Boards and crisis: being prepared for major risks

September 2017 | SPOTLIGHT | RISK MANAGEMENT

Financier Worldwide Magazine

September 2017 Issue

Risk management used to be reserved for the back office and risk reports used to put board members to sleep. Not anymore. The confusion and the impact of risk has increased dramatically, and those companies that have developed special skills, flexibility and acumen have gained a terrific advantage in the face of crises.

We find that board best practices are aligned along the following four dimensions. Physical health check – what are we exposed to? Mental health check – are we capturing the right problems? Strategic check – are we making the right moves? Governance check – are we well structured for continued awareness?

Slippage on any one of the four dimensions may doom a company to failure or underperformance. When times were good, underperformance was often acceptable because everybody was doing well. In today’s tough times, underperformance is no longer acceptable. Being unhealthy during an epidemic is not the same as being unhealthy during good times. Fortunes are also made during these times of survival of the fittest. In the following paragraphs, we discuss, in more detail, the four dimensions critical for boards to maintain adequate risk fitness. It is important that boards focus on all four dimensions to ensure fitness and success.

The physical health check – technical risks

First and foremost, a physical health check is necessary. By now, every firm should be aware of where it hurts. Ideally, they will also be aware of where their major clients and suppliers are feeling pain.

We are puzzled by companies that are almost surprised when they encounter difficulties. In today’s world, nothing should surprise us anymore: technology, geopolitics, society, company culture and of course all the classics like commodities, foreign exchange and credit. We need to open our minds to new risks, to all risks, and somehow prepare ourselves for them. While a company can never fully prepare for the actual risks, it still helps frame the mind, the organisation and the network so that those prepared can react faster, better and stronger.

Threats and opportunities may come from many different sources. For example, the bankers’ traditional view of risk residing in markets, credit or operations has been blown to pieces (and the Basel Accord is certainly threatened). Suddenly, risks are converging, interconnecting and complexifiying each other. Supply of capital, disruption of markets, volatility of values address at once the credit side, the market side and the operations of banks. Thus, we cannot rely on our old estimates. Instead, we must put the plan on the drawing board again.

There are three immediate lessons on risks that can be taken from the financial markets recent evolution. First, there is no single best way to measure risk. Second, risk picking is a major risk by itself. Not picking risks is picking risks. Third, risks do not have a shape.

We have to say that techniques have value. Financial models look for simple solutions, such as volatility or standard deviation to match with the real world in an effort to eliminate risk. Are these measures working? One major issue with these measures is the linkage of risks. In extreme situations, risk linkages are very different. Copulas, one of the most sophisticated risk tools, is a mathematical function that models how risks link. However, copulas are highly unstable. At best, these measures give a view, often biased, of risk under a certain framework. Using these tools poses a great challenge, as they might fail. The financial market does not equate to physics. In reality, when you take action, your behaviour may alter the risk profile and start a feedback loop that invalidates your reasoning. So what kind of risk reports to the board?

Having several technical frameworks to think about risk and ensuring a solid risk culture are key. With the world evolving toward a non-normal set up, as it is doing today, we have to consider many risk measures.

Markets evolve, as do risks. New products often entail untested risk. In 2012, JP Morgan Chase lost $7bn, “a storm in a teapot” as Jamie Dimon put it. A trader in London, the ‘London whale’, who was hedging the balance sheet of the bank, lost $7bn on a simple derivative CDX.NA.IG.9. The trade was supposed to hedge the default risk of the loans for the large corporations. Apparently, the hedging became speculation. On the board’s risk committee, there were three independent directors. None of them had banking or risk experience – one was the director of a museum. Boards can be the new risk of organisations, through their lack of knowledge, lack of commitment or lack of preparation. Hence the justified public consideration for boards as a risk factor.

As threats and opportunities may come from many different sources, risks are converging, interconnecting and amplifying complexity. For example, in oil & gas, the drop in oil prices has created a ripple effect that goes much beyond revenues and impacts the value chain much beyond the organisation itself, touching suppliers, countries, clients and affecting geopolitics. Thus, we cannot rely on our old estimates. Instead, we must put the plan on the drawing board again. For this, we suggest a four-step process for technical risk mastery, as outlined below.

Identify your risks

Identifying risks is too important be left to a bottom up approach. Your employees – whether it is a single person, a single department or even the CEO – will often miss the big picture. The view of the board must be fed by bottom up reporting (with open lines of communication in the corporation). One well-known company, when it started risk reporting to its board, decided to conduct a large survey, which involved most employees. It then compiled the data and reported its findings to the board. The major risk – the one that was consistently rated as having high impact on each and every employee – was VAT compliance, which was hardly a major corporate risk. Thus, the compilation of individual employees’ views of major risk, without the benefit of top-management’s view, and then of the board, may not result in a good view of risk for the whole corporation. However, taking the bottom up approach and listening to different viewpoints is still important.

Assess your risk

Once major risks have been identified, it is crucial to assess them to gain a better understanding of these risks. Even non-quantifiable risks can be assessed. The assessment does not need to be exact, as risks cannot be fully assessed. Otherwise, they would not be risks. The role of the assessment is not to be successful in the assessment, but rather to grow awareness and develop a common language that can then be used to communicate and prepare for the risk.

Many tools are available for assessment. The use of multiple tools is recommended for large investments or in sensitive areas. Sensitivity analyses (tornado diagrams or spider diagrams), scenarios and ‘Monte-Carlo’ simulations are all useful tools, with different granularity and different ease of use. A verbal assessment, done by those closest to risk, is also useful. The goal is not to increase paperwork; instead, the role is to increase awareness, and thus, we welcome all tools that help us get closer to a true awareness of the potential impact of the identified risks. No one technique can be right and thus the compact use of multiple tools is a necessity for proficient boards.

Manage your risks

If risks are present, is it best to eliminate them? If this is the case, then managing risks may become fundamental. Being too conservative can be an issue. Investors expect you to take risks. You should only eliminate those risks that are not core, and then risk management should be conducted with full transparency. We find that the best risks to manage are those that create more downside than upside. An airlines’ exposure to fuel costs is a good example. An airline has more to lose when oil prices are very high than it does when they are very low. Thus, for any risk management programme, two questions should be asked by the board. First, does it truly create value for our shareholders? Many risk management programmes create comfort for managers rather than add value to the business. Second, does it depend on timing? Any management programme that depends on timing is a speculative programme. You then have to ask the question: are you good at speculation?

Structure your risks

Finally, the structuring of risks – or sharing of risks – has had dramatic success in recent times. This entails identifying different risk exposures in a company’s network of relationships (investors, clients and suppliers among others) and agreeing to share the risks with those least sensitive to them (such as those most able to overcome the risks), to create value for all. This principle has often been used in joint ventures and acquisitions (with earn outs) as well as in commercial contracts.

Once the physical check is complete, and the board is well grounded in its thinking, it is time to address the mental check, the strategic check and governance check.

The mental health check – behaviours

The question the board must ask is – how is our risk attitude, at board level, at management level and at employee level?

We all know that market sentiments have taken many by surprise; the reality is that such sentiments are well-known factors of risk nowadays. Markets are crazy, but markets may be just a reflection of us. Are we much better than they are? And, thus, this raises the question – can we look at our failings?

We now have good views of typical behavioural risks that arise. As a checklist, boards should test themselves and test management on a number of different dimensions – a classical roster of seven behavioural risks, as outlined below.

Herd behaviour. Are we following the herd? Many prefer to have company when they are wrong rather than be wrong alone. This is particularly true of boards. Unfortunately, this type of behaviour has certainly contributed to getting us into today’s mess. Thus, it is useful to revisit past decisions, successful ones as well as failures.

Optimism. When asked if they are counted in the top 1 percent of the richest in America, a full 15 percent of the US population answers yes. Are you a better driver than average? A better board member than average? Is your company particularly insulated in the crisis? A reality check may be warranted.

Overconfidence. The best professionals acknowledge that predicting oil prices is close to impossible. The same can be said for predicting currencies or predicting markets. What about you? Most of us have views and many of us start believing our own views. Thus, the question is: do you truly know how little you know? Not surprisingly, most of the board members with whom we have administered this test, fail it. They are leaders, and one does not lead others with self-doubt. Unfortunately, in difficult times, taking some time for self-doubt is important.

Belief perseverance. Have you held the same views for a long time, despite the shifting world in which we operate? If so, are these views rigid? Most of us do not adapt fast enough; we do not have the flexibility. While humans have been remarkably adaptive as a species, we are still being pushed around. How fast can you evolve to the new environment we are facing? Do you still expect the old times to come back? If so, it is time for a reality check.

Hindsight bias. Are you the type that tends to think: ‘I told you so. I knew it.’ If so, are you looking back in time truthfully, or are you second-guessing how you truly would have reacted from today’s situation, rather than from the past.

Anchoring. Are you holding on to your stocks because they used to be worth three times more and, thus, it would be a loss to sell them now? Is your view of your assets linked to what they were a few years ago?

Representativeness. Do you believe that markets will come back up because they always do? Do you believe the cycle is four to five years, as it traditionally has been? Are you looking for some pattern to repeat itself? Sometimes true, life-altering changes happen, whether the Russian revolution or machine learning, and we have to accept that this is a possibility. Some events have changed the world in such a way that past patterns do not come back.

All of these behavioural patterns act as liabilities against your awareness of risks. Just checking where you stand, where your team stands and where your organisation stands will help you figure out the reality.

Strategic checks

As major shifts happen, strategies need to be revisited. Holding on to past strategies does not make sense. But developing new strategies, or adjusting passively to the markets, is not much better. While strategic thinking is complex, and the building of strategies requires much work, from client and competitor awareness to abilities to build on one’s core distinctiveness, there are ways for boards to test overall strategic choices for their pertinence. And, thus, the question we ask is simple: is management’s strategic shift in front of a crisis a smart move?

Smart or stupid? There are a limited number of typical strategies. Once the move is identified (and this can be done for clients and suppliers as well), one needs to question it. Is the strategy smart? Overall, smart moves will: (i) lever and enhance the company’s distinctiveness, i.e., its objectives, values, culture and capabilities, in terms of skills and resources, and its resources, in terms of assets, clients and partners; (ii) not fall into psychological traps: such as we can beat the competition no matter what we do, we know what the customer needs or we never admit defeat; we always move forward; and (iii) address significant market opportunities.

First, assess the strategy and the move considered. Then confront competitors’ moves, customers’ needs and value chain opportunities. Then use change management techniques together with quality leadership, align the organisation toward the newly defined goal and consistently drive success. Of course, even smart strategies can fail: the environment can change, the competitors can move unexpectedly, etc. Then comes the need to possibly align again, revisiting all previous risks. High quality boards will recognise this.

Governance check

Leaders fail. It happens. It is not the worst problem by itself. Leaders are human and while the selection process may be rigorous, good leaders in some circumstances may prove to be bad leaders in others. The problem comes when governance fails to balance the failing leader in place. This is where governance risk happens. In order to control for that risk, governance excellence should be grown continuously. Not to constrain but simply as a matter of fact, to make sure that leadership failure, when it happens, does not become too costly to the organisation.

There are some well-known governance risk factors that can be self-checked in any organisation. In particular, classic risk factors include: (i) a poorly defined role of the board; (ii) a domineering CEO or chairman; (iii) a poor governance culture, lacking integrity, accountability or responsibility; (iv) an inefficient board: size, independence, personalities, the role of outsiders, the structure of the board committees, all matter; (v) conflicts of interest at the board or senior management level; (vi) compensation schemes that have strong side effects; and (vii) a board that is not well aligned to its mission (whether supervisory, strategic, connecting or hands-on).

Good governance should be maintained even when things go well. The best time to make improvements is when things are going well because it is usually not as hectic as when things are not going well. Once the structures are in place for continued corporate awareness, good governance is ensured. On the other hand, poor governance will lead to classical failures: poor awareness of risks (the banks during the crisis), poor alignment board to management during tough times (BP and the Macondo blowout) or the breakup of board relations during times of stress.

Conclusions

When companies have done their physical and mental checks, when they have smart strategies in place and when the structures are in place to ensure good governance, there is a sound basis for success even during difficult times. Then, difficult times suddenly become times of re-incubation; times when a company’s distinctiveness can be deepened and new opportunities fuel success. It is hard work, but, instead of being a hard pill to swallow, a crisis can turn into a true medicine.

Didier Cossin is professor of finance and governance and Abraham Hongze Lu is a research fellow at IMD. Mr Cossin can be contacted on +41 (21) 618 0208 or by email: didier.cossin@imd.org. Mr Lu can be contacted on +41 (21) 618 0505 or by email: abraham.lu@imd.org.

Didier Cossin and Abraham Hongze Lu

IMD