Risk Management

How Much Risk Can Your Company Bear?

CFOs and risk managers clash over whether they are using a common quantitative metric to gauge their organizations’ tolerance for risk.
David KatzApril 23, 2013

LOS ANGELES – Most senior corporate executives, including CFOs, say their companies don’t use a common metric called risk-bearing capacity (RBC) to gauge their appetite for risky, financially threatening activities. But a large number of risk professionals – including some at the same companies – say their organizations do use RBC as a measurement of risk appetite.

That’s a frankly “puzzling” disconnect between top management and the risk managers who are supposed to be providing them with essential risk data and analysis, say the authors of a survey released Monday by the Risk and Insurance Management Society (RIMS) and Marsh, the insurance brokerage. Among other things, it suggests CFOs may be trying to judge risk appetite without the benefit of valuable quantitative metrics, like RBC.

In the survey, which probes some of the current divides between the C-suite and corporate risk professionals, seventy-five percent of C-suite respondents said that RBC wasn’t used by their organizations, while 50 percent of risk professionals said that it was. Of the 1,200 respondents to the February online survey, 18 percent listed their job function as C-suite and 27 percent said they were risk professionals.

RBC is a prospective view of risk that is useful in establishing allocations of risk, capital or both to drive value for the shareholders and the organization as a whole. “If an organization does not understand what risks it is willing to take, it will be difficult, if not impossible, to measure the risk itself,” said the survey report’s authors.

Yet why should CFOs care about measuring their companies’ abilities to bear financial and operational stress? In a word, the answer is “volatility,” Yvette Connor, Marsh’s director of client engagement and co-author of the study, told CFO. “There is a cost to uncertainty,” she said. “Merely having that [RBC] allocation will force you to be more disciplined” about the way in which you take on risk.

While RBC is calculated in different ways depending on the key performance indicators of a given company or industry, the common basis for the calculation is “how much risk the organization can bear before [it becomes] insolvent,” said Carol Fox, the director of the strategic and enterprise risk practice at RIMS.

One way to gauge RBC is take the difference between a corporation’s enterprise value (the sum of a company’s market cap and its net debt) and its book value (total assets minus intangible assets and liabilities), according to Connor, who noted that this should be calculated per share, which will show “the amount of risk in each share of stock.”

In its essence, she said, this calculation could provide the “the implied discount value of the firm.” The result can also be understood as the amount of risk a company can take before its book value is threatened. How much of that risk a company is willing to take, either per-project or at the corporate level, can be thought of as its risk appetite.

RBC can also be viewed as the amount of risk a firm is willing to take around its key performance indicator, such as levered free cash flow or earnings before interest, taxes, depreciation, and amortization (EBITDA), said Connor, noting that some companies might simply gauge their risk tolerance by asking the question, “What would cause my EBITDA to decrease by 10 percent?”

“Certain industries, such as financial institutions, are well down the path of developing, quantifying and allocating risk-bearing capacity,” according to the survey report. “However, other industries tend to operate in more qualitative realms and have not yet formalized their system-wide risk views and related risk tolerances. Given the widespread disconnect between senior management and risk pros, they may have a long way to go.”