Introduction

Many of the approaches described above are used directly to quantify particular types of risk. These applications are described in this chapter, together with some specific extensions that can also be used to determine levels of risk. Since different risks can affect different types of institutions in different ways, several approaches are sometimes needed to deal with a single risk. The links between various risks and the implications for quantification are also discussed.

When quantifying particular risks, it is important that these risks are modelled consistently with each other. In particular, it is important that assets and liabilities are modelled together, so that their evolution can be mapped. This is the basic principle of asset-liability modelling.

As part of this process, it is also important to consider the level of assets and liabilities throughout the projection period, not just at the ultimate time horizon. If the modelling suggests that action should be taken at points within the projection time horizon, then the projection should be re-run taking these actions into account. This is known as dynamic solvency testing or dynamic financial analysis.

Market and economic risk

Characteristics of financial time series

Before discussing the way in which market and economic risks can be modelled, it is worth considering some important characteristics of financial time series, particularly in relation to equity investments.

This book began life as a sessional paper presented to the Institute of Actuaries in Manchester and, some months later, to the Faculty of Actuaries in Edinburgh. Its presentation occurred at around the same time that a new subject on enterprise risk management was being developed for the UK actuarial exams. This made it a good time to expand the paper into something more substantial, with detailed information on many of the techniques that were only mentioned in the initial work. It also means that the book has benefited greatly from the work done by the syllabus development working party, led by Andrew Cairns and managed by Lindsay Smitherman.

I found myself writing this book during a time of crisis for financial institutions around the world. Financial models have been blamed for a large part of this crisis, and this criticism is, to an extent, well-founded. It is certainly tempting to place far too much reliance on very complex models, ignoring the fact that they merely represent rather than replicate the real world. Some senior executives have also been guilty of seeing the output of these models but not understanding the underlying approaches and their limitations. Finally, many models have been designed seemingly ignorant of the fact that the data histories needed to provide parameters for these models are simply not available. However, at least as big an issue is that many non-financial risks were allowed to thrive in the years before the crisis.

Introduction

When managing risks, it is important to be aware of the range of risks that an institution might face. The particular risks faced will differ from firm to firm, and new risks will develop over time. This means that no list of risks can be exhaustive. However, it is possible to describe the main categories of risk, and the ways in which these risks affect different types of organisation.

Market and economic risk

Market risk is the risk inherent from exposure to capital markets. This can relate directly to the financial instruments held on the assets side (equities, bonds and so on) and also to the effect of these changes on the valuation of liabilities (long-term interest rates and their effect on life insurance and pensions liabilities being an obvious example). Closely related to market risks are economic risks, such as price and salary inflation. Whilst these risks often affect different aspects of financial institutions – market risk tends to affect the assets and financial risk the liabilities – there is some overlap and both can be modelled in a similar way.

Banks face market risk in particular in two main areas. The first is in relation to the marketable securities held by a bank, where a relatively straightforward asset model will suffice; however, this risk must be assessed in conjunction with market risk relating to positions in various complex instruments to which many banks are counter-parties.

Introduction

Once risks have been analysed, the results must be assessed. This is true whether considering a project to be initiated, a product to be launched or an asset allocation to be adopted. Such analysis will generally involve trying to maximise (or minimise) one variable subject to a maximum (or minimum) permissible level of another variable.

Creating these variables will often involve applying particular risk and return measures to particular items. The different types of measures are described below, and choosing the appropriate one involves careful consideration.

The item to which risk and return measures are applied also requires some thought. These might be income or capital measures, and they might be prospective or retrospective. Income measures might be profit or earnings related, but cash flow might also be important, as liquidity problems can result in the closure of otherwise-profitable firms. Capital measures might relate to the share price of a firm, or the relationship between some other measure of assets and liabilities.

As well as determining the measures of risk and return to be used, and the items to which they should be applied, the level of risk that can be tolerated must be determined. This means visiting the concept of risk appetite. However, it is also important that risk appetite is placed in the context of other risk-related terminology.

Univariate discrete distributions

The univariate statistical distribution of each variable on its own – also known as its marginal distribution – is an important factor in the risk it poses. Many of the features above can be modelled directly by the appropriate choice of marginal distribution, or they can be added to a more ‘basic’ marginal distribution.

Univariate discrete distributions are generally only used when the number of observations is small, as they quickly become difficult to deal with as the numbers involved increase. However, even if continuous approximations are used, it is important to recognise the nature of whatever is being approximated.

The binomial and negative binomial distributions

The binomial distribution is fundamental to many risks faced. In particular, it reflects the risk of a binary event – one which may or may not occur. Such an event could be the payment of a claim, the default of a creditor or the survival of a policyholder.

The binomial distribution is parameterised by the number of trials (or observations), n, the number of successes (or claims, defaults or other events), x, and the probability that an event will occur, p. The probability must be constant for each trial.

Introduction

The calculation of economic capital brings together many of the principles discussed throughout this book, covering risk measures and aggregation in particular detail. The issue of economic capital is also important to a number of departments within a financial organisation. One way to see the extent to which this is true is to consider why economic capital might be calculated. However, it is important first to understand exactly what economic capital is.

Definition of economic capital

There are a number of ways that economic capital can be defined, but most definitions contain three similar themes:

• they refer to additional assets or cash flows to cover unexpected events;

• they refer to an amount needed to cover these unexpected events to a specified measure of risk tolerance, with risk being measured in some way; and

• they consider the risk over a specified time horizon.

A common definition of economic capital is the additional value of funds needed to cover potential outgoings, falls in asset values and rises in liabilities at some given risk tolerance over a specified time horizon. It can also be defined as the funds needed to maintain a particular level of solvency (ratio of assets to liabilities) or the excess of assets over liabilities, again at some given risk tolerance over a specified time horizon

Risk tolerance can also have a number of meanings, referring to a percentile of the results, a value of loss or the result of some other key indicator.

Introduction

The external risk management environment refers to everything that can affect the risks faced by an institution and the way those risks are managed. These factors are not uniform, and vary by industry and geographical location. Even within a particular industry in a particular country, different types of firms might find themselves in different environments. Small firms might be treated differently from large ones, and privately held ones will certainly be treated differently from publicly quoted ones. The list of potential firm-specific factors is extensive – but the important point here is that it is not sufficient simply to look at the industry and location and decide that all firms will be treated the same; rather, it is important every time to consider the nature of the firm and how this affects the external context.

External stakeholders

Since it was established in the previous chapter that the number of internal stakeholders was small, it follows that the number of external stakeholders that might exist is large. All principals except the owner-managers are external to the institutions. This means that the other holders of bank and insurance company debt and equity are external, as are pension scheme sponsors; all customers, policyholders, pensioners and other beneficiaries are external; and clearly the government, the markets and any statutory insurance arrangements are external.

Introduction

Once the context within which risks are being analysed is clear, and full risk taxonomy available, it is time to start identifying risks. The point of the risk identification process is to decide which of the many risks that might affect an organisation are currently doing so, or may do so in future. Part of the risk identification process also involves determining the way in which risks will then be analysed, in particular whether a qualitative or quantitative approach will be used. These, and other factors, are included in a risk register, discussed later in this chapter.

Risk identification should be done as part of a well-defined process. This ensures not only that as many risks as possible are identified, but also that they are properly recorded.

There are four broad areas to risk identification. The first concerns the tools that can be used, whilst the second concerns the ways in which the tools are employed. Identification also includes an initial assessment of the nature of the risk, and also the way in which the risk is recorded. Each of these aspects is discussed in turn.

Risk identification tools

In this section, a range of potential risk identification tools are discussed. These can generally by used in a number of ways and simply describe the starting point for the generation of ideas. Some common tools are described below.

Introduction

One of the most common ways in which risks can be quantified is through the use of models. Models are mathematical representations of real-world processes. This does not mean that all models should attempt to exactly replicate the way in which the real world works – they are, after all, only models. However, it is important that models are appropriate for the uses to which they are put, and that any limitations of models are recognised. This is particularly important if a model designed for one purpose is being considered for another. Similarly, models calibrated using data in a particular range may not be appropriate for data outside those ranges – a model designed when asset price movements are small may break down when volatility increases. Appropriateness will also differ from organisation to organisation. A model appropriate for analysing the large annuity book of one insurer may give unrealistic answers if used with the smaller annuity book of a competitor.

Even if a model is deemed appropriate for the use to which it is put, uncertainty still remains. The structure of most models is a matter of preference, and the parameters chosen will depend on the exact period and type of data used. This uncertainty should be reflected by considering a range of structures and parameters, and analysing the extent to which changes affect the outputs of the model. This gives a guide as to how robust a model is. In particular, the structure of a model that gives significantly different outputs when calibrated using different data ranges should be reconsidered.

Once the context has been defined, the ERM process can be implemented. However, this is not to say that the context cannot change. Both internal and external factors will develop over time, so it is important to constantly be aware of the context and its impact on the process

ERM is implemented as a control cycle. This means that it is a continual process rather than one with a defined start and end. The broad process is given in Figure 6.1.

The first stage in a risk management process is identification, but it is important to ensure that this is done using a consistent risk language and taxonomy. This involves not only defining all of the risks, but also grouping them in a coherent fashion. This is important because it ensures that risks have consistent meanings throughout the organisation.

Risk identification itself involves not only working out which risks an organisation faces, but also a description of the broad nature of those risks. It also means recording them in a consistent and complete way to make reviewing them in future a much easier process.

Having identified the risks, it is then time to assess them in the context of the risk appetite of an organisation. In practice, the risk appetite should be agreed and given in clear terms before risks are actually measured. This includes specifying the risk measures to be used, as well as the values of those measures that are thought to be acceptable.

Introduction

One way to help understand ERM is to use case studies. These can illustrate the issues faced in real organisations, and the causes of a range of risk management failures. It is, unfortunately, the failures that make up the majority of case studies. This is mainly because no-one ever hears about many successful risk management initiatives. If an investment banker fails to make increasingly desperate trades because it is impossible to hide any resulting losses in a hidden trading account, then the good design of the risk management protocols will attract little attention; however, the absence of such protocols and the bankruptcy of the banker's employer will make the news and can give valuable insights into how things should not be done.

The majority of the case studies here relate to financial institutions, since these are the ones that can be related most closely to the principles in this book. However, some non-financial examples are also included, since they highlight risk management issues that face all organisations, not just those in the financial services sector.

The information for this chapter is distilled from a number of books on the various episodes described. I recommend that you read these books, not only to understand the risk management more fully but also because the stories are often compelling in themselves.

Introduction

The previous chapters have outlined the stages that comprise a risk management process. However, as well as following these stages a number of activities should be carried out on a continuous basis. These can be summarised as:

• documentation;

• communication; and

• audit.

Documentation refers to the process by which all aspects of the risk management process are recorded, whilst communication refers to collation and circulation of information, both within an organisation and between that organisation and outside agencies. The final process, audit, covers the ongoing validation of the risk management process.

Whilst the scope of documentation and audit are relatively straightforward, communication covers a wide range of overlapping areas. The systems used to keep track of information could be described as monitoring, whilst the circulation of key items of risk information is also referred to as reporting. However, rather than trying to separate these items arbitrarily, they are included in the same section.

Documentation

Risk registers and their roles in the identification of risk have already been discussed. However, it is important to document the risk management process much more broadly. This means that the reasoning behind the process as a whole should be documented. However, there should also be adequate documentation of all decisions taken, and the reasons for those decisions.

Introduction

Having not only identified and analysed risks but also compared the risks faced with the stated risk appetite, the next stage is to respond to those risks. The responses to risk are generally placed into one of four categories:

• reduce;

• remove;

• transfer; or

• accept.

There is little point in trying to fit every potential risk response into one of these categories, since there is often ambiguity over which category a particular treatment should be put. The main purpose of detailing these four groups is to ensure that all potential responses are considered in relation to a risk as it arises.

Risk reduction

Risk reduction involves taking active steps to limit the impact of a risk occurring. This group includes approaches such as diversification. This involves combining a risk with other uncorrelated risks, or at least with risk where the correlation is less than one. At the extreme, it can involve taking on risks which have a high negative correlation with the risk faced, in which case it becomes hedging rather than just risk reduction. Whilst this approach is most obviously connected to investments, it can also relate to the choice of projects on which a firm embarks. Risk reduction can also involve the creation of more robust systems and processes, in order to reduce the chance of a risk emerging, or to limit the impact of a risk.

Introduction

Whilst ERM can be applied to any organisation, this book concentrates on financial institutions. There is, of course, an enormous range of such institutions; however, detailed analysis is limited to four broad categories of organisation:

• banks;

• insurance companies;

• pension schemes; and

• foundations and endowments.

Before looking at the risks that these organisations face, it is important to understand their nature. By looking at the business that they conduct and the various relationships they have, the ways in which they are affected by risk can be appreciated more fully. This is the first – and broadest – aspect of the context within which the risk management process is carried out.

Banks

A direct line can be drawn to current commercial banks from the merchant banks that originated in Italy in the twelfth century. These organisations provided a way for businessmen to invest their accumulated wealth: bankers lent their own money to merchants, occasionally supplemented by additional funds that they had themselves borrowed. The provision of funds to commercial enterprises remains a core business of commercial banks today.

By the thirteenth century, bankers from Lombardy in Italy were also operating in London. However, a series of bankruptcies resulted in the Lombard bankers leaving the United Kingdom towards the end of the sixteenth century, at which point they were replaced by Tudor and Stuart goldsmiths.

Whilst looking at the various parties that have an opinion on risk in financial institutions, it is clear that many rules are in place to control these risks. However, in many cases these rules consider only one aspect of a financial institution. In contrast, risk frameworks look at financial institutions, or even systems, as a whole and try to manage all of these risks in a consistent manner. There are three broad types of risk framework:

• mandatory;

• advisory;

• proprietary.

Mandatory risk frameworks must be followed in order for an organization to carry out some types of business. However, they often have features that are useful to a wider range of institutions. Advisory risk frameworks offer guidelines for firms wishing to set up their own risk management framework. These are usually generic, which means that they can be used for a many different types of organisation, but also that a considerable amount of work must be carried out to tailor them to specific institutions. Finally, there are proprietary risk frameworks. These are frameworks used by firms for some specific purpose, the most common of which is credit rating.

All of the risk frameworks covered here are comprehensive, covering a range of risk types for an organisation. This is what differentiates a framework from a more narrowly focussed code.