cash to the company (such as equity and debt) and exclude contingent capital (such as insurance and derivatives) that may bring cash to the company at some later date. The total paid-up capital (debt plus equity) must be sufficient to bear the net risk of the company after insurance and hedging. The capital structure decision is about financial leverage, which selects the mix of equity and debt.

Alternatively, the definition of capital can be broadened to include all instruments that reduce the need for equity. With this definition, the sum of the paid-up and contingent capital must be sufficient to bear the gross risk of the company. The capital structure decision combines financial leverage (equity vs. debt) and risk leverage (risk retention vs. risk transfer) to find the best mix of equity, debt and insurance.

[GRAPHIC OMITTED]

Strategic RCV Framework

A strategic risk capital value (RCV) framework (Figure 1) connects value creation to the fundamental choices that managers make on a daily basis. Essentially, the portfolio of enterprise risks and the portfolio of capital resources are the two major items that management can change to advance the company's interests.

Conventionally, risk management and capital management have operated as two different disciplines and, indeed, as two (or more) separate operations within a company. Nevertheless, the two have always had a close economic relationship. In a corporate setting, this relationship acts like a "force of gravity," keeping the two portfolios of enterprise risk and capital resources tightly connected; the amount of risk dictates the capital needed and, vice versa, the amount of capital determines the risk capacity.

The relationship between risk and capital is not always easy to articulate. In this framework, this relationship is developed by referring to an intermediate measure, economic capital (EC). In its purest sense, economic capital is the true measure of the "weight" of a company's risks. (This term distinguishes EC from other measures that are also important for the company, such as rating agency capital or generally accepted accounting principles, or GAAP, capital.)

The company's risk structure (the financial impact of the company's risk exposures as they unfold over time and scenarios) is measured by EC. In practice, this is done by running a dynamic EC model that simulates the company's financials over a range of possible futures and produces the minimum amount of capital that the company needs to bear its risks.

With EC setting the minimum amount of capital needed, the key corporate finance question is: What is the best capital structure for the company? The same dynamic EC model can help managers evaluate different combinations of capital resources (such as equity, preferred, debt, insurance or hedging).

The ultimate aim is to create value. The company is expected to generate returns on the risks inherent in its activities. Holding capital--both in cash form, as well as in contingent form--results in a cost reflecting the price of accessing that capital. Through its selection of risks and capital, management has the opportunity to maximize value creation (shown in the top half of the diagram), bearing in mind the constraints imposed by risk and capital management (shown in the bottom half of the diagram). In short, value is created when the return on risk exceeds the cost of capital.

Putting It into Practice

Although the use of ERM in the financial services sector may be more familiar, non-financial corporations are also able to use ERM strategically to create value. Here are two examples:

* A major industrial firm has credit exposure to its suppliers and buyers. It has always managed the individual exposures, but now assesses the portfolio effect of this risk, together with other significant risks. It is able to describe the structure of the credit risk--how it looks under different economic scenarios--and use that information to improve contracting terms and product pricing.

* A growing manufacturing company needs to finance capital investments to upgrade its physical plant. Its cost of financing reflects risks to supply and demand and the consequent volatility of earnings. The firm uses ERM analysis to develop the mix of new capital--debt and insurance--that enables it to execute its plan with the greatest economic value.

Ultimately, all companies are in the business of risk and capital management. Many have already made significant investments in assessing their risks. Now, managers have the opportunity to take the next step, utilizing a unifying framework, to include more of these risks in their planning to develop a more comprehensive analysis of their strategic options. While regulatory actions may have provided the initial impetus, the insights gained from this analysis can profoundly affect management's ability to create value.

RELATED ARTICLE: takeaways

* ERM has at last formalized the essential connection between a company's business operations and its overall risk management program.

* We are in a new era, where risk management is more than compliance, and leading companies will harness ERM as a strategic tool to help them boost shareholder value.

* A unifying framework is valid for the financial management of the full range of risks that a company faces and that can be used at the tactical or strategic levels.

* A dynamic economic capital model can help managers evaluate combinations of capital resources (equity, preferred, debt, insurance or hedging) to build value.

Prakash Shimpi is a consultant at the Tillinghast business of Towers Perrin with global responsibility for leading the firm's ERM practice. He can be reached at [e-mail].