Management analysis is arguably the most qualitative and immeasurable among the many considerations of a Standard & Poor's Ratings Services' credit rating. A rating committee's opinion of management's overall capabilities, fidelity to and consistency of a sound strategy, and adaptability to changing circumstances are perhaps the strongest influences on the future direction of a credit rating. Nevertheless, the quality of management judgment is not as easily benchmarked by quantitative metrics in the way that ratios and models of cash flow adequacy, liquidity, earnings capacity, and leverage help shape our views of a company's financial profile.
Proposal Summary
We now propose to introduce Enterprise Risk Management (ERM) analysis into the corporate credit ratings process globally as a forward-looking, structured framework to evaluate management as a principal component in determining the overall business profile. (The business profile, along with the financial profile, are the key factors of a Standard & Poor's credit rating.) Discussions with company managers, part of our normal credit review process, would inform the ERM evaluation. We would then score companies to benchmark our opinions of ERM quality. Furthermore, we expect that deterioration or improvement in a company's ERM quality would potentially drive rating and outlook changes before the consequences are apparent in published financial results. Companies with superior ERM should have less volatility in earnings and cash flow, and will optimize the risk/return relationship.
We invite comments by Feb. 1, 2008 on:
The ERM analysis approach,
The value of adding ERM analysis to the credit ratings process, and
The particulars of the proposed methodology.
By March 1, 2008, we expect to decide on whether to include ERM analysis, including methodology and a timetable for its introduction.
Our interest in codifying management analysis under the ERM heading coincides with increased interest by many companies to initiate their own ERM programs –- or other risk-management practices -- to increase risk-adjusted returns, improve strategic judgment, and/or avoid extraordinary losses due to lawsuits, fines, operational failures, or negligence. The intersection of these interests is in the expectation that a firm's future ability to meet financial obligations in full and on time is more likely to be enhanced by strong ERM or diminished by weak or nonexistent ERM. Our principal interest in evaluating ERM is to implement steps that will limit the frequency and severity of losses that could potentially affect ratings.
Scoring ERM
We expect to assign scores of ERM quality to all companies we review. A primary consideration is whether to provide the same scoring rules across financial and nonfinancial sectors. While using a commonly applied scale would make it easy to compare the ERM quality of, say, Unilever PLC with Citicorp, it would likely fail to provide differentiation among firms in financial or nonfinancial sectors. Risk management in financial services firms is fundamental to their very existence. Financial firms buy and sell risk, while nonfinancial firms accumulate risk as a consequence of making some other product or providing some other service. In other words, financial firms are fundamentally "riskier" than nonfinancial firms. For this reason, we propose to use different scoring definitions for nonfinancial firms.
Companies that are considered "weak" on ERM are missing complete controls for one or more major risks, because the firm has limited capabilities to consistently identify, measure, and comprehensively manage risk exposures and thus, limit losses. Execution of its risk-management program is sporadic, and losses may be widespread according to a set of predetermined risk-/loss-tolerance guidelines. Risk and risk management may sometimes be considered in the firm's corporate judgment.
Those companies considered "adequate" often manage risk in separate silos, but maintain complete control processes because the firm has capabilities to identify, measure, and manage most major risk exposures and losses. Firm loss-/risk-tolerance guidelines are less developed. Unexpected losses are somewhat likely to occur, especially in areas beyond the scope of the existing ERM practices. Risk and risk management are often important considerations in the firm's corporate judgment.
Companies that are "strong" demonstrate an enterprise-wide view of risks, but are still focused on loss control. These companies have control processes for major risks, thus giving them advantages due to lower expected losses in adverse times, as the firm can consistently identify, measure, and manage risk exposures and losses in predetermined tolerance guidelines. A strong ERM firm is unlikely to experience unexpected losses outside of its tolerance level. Risk and risk management are usually important considerations in the firm's corporate judgment.
Companies that are considered "excellent" possess all of the characteristics of those scored "strong" and will also demonstrate risk/reward optimization. The firm has very well-developed capabilities to consistently identify, measure, and manage risk exposures and losses in the company's predetermined tolerance guidelines. Risk and risk management are always important considerations in the firm's corporate judgment. It is highly unlikely that the firm will experience losses outside of its risk tolerance.
The weight of the score in the credit rating will vary depending on the importance of ERM for the particular company/sector. We would expect to introduce ERM analysis into the ratings process by the end of first-quarter 2008. However, we would refrain from assigning ERM quality scores to individual companies, until we have reviewed a sufficient number to provide a range of comparability across firms and time. This could take as little as a few months, but will likely require at least one year.
Background
The way that businesses plan for the future is changing. Analyses of potential results over near-infinite possibilities are replacing single-view business plans. Many companies examine returns per unit of risk as well the overall return on investment, allocate capital to business units on a risk-adjusted basis, and hold managers accountable for risk-adjusted profitability. The old adage that you must take on risk to achieve reward, often used to justify any new and untested process, now requires additional steps to quantify how much risk is involved for exactly how much reward. We observe that this combination of management practices, collectively known as ERM, is fundamentally consistent with the underlying nature of credit ratings. ERM specifies the range of risks that might affect a firm; credit ratings are concerned with any risk that might endanger the ability of the firm to meet its financial obligations. With ERM, management explicitly states its risk tolerance and develops processes to keep losses within that tolerance; credit analysts attempt to illustrate the firm's capacity to absorb losses and likelihood that management can limit losses to a level within that capacity for a given rating. ERM provides management with information to optimize earnings -– and ultimately the firm's value –- while staying in a well-defined risk tolerance. Credit ratings are heavily influenced by that same information in expressing a projected forecast over a rating horizon.
ERM also provides a new and clearer language for transferring information about management's intentions and capabilities, which are critical to credit evaluation. Traditional credit analysis is primarily an inference process. Analysts meet with management to understand corporate strategy, examine financial statements and forecasts, and perform other research into risks that might affect the ability of the company to meet its financial obligations. From that, analysts infer the future fundamentals of the firm. However, analysts still conjecture likely results, and this credit-focused analytical process can be simplified by the information transfer via ERM.
Standard & Poor's Experience With ERM Analysis
Since 2005, Standard & Poor's has included ERM in our rating evaluations for financial institutions and insurance companies. It has provided two key types of information: the degree to which a firm has comprehensive mastery of the risks that they face, and the extent that the firm's management optimizes revenue for the risk they are willing and able to take. In some cases, our confidence in management's ability to control risk taking allows us to conclude that a firm could absorb an apparently high level of potential risk exposure, and still qualify for high ratings. Conversely, firms with relatively low prima facie risk exposure, but with a weak ability to control risk, might receive lower ratings. While ERM did not radically change the way we assign ratings, the structure provided deeper insights that have caused us to change ratings or outlooks on many companies in the financial services sector.
In 2005, Hurricane Katrina cost insurers more than $41 billion, the largest loss event ever for the industry. The magnitude of losses eventually reported shocked many. In the wake of the disaster, ERM was a differentiating element when we reviewed insurer credit ratings. Some insurers with weaker ERM had losses that were as much as twice what they previously reported as their "probable maximum loss". These insurers were unable to even estimate their losses several days after the event. On the other hand, insurers with stronger ERM could quickly estimate losses that were within 25% of actual claims. These insurers could quickly pinpoint where weaknesses were in their ERM processes and took immediate steps to rectify them. Although we do not expect ERM to eliminate losses, firms with good ERM should not only have smaller losses in adverse times, but also rebound more quickly from those losses and establish better future practices.
More recently, many financial institutions have reported steep losses in the value of their securities backed by subprime mortgages. Despite the severity of some of the losses, we expect the effects to be less severe for those institutions that in our opinion, demonstrate stronger ERM practices.
To build on our experience gained in evaluating the trading risk component of ERM in financial institutions, in April 2006, we launched a pilot project to supplement our analysis of energy companies' trading risk with ERM concepts (see "Taking The "PIM" Approach When Assessing U.S. Energy Companies' Risk Management," published April 21, 2006 on RatingsDirect). The year-long project to evaluate trading-risk management of 10 energy firms yielded substantively new quantitative and qualitative information to augment capital and liquidity tests previously used to assess trading risk. Although we intended to focus narrowly on control processes for risks from trading in fuel and electricity markets, our analysts gained broader insights into firms' risk-management capabilities and cultures that could influence ratings. (see "S&P Completes Initial ?PIM? Risk Management Review For Selected U.S. Energy Firms," published May 29, 2007 on RatingsDirect). Encouraged by the pilot project, we expect to extend trading-risk-management analysis to other energy companies in commodities trading and to formally introduce our risk-management policies, infrastructure, and methodologies (PIM) approach into the ratings of these firms, along with those of the initial 10 companies, in early 2008. We will take this step whether we proceed with incorporating the broader ERM analysis into corporate ratings overall.
Scope and process
We expect to tailor the ERM analysis based on a firm's unique risks, structure, and culture. ERM is different in each sector, because the risks and necessary risk-control measures are different. While there is no single recipe for the best ERM platform, we believe that we can distinguish each company's effectiveness in managing risk by relying on a customized and consistent general framework. Four major analytic components will be a part of ERM, regardless of the company or sector analyzed. These include:
Analysis of risk-management culture and governance,
Analysis of risk controls,
Analysis of emerging risk preparation, and
Analysis of strategic risk management.
We formed this perspective on ERM through evaluating ERM programs of insurers and banks. In those sectors, primary risks are financial market risk, credit risk, and underwriting risk through corporate and individual insurance programs. In both sectors, we have incorporated ERM analysis as a standard of the credit review. Rating committees discuss the quality of the ERM program in establishing potential ratings.
In evaluating ERM capabilities for all financial and nonfinancial entities, we will observe how management defines its overall loss tolerance and the processes it has established to ensure that losses remain within that tolerance. In addition, the ERM evaluation will focus on the degree that management views risk and reward for risk taking in setting corporate direction. The ERM evaluation ultimately will be our opinion of the quality of management practices. The focus will be to look for adherence to systematic and consistent practices that limit future losses to achieve an optimal risk/reward structure. We will compare the ERM practices with sector risks, those identified by company management, and those of corporate peers. We will form our opinion relative to the complexity of the risks the firm faces, as well as its vulnerability to those risks. We will expect sophisticated risk-management practices to deal with more complex risks, and understand that less-sophisticated risk management may be sufficient in simpler situations.
Risk-management culture and governance
Risk-management culture measures the importance of risk and risk management in considering daily corporate judgment. To evaluate risk-management culture, we will evaluate the organizational structure, as well as the roles, capabilities, and accountabilities of those who execute risk management. The governance structure as it relates to risk management is a critical aspect of ERM. A favorable indicator of risk-management governance is a structure that strongly influences corporate judgment by risk-management staff. Perhaps even more important is the degree line-level managers adhere to risk tolerances in daily decision making.
Communication of risk and risk management inside and outside of the firm are important indicators of risk-management culture. A firm with a strong risk-management culture will have a very transparent risk-management process inside and outside the company, through public communications. Understanding of risk tolerances and how risk management affects daily decisions should be consistent from the board of directors down to line-level managers. Regarding external communications, it is important to note that compliance with regulatory standards is often insufficient. In fact, an excessive compliance culture may belie a weak risk-management culture. This is because a compliance approach to risk management usually means that the firm has neglected self-assessment and prioritization of risks and risk-management activities, leaving those roles to the regulator.
Risk controls
Firms achieve risk control through identifying, measuring, and monitoring risks, setting and enforcing risk limits, and managing risks to meet those limits through risk avoidance, risk transfer, risk offset, or other risk-management processes. We will expect firms to have programs structured to effectively deliver the risk controls necessary to maintain exposures and losses, as well as consistent execution of those programs so that future implementation will be a given. We will evaluate risk-control processes for each firm, considering those risks that we have identified for the overall sector, as well as those identified by management. Consistency between the overall corporate risk tolerances and the specific risk limits will be an important consideration. We will also review summary descriptions of risk-control programs for each major risk, as well as detailed examples of actual execution.
The PIM approach focuses on three key aspects of a firm's risk-control practices, specifically:
Policies, including business strategy, risk tolerance, risk authorities, and disclosure (i.e., internal and external reporting);
Infrastructure, including personnel, operations, data, and technology; and
Methodology, including risk metrics, stress testing, validation, and performance measurement.
The relative importance of each of these aspects in forming our opinion of a firm's risk control quality will depend on the complexity, size, and risk tolerance for each firm (See tables 1 and 2).
Table 1
Sample Risk Types
Environment risks
Financial risks
Supply risks
Management risks
Business continuity
Capital availability
Commodity prices
Corporate governance
Business market environment
Credit/counterparty
Supply chain
Data security
Environmental
Financial market risk
Employee health and safety
Liability lawsuits
Inflation
Intellectual property
Natural disasters/weather
Interest rates
Labor disputes
Pandemic
Liquidity
Labor skills shortage
Physical damage
M&A/restructuring
Political risk
Managing complexity
Regulatory/legislative
Outsourcing problems
Terrorism
Project management
Reputation
Technology failure
Table 2
Sample Risk Control Processes
Disclosure (external)
Diversifying
Hedging
Insuring
Limiting
Monitoring
Reporting (internal)
Securitizing
Training and prevention
The number and types of risk-control processes we will analyze can vary by sector and firm, depending on the key risks we believe can meaningfully affect credit quality when managed particularly well or poorly.
We will develop criteria for evaluating the quality of risk controls within each segment, and have already begun this process for the power generation sector. We will subject these specific risk-control criteria to a separate public exposure and comment process before implementation.
Tables 3 through 7 below show our initial view of key risks for each sector. The risks and sector delineations should be considered indicative and not exhaustive. We may likely group or expand along both dimensions before implementation.
Table 3
Manufacturing And Transportation
Airlines
Auto
Capital goods/engineering and construction
Commodity prices
Liquidity
Commodity prices
Labor disputes
Strategic execution
Labor skills shortage
Liquidity
M&A/restructuring
Project management
Pandemic
Regulatory/legislative
Strategic execution
Political risk
Supply chain
Liquidity
Regulatory/legislative
Labor disputes
M&A/restructuring
Terrorism
Reputation
Supply chain
Table 4
Commodities And Basic Industries
Chemicals
Natural resources
Oil and gas
Commodity prices
Commodity prices
Commodity prices
Environmental concerns
Liquidity
Environmental concerns
Liability lawsuits
Expropriation/political risk
Natural disasters/weather
M&A /restructuring
Pandemic
Supply chain
Expropriation
Terrorism
Regulatory/legislative
Table 5
Utilities And Infrastructure
Electric utilities
Integrated gas
Power generation
Commodity prices
Commodity prices
Commodity prices
Environmental concerns
Labor skills shortage
Credit/counterparty
M&A/restructuring
M&A/restructuring
Environmental concerns
Political risk
Natural disasters/weather
Financial market risk
Regulatory/legislative
Physical damage
Liquidity
Project management
M&A/restructuring
Terrorism
Physical damage
Table 6
Consumer, Retail, And Health Care
Consumer products
Health products
Health services
Retail
Failure to innovate
Failure to innovate
Regulatory/legislative
M&A/restructuring
M&A/restructuring
Liability lawsuits
Reputation
Pandemic
Reputation
Regulatory/legislative
M&A/restructuring
Strategic execution
Reputation
Table 7
Technology, Media, And Telecommunications
Hotel and gaming
Media and entertainment
Technology
Telecommunications
Employee ethics/fraud
Failure to innovate
Data security
Revenue assurance
M&A/restructuring
Financial market risk
Failure to innovate
Failure to innovate
Pandemic
Intellectual property
Intellectual property
Regulatory/legislative
Terrorism
Liquidity
Labor skills shortage
Capital availability
M&A/restructuring
Project management
Financial market risk
Regulatory/legislative
Strategic execution
M&A restructuring
Strategic execution
Supply chain
Regulatory/legislative
Emerging risks preparation
Emerging risks are those that are completely new or extremely rare adverse events, and therefore cannot be managed via a control process. However, some practices used by some firms provide meaningful benefit to addressing such risks. These include environmental scanning, trend analysis, stress testing, contingency planning, problem post-mortem, and risk transfer. We will look for firms to show that they are practicing emerging risk management in expectation of negative events, and will also look for the results of such planning during and after adverse events. Those results will include immediate information on the exposure of the firm to loss from the actual event, a prompt and sure response, the ability to moderate losses, and the ability to establish clear modifications for future procedures.
Strategic risk management
Strategic risk management is the process that a firm uses to incorporate the ideas of risk, risk management, and return for risk into corporate strategic decision-making processes. A comprehensive measure of risk is usually a key concept in these processes. Our analysis of strategic risk management will start with understanding the firm's risk profile and obtaining management's explanation of recent changes in the risk profile, as well as expected future modifications. Risk profile can be expressed in terms of earnings loss, enterprise value, or other important financial metrics for various risks or for each firm business. We will study the method used for allocating any diversification benefit incorporated into the risk profile, as well as the effect of the allocation choice on the strategic decisions made using the risk capital.
Strategic processes affected by risk and risk-management thinking include capital budgeting, strategic asset allocation, product and new venture risk/reward standards, risk-adjusted financial targets, acquisitions and divestitures, performance measurement, dividend practices, and incentive compensation. The degree that risk is vital to these processes, and that risk and risk management are also considerations in these processes, indicates the quality of strategic risk management.
We will combine the evaluations of each of these five areas into a single classification of ERM quality. The degree of importance of each factor will vary among firms.
Ratings Impact
We believe ERM could significantly enhance our assessment of a company's ability to anticipate and manage risk, but we are still in the evaluation stage. We will carefully reflect on responses to this Request for Comment before making a decision, which will depend on how the ERM analysis can influence credit strength, as well as how it affects the ratings process.
The ultimate importance of ERM to a firm's rating will depend on the risks of the firm, the susceptibility of the firm to those risks, and the capacity of the firm to absorb losses. For a firm with a high liquidity and/or excellent access to funds and a business plan that concentrates on retaining only those risks that are less complex and well understood, ERM will be less important in forming the rating decision. For firms with tight capital and/or limited access to funds that are exposed to very complex risks, ERM will be a very important part of the rating evaluation. However, capital and liquidity are not seen as a substitute for ERM. For a high ERM score, even a well-funded company still must demonstrate the ability to maintain that position by limiting future losses.
Once criteria are established, we will begin to carry out company ERM analysis generally on their current annual review cycle. We plan to add an ERM segment to our external reports on all corporations, much like we do now with short-term credit factors, accounting, and other items. We will publish ERM quality scores only after completing enough reviews to support comparisons across a representative sample.
We have no illusions that ERM analysis will be a panacea or eliminate surprises that necessitate sudden rating changes. However, it may provide insights that allow us to better anticipate which firms are more or less likely than others to weather, rebound, or even capitalize on the unexpected.
Related Articles
Insurance Criteria: Summary Of Recent Enhancements To Insurer Enterprise Risk Management Criteria (published June 2, 2006)
ERM: The New Standard And Practice In Good Corporate Governance (published June 14, 2006)
ERM: Evolving, Resonating, And Maturing Down Under (published Nov. 8, 2006)
A Roadmap For Evaluating Financial Institutions' ERM Practices (published May 3, 2007)
Credit FAQ: Solid Enterprise Risk Management Practices: An Essential Ingredient To a Successful M&A Transaction (published Oct. 2, 2007)
Asia-Pacific Insurers' ERM: Advancing From A Compliance Culture (published Oct. 3, 2007)
Insurers With Excellent ERM Have Clear Enterprise Risk Reporting (published Oct. 3, 2007)
Response Deadline
Please submit your comments on any aspect of the ERM proposal through Feb. 1, 2008 to criteriacomments@standardandpoors.com or by contacting the authors of this article, or additional contacts in table 8.
Table 8
Contact Information
Credit analyst
Location
Phone
E-mail
United States
Richard Cortright
New York
(1) 212-438-7665
richard_cortright@standardandpoors.com
Evan Gunter
New York
(1) 212-438-6412
evan_gunter@standardandpoors.com
Terry A. Pratt
New York
(1) 212-438-2060
terry_pratt@standardandpoors.com
Prodyot Samanta
New York
(1) 212-438-2009
prodyot_samanta@standardandpoors.com
Arthur Wong
New York
(1) 212-438-7870
arthur_wong@standardandpoors.com
Latin America
Ivana Recalde
Buenos Aires
(54) 11-4891-2721
ivana_recalde@standardandpoors.com
Europe
Amra Balic
London
(44) 20-7176-3637
amra_balic@standardandpoors.com
Keith Bevan
London
(44) 20-7176-7075
keith_bevan@standardandpoors.com
Trevor Pritchard
London
(44) 20-7176-3737
trevor_pritchard@standardandpoors.com
Raam Ratnam
London
(44) 20-7176-7066
raam_ratnam@standardandpoors.com
Australia
Jeanette Ward
Melbourne
(61) 3-9631-2075
jeanette_ward@standardandpoors.com
Analytic services provided by Standard & Poor's Ratings Services (Ratings Services) are the result of separate activities designed to preserve the independence and objectivity of ratings opinions. The credit ratings and observations contained herein are solely statements of opinion and not statements of fact or recommendations to purchase, hold, or sell any securities or make any other investment decisions. Accordingly, any user of the information contained herein should not rely on any credit rating or other opinion contained herein in making any investment decision. Ratings are based on information received by Ratings Services. Other divisions of Standard & Poor's may have information that is not available to Ratings Services. Standard & Poor's has established policies and procedures to maintain the confidentiality of non-public information received during the ratings process.
Ratings Services receives compensation for its ratings. Such compensation is normally paid either by the issuers of such securities or third parties participating in marketing the securities. While Standard & Poor's reserves the right to disseminate the rating, it receives no payment for doing so, except for subscriptions to its publications. Additional information about our ratings fees is available at www.standardandpoors.com/usratingsfees.
