“What Gets Measured Gets Managed”: Strategic Risk Management

The old business adage “what gets measured gets managed” certainly holds true in risk management. To support strategic decisions, a company’s performance management system must integrate key performance indicators (KPIs) and key risk indicators (KRIs). These metrics are different in one crucial respect: While KPIs examine past and ongoing performance, KRIs offer insight into future risks and may even indicate ways to avoid or mitigate them. A key risk indicator for a retailer, for example, might be the number of customer complaints. An increase in this KRI could be an early indication that an operational problem needs to be addressed. Left unresolved, the retailer will likely experience a decline in customer retention, a KPI in this example.

Developing Key Risk Indicators

The development of effective KRIs is a key challenge for most companies. Financial institutions usually have an abundance of credit risk and market risk indicators, but they are challenged in aggregating this data and developing operational risk indicators. On the other hand, nonfinancial institutions may have significant business and quality information derived from balanced scorecard and quality initiatives, but they may experience difficulties in developing KRIs for financial risk or technology risk. All companies face the challenge of establishing leading indicators that can effectively provide early warnings of potential future losses.

While the development of effective KRIs is a significant challenge, there are some readily available sources from which they can be derived. The sources include:

• Policies and regulations:Regulations that govern the business activities of the company, as well as the corporate policies and limits established by management and the board, provide useful compliance KRIs. These KRIs may include risk exposures against limits or compliance with regulatory requirements and standards.
• Strategies and objectives: The corporate and business strategies—and their associated performance metrics—established by senior management are another good source. Note that performance metrics are designed to measure expected performance, whereas KRIs should be designed to measure downside risk or volatility of performance.
• Historical losses and incidents: Many companies have compiled loss/event databases that capture historical losses and incidents. These databases, or even anecdotal evidence, can provide useful input on which processes or events can cause financial or reputational loss. KRIs can then be derived from this data.
• Stakeholder requirements: Beyond regulators, the expectations and requirements of other stakeholders—such as customers, rating agencies, stock analysts, business partners—can help in the development of KRIs based on variables that are important to these key groups.
• Risk assessments: Performed by the company, risk assessments—including audit assessments, risk-control self-assessments, and internal control tests—can provide valuable input on the business entities, processes, or risks where KRIs are needed.

ERM should focus on mitigating downside risk (i.e., worst-case performance) and also help management optimize overall risk-return trade-offs. An integrated performance and risk monitoring process would include the following steps:

1. Define the business strategy through a set of measurable strategic objectives.

2. Establish KPIs and targets based on expected performance for those strategic objectives.

3. Identify strategic risks that can drive variability in actual performance, for better or worse, through risk assessments.

4. Establish KRIs and risk tolerance levels for those critical risks.

5. Provide integrated reporting and monitoring in support of strategic risk management.

In order to effectively manage strategic risks, these steps must be fully integrated.

Unfortunately, many companies perform steps 1 and 2 through the strategic planning and/ or finance functions and then report the results to the executive committee and the board. Separately, they perform steps 3 and 4 through the risk function and report those results to the risk committees.

Performance Feedback Loop

A performance feedback loop is a critical concept that supports self-correction and continuous improvement by adjusting a process according to the variances between actual and desired performance. As a foundational component of the scientific method, the feedback loop has long been an essential tool used to support advances in many fields, including economics, engineering, and medicine. The use of feedback loops has been seen in hedge fund management and effective altruism(*). It would be difficult to evaluate and improve any process efficiently without a performance feedback loop. Risk management is no exception. How do we know if risk management is working effectively? This is perhaps one of the most important questions facing boards, executives, regulators, and risk managers today. The most common practice is to evaluate the effectiveness of risk management based on the achievement of key milestones or the lack of policy violations, losses, or other unexpected events. Yet qualitative milestones or negative proofs should no longer be sufficient. Organizations need to establish performance metrics and feedback loops for risk management. Other corporate and business functions have such measures and feedback loops. For example, business development has sales metrics, customer service has customer satisfaction scores, HR has turnover rates, and so on.

Quicker Action, Better Results

One key benefit of strategic risk management is early warning of potential problems. Alarms will sound if an initiative falls behind expectations, giving management the opportunity to redirect the effort, lay off risk, or, if results come in so far below target that nothing can salvage the project, to implement an exit strategy early on. The ability to “fail faster” will do more than almost anything else to improve a company’s financial performance.

Lack of reliable metrics is no longer an obstacle to strategic risk management. Economic capital is a common currency in which any risk can be quantified, and the RAROC calculated in various scenarios allows management to determine which business activities will maximize shareholder value.

Although strategic risks pose the greatest threat to most companies, few have yet to incorporate strategic risk management into their ERM program. Strategic initiatives always involve risk, and some will not pan out as expected no matter how carefully planned. Companies that manage strategic risk skew the overall risk-return profile in their favor. They can ramp up initiatives that exceed expectations and spot potential losers in time to take corrective action before significant losses accumulate. Risk management should improve the percentage of successful initiatives as well as create a strategic risk profile similar to a call option, with its limited downside risk and unlimited upside potential.

(*) Bridgewater is one of the largest and most successful hedge funds in the world. The founder, Ray Dalio, argues for the use of a performance feedback loop to monitor and shape organizational effectiveness. See Ray Dalio, Principle #66, Principles, 2011, www.bwater.com. Effective altruism is a new, evidence-based approach to charitable giving. The cofounder, William MacAskill, advocates the use of objective feedback loops to determine the effectiveness of altruistic pursues. See William MacAskill, Doing Good Better, Gotham Books, 2015

Originally published on LinkedIn, 27 June 2020.