Managing Risk

McKinsey Quarterly has an article on risk management that I tend to agree with -- it's not the first time I've seen similar opinions being expressed, and it's a convincing argument. Risks are not bad -- if they're managed well -- and that's where most companies fail. They don't manage risks well, or they don't understand the risks they're exposing themselves to. The article calls on a study McKinsey did from 1997 to 2002 of about 200 leading financial companies. What they found was alarming -- and should be to shareholders and regulators alike. In a significant percent of the companies, the leadership didn't fully understand the risks their businesses faced and didn't have processes in place to deal with the risks, should they arise. While risks can cause unexpected financial losses and harm credibility with customers, employees and investors, it is risk taking that generates shareholder value. Therefore, striking a balance between risk aversion and risk taking is what is needed. That's where risk management comes to play. Risk Management is loosely defined as the processes that identify, control and minimize the impact of uncertain events -- it reduces risks while putting in place a process to obtain and maintain approval for taking risks. McKinsey broadly categorizes risk as coming in four varieties:

Market Risk -- "exposure to adverse market price movements"

Credit Risk -- "exposure to the possibility that a borrower or counterparty might fail to honor its contractual obligations"

Operational Risk -- "exposure to losses due to inadequate internal processes and systems and to external events"

Business-volume Risk -- "exposure to revenue volatility ... stemming from changes in demand or supply or from competition"

To manage risk, it must first be understood what risks are being undertaken and what the appetite is for risk taking -- ie. how much financial exposure would a company be comfortable with. Risk exposure must be understood broadly, and have visibility at the board level. Risk management does not equal risk avoidance. A risk taking culture is a good thing, and needs to be nurtured.