A Board Member Guide to Risk Practices

As guardians of shareholder interests, board members need to develop a broad working knowledge of current risk assessment techniques. Only then can they be confident that management is choosing the right path.

While warranted by past excesses, a narrow focus on compliance in the wake of recent corporate scandals has distracted the business world from the broader purpose of corporate governance – ensuring a balanced risk/return trade-off for shareholders and other stakeholders. It is high time for corporate boards and managers to return to a wider view of corporate health and sustainability.

Corporate governance generally, and boards specifically, have multi-dimensional responsibilities in steering top management towards the right risk choices. Boards should:

1. Monitor the risk situation of the company systematically to identify and evaluate multiple sources of risk
2. Understand and influence management risk appetite
3. Take a portfolio view of corporate risks
4. Be apprised more specifically of the major risks (or major risk combinations) that could significantly alter business perspectives
5. Evaluate the way in which management has embedded risk management within the corporation, asking organizational questions, such as “Do we need a chief risk officer?” and technical questions, such as “Which tools are being used?”
6. Implement joint decision-making procedures in the case of major deals – acquisitions, significant investments and the like.
7. Well-informed risk thinking, as opposed to pure risk avoidance, must become an essential aspect of good corporate governance. Some companies (most notably in the financial and oil and gas industries) have developed sophisticated risk assessment tools. Yet, even at international banks and insurance companies, boards have failed. Risk models can become “black boxes” hiding the complex reality from board members with limited technical understanding of risk issues. Boards that want to rise to the challenge of broader risk thinking, as befits their responsibility as guardians of shareholder interests, need a basic level of understanding of the latest risk assessment and risk management techniques.

Quantitative risk assessment

As can be expected, the game of risk is highly uncertain. We know in advance that we can never assess risks exactly. So why should boards (and corporations) spend any effort on quantitative risk assessment? Quantitative risk assessment, even when it is not as objective as it looks, offers numerous advantages beyond informal risk discussions.

First, quantitative techniques foster risk thinking. Quantitative methods help boards and management identify the major risk drivers. Consider the impact of changes in oil prices on a car manufacturer such as Ford. The oil price impacts on a number of variables in the complex web that is the modern economy, including secondary energy prices, the cost of inputs for production, consumer demand for fuel-guzzling models, as well as general economic inflation – and, therefore, the interest rates that drive demand for cars by altering leasing or borrowing costs of vehicle financing. In other words, the impact on car sales is manifold, especially in an industry where financial services often contribute between 50 and 100 per cent of profits. Resilience to interest rate changes – as determined by financial leverage, cash flow, protection from exchange rate volatility, exposure to consumer or supplier default risk and so on – is vital to the company’s competitive position. Awareness of the various aspects of the web of risks and how they come together is essential to understanding management’s decisions and, possibly, challenging them. The portfolio view becomes a necessity at board level – and simple numbers help clarify the thinking. For example, what is the company’s sensitivity to oil prices in the context of its costs? How do funding costs increase when interest rates go up or down by 1 per cent? And how many sales would the company lose?

Second, quantitative techniques clarify risk issues by creating a common language: they encourage clearer communication both between managers and the board, and within the board; allow board members to understand management’s risk appetite; and stimulate risk understanding by objectifying subjective viewpoints. For example, I have seen two board members assessing the same situation, with one viewing a project as very risky and the other as moderately risky, although both agreed that the probability of project failure was 10 per cent. Their assessment reflected the degree to which they were averse to risk on a personal level, as opposed to deriving from objective risk evaluation.

Third, metrics encourage better risk management. Quantitative measures help board members focus on major risks. Without a clear scaling of risks, boards and even management can be overwhelmed by the breadth and complexity of risks. As a result, there may be a tendency to focus on classic risks, such as currency risk, rather than analysing the risks that truly impact the business, such as radical loss of market share.

Finally, well-designed quantitative models can help businesses price risks. For example, Moody’s KMV helped investors, lenders, and corporations adopt the tools to measure and manage credit risk. Its EDF™ (Expected Default Frequency) credit measure dramatically changed the way credit risk was priced throughout the world. KMV’s LossCalc™ became the first commercially available predictive model of Loss Given Default (LGD). Risk assessment techniques

The most basic risk assessment techniques start with sensitivity analysis (how one value dimension is sensitive to one risk driver), sometimes organised within a so-called “tornado of sensitivities”. It is surprising how many corporations do not even use this simple method to evaluate risk.

For example, most investment bankers will now present an acquisition analysis with cross-sensitivities to cost of capital and growth rates. Most of the time, a normal spread on the sensitivity analysis will bring out negative perspectives on the acquisition. Many boards have approved acquisitions without paying attention to these and without questioning future drivers of growth and of costs of capital.

The acquisition of BG by Royal Dutch Shell in 2015 was driven on the valuation side by strong oil prices and growth assumptions. Royal Dutch Shell sealed the $53 billion deal to transform the company into a more specialized group focused on the then rapidly growing LNG market and deepwater oil production. The acquisition price is highly sensitive to the oil price – the deal assumes that the price for Brent crude will reach $90 a barrel by 2018 from less than $45 in 2016. Sensitivity analysis methods, however, are poor (if not altogether inadequate) at jointly evaluating multiple risks; nor do they allow for the assessment of extreme risks.

Scenarios are a good way to encompass multiple and extreme risks. While rising a step above simple risk identification and basic sensitivities, the technique remains highly subjective.

The Monte Carlo simulation has brought the world of scenarios to a new, scientific age, by combining hundreds, possibly thousands, of probability- weighted scenarios into one result. The technique, while used frequently in engineering, is less common elsewhere (except in banks). Its potential and simplicity are strong and can present boards with a clear overview of the risk situation. Modern software has made the technique user-friendly. Banks, for example, are switching their Value at Risk (VaR) models, which assess the probability of a certain level of loss or profit, to Monte Carlo-based VaR models. Since banks make money out of risk-taking, being able to evaluate and measure risk is a core competence.

Specific tools to address particular situations have also been developed. For example, option pricing, which is used to calculate the theoretical price of an equity option, has been particularly successful at assessing the economic exposure to specific risks, such as oil price risk or credit risk, the risk of default of corporations. It is now possible for a corporation to provide the board with the default risk of a major supplier or of a major customer in a more precise way than previously. This is all the more important given the current trend for outsourcing.

It is now also possible to assess the impact of external or of strategic changes on funding costs in much more precise ways.
A good board can expect interesting assessments from these tools. For example, when considering a major joint venture, acquisition or supply agreement, the board can use an assessment of the credit risk of the other party to challenge a deal. Better still, it may want to have an assessment of how the joint venture is going to affect the company’s own position.

Finally, the derivatives markets are also providing a wealth of information that goes beyond commodity and stock price behaviours. Futures, Forwards, Swaps as well as Options provide information in market views of markets. Credit default swaps, for example, give an assessment of a country risk when one considers opening a new plant there. It allows an investor to buy protection against default of a party, a corporate or a sovereign, and thus gives a market evaluation of that default. One can easily contrast for example a Russian versus a Brazilian investment, despite the long distance and complexity of the two economies.

Hard-to-quantify risks

Strategic risks are often so complex that even modern tools, such as game theory, are poor at making accurate representations. Nonetheless, strategic and other hard-to-quantify risks need to be assessed for the board’s overview of the corporation. For example, in the case of customer demand risk, what is the risk of a major downturn? More importantly perhaps, how does one prepare for that risk? Is the corporation being run to simply enjoy the heydays of life, or can it handle the hard knocks as well? Better, can it take advantage of the downturn to steal business from competitors?
For example, the battle to retain and even increase global oil market share is intensifying. In 2015/16, Saudi Arabia ramped up production amid oil price collapse. Such strategic thinking created a fiscal gap for Saudi Arabia that has resulted in deep spending cuts. The country might eventually benefit from its strategy in the future, however, there is no easy strategy and the corresponding risks have to be well assessed.

Integration of risks

Banks have been highly sophisticated at integrating different market risks into VaR models. Some corporations use a related model, cash flow at risk (CFaR), which assesses the probability of having a cash flow lower than a certain level. However, these models do not encompass all risks – how many can combine commodity price, credit risk, operational risk and strategic risks, with the standard financial risks? Dependencies between these make them extremely complex, although the latest tools, such as copulas, which assess how risks move together, may reflect new awareness that is important to consider.

Complexity of risk models

Unfortunately, as risk models become more complex, they become black boxes to most board members. And as models move to black boxes, they become a risk by themselves. Often, the simpler thinking may then prevail.

Overall, with integrated risk thinking, we are getting to the point where today’s board will rely on its business sense and on the processes put in place within the corporation. Nonetheless, awareness of all dimensions of risks, assessed whenever possible with quantitative techniques, will help the best board members’ business sense to be accurate.

The outcome of risk assessment

Once the corporation has adequately assessed risks, a board can be more confident that management is doing a good job at taking and managing the right risks. For example, should an airline take on the risk of the oil price? Or should a German luxury car manufacturer take on the risk of the euro/dollar exchange rate? Although absolute answers (yes/no) are often given, more sophisticated choices are often the winners and will reveal management sophistication to the board. One may decide to cap risks that could put the company in jeopardy rather than hedge the whole risk. Or one may decide to just take on the risks, hopefully informing investors so that these risks are transparent.

In a complex global company, any risk programme should be designed with value creation in mind. Often, value for the company is created when one can provide customers with added value or when one can strengthen a competitive situation. Structuring risks has become the name of the game for top-quality management.

In the mid-1980s, Disney was heavily criticised for hedging the yen royalties of its Tokyo theme park at the peak of the US dollar, thus depriving shareholders of valuable foreign exchange gains. Disney’s assessment was that the foreign exchange business was quite far from the Mickey Mouse business, its core competence. One has a hard time assessing what the value of currency management to Disney shareholders could have been. On the other hand, Vodafone, has chosen to minimise foreign exchange hedging, assessing that its exposures are quite transparent and that shareholders are aware of the risks they take (and can diversify or hedge on their own).
Companies must be aware of risks that will inevitably accompany innovative business models. For example, Syngenta, the leading agrochemical company, has provided yield guarantees to farmers in Latin America, thus providing integrated agrochemical solutions and consolidating market share in a low- growth, competitive industry. Boards at companies like Syngenta should be in a position to understand both the risks and opportunities of new approaches.
Schlumberger, the leading oil services company, has started complex projects in which it shares revenues with clients, instead of going for straight sales. By doing so, it is creating new opportunities that enhance profitability – but also lead to new and/or higher risks. A good understanding of the risks taken may lead to new risk management programmes, such as hedging for oil price risk.

Structured deals in acquisitions (such as earn-outs, in which the acquisition price is paid on the earnings realised after the acquisitions) have become commonplace. Few acquisitions can justify being straight deals any more. Typically, sharing structures are like call options, while support agreements are like put options. Basic option thinking is thus also at the basis of risk thinking for board members. For example, LafargeHolcim, a leader in cement, has been building its global presence through joint ventures followed by acquisitions, while major competitors have grown through outright acquisitions. This is typical risk thinking: in a high-risk environment with little cost to time delay, why not get a foothold in the door with an option to expand? The option is all the more valuable when the risk is higher (as option traders know well). Boards that have that basic understanding will supervise effectively the acquisition programme.

Conclusions

Models can be very complex – and can appear to be black boxes to board members who fail to keep up with progress in risk methodology. Just as a patient is unlikely to accept being operated on with medical technology from the 1960s, so corporations today require board members who have a solid grasp of modern risk evaluation and management techniques. Short training courses, coaching and some reading will take most board members a long way. It is not a matter of board members acquiring an in-depth understanding of technical subtleties; it is a matter of leveraging their deep knowledge of business to engage in competent risk thinking as required by the modern corporation.

Didier Cossin is Professor of Finance and Governance at IMD , founder and director of the IMD Global Board Center. He directs High Performance Boards, a program for supervisory board members and chairpersons.