Understanding how value is created and destroyed and the role that risk plays in this process is the key to a successful business operation. One way to reach this understanding is through the development and implementation of a practical framework to systematically manage both value and risk so that your company can better take advantage of ways to increase value for its stakeholders. There are six basic steps in this value and risk management process:1. Establish context by indentifying key value drivers (how wealth is created)
2. Identify metrics (ways to quantify, measure and monitor the key value drivers)
3. Conduct stress tests or simulations of your key metrics
4. Identify and assess qualitative risks related to your value drivers
5. Respond to the risks (treat, transfer, terminate or tolerate)
6. Communicate results of key driver performance and risk management (i.e., the company's risk appetite and risk exposure to all identified risks)
The first step is to look at how your company generates value by identifying key drivers for revenue growth, operational efficiency, asset efficiency and other defined stakeholder or stockholder expectations. For example, all companies can grow revenues by acquiring new customers and retaining existing ones. Both of these support drivers carry specific challenges. Acquiring new customers may involve assessing your current market segmentation and product differentiation whereas retaining customers requires a company to focus on customer service support. You can use your year-end financial statements or financial management packages as a basis to identify the various sources of revenue, cost of goods sold, operating expenses, capital expenses, etc. and then ask yourself what factors, such as product differentiation, for instance, influence each key account item.
Once you have identified how your company creates value the next step is to identify metrics to monitor each key value driver. Ideally you want a mix of lagging and leading key performance indicators vis-a-vis key risk indicators in ERM. There are many indicators which are already in use. For example, most companies report interim financial results (change in revenue, operating expenses, etc.) and some may even have specific analytical metrics like ratios (revenue/staff, etc.). All these are useful, but not sufficient to assess other nonfinancial value drivers. For those metrics you need to look at your support drivers (e.g., market segmentation) mentioned above. Identify metrics which are comparable and easily accessible. Comparability is critical because you do not want to be comparing quarterly with year-to-date metrics. Also remember these metrics will have to be accessible either manually or automatically by a reporting or analytics tools.
Now comes the most challenging part and some may argue the most relevant to risk management -- trying to simulate various scenarios using the metrics identified in step two, also known as stress testing or "what if" analysis. You can conduct stress testing using a number of different methods, all of which pursue the common objective of minimizing potential loss by simulating risk exposure. For example, what happens if prices fall by 20%? What happens if costs of production go up by 20%? By asking yourself these questions and simulating the result using your value driver metrics you can see the impact to your top and bottom lines. Business analytics tools have capabilities to do these simulations with your data, but if you do not have such a tool then the simple "what if" function in Microsoft Excel will do the trick. Also you can create uncertainty by using Microsoft Excel's random formula to conduct Monte Carlo simulations. Many companies use this Excel function to estimate average returns, net income, production capacity, commodity costs, foreign exchange and more.
Once you have identified and quantified the key drivers that add value to your organization and conducted some quantitative stress testing, you can then begin to determine the qualitative risks that impact each driver. Some impacts to consider when evaluating qualitative risks include reputational, regulatory, customer, human resource, strategic, and corporate responsibility and sustainability.
The fifth step is to develop response plans for both the qualitative and quantitative risks identified in steps three and four. Your response can be to either mitigate or exploit. Risk mitigation can be done by transferring, terminating or treating the risk, whereas exploiting the risk may mean increasing your exposure to seek greater payoff or rewards. For example, a strategy to short mortgage class investments prior to the credit markets fallout would have reaped great financial rewards. Consequently increasing exposure in banking stocks at the peak of financial meltdown would have paid handsomely today. Where there is risk there is reward. Warren Buffett has famously said to be fearful when others are greedy and greedy when others are fearful. The key to managing any kind of risk exposure is to clearly understand your risk appetite and implement risk mitigation strategies to manage downside exposure such as stop loss triggers or hedge positions.
The final step in the value and risk process cycle is communication. Internal communication of your company's value and risk profile can serve to motivate and channel employee efforts around your company's key value drivers. External communication to shareholders and other stakeholders adds to the perception that your company is managing both value and risk responsively, and thereby increases trust and confidence in management's capabilities.
Managing value and risk is generally an intuitive skill and learned by experience. By applying a discipline to this inherent process you can better manage value creation and avoid destruction from both a quantitative and qualitative perspective. It is a balancing act between risk mitigation and risk exploitation and the winners will be those companies that understand the market and their value proposition better than their competition.