John Holliwell is Managing Director of Smith & Williamson Consultancy Limited
This article appeared as "Risk: Enough Rope to Hang the Business"in the Mastering Finance series brought out by the Business Standard in early 1998
The Colour of Money - Series on Forex Hedging
Current Issue :: Archives
Use a Forecast for Budgeting
28th May, 2012
How do you ensure that Risk does not get out of control and
threaten your business? While a growing number of computer programs have been developed to
aid in monitoring risk in the wake of recent financial scandals, John Holliwell urges
managers to remember that these are not infallible. In asking themselves what can go
wrong, managers should always consider the wholly unexpected, or
"never-seen-before", and think the unthinkable. This article provides advice on
monitoring risks but stresses that responsibility ultimately lies at the top.
is nothing wrong with risk. It is the lifeblood of business and the test of entrepreneurs
and managers. What matters is how you handle risk and the culture in which you operate.
Do you know the risks to which your business is exposed? Which exposures are big enough to
worry about? If there is anything you could do to protect against it? What it would cost
to reduce or hedge your risks?
Once you have the facts it is decision time. You can choose to do nothing or seek to
reduce the exposures or to hedge them in whole or in part. The unforgivable sins are to
fail to consider the risks or fail to act on any decisions.
The risk culture of your business is critical and must be established at the most senior
level. Above all it calls for honesty. Too often individuals are criticised for decisions
that, at the time, were in tune with the organisation's perceived appetite for risk.
But it is never easy to set down effective guidelines and the range of exposures for even
a simple transaction can be extensive.
For example, an exporter needing to borrow to finance a sale in foreign currency may have
to consider counterparty credit risk, funding risk and interest rate risk. The
permutations are endless and the costs of hedging transactions to reduce or eliminate
every possible exposure could potentially swallow any profit from a deal.
While losses are likely to be quantitative, the potentially infinite number of risk
combinations means that the skills needed to make good decisions are usually qualitative.
Even a computer programmed to consider every conceivable permutation of risks needs to be
told what level of exposure is acceptable. Any program is only as good as the parameters
and data fed into it by people who have themselves been conditioned by experience.
But what of the improbable, the wholly unexpected or the never-seen-before? Effective risk
management requires thinking the unthinkable.
This does not in any way lessen the great value of the many sophisticated risk-management
systems available. The problems come if people start to think of them, and the models they
are based on, as infallible.
It is also common for the development of control systems to come after any new
risk-related products. Be careful not to bet the business until the exposure is known. To
be in business you must make decisions involving risk. However sophisticated the tools at
your disposal you can never hope to provide for every contingency. But unpleasant
surprises should be kept to a minimum.
||Can the risks to your business be identified, what forms do
they take and are they clearly understood - particularly if you have a portfolio of
||Do you grade the risks faced by your business in a
||Do you know the maximum potential liability of each
||Are decision made on the basis of reliable and timely
||Are the risks large in relation to the turnover of your
business and what impact could they have on your profits and balance sheet?
||Are the exposures diversified or do you have too many eggs
in one basket?
||Over what time periods do the risks exist?
||Are the exposures one-off or are they recurring?
||Do you know enough about the ways in which you exposures can
be reduced or hedged and what it would cost including the potential loss of any upside
||Have trading and risk-management functions or decisions been
||Is there a clear differentiation between the actions taken
to reduce potential loss by the hedging of exposures and those where you are speculating
in the hope of profit?
||Do you have an effective risk-management policy with
responsibility at senior executive officer level?
||Is this policy regularly reviewed to identify new and
changing exposures? Even on single transactions the risk profile can change over time.
||Who decides whether or not to hedge any exposures?
||Are adequate risk monitoring procedures in place, including
those for contingent liabilities? Exposure can change very quickly and you may need to be
able to react without delay.
||Are you colleagues and staff risk conscious? They probably
attend marketing and customer acre meetings but what about risk management meetings? A
single sale rarely changes a business's future but one mismanaged risk can destroy the
hard work of years.
||Are the rewards matched to the risks?
||Are the owners of the business happy at the level of
exposure or might they prefer a lower risk profile with a potentially reduced return? What
is their 'appetite for risk"?
||What motivates individuals - is the pressure on management
and staff, or the way they are remunerated, encouraging them to take unauthorized risks or
to cover up their own or colleague's mistakes?
||Do management and staff feel free to ask questions or admit
they do not understand?
||Do you regularly update disaster-recovery plans?
||Are you proud of your business's culture and ethics?
||Do you learn from your mistakes?
The way in which the staff are remunerated has become a hotly debated topic, doubtless
fuelled in part by envy at the large sums paid to some financial market dealers.
Whatever the emotions generated, the skills of such people are in demand and they
presumably receive what their employers hope they are worth. But it highlights an
important risk-management concern, which is whether the interests of the employee and the
business necessarily have much in common.
Unless prosecuted for fraud, the risks to any individual who makes a serious mistake are
those of their employment, their reputation and any unpaid remuneration. This would be
enough to make many people think twice but not necessarily those with whom you may be most
concerned. By the very nature of their jobs the dealers and deal-doers in most industries
are paid to take risks and to thrive in a fiercely competitive and often hostile
When a business rewards any of its staff on the basis of volume or of risk-generated
profits it encourages them to take excessive chances. And if they get it wrong the
gambler's temptation is often to double up and try again. A "rogue" dealer on a
losing streak will need to keep increasing the volume or speculative nature of trades if
he or she is to have any chance of wiping out an ever mounting deficit. After all, it is
not their money.
Even when they derive no direct personal financial benefit from their actions a great deal
of damage can be done by employees under pressure to produce results.
As with so much in risk management you may have to accept that a potential risk exists and
then take steps to control it. This means ensuring that no single individual or any
common-interest group is given enough rope to hang the business.
The principles of achieving this are simple enough but are often not carried out in
Set limits, monitor exposures, have clear reporting lines, separate the trading
"front office' from the administrative and controlling "back office" and
ensure that everything is subject to the "two pairs of eyes".
How many people know and understand what is going on? If an individual is always too busy
to take a day off the alarm bells should start ringing. Are they cracking up or covering
When problems are suspected, colleagues often turn a blind eye because no-one likes a
whistle-blower. This is where the culture of business is so important; senior management
should be judged in large measure by its ethical standards. The reputations of
organisations without a high moral code are exposed risk.
They often end up losing the customers they have let down and being cheated by their own
In an increasingly complex world how do you monitor risks that you may not fully
Employing a poacher as gamekeeper may be a good idea, always assuming you can find one
willing to give up their former life and rewards. But all too often the pay offered is
inadequate and those you can attract are buried up to their necks with paperwork and kept
in the dark as to what is going on. The only thing to be said for this "mushroom
principle" is that it provides senior management with a convenient scapegoat when
things go wrong.
Responsibility for risk management rests at the top and if the senior executives do not
understand what is going on they must find out. It would be nonsense to suggest that they
should know every detail of all that is happening in a business but their job is to ensure
adequate systems and controls are put in place.
Ask straightforward question and if you do not get a straight answer then keep on asking
until you understand. Replies couched in jargon or with apparent scorn for your ignorance
should always arouse suspicion. Most honest people who are on top of their job are only
too happy to explain what they do and why.
Beware the self-deception endemic to bull markets. Just because it has not gone wrong does
not mean it is right.
Few organisations are immune from the collective mania of a booming economy and many fear
being left behind in market share and profits if they do not keep pace with the
The voice of caution is then at best an embarrassment and often an obstruction to be
removed. With the recession that so often follows the good years another generation learns
the old lessons anew and strives to put in place the checks and the balances to ensure
"it will never happen again".