There are several reasons:
Value investing may work, but it is not the only one that works.
VOSE Software provides a software tool called ‘ModelRisk 4’ which allows analysts to run Monte Carlo simulations within Microsoft Excel. The software is able to display the results in graphics format. The ‘Standard’ version of the product is free and is not time-limited. You can download it and use it for as long as you like. If you need more powerful features, the company sells the ‘Professional’, and ‘Industrial’ version of the products.
The software is supported by a very comprehensive help file which goes beyond merely explaining how to use the software, but also gives a brief explanation of the various data analysis functions and their purpose. But for more in-depth analysis, you can turn to David Vose’s book ‘Risk Analysis: A Quantitative Guide’. David runs VOSE Software out of Belgium. VOSE Software also provides risk consulting services.
The US military gives us a good model of crisis with the DEFCON
status. It allows a staged reaction to a crisis that may be impending
or may not be impending. It allows the military to prepare and also not to over-prepare.
As facts become known, and the understanding of the situation becomes more solid, the authorities are able to step up or step down preparations
and mobilisations for handling the crisis.
Business organisations would to well to think about a staged approach to
their crisis management plans.
Australian Prudential Regulatory Authority
Guidance Note GGN 222.1
Risk Assessment and Business Continuity Management
http://www.apra.gov.au/General/loader.cfm?url=/commonspot/security/getfile.cfm&PageID=8532.
Guidance Note AGN 232.1
Risk Assessment and Business Continuity Management
http://www.apra.gov.au/Policy/loader.cfm?url=/commonspot/security/getfile.cfm&PageID=8529
Prudential Standard APS 232
Business Continuity Management
http://www.apra.gov.au/Policy/loader.cfm?url=/commonspot/security/getfile.cfm&PageID=8528
Prudential Standard GPS 222
Business Continuity Management
http://www.apra.gov.au/General/loader.cfm?url=/commonspot/security/getfile.cfm&PageID=8531
Commission of the European Communities (2005): Green paper on a
European programme
for critical infrastructure protection, November
http://eur-lex.europa.eu/LexUriServ/site/en/com/2005/com2005_0576en01.pdf
De Nederlandsche Bank (2004)
Business Continuity Planning
http://www.dnb.nl/en/payments/bcp/index.jsp
It's a good question.
Risk management is, for many people in projects, one of the very basic things that anyone can do. It's not rocket science. To most people,
risk management is simply the risk register - often created because it
is a mandated part of the project management procedures - and not much
else.
And anyone can create a risk register. All you need is an Excel
spreadsheet and a template of the right headings, or a risk management
software, and start populating it.
Even the risk management framework is simple enough: identify the
risks, give an estimate of the likelihood, determine consequences,
identify controls, estimate residual risk, identify who is
responsible, and then rank the risks for prioritisation.
Brain surgery is equally simple: identify the area to be incised,
determine the likelihood of success, determine the risks, etc. People
know that not all surgeons are equally qualified to do brain surgery.
Even among brain surgeons, there is a qualitative difference in
experience and consqeuently, results.
Riding a bicycle is also equally simple, but everyone knows there is a
magnitude of difference in the performance of a rider at a Tour de
France level, and someone who rides for leisure.
But what about risk management? While anyone can come up with a risk
register, there can be a serious difference in the results.
Some areas where competence in risk analys would produce a marked
difference in results
* Risk identification - are we identifying the right risks? Are we
missing any? Are putting in risks that aren't risks? Missing a
critical risk can prove catastrophic to a project.
* Risk likelihood - are our estimates any good? Is there available
data we should be using? Overestimating can prove costly.
Underestimating can prove disastrous.
* Risk consequences - how credible are our estimates of consequence?
How complete is it? An inept analysis of the consequences will mean
poor preparation and mitigation of the consequences.
* Risk control - how realistic are the controls and mitigations we
have identified? How good is our decision-making on which controls to
implement? What is the impact of our controls
* Risk prioritisation - are using the right prioritisation approach?
Checklists and questionnaires belong in the toolbox of risk professionals. A checklist works best when used by the risk professional while interviewing an information source, whom we’ll call an interviewee.
The checklist becomes far less effective when simply handed over to the interviewee because when you let the interview work by himself, it raises new undesirable dynamics:
A well designed form helps much toward eliciting good information. At the very least, the following should be addressed when designing questionnaires and checklists:
It is vital that a checklist be tested on several interviewees first before finalising it use.
In a LinkedIn discussion someone asked for recommendations on a web-based risk management software package that’s suitable for a SME (small to medium enterprise). The key need was for managing a risk register and for tracking risks. Some of the recommendations were:
This is quite a handful of choices. I’m hoping to be able to spend some time lokking into each one.
Sit at any Risk Management 101 class or Risk Management introductory workshop and you will most certainly be introduced to the risk register. And in that risk register, you will be introduced to two columns: the Risk, and the Impact.
You will be told that the Risk is an event that may or may not happen. You will also be told that Impact is what will happen if the Risk occurs (or ‘eventuates’). Sounds clear, simple, direct.
Now let’s apply what we’ve learned. You are concerned (rightly) about crashing your car. Is that a risk? Or is it an impact? (Avoiding the pun on crash and impact). It is not certain that your car will crash, so that is a risk. What will be the impact? Easy: you may experience fatality. Or you may experience serious injury, or you may experience light injury.
But why isn’t crashing the car an Impact?
What caused the car crash? Did your brakes malfunction? Was that a risk? Was there a risk that your brakes would malfunction? Were you hit by a drunken driver? Was that a risk you faced when you were driving? Absolutely.
So let’s say: Risk = Possibility of being hit by a drunker driver. What is the impact? Crashing your car. What was the risk earlier is now the impact.
The distinction between risk and impact is not so clear. What is a risk from one perspective is an impact from another. But which perspective is the right one to take? And which perspective should you be taking when you fill in the risk register? Do you put “Car crash” under Risk or under Impact?
There’s a highly-regarded self-coaching book called “Sail, Race, and Win”, by Eric Twiname and Cathy Foster. In the book is a neat description of how to win in a race. They ask the reader to imagine a descending escalator, with lots of people, representing the competitors, walking up the escalator. The goal being to remain in the same spot they started in as much as they could manage to. They can walk up to the same pace that the escalator is going down, but they can't walk up faster than that.
Since no one’s allowed to go faster than the pace of the escalator, the would-be winner will have to focus on not making mistakes rather than walking faster than the pace of the escalator. Any mistake, no matter how momentary, will set you back a little, possibly allowing someone behind to move out in front of you. The more mistakes and lapses you make, the more you are pushed back relative to your starting position, and relative to the other competitors.
Now since you can't go faster than the pace of the escalator, you can't make up the distance you lost by putting in extra effort. The best you can do is to make no more mistakes. The only way you can get ahead of those in front of you is if they make mistakes.
I haven’t seen winning explained in this manner before, and despite its oddness, it has a certain valid point. Twiname and Foster come from the world of sailing. Perhaps the idea of not being able to outpace the escalator comes from their world, where your progress depends on the winds and the tides -- you can't go faster than what the elements or the environment allows.
The image seems rather useful when thinking about how risk impacts business. A company cannot make more money than what its environment allows. For example, if you are a consumer goods company, how much you can sell is moderated by the size of your market, the demand for your product, and the competitive dynamics of the industry you are in. In a market with 10,000 customers and 5 competitors, you just cannot make sales equivalent to a market of 20,000 customers.
And while you can't get ahead, you can definitely be set back. The key to winning then becomes minimising the setbacks. From an operational basis, you are constantly being set back if your production costs are more than the competition’s. From a discrete and pulsating basis, you are set back each time a risk eventuates which impacts you negatively. The longer and more expensive it takes you to recover, the more you are set back. The key to winning in this case is to ensure that you minimise your risk eventuations and minimise their impacts.
You can look at risks as these setbacks. It is in your interest to avoid them as much as possible, and to be able to recover as quickly as possible. Even then, you can only recover to a point less better than where you started. Hence, reducing the occurrences of risks become a key factor in winning.
I am not yet convinced that 'positive risk' should have the word 'risk' appended to it. On those days when I look at risk management as 'the management of uncertainty' I have no problem accepting that positive risks belong to this domain.
But for now, I will use as the most basic definition of risk:
Risk = what can go wrong.
Risk management = managing what can go wrong
The ‘wrong’ already implicitly includes a reference to our objectives. If something can go wrong from our point of view, it means something going wrong in relation to our interests. Something that doesn’t affect us is not something going wrong. So I don’t have to extend it to ‘something that can go wrong with regard to our objectives’ (in any case, I prefer to use ‘interests’ rather than objectives).
The ‘managing’ in ‘managing what can go wrong encompasses identification, assessment, and mitigation.
Let’s see how far these definitions will let me go.
One of the most critical processes in managing projects are those addressing project risks. Some writers go so far as to call risk managent 'project management for adults'. The implication being that if you’re not doing risk management in your project, then you’re just a kid, you haven’t grown up yet, and have no place among grown-ups (I agree with this view, by the way).
When asked what risk is, quite a few will give an answer that goes something like: 'a risk anything that can go wrong.' In this view, a risk is something that can go wrong, and therefore risk management is about addressing those things that can go wrong.
But there is another, less commonly known, view of risk. In this view, risk is something uncertain that may affect the project. Not something necessarily bad, but something uncertain.
Let's suppose you are planning a picnic for tomorrow. Being an adult, you have prepared a risk management plan (your picnics may be boring, but they are predictable). You have an entry for weather in your risk plan. In the first view of risk, you look at the weather and look for something that could 'go wrong' that could negatively affect your picnic. Is it going to rain tomorrow? If there's a chance of rain, what can we do to mitigate the effects of this rain on the picnic? Perhaps bring an umbrella. Perhaps plan to hold the picnic nearby an accessible shelter, to make escaping from the rain easier.
In the second view, we look at the weather not as something that is the harbinger of something that can go wrong, but simply something uncertain. So there's a 50% chance of rain. Let's prepare for that eventuality. But there's also a 50% chance of no rain. Let's also prepare for that happy eventuality as well -- perhaps plan to go to a place with a nicer view if the weather clears up.
With this second view, risk is not simply viewed as about bad circumstances that can happe, but simply about all uncertain circumstances. Circumstances which can indeed turn out bad (and whose effects we should be ready to address), but which can also turn out good (which we should be ready to take advantage of).
In the first view, we simply prepared ourselves for the worst. But in the second view, we also prepared ourselves for the best.
One of the challenges risk professionals wrestle with is how to convince stakeholders to take specific actions, such as proactively identifying risks. These stakeholders can be individuals, or they can be organisations. While these stakeholders are not necessarily reluctant to comply with the requirements of proper risk management, they do have to deal with their own realities, including other demands on their energy, or simply a perception that risk management is a waste of time.
Perception is reality, as the saying goes. If you want to change reality, you have to change perception. And one way to change perception is through communication. A risk professional often needs to organisational action through reports and recommendations and also through interpersonal communication.
Dr. Frank Luntz, who apparently is a highly sought political speech writer, provides ten rules for effective language in his book, “Words that Work”. I think when he came up with these rules, he was thinking in the in the context of public speeches, political messages, and media relations. But his rules seem a useful guide for a launching a coordinated approach to getting your message across.
In summary his rules are:
Luntz summarises these ten rules with ten words: simplicity, brevity, credibility, consistency, novelty, sound, aspiration, visualisation, questioning, and context.
You don’t have to follow all his rules for every message you want to get across. I don’t think that’s possible, nor is it Luntz’s intention. However, the list is useful as a guide for formulating a memorable message.
I’m going to go through Robert Chapman’s ERM book. Based on the table of contents, the first part of the book what ERM is. Part II is about ‘The Appointment’ or what I think is a discussion of the engagement process. The table of contents covers topics about interviewing the client, preparing the proposal, and implementation (of what, I am not sure yet).
Part II covers the Risk Management Process. It seems to be about a fairly standard process: Analysis of the Business, Risk Identification, Risk Assessment, Risk Planning, and Risk Management.
Part IV covers ‘Internal Influences’ which I think is about internally generated risks. The table of contents says it covers Financial Risk Management, Operational Risk Management, and Technological Risk.
The final part covers ‘External Influences’ which seems like about risks generated externally. It discusses Economic, Environmental, Legal, Political, Market, and Social risks.
Finally there are 14 short Appendixes which discuss techniques like SWOT, PEST, VRIO analysis, Change Management, among other topics.
Kytle & Ruggie
Ideas:
Globalization
Large Enterprises
CSR – what you do with your money
How you make your money
Conceptual Framework
Greater interdependencies
Hidden vulnerabilities
Significant shift in market power
Social risk
Own behaviour or actions of others create vulnerabilities
CSR Programs
Global operating environment: networked operations, empowered global stakeholders, dynamic tension between stakeholders
Supply chain components bring their own individual vulnerabilities. Risk in one can ripple through supply chain
Being large being global makes you a platform for stakeholders
Other country issues – weak regulatory frameworks, means of enforecement, high levels of corruption inadequate provision of local service.
Social issues stakeholder interests are not profit motivated\
Froot, Scharfstein, and Stein
The purpose of risk management for an organisation is to ensure availability of funds for financing investments. Risk management does not create new wealth; investment does. Wealth-creating investment is only possible if there are funds available to finance it. Risk management must be used to ensure the organisation has enough funds to finance its wealth-creating investments should events arise that threaten the availability of funds.
The best funds to use for funding investments are funds created internally. Funds obtained through debt make the company less attractive for further debt, which may result in a dangerous spiral where it cannot obtain debts when it needs them. Funds raised from equity raise the problem of investors knowing that organisations sell equity when they know it is overpriced. So despite Modigliani and Miller, who posited that how the funds are obtained is generally irrelevant, internally generated cash is best for funding further investments.
Hedging is one way to insulate the organisation from fluctuations of funds availability.
To determine what to hedge, think about events you wish to hedge against, and understand the impact of that event to your cashflow requirements for funding wealth-creating investments. For example, if your company manufactures in Europe (Euro) and sells in the USA. Suppose the Euro appreciates thus making sales in the USA slower. Then cashflow is lessened because a) there is less product demand in the USA and b) the value of dollar sales has decreased comapred to Euro, therefore, there is little incentive to further increase production capacity in Europe, therefore there is lessened need for cashflow during the time. Thus there is little need to hedge.
However, if opposite occurs, and the Euro depreciates, then sales to the US can be expected to increase (cheaper products), however,
Risk management “lets companies borrow from themselves” by shifting funds to when they are more needed.
The goal is to align the internal supply of funds with the demand for funds. The goal is not to insure against the events (such as exchange rate fluctuations) but to ensure the company has the cash it needs during such times.
The company shouldn’t need to worry much about its own stock prices. That is a problem for individual investors. They can mitigate that risk through diversification.
Choices of which financial instrument to use must not be left to financial engineers. Managers must align the instrument to the corporate goal – which is to ensure availability of cash appropriate to the environment it is hedging against.
Two key issues in derivative features is mark-to-market vs over the counter. In the former, you need to top up daily to compensate for short term losses. In the latter you only need to pay at maturity date. The other feature is linearity vs non-linearity. Futures and forward contracts may have no floor. There is symmetry in your gain or loss. Options allows setting a floor to loss, while keeping the option to benefit from the event.
