50 Enterprise Risk Management Concepts and Cases Vol.

III
A Strategic Approach to
Enterprise Risk Management
A V Vedpuriswar, T Phani Madhav and Nagendra V Chowdary
Risk management is no longer an optional exercise; it is a
mandatory requirement in most countries. Today, many
companies are emphasizing risk management not just for
legal compliance but also for winning the confidence of
shareholders. ERM, through its integrated approach can
be more effective than a silo based approach.
Organizations face various types of risks. Unfortunately, much of the focus of
risk management has been on the financial aspects. Just like the field of Knowledge
Management has been dominated by IT companies, risk management has been
strongly associated with treasury, forex and portfolio management. The risk
management agenda has been hijacked by investment bankers and corporate
treasurers and dominated by the use of financial derivatives. This is not quite the
way it should be.
Risk is all about vulnerability and taking steps to reduce it. Several factors
contribute to this vulnerability. So, it is obviously incorrect to equate risk with
fluctuations in financial parameters such as interest rates, exchange rates or stock
indices. As the Economist (February 10, 1996) put it: Top managers often fail to
understand properly the firms sensitiveness to different types of risks. This is
because the technology for identifying risk exposures in non-financial firms is as
Source: ICFAI Press. All rights reserved.
A Strategic Approach to Enterprise Risk Management 51
yet fairly, primitive, but more fundamentally because managers and boards too
often regard risk management as a matter for financial experts in the corporate
treasury department rather than as an integral part of corporate strategy.
Exploding Some Myths about Risk Management
While on the subject of risk management, four points need to be made at the outset.
Risk is not something new. One of the earliest examples of risk management features
in the Old Testament. An Egyptian Pharaoh had a dream which was interpreted as
seven years of plenty to be followed by seven years of famine. To deal with this risk,
the Pharaoh purchased and stored large quantities of corn during the good times.
As a result, Egypt prospered during the famine.
Thesecond point is that risk can neither beavoided nor eliminated completely. Indeed,
without taking risk, no business can grow. And if there were no risks, managers
would not be needed. The Pharaoh in the earlier example was obviously taking a
risk in the sense that his strategy would have proved counter-productive, had
there been no famine.
This leads us to the third point. Risk management is all about making tradeoffs.
These tradeoffs are closely related to a companys assumptions about or
interpretation of the developments in the external environment. Consider two
leading global pharmaceutical companies, Merck and Pfizer. Merck is betting on
a scenario in which Health Maintenance Organizations (HMOs) rather than doctors
will dominate the drug-buying process. Hence its acquisition of the drug
distribution company Medco. On the other hand, Pfizer has invested heavily in its
sales force on the assumption that doctors will continue to play an important role.
Each company is working out its strategies based on an assumption and
consequently taking a risk. Similarly, a company which bets on a new technology
could be diverting a lot of resources from its existing business. If the new technology
fails to take off, it may become a severe drain on the companys finances. But, if the
firm decides not to invest in the new technology and it does prove successful, the
very existence of the company becomes threatened. So, what it means is that in
many cases, not taking a risk may turn out to be a risky strategy.
A fourth point, which is often overlooked, is that risk may not ariseonly becauseof
environmental changes. Many of the risks which organizations assume have more
52 Enterprise Risk Management Concepts and Cases Vol.III
to do with their own strategies, processes and culture than any external factors.
For example, the collapse of Barings Bank had as much to do with poor
management control systems as unfavourable developments in the external
environment. An excessive risk-taking culture contributed to the downfall of Long
Term Capital Management. Similarly, many companies have been ruined by the
reckless plans of CEOs obsessed with growth.
Understanding Uncertainty
Organisations face various types of uncertainties.
1. State Uncertainty: This refers to unpredictability about the environment. Causes
of state uncertainty are:
a) Volatility in the environment;
b) Complexity in the environment; and
c) Heterogeneity in the environment.
2. Effect Uncertainty: This is the uncertainty about the impact of developments in
the environment on the organisation.
3. Response Uncertainty: This refers to the unpredictability about the options
available to an organisation and their outcome. Even after an option is selected,
the speed at which it will respond depends significantly on how deeply entrenched
are the companys processes and cultural traits.
Integrating Risk Management into Corporate Strategy
Quite obviously, risk management has to mesh with the ultimate goal of the
organisation, which is to maximise the shareholders wealth. That means
maximising earnings through judicious investments, which in turn necessitates
adequate cash flows. Firms typically run into cash flow problems because they fail
to anticipate or handle risks efficiently. These include huge R&D investments which
do not pay off, excessive premium paid for an acquisition, costly litigation
(especially class action law suits) by aggrieved stakeholders, excessive dependence
on a single or few customers and suppliers and vulnerability to interest rate, stock
index and exchange rate movements. In March 1997, the chemicals giant, Hoechst
incurred expenses of about $400 million due to product recall and unexpected
A Strategic Approach to Enterprise Risk Management 53
restructuring charges. Metallgesellschaft tried to cover the risk associated with its
long-term contracts through oil futures. It ended up losing a huge amount. Philip
Morris had to cut prices of Marlboro sharply due to unexpectedly stiff competition
from cheaper private labels.
Thus for any company, the sources of risk and the ways to deal with the risk are
closely linked to business strategy. We need to examine how some strategies create
risks while others mitigate them. Any company needs to grow and generate
adequate profits to survive in the long run. Unprofitable or stagnating companies
are doomed to failure. So, per se, companies have to make investments. All
investments carry some risk. Indeed, if investments did not carry risk, the field of
financial management would not exist. Thus, risk cannot be eliminated entirely.
On the other hand, a prudent risk management strategy would result in sufficient
cash flows which can keep the company going even if some of the investments run
into rough weather. And it would ensure that the company holds only such risks
it is comfortable with and transfers the remaining risks to other parties.
How does a company decide what risk to keep and what to hedge? By classifying
risks, managers can decide what risks to carry and what to transfer by taking a
suitable insurance. Often, companies are comfortable with outsourcing risk caused
by external factors. This is probably why financial risk management has caught on
quite well in recent times. Companies also tend to transfer those risks which are
unmanageable. They also usually cover one time risks rather than recurrent risks
typically through insurance. Companies also usually carry those risks which are
closely connected to their core competencies. Thus, software companies would in
normal circumstances, not transfer technology risk. Self retention makes sense
when the cost of insuring the risk is out of proportion to the probability and impact
of any damage. However, there is no hard and fast recommended rule. What risk to
keep and what to transfer has to be determined on a case to case basis.
Types of Risk Commonly Encountered
A firm can be exposed to various types of risks. Let us now look briefly at some of
the risks commonly faced by organisation.
Strategic risks arise from the firms core business strategies. Excessive
dependence on a single or few products or a single or a few regions for generating
54 Enterprise Risk Management Concepts and Cases Vol.III
revenues leads to vulnerability. A diversified product portfolio or geographical
base can lend a degree of stability to revenues and profits. This may mean moving
into new businesses or expanding capacity to serve new markets. Major capacity
expansion, vertical integration and diversification projects all involve risks.
Quantifying the risks involved and taking a view on whether such risks can be
borne is hence crucial.
The most commonly discussed form of risk is financial risk. When interest or
foreign exchange rates fluctuate, there is an impact on cash flows and profits. Risk
also increases as the debt component in the capital structure increases. This is
because debt involves mandatory cash outflows while dividends in the case of
equity can be paid at the discretion of the company. Today, sophisticated hedging
tools like derivatives are available to manage financial risk.
Technology risk has become a major factor these days, especially due to the
growing importance of software as opposed to hardware. Innovations are more
frequent and regular in the area of software. Consequently, companies which do
not have a strategy to cope with changing technology may find themselves at a
disadvantage. Very often, successful and well-established companies fall by the
wayside in the wake of an innovative and disruptive technology introduced by
a startup.
Political risk refers to actions of governments that interfere with business
transactions, resulting in loss of profit or profit potential. In extreme cases, political
risk results in confiscation of property. More commonly, governments change
policies from time to time and put restrictions on the way businesses operate.
Another type of risk is environment risk. If companies fail to put in place policies
which ensure that the environment in which they operate is not damaged, they
face the risk of resistance and hostility from the society. In some cases, the very
existence of the company may be threatened, as well illustrated by the example of
Union Carbide in Bhopal. Similarly, oil companies like Exxon have faced major
crises due to oil spills from their tankers.
Many companies today look at mergers and acquisitions as a way of generating
fast growth by gaining access to resources such as people, products, technology
and facilities. Yet, mergers and acquisitions have to be planned and executed
carefully. The premium paid by the acquiring company should reflect the synergies
A Strategic Approach to Enterprise Risk Management 55
which can be realised. Poorly executed acquisitions prove to be a severe drain on
the existing resources and even ruin a company in some cases.
Today, legal risk has also become important. Class action suits by employees or
shareholders can pose grave concerns. Similarly, anti trust proceedings by the
government can distract a company so much that it may not have enough time for
its core business. Microsoft, till the recent judgment has been heavily burdened in
this respect. On the other hand, Intel seems to have managed its anti-trust risks
well through various proactive measures personally overseen by Andrew Grove.
More and more importance is being paid to high standards of ethics and corporate
governance. Unethical practices and low standards of corporate governance can
severely damage the reputation of a company. In such circumstances, the share
price and consequently the market capitalization may plunge dramatically. A good
example of a company, which has seen a severe decline in its business owing to
unethical and illegal disclosure practices is the famous insurance company,
Risk Management:
A Holistic Perspective
Legal &
Ethical Risks
Technology
Risks
Strategic
Risks
Environmental
Risks
M&A
Risks
Political Risks Financial
Risks
56 Enterprise Risk Management Concepts and Cases Vol.III
Lloyds of London. In India, Shaw Wallace, once one of Indias leading companies
is in ruins because of poor corporate governance practices. In the mid-1990s, ITC
ran into big problems because of poor corporate governance.
In their seminal paper, The Balanced score card Measures that drive
performance, (Harvard Business Review, January-February, 1992) Robert Kaplan
and David Norton emphasized the need for assessing the performance of an
organisation from four different angles customer perspective, internal perspective,
innovation and learning perspective and shareholder perspective. Their Balanced
scorecard considers financial measures that indicate the results of actions already
taken. At the same time, it incorporates operational measures on customer
satisfaction, internal processes and attempts at innovation and improvement, all
of which drive future financial performance. Similarly, the various business risks
which an organisation faces must be considered along with the financial risks.
Ultimately, financial risks are the outcome of business strategies. If the role of
financial risk management is to minimise uncertainty regarding cash flows, the
very source of these cash flows is the type of business which the company operates
and how well it manages them.
(A V Vedpuriswar is Dean, ICFAI Knowledge Center, an affiliate of The ICFAI
University and Consulting Editor of Global CEO Magazine. He can be contacted at
ved@icfai.org. T Phani Madhav is Faculty Associateat IBS CaseDevelopment Center. He
can be contacted at phanimadhav@icfaipress.org. Nagendra V Chowdary is Faculty at
IBS. Hecan becontacted at nagendravchowdary@hotmail.com)
Treasury Management

January 2003
74
ENTERPRI SE RI SK MANAGEMENT RI SK
Enterprise Risk Management
Understanding the linkages between
Business and Financial Risks
With the changing times, organizations need to follow
a holistic approach towards risk management.
Enterprise risk management has been gaining
prominence in recent times paving the way for
managing all the risks that a firm encounters in an
integrated way. It is being noticed that there exists a
linkage between the business and financial risks that a
firm faces. The financial strategy of a firm has to be
inline with all its other strategies and should effectively
address the needs of the firm.
A V Vedpuriswar
ICFAI Press. All Rights Reserved.
RI SK SPECI AL I SSUE
I
n recent times, the concept of
Enterprise Risk Management
(ERM) has caught the imagination
of CEOs and CFOs across the world.
But the concept itself has emerged
from a simple insight. Business and
financial risks must not be seen as
watertight compartments. They should
be managed in an integrated fashion.
Where business risk is low, a firm can
and should take higher financial risk.
On the other hand, when business risk
is high, financial risk must be low.
Understanding Business Risk
Business risk is nothing but the
uncertainty associated with the
operating cash flows of a business.
The uncertainty is essentially about
how much the firm can sell, at what
price it can sell and what will be the
operating expenses incurred in the
process. These uncertainties are a
direct outcome of the nature of the
business and the firms corporate
strategy. The key issues here are
What are the firms core competencies?
What is its business model? How has
the firm positioned itself in relation to
its competitors? What is its competitive
scope? So, to understand the linkages
between business and financial risk,
we need to understand how financial
strategy emanates from corporate
strategy.
The Link Between Financial
Strategy and Corporate Strategy
Finance professionals often overlook
the fact that a companys financial
strategy emanates from its corporate
strategy. After corporate strategy is
formulated, long-term objectives are
tentatively set. Then the strategy must
be operationalized, institutionalized
and controlled. Strategy
implementation involves:
Identification of measurable,
mutually determined annual
objectives.
Development of specific functional
strategies.
Communication of concise
policies to guide decisions.
Annual objectives are necessary to
translate long-range aspirations into
the annual budget. They are specific,
measurable statements of what an
organization is expected to achieve
towards the accomplishment of the
corporate strategy. Specific annual
objectives should provide targets for
performance in different functional
areas.
A functional strategy is the short-
term game plan in key areas like
marketing, finance, production/
operations, R&D and personnel. Such
a strategy brings clarity to the
companys corporate strategy by
providing more specific details about
how key value chain activities are to
be managed in the short-run and in
the long-run.
The time horizon of a functional
strategy is usually short, typically a
year or less. This shorter-time horizon
helps the functional managers to focus
on what needs to be done to make
the corporate strategy work. It allows
functional managers to recognize
current conditions and make suitable
adjustments to their operating plans.
Formulating Financial Strategy
The time-frame for financial strategies
varies from decision to decision.
Treasury Management

January 2003
74
ENTERPRI SE RI SK MANAGEMENT
Treasury Management

January 2003
75
SPECI AL I SSUE
A firm which wants
to grow market
share rapidly, may
need to take the
acquisition route.
Such a firm may also
like to build a lot of
inventory to minimize
lost sales
Long- term financial strategies are
applicable in areas like long-term
capital investment, capital structure
and dividend policy. Strategies with a
more short-term orientation are
designed to manage working capital
and short-term assets. However, it
must be understood that the dividing
line between short-term and long-term
is often thin and arbitrary. Indeed, the
long-term is nothing but a summation
of short-terms.
Consider capital allocation:
Growth oriented strategies generally
require heavy investments in facilities,
projects, acquisitions, and/or people.
These investments have to be planned
carefully. Often they cannot be made
in one go. So, a capital allocation
strategy must set
priorities and decide the
timing of these
investments.
T u r n a r o u n d
strategies often require
a financial strategy that
focuses on the
reallocation of existing
capital resources. This
may necessitate
pruning product lines,
revamping production
facilities or deploying
personnel elsewhere in
the firm.
An important element of the
capital allocation strategy is the level
of capital expenditure delegation. If a
business is pursuing rapid growth,
flexibility in making capital
expenditures at the operating level
may enable timely responses to an
evolving market. On the other hand,
capital expenditures have to be
carefully controlled if retrenchment is
the strategy. But such policies must
also take into account the nature of
the industry and the organizational
culture.
Capital structure, another strategic
decision in finance, depends again on
the nature of the business and the firms
positioning. Where business risk is
high, as in case of research based
industries, dependence on equity is
preferable. Where business
uncertainties are less, as in mature
businesses like branded consumer
goods, more debt can be used. In a
given business, a more aggressive firm
would use more debt and a less
aggressive firm, more equity.
Dividend policy is an integral part
of corporate financial strategy. Lower
dividends increase the internal funds
available for growth. In turn, internal
financing reduces the need for external
financing. Often this means leverage.
However, stability of earnings and
dividends makes a positive
contribution to the market price of a
firms stock. Thus, a strategy guiding
dividend management must support
the posture of the business towards
equity markets.
Working capital is critical to the
daily operations of the
firm. It is directly
influenced by seasonal
and cyclical
fluctuations, firm size,
and the pattern of
receipts and
disbursements. The
working capital strategy
must provide
guidelines for
conserving and
rebuilding the cash
balances required for
daily operations. The
importance of liquidity
is often underestimated.
Without liquidity, even the most
profitable firms can get into serious
trouble.
Understanding the Linkages
Between Finance and Other
Functions
Financial strategy cannot be
formulated independent of other
functions. But these linkages are often
ignored. Take the example of Research
and Development (R&D). With the
increasing rate of technological change
in many industries, R&D has assumed
tremendous importance. In the
technology-intensive computer and
pharmaceutical industries, firms
typically spend between 4 and 6% of
their sales dollars on R&D. In the
pharmaceuticals business, a new drug
may take up to 15 years to develop,
involving expenses of up to $500 mn.
And global pharma companies have
typically many R&D projects under
way simultaneously to fill the pipeline.
So, one can imagine the huge risks
involved.
The financial strategy will vary
depending on the exact nature of
risks, which in turn would depend on
the R&D strategy. First, R&D strategy
should clarify whether basic or applied
research will be emphasized. Basic
research often has a longer time
horizon than product development.
Consequently, basic research is more
risky. Again, should R&D efforts be
conducted solely within the firm or
should a portion of the work be
contracted outside? If technology is
outsourced, the risks could typically
be less in the short-run. But in the
long-run, the firm may forgo a
valuable source of competitive
advantage.
In general, the more the risk
involved, the more the need for equity,
the more the need to conserve
resources by paying less dividend and
the more the company must depend
on internal sources of funds. As
opposed to an R&D oriented
company, a contract manufacturer who
licenses technology assumes less
business risk. So, he can afford to take
more financial risk. He can use more
debt and pay out more dividends.
Operations Management (OM) is
a core function in any business. OM
is a process of converting inputs into
value-enhanced output. Functional
strategies in OM must guide decisions
regarding the basic nature of the firms
OM architecturethe output location,
facilities design, process planning,
extent of outsourcing, etc.
A firm can manage its operations
in various ways. Vertical integration is
pursued when the costs of interaction
with external entities are high. But
this strategy calls for heavy
investments in fixed assets. So the
more vertically integrated the firm, the
more likely the leverage will be high.
On the other hand, in the case of
vertical integration, working capital
requirements may be less. Heavy
outsourcing may mean less capital
investments but more working capital
may be required as many external
Treasury Management

January 2003
76
ENTERPRI SE RI SK MANAGEMENT RI SK
research, because the positive cash
flows are severely discounted when
they are analyzed over a very long
time-frame. As a result, the volatility
or risk is not properly valued. Option
analysis like the kind used to value
stock options, provides a more flexible
approach to valuing our research
investments than traditional financial
analysis because it allows us to
evaluate those investments at
successive stages of a project.
Concluding Notes
The fundamental goal of a business is
to find customers who are willing to
pay a remunerative price for its
products. As Peter Drucker has
mentioned time and again, profits
always lie outside the business. They
are outside the firms control. That is
why, there is so much uncertainty
about operating cash flows. A firms
financial strategy must take into
account the pattern of operating cash
flows. Business and financial risks
need to be managed in an integrated
way. The four questions which Peter
Drucker raised in his book Managing
for Results are as relevant today as
they were when the book was written
four decades ago. The questions which
Drucker raised were:
What are the risks that are built into
the nature of the business?
What are the risks one can afford
to take?
What are the risks one cannot
afford to take?
What are the risks one cannot
afford not to take?
Finding answers to these
questions is the essence of ERM. And
these answers cannot be found
without a sound appreciation of the
linkages between business and
financial risks.
A V Vedpuriswar is Dean, Icfai
Knowledge Center. His book,
Enterprise Risk ManagementA
Strategic Approach to Derisking an
Enterprise, has recently been
published by Vision. He can be
contacted at ved@icfai.org.
manufacturing people, a framework
for talking about the product and it
suddenly became clear to all involved
that the packaging size had to change.
In this case, then, finance was a real
resource in problem solving.
A major strategic decision which
Merck took in the early 1990s
underscores the changing role of the
finance function. In 1993, Merck paid
a heavy amount to acquire Medco, the
managed health care company. This
was an attempt by Merck to redefine
its business in the early stages of US
health care reforms. Lewent used a
decision tree model with two
branches, one with the acquisition
and one without. She factored in
many possible health care reforms
scenarios. A careful
assessment of these
scenarios convinced
Lewent that no matter
which way the reforms
proceeded Medco
would be a useful
acquisition, especially
in view of its ability to
handle all the
paperwork and cut
costs while ensuring
quality. Lewents
calculations later turned
out to be right.
Finance managers
have to be skilled in
quantifying risk in very uncertain
situations. This implies a good
understanding of the business. It also
implies reasonable familiarity with
techniques such as real options which
go far beyond spreadsheet analysis.
Lewent has explained the role of a
CFO in evaluating risky investments
in the pharmaceuticals business:
They arent investments that easily
lend themselves to traditional financial
analysis. Remember that we need to
make huge investments now and may
not see profit for 10 to 15 years. In
that kind of situation, a traditional
analysis that factors in the time value
of money may not fully capture the
strategic value of an investment in
suppliers are involved and they have
to be paid on time.
There are linkages between
financial and marketing strategies as
well. A firm which wants to grow
market share rapidly may need to take
the acquisition route. Such a firm may
also like to build a lot of inventory to
minimize lost sales. Often, this results
in the need for increased working
capital and consequently more
leverage. On the other hand, a firm
satisfied with a lower rate of growth,
would depend more on internal
resources. Consequently, it will be less
leveraged. Again, we see the clear
linkage between business and
financial risks.
Integrating the Finance Function
into Business
Strategy
To understand the
linkages between
business and financial
risk, finance
professionals will have
to learn to work with
business units as
partners and get a grip
on both the hard
financials and the
strategic intent of any
project. The policing/
auditing mindset will
have to change. J udy
Lewent of Merck, one of the most
respected CFOs in the industry has
talked about one of her experiences
1
,
relating to a development project in
the agricultural research department
for an antiparasitic agent called Avid:
We collected the manufacturing and
marketing elements and the research
inputs, but the financial evaluation
model showed a negative net present
value for the project. If we had been
traffic cops, we would have blown our
whistle and gone home. But instead,
we started to take the project apart and
talk more in-depth with marketing and
with manufacturing We were able
to give the projects sponsors, the
marketing department and
1
Harvard Business Review, J anuary-February, 1994.
Finance managers
have to be skilled in
quantifying risk in
very uncertain
situations. This
implies a good
understanding of the
business
Reference # 5-03-01-20
Enterprise Risk Management 71
Enterprise Risk Management
CFOs must have a thorough understanding of the various
risks their organizations face. A focus on financial risks
alone is not sufficient. Indeed, financial risks are the result
of a companys strategic and operational decisions. A smart
CFO must have a thorough understanding of the companys
strategy and its implications. Only then will the CFO be
able to come to grips with the risks faced by the company
and implement ERM effectively.
A V Vedpuriswar
Enterprise Risk Management (ERM) is all about the identification and assessment
of the risks of the company as a whole and formulation and implementation of a
company-wide strategy to manage them. At the outset, CFOs must appreciate that
ERM combines the best of three different but complementary approaches
1
. The first
is to modify the companys operations suitably. The second is to create an all-
purpose cushion by reducing debt in the capital structure
2
. The third is to use
insurance or financial instruments like derivatives to transfer the risk, at a price, to
a third party. The CFO must weigh the different options before implementing a risk
mi ti gati on strategy. Thi s cal l s for a strategi c rather than a tacti cal or
transaction-oriented approach towards risk management. CFOs must also
Source: ICFAI Reader, April 20003. ICFAI University Press. All rights reserved. This article was originally
published as A Strategic Approach to Managing Risks: The CFOs Role.
1
Read Lisa K Meulbroeks working paper, Integrated risk management for the firm: A senior
managers guide.
2
This approach is very general and applicable across all companies. The less the amount of debt to be
serviced, the lower the risk of going bankrupt.
72 Effective CFO Roles and Responsibilities
appreciate that managing risk in an integrated way is always better than doing so
in a piece-meal fashion.
The Need for Strategic Thinking
Take the case of environmental risk in a chemical plant. Modifying the companys
operations could mean installation of sophisticated pollution control equipment
or using a totally new environment-friendly process. The company could also
reduce debt and keep plenty of reserves to deal with any contingencies arising out
of environmental mishaps. A third alternative is to buy an insurance policy that
would protect the company in case an accident occurs and big compensation
payments have to be made to victims. Taking an insurance cover is simple, but it
implies a minimalist, defensive approach. This is a low-risk, low-return strategy.
On the other hand, tailoring the operations creates possibilities for process
innovations and more sustainable competitive advantages by getting ahead of
other players in the industry. But this is a high-risk, high-return strategy.
Consider an oil company which needs a steady supply of petroleum crude to
feed its refineries. Oil prices can fluctuate, owing to various social, economic and
political factors. The company can reconfigure its operations by setting up a large
number of oil fields all over the world to insulate itself from volatility. This would
limit the damage that can be caused by OPEC, production cuts, terrorist strikes or
instability in Islamic countries. If there is a long recession, the best bet for the
company would be to keep minimum debt and carry a pile of cash on the balance
sheet. The company may also resort to buying oil futures contracts that guarantee
the supply of oil at predetermined prices.
A company like Walt Disney which operates theme parks is exposed to weather
risks. If weather is inclement, people will not turn up. So, Disney decided to set up
a theme park in Florida. This was a major strategic decision with important
implications vis--vis Disneys operations. Disney probably did not have a choice
then. But today, Disney can buy weather derivatives or an insurance policy to
hedge the risks arising from bad weather. This is a purely financial solution.
The software giant, Microsoft operates in a business, where technology changes
rapidly. Microsoft manages its risk by maintaining low overheads and zero debt.
Enterprise Risk Management 73
The company also carries a lot of cash. But Microsoft also has organizational
mechanisms to deal with risk. The capacity of a software company is essentially the
number of software engineers on its payrolls. Excess capacity can create serious
problems during a downturn. So, Microsoft believes in maintaining a lean staff. It
depends on temporary workers to deal with surges in workload from time to time.
This not only reduces the risk associated with economic slowdowns but also results
in greater job security to its smaller group of talented, permanent workers.
Important Risks Faced by Companies
A survey conducted by Mercer Management Consulting between 1993 and 1998 reported that the
following risks had the greatest negative impact on share prices. Most of the risks are of a non-
financial nature.
Accounting irregularities
Competitive pressures
Cost over runs
Customer demand shortfalls
Customer pricing pressures
Foreign macroeconomic issues
High input commodity prices
Interest rate fluctuations
Law suits
Loss of key customers
M&A integration problems
Management ineffectiveness
Misaligned products
Natural disasters
R&D delays
Regulatory problems
Supply-chain issues
Supplier problems
Source: Economist IntelligenceUnit report on EnterpriseRisk Management, 2001.
An airline can manage its exposure to fluctuating oil prices by taking operational
measures to cut fuel consumption, such as by purchasing more fuel efficient engines.
But it can also buy financial instruments such as futures to hedge this risk.
Choosing between a Financial and Organizational Solution
The above examples clearly call for a strategic thinking on the CFOs part. The CFO
must consider various factors before choosing between a financial solution
74 Effective CFO Roles and Responsibilities
revolving around derivatives or insurance and an organizational solution that
calls for a major revamp of operations. Strategic risks invariably need organizational
solutions. Such risks are built into the very nature of the business. But, in many
other situations, financial solutions such as derivatives or insurance may be more
efficient than organizational solutions. One way to resolve this dilemma is to
estimate the amount of capital investment to be made to deal with a risk. This can
be compared with the costs involved in transferring the risk such as insurance
premium or option premium. Financial solutions are often useful when enough
data is available to analyse, model and evaluate the event. If this is not the case,
operations may have to be reconfigured suitably.
Operational approaches to risk management are difficult and complicated in
some situations. They may be too expensive or may conflict with the companys
strategic goals. By using financial instruments, companies may be able to focus on
specific risks and hedge them at a lower cost. Unfortunately, financial instruments
are not available for some types of risk. Also, they are only suited for risks which
can be clearly identified and quantified.
Taking an Integrated Approach
If choosing between an organizational and a financial solution is one dimension of
ERM, an integrated approach to managing risks is the second. Company-wide
integration of risk management activities can cut costs such as by enabling the
purchase of more cost-effective insurance and derivative contracts. In 1997,
Honeywell purchased an insurance contract that covered various types of risk-
property, casualty, foreign exchange, etc. Honeywell cut its insurance costs by 15
percent in the process. Aggregate risk protection not only costs less than individual
risk coverage but is usually better suited to the companys risk management needs.
While taking an integrated view of the different approaches to ERM, CFOs
must realise that one approach, if implemented, can have an impact on another.
For example, the debt employed by a company depends on its capital expenditures,
which, in turn, may depend on the companys diversification plans. Similarly,
cross-business risks should not be overlooked. In 1988, Salomon Brothers
unsuccessful attempt to takeover R J R Nabisco changed its risk profile adversely.
This had a negative impact on Salomons derivatives business.
Enterprise Risk Management 75
Coping with Uncertainty
A good CFO must have skills in quantifying risk in very uncertain situations. Judy
Lewent, CFO, Merck
3
has explained the subtleties involved in evaluating risky
investments in the pharmaceutical business: They arent investments that easily
lend themselves to traditional financial analysis. Remember that we need to make
huge investments now and may not see profit for 10-15 years. In that kind of a
situation, a traditional analysis that factors in the time value of money may not
fully capture the strategic value of an investment in research, because the positive
cash flows are severely discounted when they are analyzed over a very long time
frame. As a result, the volatility or risk is not properly valued. Option analysis, like
the kind used to value stock options, provides a more flexible approach to valuing
our research investments than traditional financial analysis because it allows us
to evaluate those investments at successive stages of a project.
The ultimate strategy for the rainy day is to keep overheads and debt low and
hold lots of cash to tide over uncertainties about which managers have little idea
today. Indeed, equity is an all-purpose risk cushion. The larger the amount of risk
that cannot be accurately measured or quantified, the larger the equity component
should be. That is why companies in the technology business, like Infosys have
little debt. But smart CFOs know that lower risk through use of more equity also
implies lower returns as equity is a more expensive source of funds. So the CFO
must take a view only after weighing the pros and cons.
Conclusion
CFOs must not view ERM as a defensive mechanism. Nor should they equate ERM
with the use of derivatives, insurance and other hedging instruments. Instead,
they must use risk management creatively to add value for shareholders. That calls
for a strategic, integrated approach as opposed to a tactical, transaction passed
approach. As Knight and Petty put it
4
: It (risk management) should be a creative
initiative, exposing exciting opportunities for value growth and innovative
handling of risk. The policy is not about compliance and disclosure, important as
these may be, but it is about developing a strategic approach to enterprise risks
3
Harvard Business Review, January-February, 1994.
4
Financial Times Mastering Risk, Volume I.
76 Effective CFO Roles and Responsibilities
that release value to shareholders. In the absence of such a policy, a company will
be, at best, value-neutral; at worst value-destroying. The risk policy provides the
chief executive with the impetus for sustainable value creation.
(Theauthor is Dean, ICFAI KnowledgeCenter, an affiliateof TheICFAI University.
Hecan becontacted at ved@icfai.org).