How can a business drive value out of a risk management program? The answer is different for everyone, says Keith DeCoster, managing director, Aon Risk Services.
“As risk assessment frameworks have evolved over time, it has become more evident that a well-positioned risk management program can provide meaningful information to key decision-makers,” DeCoster says.
Regardless of how one approaches the decision-making process, an organization is creating a model to quantify potential outcomes and support the decision. These models are more objective if they are developed using a systematic, structured and quantitative approach. The three steps in this process are determining an organization’s risk appetite, measuring risk impact or quantification, and stress-testing “what-if” scenarios.
In part one of a three-part series, Smart Business spoke with DeCoster about how to approach risk financing decisions.
How should a business approach modeling with regard to risk financing decisions?
At any level of model sophistication, the outcomes may be wrong. They are, however, beneficial in providing directional information and aiding in forecasting. The results are powerful in supporting decisions, from everyday choices to catastrophic event planning and management. To drive the greatest return, risk identification and prioritization can provide focus as to which risks are worthwhile to assess in a deeper manner. This leads to focused and value-accretive risk quantification efforts.
Within that framework, a powerful guidance tool can be created that is flexible enough to incorporate environmental changes. This arms decision-makers with information to frame reasoning and logic and represents information in the correct manner. The process begins with the determination of risk appetite. Only when forecasts, performance objectives, financial thresholds, performance drivers and management interaction are integrated will a true picture of risk appetite emerge in relation to key performance objectives.
How can a company determine its risk-bearing capacity (RBC?)
A 2006 publication from Standard & Poor’s titled ‘Evaluating Risk Appetite: A Fundamental Process of Enterprise Risk Management’ identifies three key elements. First, create an understanding around the magnitude of adverse events in relation to risk tolerance. Second, determine the amount of capital that would be acceptable to lose over a defined time period. Third, establish preferences for performance through financial targets and objectives and the relationship to risk. When incorporating risk performances into the risk appetite discussion, consider including business/performance model uncertainty, risk concentration, the nature of critical risks and experience in managing critical risks. Any risk appetite evaluation begins with a good understanding of expected financial and operational performance that is aligned with critical performance measures.
Using the expected performance baseline, identify thresholds for performance. For example, an annual budget management target has a different threshold than a debt covenant. Both carry different implications if they are not obtained and could impact how resources are deployed to manage risk. Once thresholds are established, the magnitude of risk appetite in relation to an objective is established.