As we reel under the ongoing credit crisis, many analysts opine that companies failed to implement a proper risk management in place, which led to their failure.
"They had KPIs (key performance indicators) but what about KRIs (key risk indicators)?" asks Dr David B Friend, Chairman and CEO of Palladium Group, the US.
"When they [companies and institutions] were planning for derivates they did not see problems coming simultaneously across sectors and asset classes. But in business you have to have plans for rarest of risks – not just a strategy plan but a risk plan," he says.
Aditya Malviya, Director of the Risk Management team at Arqaam Capital, believes the model of bifurcating different risks is not foolproof and can lead to problems.
"Traditionally and until recently, a number of companies worked on the model of bifurcating different risks and aligning the risk management function into silos such as credit risk unit, market risk unit, operational risk function and so on. Although this made accountability easier, a key point was missed and that is different risks that a firm is exposed to are interdependent," he told Emirates Business.
"KRIs coming out of different departments may have lacked coherence or perhaps given conflicting messages to the decision-makers. Risk management should be viewed as a business wide activity impacting everything that the business is engaged in. Secondly, even if we assume that the KRIs were coherent and gave the same message, was this message decoded into a language that non-risk executives and board understood? Even if these were understood, were they followed up by sound and timely action by the management? Based on the above argument, I am of the view that KRIs do not lie if implemented properly. And no, the expectation placed on risk management was not bigger than what it is capable of. The counter argument can always be that the results from your model can only be as good as your model," he says.
Experts opine that both KPIs and KRIs work in tandem but in times of crisis the latter becomes very important. "KRIs, by their very nature, are forward-looking and serve an early alarm bell for a potentially adverse consequence to the business. In contrast, KPIs are tools employed to measure past performance. Past may not be an accurate predictor of the future and hence KRIs assume a critical importance especially when the issue at hand is business continuity and survival. Additionally, when KRIs are integrated with business strategies, the task of identifying, evaluating and understanding potential risks to the business model becomes easier. This in turn aids the board and the senior management to take timely and adequate steps to avoid 'disasters'," explains Malviya.
David Traylor, one of Deloitte's leading risk management experts, calls KPIs the rear view mirrors and KRIs the front windscreen of a business. "KPIs are the rear view mirrors of your business. They let you know how you have done. They are important from a performance perspective. But, they do very little to let you know of the risks that lie ahead of your company. That's what KRIs do for a business. They are the front windscreen of a business. Because of this, they are important from a risk perspective. They indicate to a company potential hazards that should be avoided. They alert the company to the future so that the past has a better chance of showing good performance. In this way, KRIs and KPIs work together. KRIs help a company avoid problems so that KPIs help enable good performance," he says.
According to Theresa Schnepf, Head of Global Risk for JP Morgan Asset Management: "KRIs and KPIs each perform a valuable service; however, many individuals tend to confuse the two. A large number of measurements can distract from the primary purpose, which is focusing on the key measurements driving the business and the risks. These metrics tend to be retrospective rather than predictive, which makes it challenging to attain the goal of preparing better for the future."
Schnepf believes risk modelling is not of much use in time of stress. "Events of the last 18 months have superseded traditional stress scenarios (eg, 1987 US stock market crash, 1998 LTCM and emerging markets credit crisis). Modelling theoretical scenarios in the middle of a crisis does not feel useful when one is living through situations that surpass the stress scenarios. However, now is a good time to obtain from business and risk managers their nightmare scenarios and to model those," she says.
Malviya, of Arqaam Capital, on the other hand, believes that stress or no stress, risk models examine a number of scenarios ranging from the worst to the best. "The question to be asked is how good are the models employed and what is the breadth of the scenarios they capture. Once the effectiveness of the model has been established, quantification of risks under each scenario must be performed and analysed. The results of all analyses must be communicated and explained to the stakeholders and decision-makers. There is absolutely no point in performing rigorous exercises if the intent is not to understand and act on what the model tells us and how strategies are aligned with risks," he informs.
Traylor believes risk modelling is most useful in times of stress. "Risk modelling is not only designed to analyse probable risks and events. Risk modelling is most useful when deployed to analyse the impact risks arising from unlikely events during times of stress. Stress is nothing more than volatility. Today's financial markets are in stress because of the current volatility. Volatility is risk that modelling is designed to effectively analyse. After all, in times of little volatility, we are more certain of the future and risks correspondingly are reduced."
It is very important that companies make sure that proper risk management is part of the psyche of the firm.
"Risk management is an area of paramount importance in the management of any business, especially in today's challenging global economic conditions, if the stakeholder intent is survival, growth and sound discipline. The interest in risk management needs to permeate to the boardroom and filter down to the lowest operational level of any firm," Malviya stresses.
He gives some tips on effective risk management. "This can be achieved by creating risk transparency and integrating risk management in all aspects of the business. Apathy to risk management has been created by lack of understanding in what risk management does and why its importance in every aspect of business is essential. Creating an ethos for risk management is a top-down phenomenon and this can be achieved by corporate risk management education at all levels, starting right at the top. Adequate training programmes to deliver the message to all that risk management is not a necessary evil; it is essentially a business partner that may help alleviate some of the disinterest shown towards risk management. Last but not the least, risk management professionals should understand and be comfortable with the level of risk that the business is and can be exposed to before sending out incoherent, conflicting and risk-jargon heavy messages to the recipient. The idea is to get the message across – why not make it simple."
As a risk management expert, Traylor believes in four principles that must be adhered to so that risk management can be part of the psyche of a company.
"First, link the risk management culture to the strategy of the company; second, build the culture from the bottom up; third, ensure that change is leadership led through role modelling; and fourth, align the company to make the cultural change stick."
Schnepf cautions against the glib use of the mantra of "everyone is a risk manager". "Many firms follow but not all succeed in imbedding within the organisation. While compensation incentives should specify a risk/control component that can be measured, the most important behaviour reinforcement is the tone set from the top. If senior management routinely articulate and abide by certain risk precepts and protocols, then the rest of the organisation will respect them as well. If, however, senior management routinely ignore or treat controls as obstacles, then their employees will be tempted to do similarly," she advises.
Advising companies in updating their risk management modelling and framework in capital planning, credit, market, operational and liquidity risk, Malviya states: "The idea here is quite simple. Integrate the risk framework that incorporates aspects related to credit, market, operational, liquidity and all the other relevant risk considerations as they are highly correlated."
"For instance, a bad counterparty credit decision will lead to market risk exposure (caused as a result of getting rid of collateral), which in turn could cause liquidity concerns if the asset is not sold at the correct price or time – operational risk failure.
As for the models, a good understanding is required of what the model is intended to do. Be prepared to understand the results and communicate effectively and emphatically to people who make the final decisions," he says.
Common sense and judgment is what Schnepf advises here. "Rigorous modelling is needed but should not be engaged in for the sake of simply engaging in academic debate. Measurable output and crisp translation into non-quantitative terms is crucial."
Talking of risk management techniques in the post sub-prime world, Malviya sees them becoming stronger. "Risk management professionals may have borne the brunt of several investor groups, governmental agencies in the aftermath of the global credit crunch but this should not be deciphered as a sign of weakness."
"If anything risk management techniques will be further enhanced to consider scenarios and circumstances that may have been previously ignored. A positive message coming out of what has happened in the recent times has made the task of creating an awareness of risk management easier for all interested parties. Businesses will appreciate the role of risk management more and perhaps view the function as a business partner. Drive towards improving risk models, more regulatory oversight and a giant leap towards self-risk assessment are a few benefits to list," he states.
Traylor believes that the failure in implementing proper risk management policies led to the recent financial debacles. "Risk management did not fail and create the current financial crisis. The failure was in adopting adequate risk management practices or ignoring the warnings of appropriate risk management programs. Risk management continues to evolve and I believe it is capable now of managing the risk in the post sub-prime world, as it was capable before the onset of the financial crisis. Businesses need to evolve to adopt and make risk management as much a part of their culture as any other business imperative. Nevertheless, risk management will continue to evolve to capture and quantify risks. Successful adoption of risk management evolution is a matter of business adaptation," he mentions.
Effective liquidity risk management framework
Liquidity is the lifeline of any business. There are examples galore of businesses failing due to lack of liquidity. The common pitfalls are asset concentration, lack of adequate management information systems, ineffective or absent liquidity strategy, very little or no senior management involvement in the day-to-day liquidity strategy execution, lack of contingency plans, economic conditions and so on, the list is endless.
In order for any liquidity strategy to work, the following principles must be assessed:
- Liquidity mismatch analysis: Every firm should create, update and maintain a liquidity mismatch schedule, which matches assets with liabilities for different time horizons. In simpler language, the requirements should be married with availability in the given time spectrum.
- Strong liquidity strategy and implementation: All firms need to have a strong liquidity policy in place and this should policy transmit across the firm, both preach and practice.
- Robust management information system: Effective implementation translates into practice by having a robust liquidity management information system that churns out timely, reliable and accurate reports to the management to understand and take suitable actions.
- Contingency strategy and scenario analysis: Liquidity mismatch analysis should be tied in with contingency strategy: what does the business do if a particularly bad scenario happens in practice, what are the back-up plans, are there alternative sources of funding that the business has access to – these are some very pertinent questions to consider.
- Internal control and mitigation of operational risk: This can be achieved by having in place a mechanism to conduct independent reviews of cash management, testing the effectiveness of the system, maintaining audit trails.
The underlying principle is that however good the policies are, it is its implementation, monitoring and taking corrective action [if required] that lends it strength.
Aditya Malviya, Director of the Risk Management team at Arqaam Capital
Keep up with the latest business news from the region with the Emirates Business 24|7 daily newsletter. To subscribe to the newsletter, please click here.