Enterprise Risk Management

1. Enterprise Risk Management ACCA Conference - Mayfair Radisson Hotel 3rd July 2009 Brandon Davies

2. The definition of ERM Enterprise Risk Management may be defined as a process for managing risk on a firm-wide basis, across types of risk, locations and business lines. There is nothing fundamentally original in the concept of Enterprise Risk Management. Companies and especially Banks have been managing their balance sheet risks on a top-down enterprise-wide basis for at least three decades. What is new is that Companies now have tools that in many markets enable them to manage their balance sheet risks on a more integrated basis.

3. The definition of ERM These are: risk analytics � which provide a greater ability to understand not only the risk of any one transaction, but the risk of that transaction in the context of all other transactions the company is undertaking. Thus companies can now manage risk to some considerable extent at the portfolio level risk management products � which allow a company to manage its credit or market risk exposures, e.g. credit default swaps, commodity swaps and options and interest rate and currency swaps and options. There are also insurance contracts and outsourcing contractors available that make operational risk more manageable than in the past.

4. The definition of ERM The availability of enhanced analytical tools and risk management products has in turn led to new governance structures There is no single risk governance structure that can be considered the �correct� one. The availability of appropriate risk management analytics, data, products and expertise should all play a role in defining the appropriate risk governance structure for any company.

5. The definition of ERM The key objective for any company is to have a clearly defined and well executed risk governance structure that allows it to understand and manage its risks. Trying to build a sophisticated ERM based structure without the products necessary to manage the risks in an integrated manner is likely to prove frustrating. Such a structure may be less effective than having a risk committee with a broad membership. Even in major international companies, many senior managers are rightly concerned that ERM based analysis can become too sophisticated

6. The definition of ERM It is important to recognize that correlations are observations, they do not imply cause and effect. Moreover correlations in financial markets in particular are in general conditional - the relationships change depending on where the economy is in its cycle. Such correlations are also dynamic in that they change as a result of potential drivers such as technology, which occurs with the development of new products or markets. It is important therefore to maintain a certain wariness in relying on observed or assumed correlations within, let alone across, risk categories.

7. The definition of ERM Many companies may start the process of ERM by looking at the way in which some of their businesses or products exhibit strong connections between risk categories, such as say commodity market and credit risk. Such connections are common, for instance, market risk inevitably brings with it counterparty credit risk Managing these risks in a connected fashion can be described as integrated risk management, which is usually undertaken at the business or divisional level, and may lead towards ERM

8. The history of ERM Financial crises have been the main driver in the development of the information systems and financial products necessary to undertake risk management. Whilst these crisis have often originated in financial markets the lessons have been drawn on by governments, regulators, auditors and analysts and have changed perceived �best practice� in corporate governance. The current financial crisis will be no exception and a personal forecast is that as a result cash flow statements will become more important as a basis for analysts and auditors appraisal of a companies robustness.

9. The history of ERM In banks the management of the balance sheet through the ALCO has allowed them to take an enterprise-wide approach to financial risk management, setting prices to reflect risk and the cost of its management. In companies the �auditing� of enterprise risks has usually resulted in a clear delineation of risks into transaction, translation and economic exposure Transaction exposure is as it says a look at the risks a company runs at an individual transaction level. Whilst it may pay to insure or hedge such risks on a deal by deal basis this is often inadequate as contracts may be long term or the prospect of repeat business may warrant a more strategic look at risk management on a continuing basis. - For example it would not pay an airline to hedge it Kerosene risk on a flight by flight basis.

10. The history of ERM Translation exposure relates to the way risks may be represented in a set of financial accounts. Whilst it may be thought that the role of such accounts is to uncover risks it can on a surprising number of occasions misrepresent them. It can be important for companies either to explain any perceived misrepresentation or to undertake transactions to mitigate any undesirable effects of such translations. - For example the hedging of future profit flows from overseas subsidiaries may create currency exposures the hedging of which would not count as such under IFRS.

11. The history of ERM Economic exposure is often the most fundamental of risks and the hardest to deal with. It is the underlying risk of the company to such risks as location or technology risks etc. - An example of such a risk is when a company located in one jurisdiction finds itself subject to laws or regulations that increase its costs and make it uncompetitive with companies in other jurisdictions

12. ERM today During the first few years of the 21st Century there was a series of high-profile business scandals and failures (including Enron, Tyco and Worldcom) where investors, company employees and other stakeholders suffered very large losses In response to calls for enhanced corporate accountability, the US Congress passed the Sarbanes-Oxley Act in 2002 The COSO internal control framework is generally considered an appropriate framework for meeting the Sarbanes-Oxley reporting requirements.

13. ERM today COSO also saw the need for a more extensive framework that would provide: key principles and concepts a common language clear direction and guidance for a more complete risk management process. As a result, it published the �Enterprise risk management � integrated framework�, in 2004. The ERM framework extended rather than replaced the internal control framework.

14. ERM today COSO developed a deliberately broad definition of ERM so that it could be applied across organizations, industries and sectors. Its standards encompass the following process. Enterprise risk management is: carried out by a company�s board of directors, management and other personnel applied as part of creating a company�s strategic plan applied across the entire enterprise designed to identify potential events that may affect the company adversely designed to manage the company�s risk to the level of its risk appetite intended to provide reasonable assurance that the company can achieve its objectives.

15. ERM today COSO identified the following as essential for enterprise risk management: - aligning risk appetite and strategy � management considers the entity�s risk appetite in evaluating strategic alternatives, setting related objectives and developing mechanisms to manage related risks - enhancing risk response decisions � ERM provides the rigor to identify and select among alternative risk responses � risk avoidance, reduction, sharing and acceptance - reducing operational surprises and losses � entities gain enhanced capability to identify potential events and establish responses, reducing surprises and associated costs or losses

16. ERM today identifying and managing multiple and cross-enterprise risks � every enterprise faces a myriad of risks affecting different parts of the organization, and enterprise risk management facilitates an effective response to the interrelated impacts, and integrated responses to multiple risks seizing opportunities � by considering a full range of potential events, management is positioned to identify and proactively realize opportunities improving deployment of capital � obtaining robust risk information allows management to effectively assess overall capital needs and enhance capital allocation

17. ERM today- implementation The first component of a companies ERM framework is a clearly defined and well established management oversight and control culture that includes some or all of the following features: the board and senior management articulates a risk management and control philosophy that sets the tone for the risk management culture throughout the company risk appetite is set by the board and senior management risk is defined to include all of the risks faced by the company � both financial and non-financial, and both internal and external risks are considered on a portfolio basis � across risk types and across business entities risk considerations are an integral component of strategy formulation and implementation risk considerations are also an integral component of day-to-day activities. ERM involves all personnel at every level, from the board down.

18. ERM today The second component of the ERM framework is a risk management process that corresponds to the four remaining elements of the risk management framework. The terminology used to describe the risk process varies from company to company but will in general cover: Risk recognition and assessment Control activities and segregation of duties Information and communication Monitoring activities and correcting deficiencies

19. ERM today- implementationa warning Whilst many concepts in ERM have their origins in portfolio management it is important not to get carried away with this idea. Whilst any grouping of risks may be characterised as a portfolio they are as likely as not to be more of a collection of disparate risks acquired not as a result of deliberate choice as of the necessity to conduct a business

20. ERM & Economic Capital Some companies (notably banks) have developed economic capital frameworks as tools for assessing risk, have realized benefits in the following areas: risk management � economic capital provides a consistent and comprehensive risk management tool using a common language and measure capital adequacy � economic capital calculations can be used to determine the level of capital needed to absorb severe losses risk appetite � the amount of risk that a company is willing and able to take. Economic capital is often used to explain risk appetite strategic planning � economic capital can be used to take into account the cost of risk when planning future strategy, by making it clearer which alternatives create the most value. It can also be used when assessing the success of existing strategies performance assessment - economic capital can be used in performance assessment, by evaluating the returns in relation to risk portfolio and product management - economic capital can be used to support decisions in many operational contexts.

21. ERM & Economic Capital Economic capital is the amount of capital required to absorb severe unexpected losses over a specified period with a specified confidence level Economic capital is often depicted using charts such as the one shown below. The chart shows the typical distribution of a bank�s losses, with the size of loss indicated on the �X� axis and the frequency of loss indicated on the �Y� axis. The shape of the chart indicates that losses will usually be less than the expected (mean) loss, but that occasionally there will be very large losses.

22. ERM & Economic Capital

23. ERM & Economic Capital Expected loss is the anticipated average loss over a defined period of time. Income to offset these losses would normally be factored into product pricing. For example, product margins should cover expected credit losses as well as overhead costs and the cost of unhedged risk. Unexpected loss is the potential for actual loss to exceed the expected loss, which reflects the inherent uncertainty in the loss estimate. Capital is held to absorb unexpected losses, and the cost of holding such capital should be factored into pricing decisions

24. ERM & Economic Capital The confidence level (or level of certainty) indicates the probability that the economic capital will be sufficient to absorb unexpected losses over a specified time period. It is sometimes interpreted as the risk of insolvency during the specified time period. Both the level of certainty and the time period are determined by bank management. Tail risk is the potential for actual loss to exceed the unexpected loss. Capital is held to absorb these extreme losses (losses beyond unexpected loss), and the cost of holding such capital should be factored into pricing decisions.

25. BUT DANGERThe definition of ERM It is important to recognize that correlations are observations, they do not imply cause and effect. Moreover correlations in many financial and commodity markets are in general conditional - the relationships change depending on where the economy is in an interest rate cycle. Such correlations are also dynamic in that they change as a result of potential drivers such as technology, which occurs with the development of new products or markets. It is important therefore to maintain a certain wariness in relying on observed or assumed correlations within, let alone across, risk categories.

26. BUT DANGER