With hindsight many have rightly argued that the credit crunch has fundamentally been caused by a failure of risk management. A failure to understand the risks and exposures within the portfolio of assets held by financial services companies. Understanding the quality of assets and liabilities on these companies balance sheets is now a major industry challenge. We can all nod wisely whilst expressing these sentiments with the benefit of hindsight.
However on the day that has seen the disappearance of two major Wall Street players, it is worth reflecting on the value of foresight, or more specifically, on how another Wall Street player appears to have foreseen the looming subprime crisis and managed its positions accordingly. I refer to Goldmans Sachs who appear to be weathering the current storm better than many others. In a recent article, The New Arsenal of Risk Management, the authors note that Goldmans has so far avoided the large losses that have afflicted its leading competitions. They suggest that this is because “the firm’s culture embraces rather than avoids risk.”
So with the benefit of hindsight would Risk-based performance have helped Lehman Brothers and Merrill Lynch, or indeed Bear Sterns and others in the market to develop the foresight to survive? Naturally we would argue it would, but quite simply we will never know and would be foolish to make such unsubstantiated claim. However, in this article we will briefly touch on three areas where the value delivered by Risk-based performance encourages us to argue that it is the right approach going forward and would help management develop the type of foresight that will be required in a future, more challenging business environment.
The areas we will touch on are:
- Focussing on what we are trying to achieve
- Understanding cause and effect relationships
- Driving transparency
1. Focussing on what we are trying to achieve
The Risk-based performance methodology requires that companies understand what they are trying to achieve and develop a reasonable level of clarity around their objectives. Ideally, an organisational strategy map is the starting point for a Risk-based performance implementation, however often companies may not have a defined strategy map. We often start with a ‘rough’ strategy map distilled from various strategy presentations and documents. This is a ‘starter for 10’ and enables us to move on with discussions that will ultimately clarify the strategic map, objectives and the key risks and key controls.
Using organisational objectives as the starting point for discussions ensures that the resulting key risks and key controls are focused on delivering the objectives and are explicitly aligned to objectives. Too often we see key risks and key controls developed in brain-storming sessions which begin with the question “What are our key risks and key controls?” rather than beginning with “What are we trying to achieve, what risks will stop us achieving and how do we mitigate those risks?”. In our experience, when the discussion starts with a completely open-ended question “What are our key risks and key controls” without the strategic context in place, the result is often a large number of poorly defined, poorly thought out risks and controls which will be very difficult to monitor and manage going forward.
The Strategy Map can also be used as the basis for what might be referred to as an Execution Architecture – this is a relatively simple but powerful idea that involves using the Strategy Map concept as a basis for understanding where different types of risks are within the business and how they should be managed. This example uses a generic strategy map to demonstrate this idea.
The Strategy Map is used to capture and visualise the cause and effect relationships within the context of strategy. The idea behind the Execution Architecture is to overlay major risk types onto the Strategy Map to clarify the cause and effect relationship between these different types of risks therefore improving our ability to manage these risks. For example, reputational risk often presents a number of challenges of how to best manage it. Using the Execution Architecture concept, it is clear that reputational risk is a lagging risk type which has a strong relationship with operational objectives and risks in leading perspectives, Internal Processes and Learning & Growth. Therefore this demonstrates that the quality of your operational risk management has a direct impact on your reputational risk profile.
2. Understanding cause and effect relationships
Building on the previous point around cause and effect relationships, the Risk-based performance methodology encourages organisations to define leading and lagging indicators within each of the three different scorecard types – Performance Scorecard (Key Performance Indicators), Risk Scorecard (Key Risk Indicators) and Controls Scorecard (Key Control Indicators).
Using leading and lagging indicators enables the cause and effect to be monitored and managed. This enables performance and risk drivers to be captured explicitly within the scorecards and helps improve the quality of indicators, generating better information and reducing the number of indicators that are required. It also provides management with ‘levers’ to manage the business.
The concept of leading and lagging indicators is a familiar one to those who have knowledge of the Balanced Scorecard. However extending this thinking to include risk and controls with the Risk-based performance methodology brings significant additional value through the level of clarity and quality of management discussion and information generated as teams seek to understand how a lagging Key Control Indicator can also be a leading Key Risk Indictor, which in turn maybe a leading Key Performance Indicator.
These are discussions and relationships that are generally developed and refined over time through an iterative process of review and refinement.
3. Driving transparency
Addressing Performance, Risk and Controls in an integrated framework, as Risk-based performance does, drives the level of transparency, both within each dimension and within the overall performance and risk picture created.
Transparency is created at the strategic level via the Risk-based performance Strategy Map which sets out the organisational objectives plus related risks and controls. The status of each dimension, performance, risk and controls, is visualised via the Strategy Map using the Risk-based performance RAGAR scoring method. This promotes informed and robust management discussions around the balance between risk and reward.
At a more operational level the Risk-based performance scorecards generally leads to a better reporting and analytics environment. In a recent implementation in a middle office environment, management feared the continuing increase of operational losses and what seemed to be ever increasing error rates. In fact, in developing the data to support the scorecards, the resulting key indicators presented a different picture. They showed that the trends for losses and error rates had significantly dropped (as had the volume of business – not surprising in today’s environment) but there was a significant lag in the reported financial numbers. This new level of transparency enabled profiling of losses and errors. It also enabled profiling and aging of outstanding claims by counterparties – providing the information to enter into negotiations to ‘clean up’ historical losses and reduce historical exposures.
These are just three areas where Risk-based performance can help to develop the insight and foresight that will enable companies to survive and drive execution in this difficult business environment.
Whilst Risk-based performance delivers a framework to manage performance and risk strategies, processes, and technologies, most importantly it encourages the development of a ‘Risk-based performance culture’ – a culture where well-informed discussions and debates around risk and reward become everyday occurrences and a normal part of management decision-making. Developing this type of ‘Risk-based performance culture’ is critical to the successful execution of strategy now, as demonstrated by Goldmans, and in the increasingly challenging business environment we will all face in the immediate future.
Related articles that maybe of interest include;