Cost of risk' is a widely used phrase, but what does it really mean? Unfortunately, there is no simple answer, and your view will depend on where you are standing. However, there are ways for organisations to better understand, quantify and manage the cost of risk in their business.
Multiple perspectives and definitions
There are as many different definitions of the cost of risk as there are perspectives. Each person's view will depend largely on their responsibility for managing risk within their organisation. At board level, the cost of risk is largely about uncertainty in achieving corporate objectives.
This is an enterprise-wide issue involving deviations from expected outcomes over a given period, and encompasses issues related to risk appetite, risk communication and the costs of strategic risk management. The finance director will focus on the costs of managing risk through efficient use of capital. In addition there are the costs of running the risk management area within the company, including audit. The treasurer will focus on the cost of financial risk transfer techniques. Insurance buyers may simply use the straightforward measure of insurance premiums to define cost of risk.
For many risk managers and insurance buyers the cost of risk will be the budget they manage. It may include:
- risk management department running costs
- broking fees and commissions
- insurance premiums
- audit and consulting fees
- legal and claims expenses
- uninsured loss costs
- risk improvement costs
- captive insurer's financial results.
This budget gives us some understanding of the fundamental cost of risk to a business. However, there are more sophisticated approaches that can enhance a risk management culture and contribute to better strategic decisions, shareholder value and increased profitability.
Risk appetite
There are many valuable tools and techniques that can help mitigate risks and manage earnings volatility.
Cost of risk can usefully be divided into two categories - retained risks and transferred risks. The category into which a risk falls is determined by the organisation's risk appetite. The term 'risk appetite' is also one with different interpretations, but in its broadest sense risk appetite covers more than just insurable risks and is a way of viewing the gains or losses a company is prepared to tolerate. It is reflected in many ways, including performance metrics, procedures and controls, 'custom and practice' or the 'gut feel' of the CEO or board.
Most importantly for the cost of risk debate, risk appetite defines the risks that a company is prepared to retain or transfer. However, when clearly defined and communicated to all stakeholders, both internal and external, it can also enable:
- better strategic decision making
- an embedded risk culture with improved transparency and enhanced corporate governance.
Retained risks fall into two areas.
The first is business, project or investment risk. This area treats risk as uncertainty of expectation and therefore encompasses a company's biggest opportunities for loss or gain. To succeed, organisations take risks.
These require quantifying and understanding to create the best basis for strategic decision making. Useful techniques in this area involve dealing with uncertainty over time, and can include discounted cash flow analysis, decision tree analysis and real options.
Loss prevention and mitigation are concerned with managing downside risks, or losses. Techniques to manage the costs of these risks are the province of the health, safety, environment and quality, loss control, traditional risk management and asset protection functions. They include, among other things, risk prevention and reduction and the financial risk management techniques of captive insurance companies and reserves to manage retained losses.
The costs of transferred risks can be managed either wholly or in part through a variety of commercial techniques such as contract terms and strategic alliances. Cost of risk is also managed through financial risk transfer techniques including insurance, hedging and derivatives. This aspect of risk management has traditionally been one of strength for insurers, brokers and banks.
Relationships with capital providers
The costs of managing risk through efficient use of capital, whether by debt, equity or off-balance sheet (for example insurance) are key to an organisation's financial risk strategy. Traditionally the risks a company represents are well understood by investors in return for equity, and by banks in return for debt finance. In the 1990s, the relationship between the insurance industry and companies became less focused on an intimate knowledge of risks. In the current economic environment companies have an opportunity to work in partnership with insurers to strip away assumptions about their risks.
Insurers, whose business is dealing with and quantifying risk, have tools and techniques that can help organisations understand the fundamental drivers of cost of risk. These include:
- understanding risk appetite and capital allocation, risk quantification and uncertainty analysis
- management of retained risks, including captive strategies
- financial risk transfer.
Companies who invest in a relationship with their insurers to develop a keener understanding and analysis of their risks can gain significant benefits in risk transfer costs and coverage. If this is successfully done, organisations can feel confident that they are managing their wider cost of risk effectively and with less volatility.
The value of risk
Focusing on a narrow definition of cost of risk ignores the positive impact that a broader view can have. Decisions on what risks to retain or transfer (risk appetite), risk retention strategies (risk management and captive insurance) and how to most efficiently transfer risk all lead to a lower overall cost of risk. Organisations that take a purely transactional, insurance premium-based view of the cost of risk could be in danger of knowing the price of everything and the value of nothing.
- John Scott is senior vice president, principal consultant, Zurich Strategic Risk, Tel: 01252 387 337, E-mail: john.scott@zurich.com
