One story of the credit crisis can be told as a “tale of two banks.” Both banks are real financial institutions — large, well known, and diversified — that cannot be identified by name. Both were hit hard in the first months of the crisis; indeed, there was concern that they might not survive. But they had very different ways of approaching risk as they struggled to rebuild their businesses.
The first could be referred to as the Bank of Caution. Its leaders deliberately retrenched. They dramatically cut back new loans, and they established very high capital reserve requirements, trying to anticipate future regulatory requirements. After a month or two, upper management pushed for more risk taking, but individual traders resisted. The Bank of Caution garnered a great deal of praise, at first, for its responsible and prudent behavior.
The other bank might be called Intrepid & Company. Its leaders chose from the outset to take on more risk, despite the crisis. They set ambitious loan and profitability targets, and they encouraged their traders to continue looking for high-return investments.
The result: two very different levels of financial performance. The Bank of Caution posted a quarterly loss. Its executives privately admitted that their timid risk policy was largely to blame. Intrepid & Company, in contrast, posted a record profit in the second quarter of 2009 and set aside substantial reserves for both future loans and year-end compensation.
The Bank of Caution’s case is a textbook example of management oscillation after a crisis. In many companies, the pendulum of corporate policy swings to extremes, first embracing risk excessively and then pulling back with sudden force from the perceived cause of trouble. This story also shows how difficult it can be for senior management to align its risk-taking expectations with the attitudes of rank-and-file employees, and it suggests serious competitive implications for a company that shifts its practices so readily. The problem of excessive caution is pervasive today in a variety of industries. The global financial meltdown has made many business leaders so risk averse that they are missing opportunities for returns.
Why should a sudden wave of prudence be troubling? Because well-considered risk taking is critical, not just for the success of individual companies but also to enable a properly functioning economy. For example, business-to-business lending always involves a certain level of risk; curtailing it can hobble entrepreneurship, deprive deserving businesses of capital, and reinforce deflation. Moreover, for any business, the calculation of risk should assess not only potential damages, but also potential rewards and gains — and an overly cautious mind-set makes that more difficult to do well.
Although the need for risk taking is recognized by both businesspeople and economists, the complex web of risks in the global economy severely tests many companies, both in their judgment about how much risk to take and in their controls for tracking and managing it. It doesn’t help when senior management teams are not practiced at discussing risk in the context of strategic decision making or at articulating their expectations to the organization.
To overcome this problem, many companies need a fresh, more rigorous definition of the appropriate level of risk to take: in short, the articulation of their risk appetite. Besides asking how much risk to avoid and how to prepare for the downside, corporate leaders should be asking how much risk they want — and how much capital they are willing to stake for how much potential gain. These considerations should be discussed and made clear to the organization before the moments of truth in a trade or deal, so that traders and deal makers understand the risk appetite of the company as a whole and the part that their individual deals might play in corporate-wide performance.
Benefiting from Clarity
A risk appetite is a company-wide statement of the amount of risk that is desirable in day-to-day affairs. Setting this goal, and satisfying it through everyday practices, links the firm’s strategy directly to operations and implementation. It ensures that the risks being taken align with the business agenda set by senior management and the board of directors. Defining the risk appetite empowers employees to make the necessary trade-offs between risk and caution on behalf of shareholders and the future of their enterprise, and it gives them the support they need to make decisions with confidence, especially in this time of financial instability and government oversight.
Creating and implementing a risk appetite architecture requires conducting an ongoing, multidimensional analysis of the business. It means delving deeply into company practices to understand the interplay of all the different kinds of risk — market, credit, investment, operational, reputational — within and across different lines of business and how they affect the whole. It also means monitoring the risks that are being taken and identifying trade-offs across the enterprise and ways to keep risk at an optimum level, to avoid both overextending the firm and missing opportunities.
Just having a risk appetite process and framework in place can have a dramatic impact. For example, after the financial crisis, one government had to bail out a group of failing financial institutions, acquiring controlling interests in some commercial banks, insurance companies, and small investment banks in the process. The government was very sensitive to the reputational risks that it might face as it restructured the portfolios of these institutions. Given the charged political environment, the government representatives even considered it dangerous for these companies to make significant short-term profits, especially from transactions that could be seen as risky.
The government therefore defined a single risk appetite framework for the group and embedded it in the various enterprises. This profile included a number of specific metrics, reflecting both the government’s desire for gain and its concern about limits. For example, the top gross leverage ratio was set between 20 and 40. Simply having this limit in place forced one of the newly acquired banks to shut down some of its more highly leveraged businesses.
Though it might seem only relevant to financial services, defining risk appetite is a valuable exercise for companies in any sector. A multinational chemical company, for instance, might perceive a need to hedge commodity risks and guarantee the supply of some incoming raw materials by speculating on their prices. But this creates two problems. First, in many cases, the company’s management does not know how much risk to underwrite. Given the strategic goals of the business, it isn’t clear what level of exposure is worthwhile. Second, decisions about speculation and hedging are typically made within one business unit, and therefore the risk is not viewed in the context of the total company. Thus, the local management might hedge against the risk of high prices in a certain commodity, without being aware that the larger company’s natural diversification over its 20 units has already compensated for this risk, reducing it to zero and making the hedge unnecessary.
Similarly, consider the benefits for an energy company that can articulate its risk appetite. The share prices of multinational oil companies typically track the price of oil, but shareholders generally dislike volatility in earnings and share prices. Therefore, oil companies tend to be undervalued, and their leaders devote significant effort to trying to give the impression of stability in the face of fluctuating oil prices. Instead, companies could articulate their appetite for earnings volatility to employees and shareholders at the same time. This would provide a visible rationale for hedging efforts to smooth out earnings, and it would also add to the shareholders’ tolerance for fluctuation; it would thus stabilize share prices overall. The financial performance of airlines is also tied to oil prices, and airline executives can only gain from a clear statement of their threshold of discomfort. Is it US$75 a barrel, or $90? With such a marker in place ahead of time, both management and shareholders can be better prepared for the measures that will be needed when oil prices rise or fall.
The Risk Appetite Exercise
Whether a company wants to get a better handle on its own risks or is mulling an acquisition and needs to understand how the target company’s risks might interact with its own, it must consider five basic components in defining a corporate risk appetite.
1. Establish a risk baseline. Catalog all the current risks in financial terms to better understand the organization’s exposures and concentrations. How much damage would be sustained if all current measures failed to the greatest plausible extent? This exercise must be conducted at the individual business unit level as well as across the enterprise to illuminate aggregate risks and diversification benefits.
2. Set a risk appetite for the company. This is done through a framework that translates the corporate strategy into a largely quantifiable set of metrics and measures for everyone to work with. The exercise involves a series of questions designed to tease out a firm’s preferences and pain barriers for all types of risk. A company should evaluate risk from the following angles:
- The overall group tolerance for risk. When looking at the overall company, management might ask itself these questions: What level of financial risk are we willing to maintain? For example, what leverage and earnings volatility is acceptable? What level of reputational risk can we handle — and, conversely, what sort of public reputation are we seeking to create? What is our desired long-term credit rating?
- The mix of businesses. Executives considering specific units might ask these questions: Should this business be grown, contracted, or maintained as is? Should our oversight and controls be increased, decreased, or maintained? How does this business fit with the other units?
- The preferences for aggregated exposure and concentration. An executive team could ask these questions: What is our maximum acceptable level for investments in a single industry or our maximum exposure for a single investment domain? What is the maximum asset class concentration?
3. Supplement the internal view with an external perspective. Look at the company’s risk taking in the context of the competitive landscape. For instance, a manufacturer might find that its leasing business, although profitable and within its risk guidelines, yields inadequate returns when benchmarked to the industry.
4. Implement the implications. After a company catalogs its current risks and clarifies its appetite, a reckoning is most likely in order. Some lines of business will continue as they are, but others will need to change or perhaps be divested. Some businesses might prove too risky and others not risky enough, or the risk level might be on target but the returns too meager.
5. Keep an eye on the dashboard. Once defined, the risk appetite must be monitored regularly. A risk appetite dashboard delivered to managers’ desktops can be used to track operations each day, ensuring that the institution is meeting expectations and can make adjustments when necessary.
The Adaptable Appetite
It is important to keep in mind that no corporate strategy is set in stone. In response to changing business and economic realities, new competitive conditions, or altered strategic priorities, a company’s risk appetite will evolve over time. The company must therefore be prepared to make changes easily and rapidly, and the changes must be transparent: visible, shared with key constituents, and monitored to prevent confusion.
Many business leaders grapple with the question of risk — and with their own company’s confidence level. This is hardly surprising, given the turbulence facing companies, even in times of economic growth. Well-considered risk taking is critical for success; companies that are too cautious for too long sometimes discover that they’ve made a significant mistake. They swing too far toward overexposure, and then they get frightened again and overshoot in the opposite direction. This oscillation between high risk and no risk creates a debilitating and confusing state of affairs for customers, employees, and investors alike.
To cope, companies must adopt new risk management strategies such as the risk appetite architecture. Ultimately, these strategies will help companies better understand risk, rebuild confidence, and steady the pendulum.
Reprint No. 10102
- Alan Gemes is a senior partner with Booz & Company based in London. He is the global head of financial services for the firm and has worked with many of Europe’s leading banks and insurers.
- Peter Golder is a principal with Booz & Company with the financial-services practice based in London, specializing in corporate strategy, capital markets, and risk management.
- Also contributing to this article were Booz & Company Senior Associate Yogesh Patel and Principal Hussein Sefian.