Analyzing risk Featured

7:00pm EDT December 26, 2009

How can a business drive value out of a risk management program? The answer is different for everyone, says Keith DeCoster, managing director, Aon Risk Services.

“As risk assessment frameworks have evolved over time, it has become more evident that a well-positioned risk management program can provide meaningful information to key decision-makers,” DeCoster says.

Regardless of how one approaches the decision-making process, an organization is creating a model to quantify potential outcomes and support the decision. These models are more objective if they are developed using a systematic, structured and quantitative approach. The three steps in this process are determining an organization’s risk appetite, measuring risk impact or quantification, and stress-testing “what-if” scenarios.

In part one of a three-part series, Smart Business spoke with DeCoster about how to approach risk financing decisions.

How should a business approach modeling with regard to risk financing decisions?

At any level of model sophistication, the outcomes may be wrong. They are, however, beneficial in providing directional information and aiding in forecasting. The results are powerful in supporting decisions, from everyday choices to catastrophic event planning and management. To drive the greatest return, risk identification and prioritization can provide focus as to which risks are worthwhile to assess in a deeper manner. This leads to focused and value-accretive risk quantification efforts.

Within that framework, a powerful guidance tool can be created that is flexible enough to incorporate environmental changes. This arms decision-makers with information to frame reasoning and logic and represents information in the correct manner. The process begins with the determination of risk appetite. Only when forecasts, performance objectives, financial thresholds, performance drivers and management interaction are integrated will a true picture of risk appetite emerge in relation to key performance objectives.

How can a company determine its risk-bearing capacity (RBC?)

A 2006 publication from Standard & Poor’s titled ‘Evaluating Risk Appetite: A Fundamental Process of Enterprise Risk Management’ identifies three key elements. First, create an understanding around the magnitude of adverse events in relation to risk tolerance. Second, determine the amount of capital that would be acceptable to lose over a defined time period. Third, establish preferences for performance through financial targets and objectives and the relationship to risk. When incorporating risk performances into the risk appetite discussion, consider including business/performance model uncertainty, risk concentration, the nature of critical risks and experience in managing critical risks. Any risk appetite evaluation begins with a good understanding of expected financial and operational performance that is aligned with critical performance measures.

Using the expected performance baseline, identify thresholds for performance. For example, an annual budget management target has a different threshold than a debt covenant. Both carry different implications if they are not obtained and could impact how resources are deployed to manage risk. Once thresholds are established, the magnitude of risk appetite in relation to an objective is established.

How can an organization better understand risk-reward tradeoffs?

An element of probability needs to be introduced. Otherwise, there is no basis for evaluation. For risk appetite, this should include the critical volatility drivers for the organization. In theory, every driver could be considered; however, this is not practical. Therefore, a proxy for reality should be created. Drivers can be revenue- or expense-driven, the economic conditions that impact retail sales or a catalyst used in a manufacturing process.

Once critical drivers have been captured, a portfolio driver model can be created to build the proxy performance model, which establishes a measurement of the probability of breaching critical performance measures. For example, if an organization identifies hazard risk, interest rates, investment returns, commodity process, health benefits and human capital as the key organization performance drivers and risks, a model can be constructed for each. For each iteration, both the raw (no mitigation) and net (post-mitigation) impacts are calculated, leading to an outcome for each driver and an overall portfolio impact to the organization. Models of various types can be used for the drivers, including historically based frequency and severity. Running thousands of iterations of the portfolio model will generate a distribution of potential outcomes resulting in a true picture of volatility.

Finally, incorporate management parameters. If there is a deviation from forecast that management will react. If an organization is not going to hit a quarterly target, management may determine that some spending can be pulled back to help meet the objective. If these nuances are not captured, the model will not emulate management behavior and will produce results that imply that it is more likely that a performance threshold is breached.

What is the next step after establishing a risk appetite analysis?

The risk appetite analysis is now a foundation to determine if a new risk management strategy is a good use of capital and provides an acceptable risk-reward tradeoff. Once the foundation for risk appetite is established, a deep, analytical dive into a key risk or risks can be taken to investigate if alternative mitigation strategies prove to be a better management strategy.

Next month: Part two looks at measuring risk impact and quantifying risk.

Keith DeCoster is managing director of Aon Risk Services. Reach him at (317) 237-2400 or Also contributing to this article were Jay Gotelaere, managing director and actuary, and Mike Giacobbe, managing director, Americas business development leader. Reach Gotelaere at (312) 381.2772 or Reach Giacobbe at (312) 381-4185 or