Previously Published by Agenda, a Financial Times Service

Opinion
February 10, 2014

Boards Must Make Extreme Risk a Top Priority

Karamjeet Paul is managing principal of Strategic Exposure Group, and the author of Managing Extreme Financial Risk: Strategies and Tactics for Going Concerns.

No director wants their company to experience the fate of MF Global, Enron or Lehman Brothers. For this reason, minimizing exposure to sudden catastrophic events — known academically as extreme tail risk — must be a top priority for boards because of their devastating financial impact.

Two macro-business trends make extreme risk a greater governance priority. First, global interconnectivity makes companies more reliant than ever on other businesses, so one supply chain problem can potentially threaten an entire company's business model. Next, information today is disseminated and processed faster than ever before, leaving management with a reduced window to respond to an incident. As a result, the margin of error has never been smaller.

Every business model is susceptible to this threat. But for financial companies, extreme risk represents a unique challenge. Due to their balance-sheet leverage and their market’s fast-paced operating environment, a major event can quickly have a magnified impact throughout their systems. They don’t have breathing space the way Boeing had with last year’s battery crisis or J&J had during its 1982 and 2010 Tylenol recalls. Additionally, financial firms employ a revenue model that leaves their capital levels susceptible to runs in the event of a major crisis.

As directors seek to better secure their businesses from these threats, they should remember that risk has two distinct dimensions: one, when managed effectively, drives the revenue engine; the other, if not managed effectively, risks financial havoc in crises.

Companies have historically used traditional risk management to provide oversight for the former. However, companies also manage the latter dimension — low-probability extreme risk — as an extension of traditional risk management discipline. This can be a recipe for disaster, as the objectives are starkly different and traditional risk management tools can’t even measure these critical threats objectively. That’s why Lehman Brothers and Bear Stearns weren’t aware of their proximity to the precipice before their business models failed.

So, how can boards ensure that their companies don’t operate too close to the edge and become unwitting victims of “too much risk?” Three changes are needed.

First, a board must recognize that a company will fail not because it has too much risk, but because it has too much extreme risk. This distinction is absolutely critical. Simply put, traditional risk management is based upon the theory of probability, where the cost of being wrong is the loss of profits. But with so-called extreme risk, the cost of being wrong can be fatal for companies.

Traditional risk management anticipates things will go awry and provides for solutions. With extreme risk, there is no telling how a catastrophic event can arise, as experienced by BP in the Deepwater Horizon disaster.

Since the company’s survival could be at stake, it’s dysfunctional to address a company’s sustainability using the classic drivers of traditional risk management such as probabilities and expected values. Obviously, a new approach is needed.

Second, extreme risk needs metrics to quantify it so it can be addressed effectively. Boards and companies use precisely defined measures, such as earnings, profitability and volatility, to manage their business. Shouldn’t there be one for extreme risk too?

The complexities of today’s revenue models make it paramount that extreme risk be measured distinctly, transparently and simply so that effective oversight can be established. The insurance industry’s commonly used concept of a “probable maximum loss” model can be an effective tool for extreme risk management. For example, this approach can capture extreme risk objectively and continuously at financial companies so they can avoid being blindsided in crises.

Third, companies need sound policies to diligently manage extreme risk. This must start with the distinct board oversight of how much extreme risk is too much and what limits and guidelines are needed specifically for its effective management.

Boards can address the extreme risk problem only if they establish specific guidelines and strive for an effective oversight process. By adopting the three steps above, they can help ensure their company’s future survival.