SAS® Risk Management
Delivering enterprise risk management solutions to
maximize shareholder value
A SAS White Paper
Table of Contents
Executive Summary .......................................................................................................1
What is Enterprise Risk Management?........................................................................1
Why Institutions Need Effective Enterprise Risk Management ................................2
Company Drivers..........................................................................................................2
Regulatory Forces ........................................................................................................2
Communicate Risk Measures Throughout the Organization ....................................2
Scorecard Framework ..................................................................................................3
Visual Challenges.........................................................................................................5
Strategic Analysis .........................................................................................................5
Effective Diagnostic Techniques..................................................................................6
Corporate Simulation....................................................................................................6
Risk Capital Allocation ..................................................................................................7
Calculating Risk/Reward Measures .............................................................................7
The SAS Solution ...........................................................................................................8
Summary .........................................................................................................................8
Technology ...................................................................................................................8
Behavioral Impacts .......................................................................................................9
About SAS ....................................................................................................................9
SAS® Risk Management
Executive Summary
Uncertainty in business makes it difficult to accurately predict and avoid large fluctuations in the
performance of capital across the firm(s). As global markets mature, institutions recognize that
risks are intertwined and should be measured in an integrated manner. The ability to accurately
measure, predict and act on these measures has proven elusive. To meet these challenges, firms
are looking for a true enterprise risk management (ERM) solution. The challenges facing
companies include issues ranging from data management to implementing complex analytical
techniques. Companies who successfully measure and act upon risk-adjusted returns are typically
rewarded with higher valuations from financial markets, higher credit ratings and lower costs of
capital. Small changes in valuation or investment costs can translate into significant returns on
investment.
What is Enterprise Risk Management?
Enterprise risk management (ERM) is the pulling together of information from across historically
separate areas and consolidation of results into one picture that represents a complete view of the
company’s risk. Do you have a consolidated picture of your organization? Can you answer the
following questions?
•
Can you accurately explain your company’s earnings volatility?
•
Can you anticipate how operational risk will affect earnings?
•
Can you identify and value risk by geography, business unit or market segment?
•
Does your company appear under-valued compared with your competitors?
•
Does management spend less time making strategic decisions and more time calculating
results to meet regulatory requirements?
An ideal ERM platform would help financial executives and portfolio managers answer these
questions in order to define and communicate quantitative goals to the employees who are
charged with executing strategy. It would give everyone in the organization access to a clear view
of the company in terms of risks and define individual behaviors that could affect the risk control
process. At the same time, it would provide the necessary diagnostic tools to dig deeper into the
details of information, to help decision makers visualize complex relationships, comprehend them
and react. And it would include the necessary forecasting models so analysts can perform
“what-if” scenarios before trying them in the real world. Finally, it would help you depict your
organization more clearly in terms of risks, making it more competitive in the marketplace.
1
SAS® Risk Management
Why Institutions Need Effective Enterprise Risk
Management
Company Drivers
One of the foremost objectives of a comprehensive risk management solution is to decrease the
overall volatility of earnings while maintaining an adequate rate of return. For internal purposes,
this means that management must work to reward behavior based on a risk-adjusted return.
Performance based solely on returns or risk misses the overall objective of decreasing earnings
volatility and increasing shareholder value. Management must use a risk-adjusted rate of return to
measure business units, capital projects, individual departments, or individuals themselves. These
measures tend to reward behavior that maximizes return while providing an incentive to examine
and adjust the risk taken by the corporation.
Externally, corporations must constantly compete for attention from analysts and investors. Firms
able to demonstrate lower earnings volatility than their competitors are typically rewarded with a
higher valuation. Likewise, if a company is able to demonstrate superior control to creditors, they
may observe a lower cost of debt than their competitors.
Regulatory Forces
Changes in regulatory requirements can force many companies to re-examine their risk control
processes. FAS133, FR932.5, the new Basel Capital Accord and a host of other regulations force
companies to use risk management tools for regulatory reporting and compliance. Companies
that fail to adequately meet regulatory compliance face stiff fines or adverse market reactions.
Many firms are creating risk methodologies for the first time in an effort to comply with these new
regulations. An effective ERM platform would help clients meet or exceed these new
requirements.
Communicate Risk Measures Throughout the
Organization
Successful firm-wide risk management starts with the ability to effectively communicate the
strategic goals of a company to the individuals charged with executing strategy. Too often, firms
publish a mission statement or goals at the beginning of the year and re-visit it once at the end of
the year. Executive management must first define a global strategy and mission statement that is
used to steer the direction of the firm. This general direction is shaped further by the risk control
committee or Chief Risk Officer to specifically define quantitative goals for the fiscal planning
period(s).
2
SAS® Risk Management
There are two keys to creating a successful risk control initiative. First, executive management
needs the ability to communicate quantitative goals to the front-line employees who are charged
with the execution. Many companies fail to effectively communicate these goals on a consistent
basis. Second, an effective risk control solution supports a variety of communication methods that
can be tailored for the needs of each employee. These channels should include: email messages,
Web-based scorecards, wireless via PDA devices, pagers, cell phones, paper reports,
spreadsheets and many other forms of communication.
Experience shows that the introduction of an ERM platform forces employees to re-examine their
role in the risk control process. Once corporate goals are consistently defined and communicated,
their daily decision making process changes. The management of data, processes and reports
are replaced by the ERM system. As a result, employees can spend more time analyzing results
and making decisions based on the metrics produced by the system.
Scorecard Framework
Identification of the key indicators that influence strategic objectives is another important element
of an effective risk framework. These indicators are typically grouped as either leading or lagging
values that affect a specific strategic goal. Leading indicators are powerful management tools that
can help managers change policies before they miss their targets. A proactive approach to
managing strategic goals provides a substantial return on the investments necessary to measure
these indicators.
Figure 1 is an example of a scorecard tracking a combination of leading and lagging indicators.
The graphics allow decision makers to quickly gauge where the firm is meeting goals and the
areas that need additional assistance. The scorecard should provide the necessary details for
employees to explore what causes certain indicators to fall below expectations. A firm-wide risk
solution should provide the ability to drill down to a level that is sufficiently granular enough to
diagnose a problem.
3
SAS® Risk Management
Figure 1: A scorecard tracking leading and lagging indicators
Figure 2 depicts the ability to drill down within certain indicators to analyze specific situations.
After establishing what is causing a particular strategy to falter, the next step is giving users the
ability to solve the problem using the appropriate strategy.
Figure 2: A ranking overtime of factors that affect key indicators
4
SAS® Risk Management
Visual Challenges
The ERM platform must condense and transform vast amounts of data into useful information.
Capturing data from across the enterprise as well as providing easy methods for analysts to
visualize, comprehend and react to this information poses two unique challenges for technology
providers. The challenge for analysts is how to effectively wade through large amounts of
information. Sometimes, the information provided by the techniques used to calculate risk metrics
can be complex and difficult to understand.
An ERM platform must condense complex information into easily understood metrics that are
surfaced through a scorecard or other appropriate delivery mechanism(s). In addition, the platform
should provide analysts with the ability to visualize complex relationships that represent multiple
dimensions. Tabular reports or graphs are not always the most effective way to communicate
these complex relationships to an audience. The ability to visualize risk capital and associated
metrics over multiple dimensions is a key factor for the success of an ERM platform.
Strategic Analysis
After communicating company goals, users need the ability to alter corporate strategy to avert
crisis situations. The first step in forming cohesive strategies is to identify the key indicators that
contribute most to the overall strategic objectives. There are a number of analysis techniques that
can help determine the cause of abnormal conditions or provide insight into possible opportunities
to enhance revenue. Most of these techniques are common for traditional risk control operations,
but are rarely utilized within true enterprise-wide risk management environments. These
techniques provide the foundation for robust what-if analysis within a larger corporate structure.
Some of the techniques include:
•
Conditional analysis for groups of indicators.
•
Scenario simulations.
•
Sensitivity analysis for a variety of indicators.
•
Relative rankings of indicators.
•
Multiple period simulations.
•
Shock analysis.
•
Stochastic simulation of indicators.
The majority of these techniques are designed to allow business users to accomplish two basic
tasks: to diagnose current situations within the current business climate; and to play “what-if”
games with their strategic directions.
5
SAS® Risk Management
Effective Diagnostic Techniques
Initially, diagnostic techniques can be used to determine the current state of the business.
Tracking indicators are a good first step for visualizing strategic direction, but companies must
have the ability to make mid-course corrections along the way. These techniques can give
management the ability to determine what factors have the largest impact on performance. Once
identified, management can focus on possible ways to improve performance.
Too often managers use simple analyses to determine how susceptible the business is to a
particular factor. Simple measures can help, but business sensitivity to a particular factor only
shows what happens when that factor changes and the other factors are held constant. These
types of measures do not indicate what happens when the factors vary simultaneously. An ERM
platform should allow a ranking of these factors that takes into account the complex relationship
between all of the factors that affect a business.
Figure 3 is a ranking showing the evolution of certain factors over time. This ranking allows
managers to see into a future state of their business and the possible effects these factors could
have.
Figure 3: Visualization capabilities of a firm-wide risk solution
Corporate Simulation
An effective ERM platform gives corporate America the ability to examine “thousands” of possible
business climates within the safe confines of their simulated world. Without an ERM platform
companies are forced to perform individual scenarios with a host of spreadsheets or applications
that cannot accurately represent the true complexity of the business. ERM software can enable
companies to essentially create their own version of the future. It can allow business users to
6
SAS® Risk Management
simulate and test new ideas without the exposure of trying them in the real world. Combined with
a corporate scorecard, it can simulate business climates and let executives benchmark progress
and determine potential gaps in strategy.
Risk Capital Allocation
The deployment of capital to lines of businesses, corporate projects or individual traders is one of
the most important decisions organizations face. An organization must realize returns equal to or
greater than its internal hurdle rate without exposing the firm to unnecessary risks. An ERM
platform allows organizations to evaluate risk adjusted performance metrics, such as risk adjusted
return on capital (RAROC), for key strategic decisions. Some of these decisions include:
•
Performance measurement and incentives.
•
Project capital allocation.
•
Firm-wide capital allocation.
•
Credit capital allocation.
•
Profit and loss decisions on capital expenditures.
•
Reserve optimization.
•
Improvement of general portfolio performance.
Calculating Risk/Reward Measures
Executives need to view capital allocation decisions from a strategic level. Historically, risk
measures were calculated using estimated methods. This lack of granular analysis sometimes
resulted in incorrect decisions. It also resulted in the inability to drill further into the particular asset
class. An ERM solution would allow users to take a bottom-up approach and price the risks for
each asset. This yields a more accurate measure of risk and reward. This approach also allows
users to observe behavior at a lower level than previously possible.
The ability to formulate strategic decisions quickly and accurately provides the real test for an
ERM platform. It should give executives the ability to dynamically view capital deployment
throughout the enterprise.
7
SAS® Risk Management
The SAS Solution
SAS provides a firm-wide solution that includes processes for managing risk, finding unique
opportunities and communicating those opportunities to management, shareholders and outside
analysts. SAS Risk Management enables institutions to manage data throughout the organization,
analyze complex situations and provide regulatory reports. It provides a single, comprehensive
environment for data management that lets you:
•
Access and consolidate position and market data from around the world (regardless of
geographic location, legacy system or origin).
•
Qualify, clean and organize that data within a powerful environment that includes business
rules, intelligent process and validation.
•
Identify and evaluate multiple dimensions of risk, as well as your company’s overall risk.
SAS provides risk analysis that facilitates analyzing and exploring data in order to compute risk
measures (firm-wide, by location, by region, by division, by portfolio, by business unit, by line of
business, etc.), leading to virtually unlimited perspectives and new insights regarding the
allocation of capital relative to risk and returns.
SAS also provides risk reporting that transforms the vast amounts of data generated by your
company into information that can be understood — balanced scorecard, graphical and bar chart
reports — so decision makers can quickly react to changing market conditions, rapidly identify
new strategic directions and uncover sources of potential problems before they materialize.
Summary
Competitive pressures are forcing organizations to examine and optimize their use of capital.
Companies must start to look at enterprise risk and measure performance on a risk-adjusted
basis. Management must constantly evaluate and re-evaluate the risk of unexpected losses
versus available capital. Organizations who are able to balance superior returns with moderate
volatility are generally rewarded with superior valuations from financial markets. Driving this belief
throughout an organization is the key to executing a risk-based strategic initiative.
Technology
The technology required to successfully implement an ERM platform requires three major pieces.
The first piece is the ability to easily acquire data from disparate systems, transform the data and
load it into a consolidated format. The second piece is a robust and flexible risk engine capable of
producing the metrics required. Lastly, the ERM platform must effectively communicate metrics
throughout the organization. Communication technologies include portals, scorecards,
dashboards, Web-based reporting and traditional report creation tools. All three components must
8
SAS® Risk Management
come together to form an integrated framework on which clients can build an ERM solution. In
addition, the framework should scale with the demands of the organization.
Behavioral Impacts
The ability to communicate and implement strategy throughout the organization is essential for an
effective ERM solution. Every ERM strategy must be able define, measure and communicate key
metrics to everyone within the corporation. To successfully achieve the goals of an ERM solution,
employees must think and act as a team. The entire organization must behave like risk managers
and understand the impact of their decisions on a risk-adjusted basis.
About SAS
SAS is the market leader in providing a new generation of business intelligence software and
services that create true enterprise intelligence. SAS solutions are used at more than 38,000 sites
— including 99 of Fortune 100 businesses — to develop more profitable relationships with their
customers and suppliers, to make better, more accurate and informed decisions, and to drive their
organizations forward. SAS is the only vendor that completely integrates leading data
warehousing, analytics, and traditional business intelligence applications to create intelligence
from massive amounts of data. For 25 years, SAS has been giving customers around the world
The Power to Know™.
9
World Headquarters
and SAS Americas
SAS Campus Drive
Cary, NC 27513 USA
Tel: (919) 677 8000
Fax: (919) 677 4444
U.S. & Canada sales:
(800) 727 0025
SAS International
PO Box 10 53 40
Neuenheimer Landstr. 28-30
D-69043 Heidelberg, Germany
Tel: (49) 6221 4160
Fax: (49) 6221 474850
www.sas.com
SAS and all other SAS Institute Inc. product or service names are registered trademarks or trademarks of SAS Institute Inc. in the USA
and other countries. ® indicates USA registration. Other brand and product names are trademarks of their respective companies.
Copyright © 2002, SAS Institute Inc. All rights reserved.
50113US.0402