Orchestrating risk-adjusted performance management

IBM Global Business Services
IBM Institute for Business Value
Financial
Orchestrating
Management
risk-adjusted
performance
management
Identify and address risk
events better and faster

---

IBM Institute for Business Value
IBM Global Business Services, through the IBM Institute for Business Value,
develops fact-based strategic insights for senior executives around critical public
and private sector issues. This executive brief is based on an in-depth study by
the Institute’s research team. It is part of an ongoing commitment by IBM Global
Business Services to provide analysis and viewpoints that help companies realize
business value. You may contact the authors or send an e-mail to iibv@us.ibm.com
for more information.

---

Orchestrating risk-adjusted performance management
Identify and address risk events better and faster
By Steve Rogers, Spencer Lin and Robert Torok
There’s no denying the prevalence of new opportunities and risks in today’s global
environment. Yet, most enterprises are failing to put risk into the context of overall
performance. By treating risk and performance management (sometimes refer ed
to as corporate, enterprise or business performance management) as separate
disciplines, they miss opportunities to limit surprises and/or capitalize on the upside
of risk. CFOs are wel -positioned to encourage a more holistic and cross-silo view of
risk. Integrating risk into planning, budgeting, reporting and forecasting can lead to
bet er decisions through risk-adjusted plans and budgets.
In the IBM CFO Study 2008 of over 1,200
compliance risks. Of the risk event types, the
CFOs and senior Finance professionals, two
most frequently mentioned were strategic risks
out of three (62 percent) enterprises with
involving decisions about markets, customers,
revenues over US$5 bil ion encountered mate-
products, M&A activity and other top-line
rial risk events in the last three years.1 Of those,
business decisions. Geopolitical and envi-
nearly half (42 percent) admitted to not being
ronmental / health risks were the next most
well prepared for it. The situation at smal er
prevalent.
enterprises was better, but not by much. Of
However, for publicly traded companies, it
enterprises with revenues under US$5 bil ion,
seems all risks come home to roost in the
46 percent experienced a major risk event and
stock price. Therefore, virtual y all risks ulti-
39 percent were not well prepared.
mately have a financial impact. Another study
Risk comes in many flavors besides finan-
found roughly the same magnitude of non-
cial. The IBM CFO Study 2008 found that 87
financial risks (85 percent) led to companies’
percent of risk types were non-financial in
market capitalization decline of 30 percent or
nature, that is, strategic, operational, geopo-
greater relative to their peer group.2
litical, environmental / health and legal /
1
Orchestrating risk-adjusted performance management

---

Astoundingly, most organizations don’t plan
Successful enterprises are starting to take a
for risk. Despite the preponderance of risks,
broader view of risks and leveraging perfor-
only about half (52 percent) of all surveyed
mance management tools to manage risk.
acknowledge having any sort of formalized
The IBM CFO Study 2008 findings suggest
program to manage risk. Fewer categorize
two types of CFO actions to help businesses
their organization as being effective at risk
understand the trade-offs among revenue,
management (45 percent). Moreover, only 29
profit and risk:
percent of enterprises conduct risk-adjusted
Develop a more holistic view of risk. Facing
forecasting and planning.
a wide range of risks requires enterprises to
While most enterprises are not in the busi-
broaden their risk apertures and focus on
ness to manage risks but instead to drive
those risks with the greatest potential impact
performance, does effective risk management
and occurrence.
correlate with better enterprise performance?
Integrate risk into planning, budgeting,
In a word, yes. The IBM CFO Study 2008 found
reporting, and forecasting. Factoring risk into
that increased effectiveness at supporting /
four main areas of performance management
managing / mitigating enterprise risk charac-
positions the enterprise to better limit surprises
terizes financial outperformers.3
and capitalize on upside opportunities.
CFOs are uniquely positioned to determine and
guide the overal enterprise risk profile – largely
due to the CFO’s influential role both at the
strategic and tactical levels, expertise in the
organization’s operations, support of data and
measurement programs, and ultimate account-
ability to shareholders (and regulators).
2
IBM Global Business Services
IBM Global Business Services

---

Orchestrating risk-adjusted performance management
Identify and address risk events better and faster
Approaching risks today
The simple reality is that risk is a real part of
Robust risk management improves an
the performance of an enterprise, regardless
enterprise’s ability to take calculated
whether it is planned for, managed formal y
and ful y-informed risks by analyzing the
or wholesale ignored. Presently, enterprises
enterprise-level implications of decisions.
face a wider range of risks than they actively
Meanwhile, risk management has evolved to
manage. Moreover, traditional performance
include taking deliberate actions to increase
management fal s short of explicitly identifying
the odds of good outcomes and reduce the
and tracking risk.
likelihood of bad outcomes.
Enterprises face a wide range of risks
Managing risk, especial y an extended risk
Since upwards of 85 percent of risks are non-
portfolio that includes factors beyond Finance,
financial, effective risk management means
compliance, and accounting procedures, may
going beyond the obvious financial risks. In
at first seem to be beyond the CFO’s scope.
the IBM 2008 CFO Study, enterprises that
However, the IBM CFO Study 2008 suggests
self-reported being highly effective at risk
that enterprises are looking to the CFO for
management are three times more likely to
leadership in this area. Sixty-one percent of
have Finance ful y contributing to management
respondents view the CFO as the owner of
of reputational risk, supply chain disruptions,
enterprise risk management. That said, it is
market risk and/or episodic / catastrophic risk.
clear that the risk discipline is a “team sport”
They are also more likely to ful y contribute to
and collaboration across the enterprise is
managing market risk.
necessary.
While a focus on a wider range of risks is a
In publicly traded companies, CFOs are the
positive development, enterprises should resist
only C-suite members cal ed upon quarterly
the urge to look at all potential risks no matter
to provide an aggregate picture of the enter-
how smal . Without a filter, one could foresee
prise. As an increasing number of jurisdictions
an endless list of potential risks. Instead, as
require certification of financial statements with
with performance management, impact on the
the CFO’s signature, they are also personal y
enterprise’s value drivers can help scope the
vested in knowing where risk resides and if it
materiality of potential risks. Natural y, the value
is being properly managed. Moreover, CFOs
drivers will differ by industry just as potential
understand that reward is intrinsical y tied to
risks will vary (see Figure 1).
risk but are also general y led by a conserva-
tive nature.
3
Orchestrating risk-adjusted performance management

---

Enterprises face a
FIGURE 1.
Example value drivers for the Oil and Gas and Pharmaceutical industries.
wide range of risks,
Upstream Oil and Gas industry
Pharmaceutical industry
85 percent of which
Next stage drivers
Value drivers
Next stage drivers
are non-financial in
Production growth rate
New products license
nature – they need to
Revenue growth
Crude oil price
Patent status
be able to filter out
US$ exchange rate
Demographic changes
Profit margin
risks that are relatively
Regulatory issues
Operating costs/barrel
Manufacturing costs
inconsequential or
Production taxes
Tax rate
Abandonment rate
seemingly unlikely, as
R&D credits
well as the ability to
Exploration costs/barrel
Working capital
Cost of raw materials
Development costs/barrel
Inventory levels
avoid or mitigate the
Production costs/barrel
Fixed assets
potential compound
Projected regulatory requirements
Replenishment rates
Projected volumes
effect of individual risks.
Reserves/production rates
Growth duration
Barriers to entry for new entrants
Currency risk
Regulation
Geopolitical risk
Cost of capital
Economies of scale
Source: IBM Global Business Services.
Risk begetting risk: The snowball effect
Most organizations could – and likely would
Imagine the impact to a Canadian-based
– consider the risk implications of any of
bottled water manufacturer if a series of non-
these risks individual y. For example, foreign
traditional and traditional risk events occurred,
exchange risks would be managed through
to devastating compound effect (a sharp
formal hedging programs and/or matching of
share price decline, see Figure 2).
some expenses against revenue flows, while
FIGURE 2.
Example of compounding effect of risks at a major food manufacturer.
Event
Effect
Foreign currency strengthens…
Since bulk of revenue is in U.S. dollars while reported results are in Canadian
dollars, the stronger foreign currency resulted in a lower revenue figure on the
income statement, while costs remained relatively flat
Canadian government restricts
The restricted water exports damage the supply of raw materials and increase
water exports…
the cost to the organization while sales opportunities are lost, which in turn
leads to pricing pressures and volume difficulties
Weak results cause goodwill
Due to weaker results, goodwill (for accounting purposes) no longer has
write-off…
economic value and is therefore written off
Debt covenants are violated…
This, in turn, affects the debt-equity ratio and causes the violation of certain
debt covenants
Dividends are suspended…
The violation of debt covenants requires a suspension of dividends
Source: IBM Institute for Business Value analysis.
4
IBM Global Business Services

---

the risk of water export restrictions would be
or performing further analysis to measure the
managed by identifying multiple sources of
likelihood and consequence of each risk, the
water, especial y U.S.-based sources.
resiliency or recovery capability of the organiza-
tion to specific risks, or the interaction of related
Very few enterprises consider the compound
and/or seemingly unrelated events. Rather,
effect of two major economic risks (for
the targets within performance management
example, currency and export restrictions) and
models usual y reflect the net / aggregate effect,
the possible effect on results and ultimately,
that is, the expected loss of all known risks that
stock price. For example, to address the risks
may arise, but not the possible impacts of the
together, this company could have established
unexpected.4
financing structures that would account for
simultaneous changes in both currency and
In the IBM 2008 CFO Study, enterprises that
physical goods supply, or by arranging a U.S.
self-reported being effective in risk manage-
source of supply.
ment were nearly four times more likely to be
effective at measuring / monitoring business
Understanding how each risk might interact
performance (42 percent versus 11 percent
with others allows decisions that can remedy
for moderate to ineffective). The same organi-
(or prevent) the possible effects of an active
zations leverage performance management
and complex risk portfolio.
tools to manage risk (see Figure 3). Across
Extending performance management
the board, it is clear that these organizations
Traditional y however, performance manage-
engage in more formal risk management activi-
ment does not explicitly track risk, whether
ties than less effective organizations, including
only through a qualitative description of risks
the use of monitoring, reporting, historical
FIGURE 3.
Leveraging performance management tools to manage risk.
Historical comparison of key risk and
51%
performance indicators
35%
Specific risk thresholds (formal trigger
39%
points for risk mitigation activities)
28%
Risk-adjusted forecast and plan
37%
23%
Predictive analytics/modeling for
35%
measuring and monitoring risk
21%
Economic capital and allocation
26%
18%
Access/process controls fully embedded
22%
in risk systems
12%
Very effective to effective at supporting/managing/mitigating enterprise risk
Moderate to ineffective
N = 1,229
Note: Executives were asked: Which of the following risk management activities does your company conduct enterprisewide? (Select all that apply).
Source: IBM Global Business Services, The Global CFO Study 2008.
5
Orchestrating risk-adjusted performance management

---

comparisons, evaluation tools, predictive
ment. Performance management’s fact-driven
The CFO’s unique
analytics, risk-adjusted forecasts and process
processes to measuring performance, gaining
perspective can enable
controls.
insight on operations, and forming the basis
enterprises to mesh
for critical, forward-looking decisions are good
the complementary
While few currently consider risk as part of
complements to risk management.
economic evaluations, study participants
disciplines of
expect nearly half (49 percent) wil employ it in
Both performance and risk management seek
risk management
the next three years. Similarly, the use of risk-
to create the proactive capability to guide an
and performance
adjusted forecasting and planning is expected
organization, influencing decision making to
management – aside from
to grow from 23 percent to 38 percent within
steer the organization toward effective perfor-
frequently sharing data
the same time frame. This suggests that risk will
mance and the achievement of key metrics. In
increasingly be a part of the assessment and
this way, performance and risk management
sources, both disciplines
decision-making process.
are two sides of the same coin, both with
aim to proactively guide
the same objective, but one dealing with the
organizations toward
“The business units own the actual
known universe, tracking past events, and the
effective performance
risks. Finance helps them manage
other dealing with uncertainty.
and achievement of key
the risks.”
The discipline required for performance
metrics.
management is well suited to risk manage-
– CFO, Major bank based in Europe5
ment (see Figure 4). On the operational side,
Placing risk in the context of
performance and risk management share
performance
many core functional components, such as the
role of data collection, analysis tools and dash-
Since risks are not likely to disappear of their
boards. In most enterprises, performance and
own accord, enterprises should begin to move
risk management even share data sources.
toward risk-adjusted performance manage-
FIGURE 4.
Aligning risk and performance management characteristics.
Risk management
Performance management
Expected benefits
characteristic
characteristic
Maturity
Emerging approaches
Established and growing
Integrating disciplines brings formal,
seek more formal and
formalized discipline with
programmatic qualities to risk management
comprehensive structure
specific, dedicated resources, while improving the comprehensiveness of
within the enterprise’s
procedures and technology
performance management
operations
Use of
Seeking a greater data and
A data and metrics-focused
Incorporating risk into performance
data and
metrics-focused approach to
approach
management’s fact-driven approach improves
metrics
non-traditional and/or non-
the robustness of both disciplines
financial risks
Timing
Often a post-mortem
External and internal historical Data collection and analyses of both
and impact process, where risk events
and cross-enterprise analyses disciplines can enhance the accuracy of
are understood and managed are aimed at forecasting
forecasts and predictive analytics
after they occur
future events
Output
Creating intelligent, informed Driving intelligent, informed
Providing a greater foundation for intelligent,
decision criteria
business decisions
informed decisions
Source: IBM Institute for Business Value.
6
IBM Global Business Services

---

“Improving risk management
threats to the enterprise’s value drivers, such
as drivers of revenues, margin advantage(s)
within finance is important, but
and returns on invested capital, and how they
integrating it with operational per-
might impinge on improved sources of growth,
formance is critical.”
operational improvements and desired busi-
ness model changes. After taking account of
– CFO, Healthcare payer based in North
current controls and management actions, the
America6
enterprise can then gauge if the exposure is at
CFOs are in an ideal position to help place
an acceptable level; if not, it can explore addi-
risk in the context of performance. How does
tional actions.
a CFO get started? The first step requires
Enterprises also must take care to properly
developing a more holistic view of the enter-
define their risks. For example, a hurricane
prise’s risk profile, identifying material risks,
is not a business risk for a railroad company.
both financial and non-financial, that may have
Instead, the risk is a service disruption brought
been previously overlooked.
on by the hurricane. Therefore, emphasis on
The second step requires integrating risks into
identifying real business risks can bring about
the performance management processes of
contingency planning that works through the
planning, budgeting, reporting and forecasting.
root causes (treating some of them agnos-
By driving risk management in a formal and
tical y) to better define risk management
purposeful way, enterprises are more likely to
actions. The goal is to keep a line of sight from
identify potential risks faster, respond to them
actions to root causes to the real business
quicker and prepare for them better.
risks.
Develop a more holistic view of risk
Assess internal and external risks across
Facing a wide range of risks, enterprises must
silos
broaden their risk apertures to focus on risks
Additional y, enterprises tend to focus on
with the greatest potential impact and occur-
external risks – such as capital availability,
rence. To operate with a more holistic view of
competitors, shifting customer needs,
risk, enterprises will need to:
economic downturns, legal or regulatory
• Identify and properly define the most
actions, shareholder relationships, disruptive
important risks
technologies and political unrest – but it may
be helpful to examine risks both outside-in and
• Assess internal and external risks across
inside-out. Internal risks, broadly speaking, are
silos.
strategic and operational, such as process,
management information, human capital,
Identify and define the most important
integrity and technology, as well as financial.
risks
Within the context of its industry environment,
Moreover, it helps to consider alternative views
each enterprise must concentrate on the major
of looking at risk, such as a value driver-based
risks with the greatest impact and likelihood
approach. For example, a company recently
of occurrence. Central focus should be on
7
Orchestrating risk-adjusted performance management

---

decided to look at its supply chain processes
CFOs can exploit their knowledge of plan-
in terms of the revenue at risk versus solely in
ning, budgeting, reporting and forecasting to
terms of cost basis. The company’s analysis
help set the risk management strategy. Key
revealed a dependency on a sole second-
risk indicators (KRIs) can be presented along-
tier supplier that made an inexpensive part
side key performance indicators (KPIs) to
needed in nearly 80 percent of its products.
monitor their material impact on value drivers.
To eliminate that risk, the company engaged
Therefore, factoring risk into the four main
product designers to remove that particular
areas of performance management presents
component from the final products.
an opportunity (see Figure 5).
Successful execution depends on collabora-
Enhancing strategic and operational
tion across the enterprise dimensions (for
planning
example, countries, business units and func-
While performance and risk management
tions) to avoid silos of risks and to better
operate in a continuous cycle, the logical
understand their risk interactions. The same
starting point is planning. As our earlier Figure
cross-enterprise collaboration is needed for
3 suggests, effective risk management organi-
successful performance. Risk management
zations are more likely to employ risk-adjusted
is about orchestration from the Board level
planning. These same organizations are three
to middle management. The CFO is uniquely
times more likely to report having more accu-
placed to lead that dialogue.
rate business plans (31 percent versus 10
percent) and to capitalize on enhanced risk /
Integrate risk into planning, budgeting,
reward opportunities (33 percent versus 11
reporting and forecasting
percent).
Governance and a management system are
important to managing risk. At any point in
Enterprises looking to incorporate risk into
time, three activities should be going on:
planning should consider the following
• Assessing a set of risks
actions:
• Implementing risk management plans from
• Prioritize risks based on greatest impact and
prior risk assessments
likelihood of occurrence.
• Monitoring the effectiveness of risk manage-
• Create a line of sight working backward from
ment plans already implemented.
the identified risks and their root causes.
• Correlate risks within and across silos.
While it is important to verify that planned
actions are implemented, it is also important
• Adjust for the compounding effects of
to gauge their effectiveness in reducing the
seemingly independent risk events.
likelihood and/or impact of a given risk. Since
• Plan for different scenarios.
changing external factors may influence risk, it
is important not to be lul ed into complacency
that, once addressed, a risk need not be
re-evaluated.
8
IBM Global Business Services

---