Enterprise Risk Management and Business Continuity

Enterprise Risk ManagementandBusiness ContinuityRick Gorvett, FCAS, MAAA, ARM, FRM, Ph.D.Actuarial Science ProfessorDepartments of Mathematics and FinanceUniversity of Illinois at Urbana-ChampaignCrisis Management & Business Continuity SeminarBloomington, ILOctober 10, 2003Agenda•About me•A risky world•Broadening our perspective•Enterprise risk management (ERM)–Evolution–Current state–Relationship to Business Continuity•Conclusion“Who am I? Why am I here?”-Admiral James Stockdale, 1992•Currently–Professor, Depts. of Mathematics and Finance–University of Illinois at Urbana-Champaign•Prior–Senior Vice President–Director of Internal Audit & Risk Management•Internal Audit•Corporate Investigations•Risk Management•Enterprise Risk Management•Business ContinuityA Risky WorldAnd it just seems to be getting riskier!•What’s getting riskier about our world?•What isn’t ?–Perhaps aspects of technology, medical care,…?•Evidence of riskiness–Catastrophic events in a more crowded world with greater vulnerabilities–Current events–Books –e.g., Safe Food: Eating Wisely in a Risky World–Financial marketsWhy Worry AboutInterest Rate Risk?(cont.)Data per FRED II, St. Louis FRB, for 3-Month T-Bills, Secondary MarketMonthly Change in U.S. T-Bill (Annualized) Returns-6-4-2024Month (Jan 1934 through June 2003)Change in Annualized Return (Percentage Points)Why Worry AboutInterest Rate Risk? (cont.)Data per FRED II, St. Louis FRBHistorical Term StructureU.S. Treasuries02468101214161819771983Calendar Month (1977 to 1983)Percentage Rate3-month1-year5-year10-yearWhy Worry About FX Risk?Time Series of Annual Percentage Changes in Exchange RatesJapanese Yen /U.S. Dollars(Data per FRED, St. Louis FRB)-30.0%-20.0%-10.0%0.0%10.0%20.0%30.0%19711975197919831987199119951999YearPercentage ChangeSteps in theRisk Management Process•Determine the corporation’s objectives•Identifythe risk exposures •Quantifythe exposures •Assess the impact•Examine alternative risk management tools•Selectappropriate risk management approach•Implementand monitorprogramThe Bottom Line:It All Boils Down to Capital•“Capital”–Assets less liabilities; owners’ equity; net worth–Support for (riskiness of) operations–Thus, supports profitability and solvency of firm•“Capital Management”–Determine need for and adequacy of capital–Plans for increasing or releasing capital–Strategy for efficient use of capitalWhy Do We Care About Managing Capital?•Leads to solvency and profitability•Benefits of solidity and profitability–Higher company value–Happy claimholders–Better ratings–Less unfavorable regulatory treatment–Ability to price products competitively–Customer loyalty–Potentially lower costsThe “Problem” With Capital•A certain amount of capital is needed in order to promote solvency–Thus, we need to be able to raisecapital•But.... If there is too much capital, profitability (as measured by return on equity) will suffer–Thus, we need to be able to efficiently deploycapitalWhat Does Capital Management Entail?CapitalManagementProductPricingFinancialRisk Mgt.SettingObjectivesRaisingCapitalStrategicPlanningLiabilityValuationAssetAllocationRiskManagementFinancial Theory andCapital Management•Why bother to worry about financing or FRM (or any risk management activity), in light of the “capital structure irrelevance proposition”?•Modigliani-Miller (1958): if financing doesmatter, it must be because of one or more of:–Tax effects –convex tax function–Financial distress /bankruptcy costs–Effects on future investment decisionsCapital Structure -Reality•Modigliani-Miller Proposition: capital structure decision is irrelevantto firm value, under certain “friction-free” assumptions (e.g., no taxes)•But: in reality, there are taxes•There are also costs associated with financial distress•Different corporate situations may indeed lead to differentcapital investment decisionsImpact of Financial Risk Managementon Cash Flow VolatilityCash FlowLikelihoodPre-FRMPost-FRMEnterprise Risk Management•Or “Enterprise Risk and Assurance Management”•What is ERM?–Concerned with a broad financial and operating perspective–Recognizes interdependenciescorporate, financial, and environmental factors–Strives to determine and implement an optimal strategyto achieve the primary objective: maximizethe valueof the firmGoals of ERM•Ensure business continuity•Enhance opportunities for the company to achieve its objectives•Create and increase company value•Make risk management more cost-efficient•Stabilize earningsEvolution of ERM•Historically: “risk silo” mentality•Mid-1990s:–First “Chief Risk Officer”–First use of ERM terminology•Late-1990s:–Risk-related regulatory requirements (e.g., Turnbull)–Earnings protection insurance debuts•2001:–September 11–Corporate scandals–Beginning of efforts to improve corporate governanceCurrent State•Findings from various surveys–An acknowledged need to improve risk management–A recognition that a holistic approach is appropriate and preferable–ERM can improve overall capital management and thus enhance corporate value and competitiveness–A variety of approaches to improving risk management–There are still problems to overcomeA Paradigm ShiftTraditional•Risks managed in silos•Concentrates on physical hazards and financial risks•Insurance orientation•Ad hoc /one-off projectsEmerging•Centralized mgt., with exec-level coordination•Integrated consideration of all risks, firm-wide•Opportunities for hedging, diversification•Continuous and embedded Types of Risks•Operational–Hazard–Physical•Strategic–Capital /resource allocation–Industry /competitors•Technological–Databases–Security–Confidential information•Stakeholder•Legal–Compliance–Regulatory•Financial–Capital markets–Credit risks–Taxes•Human capital–Retention–Training•ReputationalIssues in ERM Implementation•Different corporate cultures require different ERM approaches•Who is going to be the ERM champion within the company–Among senior executives–Among departments /functions•How to embed a risk management culture and responsibilities throughout the firm Components of the ERM Process•Determine corporate objectives•Risk identification–Goal: comprehensiveness–E.g., self-assessment•Risk measurement–Volatility measures–Value at Risk (VaR)ImpactLikelihoodSize of lossLikelihoodComponents of ERM (cont.)•Assessing the impact–Stress or scenario testing–Stochastic simulation•Examine and select alternative risk management tools and techniques–Traditional risk transfer–Natural hedging /diversification–Integration of risksE.g.,“dynamicfinancialanalysis”An Analytic Technique:Dynamic Financial Analysis•Dynamic–Stochastic /variable –not fixed /static–Reflects uncertainty•Financial–Integration of financial, operational, etc., factors–Assets andliabilities•Analysis–“An examination of a complex, its elements and their relations”–Complex: “a whole made up of complicated or interrelated parts”Definition of “DFA”“Dynamic Financial Analysis is the process by which an actuary analyzes the financial condition of an insurance enterprise. Financial condition refers to the ability of the company’s capital and surplus to adequately support the company’s future operations through an unknown future environment.:The process of DFA involves testing a number of adverse and favorable scenarios regarding an insurance company’s operations. DFA assesses the reaction of the company’s surplus to the various selected scenarios.” --CAS DFA HandbookKey Ideas in this DFA Definition•“Financial condition”–Specifically, capital and surplus•“Future operations”–Going concern•“Unknown future environment”–Uncertainty /stochastic•“Testing a number of.... scenarios”–Analysis across different environments•“Assesses the reaction of.... surplus”–Analyze acceptability of resultsTypes of DFA•Scenario testing–Projects results under specific conditions–Catastrophe, interest rate shift–Used for cash flow or stress testing–New York Life Insurance Regulation 126 •Stochastic simulation–Models uncertainty components by distributions–Uses randomly selected values to calculate a large number of outcomes–Evaluate risk by proportion of unacceptable outcomesSample DFA Model Output Distribution for SURPLUS /Ending/I115PROBABILITYValues in Hundreds0.000.030.060.100.130.166.813.921.128.235.442.549.7Keys to Success in ERM•Senior management commitment and sponsorship•Embed a “risk management culture” in the corporation at the operational level•Provide for accountability, both specific and widespread•Clearly defined responsibilities for coordination and maintenance•Adequate communicationKeys to Success inBusiness Continuity Planning•Senior management commitment and sponsorship•Provide for accountability, both specific and widespread•Clearly defined responsibilities for coordination and maintenance•Adequate communication•Differentiate BCP from “technology disaster recovery”Conclusion“The revolutionary idea that defines the boundary between modern times and the past is the mastery of risk”-Peter Bernstein, Against the Gods