Enterprise risk management is evolving into holistic risk portfolio management. This means eliminating unwanted risks to create room for smart risk-taking on high-return strategic business initiatives. Managing risk on a holistic level poses challenging questions, including:
- What is our organization’s risk capacity?
- How do we assess how much aggregate risk-taking is prudent?
- What if our risk tolerance requires a cash buffer for unexpected cash flow surprises?
The answers to these questions depend on understanding your organization’s risk capacity and risk tolerance.
A Top-Down Approach to Estimating Risk Capacity
Estimating your company’s risk capacity does not have to be a daunting exercise. The principles are fairly straight-forward. It is often better to keep the analysis relatively quick and simple, versus engaging in overly complex approaches that take a long time to develop and may thus be irrelevant by the time an initiative is launched. Also, understanding the relative value of competing initiatives may often be more relevant to decision-making than focusing on the precise valuation of each initiative by itself.
Step 1: Identify critical financial metrics thresholds
An organization’s risk capacity is typically constrained by specific thresholds, such as commitments to minimum corporate credit ratings or compliance with financial debt covenants. The objective is to identify and determine such critical thresholds, typically over the medium-term horizon (e.g., maximum financial leverage for each of the next eight quarters).
For example, credit rating agencies provide issuer-specific reports that illustrate what financial metrics would put upward or downward pressure on assigned credit ratings. For a company that is determined to stay within specific credit ratings or categories, such as investment grade (defined as Baa3/BBB- or better), the minimum threshold would be defined as the financial metrics that correspond to such minimum ratings. Two common financial metrics in this context are leverage ratios and coverage ratios, which are based on debt, EBITDA and interest rate expense.
Step 2: Determine historical financial metrics fluctuations
Once critical financial metrics have been determined, the next step is to estimate future uncertainties in projections for these metrics (referred to as “fluctuations”). One common approach to estimate future expected fluctuations is to measure the variability in historical financial statement data.
For example, let’s say that debt and EBITDA represent the most applicable financial metrics to stay within an identified critical leverage threshold. To assess the likelihood that we comfortably reside within such a leverage threshold, we need to determine reasonable fluctuations of debt and EBITDA over the forecasting horizon. Historic fluctuations in debt and EBITDA would be a starting point to estimate future variability in such financial metrics. When performing this historical analysis of past variability, companies often chose to “adjust” historic data to eliminate the effect of impacts that are unlikely to have any bearing on future results. This includes one-time items or outlier events that are stripped out of reported financials to improve the relevance for forecasting future fluctuations.
Step 3: Build the base case scenario and evaluate strategic initiatives
Having identified critical financial metrics and related thresholds and having estimated future reasonable fluctuations around projections of these metrics, we can now build the base case stochastic model of our business results. This stochastic model leverages our estimated variability of future financial metrics, thus providing reasonable distributions of future results around the conventional “point estimations” of projections. This base case represents the business as is (i.e., without accounting for contemplated strategic initiatives).
We can construct our base case stochastic model by applying estimated fluctuations to financial projections. This is done to assess the likelihood of complying with the previously identified thresholds. Building on this base case, we can evaluate various, perhaps competing, strategic initiatives, such as M&A or business transformations, by overlaying scenarios on top of the previously discussed base case.
This is a valuable tool for CEOs and CFOs seeking to better deal with M&A auctions, where potential acquirers often must act extremely quickly to provide new bids for in-play companies. Thus, the likelihood of the so-called “winner’s curse” can be reduced. Instead, informed decision-making in time-sensitive situations relieves stress on decision-makers.
Creating Risk Capacity for Strategic Initiatives
When there is time to plan for strategic initiatives, multiple contingency scenarios can be built on top of the base case scenario to offer insights into what mitigating actions provide sufficient risk capacity room for strategic initiatives. Thus, if we do not like the odds, we can proactively free up room by eliminating existing risks. This is the essence of holistic risk management—looking at risk holistically across the organization and looking at the portfolio of risk as a whole.
The key here is to identify undercompensated risks that are not part of our core business to be eliminated. Foreign exchange and commodity exposure are frequent examples of risks that are non-core to most non-financial companies. Whereas such risks may be non-core to you, they may well be core to financial market players, and can thus be mitigated at low frictional costs.
After identifying risks to be eliminated, you can reassess the likely threshold compliance proforma for the subtraction of the unwanted risk. To account for unknown or unmodeled risks, or when risk tolerance concerns demand a more conservative approach to estimating risks, it is common to add a dollar risk buffer into the modeling. For instance, a company may want all scenario likelihood calculations to allow for an extra $100 million surprise cash flow shortfall to compensate for unknown risk factors. This can be built into the model as an overlay scenario.
The following table shows a framework that can be used to conceptualize what type of actions to be considered for each risk type in an organization's risk portfolio. For example, for a risk that is both a strategic fit (top row) and provides a high return (right column), the focus is to amplify good risk taking in pursuit of return. If the opposite is true, we would seek to reduce risk taking in this category to free up risk capacity to make room for better endeavors.
In summary, by measuring an organization’s base case risk capacity, and adding scenarios for strategic initiatives, we can take smart risks while staying within our risk tolerance limits. When risk capacity space is not available, we can add room by eliminating or mitigating risks. The resulting adjusted risk portfolio may be conducive for prudent strategic risk taking in pursuit of risk-adjusted returns.