This is the first of four articles in a special report looking at risk retention. Also included are: Seven Factors in Self-Insuring, which explores the components of retention strategy; If Insurance Costs Too Much, Don’t Buy It, which provides a case study in cost saving; and Taking a Risk on Workers’ Comp, which zeros in on that specific coverage.
Out of the ashes of the financial crisis, corporate approaches to figuring out how much risk to retain and how much to transfer to insurers, banks and the capital markets have been growing by leaps and bounds in sophistication.
From its origins in the insurance industry, corporate risk management calculations of how much a given risk will cost, how much the organization should be protected against that cost and what to pay for that protection have been brought in-house. Chastened by the growing prominence of unpredictable, system-threatening global risks, however, finance and risk executives also grant that gut-level intuitions about a company’s stomach for taking on risk should play an important part in retention decisions.
Increased awareness of the potential speed, magnitude and unpredictability of risk has brought CFOs into a world they previously relegated to risk managers. If Superstorm Sandy could become so fierce so fast, or Lehman Brothers could collapse in a matter of months, it followed that senior managements needed to prepare for such threats by looking at them in the context of their companies’ entire financial structures. What was predictable? What was not? How do we prepare for the unpredictable ones? How do we budget or plan at all?
More and more, the answers to the question of how much risk to retain and how much to pay a third party to cover are starting from a complex calculation with two basic components: a corporation’s financial wherewithal to absorb uncertainty and its willingness to do so. Call them Risk Tolerance and Risk Appetite.
Valuing the Volatility
To be sure, for a long time risk managers have been in the business of deciding whether their companies should insure or retain the expense of covering their property, casualty and workers’ compensation loss exposures. The profession has evolved its own metrics to help risk managers with such decisions, most notably total cost of risk. (TCOR is defined as the sum of premiums plus retained losses plus administrative expenses associated with risk management.)
Until recently, all the thinking revolved around the activity of the property/casualty insurance market. Pricing in that market tends to follow a fairly predictable cycle. There are “hard markets,” in which insurers talk tough, charge high premiums and cover narrowly defined risks. Those are followed by “soft markets,” in which carriers hungry for market share offer bargain-basement prices for generous coverage.
How much risk to retain used to be largely a function of that fluctuation in pricing and availability of coverage. But a number of factors have conspired to break down the walls surrounding the tight little insurance world. For one thing, the risks have either gotten more frightening — consider, in sequential order, the 9/11 attacks, Hurricane Katrina and the global economic collapse of 2008-2009 — or at least appear so.
Second, the collapse turned a century of finance theory on its head. In months, it seemed, the notion that a company or an investor could modify its risks by balancing a portfolio of them was replaced by a widespread fear that an unpredictable “Black Swan” event could wipe out a whole portfolio in an instant.
In such a climate, concepts of risk that focused on a steady state in which a company could allocate its resources across a reasonably predictable set of exposures have faded rapidly. Replacing them are various approaches to assessing risk that boil down to a single word plucked from Wall Street: volatility.
If CFOs can plot the dispersion of the likelihood of bad things happening under a variety of situations — the same way a quant can plot share prices — they can pinpoint how much money to put behind various possibilities. Then they can decide how much their companies can deviate from the norm and how much deviation is simply unacceptable.
To date, the banking and insurance industries have been far ahead in developing methods and metrics along these lines. But if the frequency of the use of the word “volatility” by insurance and risk management professionals is any indication, the thinking is spreading to companies of all kinds. “Outside of the financial services industry, finance executives are looking to value that volatility. They’ve been more [proactive] about it,” says Claude Yoder, global head of analytics for Marsh, the insurance brokerage.
Driven by the increased uncertainty concerning the value of the risk a company may or may not retain, thinking about retention has moved far beyond the calculation of mere insurance costs. “If the retention goes up, the premium goes down. The problem is, what additional risk are you taking on?” Yoder asks.
By at least one current definition, risk appetite is a softer, more qualitative idea, and risk tolerance is more quantitative. “While risk appetite is about the pursuit of risk, risk tolerance is about what you can bear,” according to a 2011 paper on risk appetite by Richard Anderson, deputy chairman of IRM, the Institute of Risk Management (IRM), an educational organization.
“Without a doubt there will be occasions [when] an organization can bear more risk than it is thought prudent to pursue,” Anderson writes. “We remain of the view that articulating the tolerance is comparatively simple, while working out what you wish to pursue is relatively complicated.”
Thus, calculating its risk tolerance may be a logical place for a company to start its risk-retention analyses, followed by an inward look at its actual appetite for risk. Richard Michel, a senior vice president and national risk management practice leader at Wells Fargo Insurance Services, advises clients to ask two basic questions to judge risk tolerance.
The first is, “What is my company’s capacity to take risk before we have a catastrophic business consequence?” The second is, “What is the potential impact of uninsurable risks?” Detailed answers to those questions should provide a company with a sense of how much capital it needs to allocate before taking on more risk.
Within that broad framework, there are many specific risk-tolerance metrics. One fairly common measurement among corporations outside financial services is risk-based capacity (RBC).
Although the factors used in calculating RBC depend on a company’s or industry’s key performance indicators, they can be defined broadly as “how much risk the organization can bear before [it becomes] insolvent,” said Carol Fox, director of the strategic and enterprise risk practice at RIMS. Jay Gotelaere, a managing director and actuary at Aon Global Risk Consulting, calls RBC “a survivorship metric.”
By one measure, RBC is the difference between a corporation’s enterprise value (the sum of its market cap and its net debt) and its book value (total assets minus intangible assets and liabilities), according to Yvette Connor, Marsh’s director of client engagement. RBC should be calculated per share, which will show “the amount of risk in each share of stock.” The result can be understood as the amount of risk a company can take before its book value is threatened.
For other companies, RBC may be the amount of risk a firm is willing to take around a high-priority metric, like levered free cash flow or earnings before interest, taxes, depreciation, and amortization (EBITDA), says Connor. Some companies might simply gauge their risk tolerance by asking the question, “What would cause my EBITDA to decrease by 10 percent?” Other “levels of pain” defining the outer edges of acceptable risk might be factors that could cause a credit rating downgrade or a bank covenant violation, Wells Fargo’s Michel says.
Operational Metrics
Measuring an organization’s risk tolerance doesn’t revolve solely around financial metrics, however. For a manufacturer, operational metrics such as those gauging the efficiency of its plant processes and the quality of its products can be a guiding light for how much risk to retain, according to Laurie Champion, managing director and practice leader of Aon Global Risk Consulting.
“The percentage of a product that does not meet quality standards” can be a proxy for the measurement of such an organization’s ability to assume risk, she says. Accounting metrics that gauge the strength of a company’s supply chain, such as inventory and accounts receivable, can also reveal a company’s susceptibility to breakdowns.
Once armed with a thorough knowledge of their companies’ financial and economic exposures, CFOs need to thoroughly assess their company’s appetite for risk to come up with the right retention level. While numbers can be used in determining whether a company is a relatively conservative or aggressive risk taker, determining its risk appetite tends to be “a very visceral decision,” says Gotelaere.
Sometimes appetite translates into a percentage swing, as in the case of a company that might not want to embark on an uninsured activity that could risk, say, 5 percent of its revenue or 10 percent of its profits, he said.
More often, the hunger or distaste for certain risks is a matter of corporate culture or reputation. A company may, for instance be wary of pursuing a profitable line of business because it represents a high risk to employee or public health. “There needs to be a line drawn in the sand even for risks that have a high rate of return,” says Carl Groth, a managing director at KPMG’s risk advisory practice. In short, companies must have the appetite for these risks as well as the tolerance to pursue them.
This is the first of four articles in a special report looking at risk retention. Also included are: Seven Factors in Self-Insuring, which explores the components of retention strategy; If Insurance Costs Too Much, Don’t Buy It, which provides a case study in cost saving; and Taking a Risk on Workers’ Comp, which zeros in on that specific coverage.