Companies and regulators love reports, disclosures and transparency. And nobody loves risk reporting more than me. Trouble is risk reports are RM1. If we wanted to really make a difference to decision makers we would switch from risk reporting to risk-adjusted performance reporting instead. Risk managers always have a choice: generate own risk reports or use the outputs of risk analysis to improve existing performance and management reports instead. To me the choice is clear. Integrating risk information into existing management reporting is the future. So, what should risk-adjusted performance report look like?
5 items you would expect to see in an awesome performance report:
1. Probability of achieving a target or an objective / likelihood of success
A useful metric that risk managers should communicate to decision makers is the probability of meeting / achieving an objective or target. Think of it as achievability given the risks. If your performance report has targets or objectives, then risk managers can measure and report how achievable they are and whether they are more achievable today than last month. Norman Marks calls this likelihood of success and Tim Leech calls objective centric. I provide a step by the step guide how to do it here. This can be represented as a single number (70% probability of achieving business plan objective) or as bands (forecasted performs falls within acceptable range). Separate likelihood of success needs to be reported for each significant objective. Archer Insight, for example, does a good job presenting risk information as probability distributions around the objective.
2. Risk-adjusted performance metrics
Most of the time it makes no sense reporting on the risks, instead information about risks can be represented as effect on some existing performance metric. Taleb calls it X and f(X). They also call it f(x) in operations research. Sure we can quantify any risk, build a loss exceedance curve and even make important conclusions related to the mitigation of that specific risk. This is called X. But it is so much more useful to measure the effect of risk on a decision or an objective instead. This is called f(X) or function of risk.
This can look like representing risks associated with an investment project as volatility of NPV or risks associated with construction project as volatility of budget and schedule. Risks associated with production can be represented as volatility of volume of product produced. Or assigning future cash flows to their associated risks expectations to inform decision makers that some promises are more certain than others. Other metrics like RAROC are also good examples.
Obviously it would be weird to see risk adjusted metrics in a risk report, instead good risk managers change how performance is reported in existing performance and management reports.
3. VaRs, EaRs, cVaRs
There are certain risks where it makes sense to report them as stand alone items. For these risks a loss exceedance curve is normally generated and useful metrics like expected losses, VaR (unexpected losses), probability above threshold, etc. are determined.
This is what a typical loss exceedance curve looks like:
https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?resize=300%2C94&ssl=1 300w, https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?resize=150%2C47&ssl=1 150w, https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?resize=768%2C240&ssl=1 768w, https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?resize=1536%2C480&ssl=1 1536w, https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?resize=2048%2C639&ssl=1 2048w, https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?resize=900%2C281&ssl=1 900w, https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?resize=260%2C81&ssl=1 260w, https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?resize=600%2C187&ssl=1 600w, https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?w=1460&ssl=1 1460w, https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?w=2190&ssl=1 2190w" alt="insurance" width="728" height="228" data-attachment-id="25541" data-permalink="https://riskacademy.blog/understanding-the-risk-profile-is-the-most-important-step-in-insurance-decisions-so-why-isnt-everyone-doing-it/picture1-5/" data-orig-file="https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?fit=3898%2C1217&ssl=1" data-orig-size="3898,1217" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0"}" data-image-title="Picture1" data-image-description="" data-image-caption="" data-medium-file="https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?fit=300%2C94&ssl=1" data-large-file="https://i0.wp.com/riskacademy.blog/wp-content/uploads/2022/08/Picture1.png?fit=730%2C228&ssl=1" data-lazy-loaded="1" />
It makes sense to report risks as standalone if they need to be monitored on a regular basis and have a specific and mature market for mitigation, for example credit risk or market risks. Sometimes we reported operational risks as well, but usually to serve a specific and once-off narrow purpose like purchasing an insurance policy or adjusting maintenance budget or mitigating an environmental risk.
If there is a culture within the organisation to track and monitor specific financial risks then it is common to pull that information into a separate risk report and present it on a regular basis to monitor whether risk exposure is within limits. Since VaR recalculation requires risk models companies usually automate that part of risk reporting. More on that in the next section.
4. Limit breaches and activated stop losses
Whenever risks are quantified as standalone, unexpected losses or VaRs can be used to set limits and use middle office to monitor against the target risk exposure. Risk management team plays an important internal control role by recalculating VaRs frequently, monitoring risk exposure and activating stop losses if risk exposure goes outside limits. This work usually requires close collaboration with finance, treasury and commercial teams.
5. Transparent methodology with a back test
Finally, an awesome risk-adjusted performance report would make the methodologies used in risk analysis transparent to the decision makers and provide clear results of the back tests used. Showing evidence of past back tests is important to give decision makers the confidence needed to make the decisions based on the information presented.
What would you add to the risk-adjusted performance report? Catch Graeme, David and I just before the FERMA event in Copenhagen to share ideas.
Comments