Developing risk maps and assembling the risk register produces a lot of information about risks, in qualitative as well as in quantitative terms. The simple fact that these processes are in place provides some reassurance that the risks are recognized and given proper attention. This is a goal in and of itself.
While in many ways essential to an ERM program, risk maps are largely static devices that don't allow codependencies between risks to be taken into account in any meaningful way. As a straightforward example, consider the relationship between the oil price and the USD/NOK exchange rate. Given the oil dependency of the Norwegian economy, this exchange rate tends to be sensitive to the price of oil, which is quoted in USD. Over the decades, this has provided Norwegian oil companies with a natural hedge: A lower oil price tends to weaken the Norwegian krone, as less oil revenue needs to be converted into NOK. Such dynamic relationships are hard to capture in a risk map, yet they are highly relevant to the risk management strategies of these companies.
Nor do the risk maps easily translate into an overall estimate of the uncertainty in the firm's future performance, as expressed through financial bottom lines such as earnings, liquidity, or balance sheet ratios. These shortcomings of the risk maps bring us to the fourth task facing the executives responsible for an ERM program: aggregating the firm's portfolio of risks into some indicator, or metric, that can guide the company's executive team (and board of directors) in matters related to the firm's overall risk profile.
Alviniussen and Jankensgard (2009) argue that most ERM programs today are detached from the analytical work of predicting and managing the firm's financial position. Not taking into account the firm's financial situation means that, despite the ERM effort to identify and quantify risks, an estimate of aggregate risk continues to elude companies implementing ERM. In the enterprise risk budgeting (ERB) approach proposed by these authors, the risk register is integrated with the firm's financial planning process to generate risk-adjusted forecasts of important enterprise-level indicators of performance and financial health.
To address the concerns voiced in the previous paragraph, companies need to take a more analytical and quantitative approach to risk management. In practical terms this implies building a model that combines the company's many different risks into a probability distribution for some bottom line considered important, such as earnings or its debt-to-assets ratio. From such a probability distribution, summary risk statistics can be obtained – for example, the loss in earnings associated with a certain probability (this measure is known as earnings at risk). Generally, this approach requires some form of simulation methodology (e.g., Monte Carlo simulation).
Statoil's corporate risk model, briefly introduced earlier in this chapter, is based on these principles. It contains a sophisticated methodology for estimating the amount of variability in the firm's main risk exposures, based on historical time series, as well as estimates of the tendency of these risks to co-vary. It lets the user select an output from a list and, within a few minutes' time, obtain a probability distribution for this variable. Moreover, the user can learn what the probability distribution would look like under an alternative course of action. For example, the model allows the user to overlay the probability distribution for net income with a second distribution that takes into account a certain risk management strategy (e.g., buying put options covering a certain fraction of the company's net exposure to the oil price). Such an overlay is illustrated in Exhibit 4.3.
Statoil's risk model allows the company to produce a probability distribution for various financial parameters considered important, such as earnings or return on assets employed. The obtained probability distribution can be used to derive summary risk statistics of the company's overall risk. In this graph, the base case outcome distribution (the darker line) for net income is compared with what it would look like if the company implemented a large-scale hedge of the oil price (the lighter line). The values of net income on the x-axis have been deliberately hidden. The vertical dashed line represents the value of net income associated with the 5th percentile of the probability distribution, a measure commonly referred to as net income at risk (or earnings at risk).